hitoshura25/cvefixes huggingface dataset:
CVE-2014-1933 (Python, published 2014-04-17T14:55Z)
Description: value: The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/python-imaging/Pillow
Files changed:
PIL/EpsImagePlugin.py
PIL/Image.py
PIL/IptcImagePlugin.py
PIL/JpegImagePlugin.py
Commit message: Removed tempfile.mktemp, fixes CVE-2014-1932 CVE-2014-1933, debian bug #737059


Vulnerable code:
    file = tempfile.mktemp()
        import tempfile
            file = tempfile.mktemp()
            file = file + "." + format
        outfile = tempfile.mktemp()
        o = open(outfile, "wb")
        file = tempfile.mktemp()
        os.system("djpeg %s >%s" % (self.filename, file))
            self.im = Image.core.open_ppm(file)
            try: os.unlink(file)

Fixed code:
    out_fd, file = tempfile.mkstemp()
    os.close(out_fd)
        import tempfile, os
            f, file = tempfile.mkstemp(format or '')
            os.close(f)
            
            if file.endswith(format):
                file = file + "." + format
        o_fd, outfile = tempfile.mkstemp(text=False)
        o = os.fdopen(o_fd)
        f, path = tempfile.mkstemp()
        os.close(f)
        if os.path.exists(self.filename):
            os.system("djpeg '%s' >'%s'" % (self.filename, path))
        else:
            raise ValueError("Invalid Filename")
            self.im = Image.core.open_ppm(path)
            try: os.unlink(path)
CVE-2014-9682 (JavaScript, published 2015-02-28T01:59Z)
Description: value: The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/skoranga/node-dns-sync
Files changed:
lib/dns-sync.js
package.json
test/test.js
Commit message: adding validation check for hostname


Vulnerable code:
            nodeBinary = process.execPath,
            scriptPath = path.join(__dirname, "../scripts/dns-lookup-script"),
  "version": "0.1.0",
    "debug" : "~0.7",
    "shelljs": "~0.2"
    "mocha" : "~1",
    "jshint" : "*"

Fixed code:
//source - http://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address
var ValidHostnameRegex = new RegExp("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$");

function isValidHostName(hostname) {
    return ValidHostnameRegex.test(hostname);
}
            nodeBinary = process.execPath;

        if (!isValidHostName(hostname)) {
            console.error('Invalid hostname:', hostname);
            return null;
        }

        var scriptPath = path.join(__dirname, "../scripts/dns-lookup-script"),
  "version": "0.1.1",
    "debug" : "^2",
    "shelljs": "~0.3"
    "mocha" : "^1",
    "jshint" : "^2"

    it('should fail to resolve valid dns', function () {
        assert.ok(!dnsSync.resolve("$(id > /tmp/foo)'"));
        assert.ok(!dnsSync.resolve("cd /tmp; rm -f /tmp/echo; env 'x=() { (a)=>\' bash -c \"echo date\"; cat /tmp/echo"));
        assert.ok(!dnsSync.resolve("$(grep -l -z '[^)]=() {' /proc/[1-9]*/environ | cut -d/ -f3)'"));
    });
CVE-2020-25019 (JavaScript, published 2020-08-29T17:15Z)
Description: value: jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/jitsi/jitsi-meet-electron
Files changed:
app/features/utils/openExternalLink.js
app/preload/preload.js
main.js
package.json
Commit message: Share logic for opening external links


Vulnerable code:
const { ipcRenderer, shell, remote } = require('electron');
const url = require('url');

const protocolRegex = /^https?:/i;

/**
 * Opens the given link in an external browser.
 *
 * @param {string} link - The link (URL) that should be opened in the external browser.
 * @returns {void}
 */
function openExternalLink(link) {
    let u;

    try {
        u = url.parse(link);
    } catch (e) {
        return;
    }

    if (protocolRegex.test(u.protocol)) {
        shell.openExternal(link);
    }
}
    shellOpenExternal: shell.openExternal,
    ipcMain,
    shell
            shell.openExternal(url);
  "engines" : {
    "node" : ">=12.0.0"

Fixed code:
const { shell } = require('electron');
const url = require('url');


const protocolRegex = /^https?:/i;

/**
 * Opens the given link in an external browser.
 *
 * @param {string} link - The link (URL) that should be opened in the external browser.
 * @returns {void}
 */
export function openExternalLink(link) {
    let u;

    try {
        u = url.parse(link);
    } catch (e) {
        return;
    }

    if (protocolRegex.test(u.protocol)) {
        shell.openExternal(link);
    }
}
const { ipcRenderer, remote } = require('electron');
const { openExternalLink } = require('../features/utils/openExternalLink');
    ipcMain
const { openExternalLink } = require('./app/features/utils/openExternalLink');
            openExternalLink(url);
  "engines": {
    "node": ">=12.0.0"
CVE-2023-37623 (Perl, published 2023-07-26T20:15Z)
Description: value: Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/netdisco/netdisco
Files changed:
lib/App/Netdisco/Web/TypeAhead.pm
Commit message: avoid CSS vulnerability in Find Anything


Vulnerable code:
    to_json [map {$_->dns || $_->name || $_->ip} $set->all];

Fixed code:
use HTML::Entities 'encode_entities';
    to_json [map {encode_entities($_->dns || $_->name || $_->ip)} $set->all];
CVE-2023-37623 (CSS, published 2023-07-26T20:15Z)
Description: value: Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/netdisco/netdisco
Files changed:
share/public/css/netdisco.css
share/views/ajax/admintask/jobqueue.tt
share/views/js/admintask.js
Commit message: avoid CSS vulnerability in Job Queue page


Vulnerable code:
  padding-bottom: 0px;
  line-height: 8px;
      data-content="<pre>[% row.log | html_entity %]</pre>"
          attr: 'data-content'

Fixed code:
  font-size: 15px;
  font-family: monospace;
  white-space: pre;
      data-content="[% row.log | html_entity %]"
          text: $('<span/>').text( $(this).attr("data-content") ).html()
CVE-2023-37624 (Perl, published 2023-07-26T20:15Z)
Description: value: Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/netdisco/netdisco
Files changed:
lib/App/Netdisco/Web/AuthN.pm
Commit message: avoid open redirect vulnerability with return_url login helper


Vulnerable code:
        redirect param('return_url');

Fixed code:
use URI::Based;
        redirect ((scalar URI::Based->new(param('return_url'))->path_query) || '/');
CVE-2022-36082 (Python, published 2022-09-07T22:15Z)
Description: value: mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mansuf/mangadex-downloader
Files changed:
mangadex_downloader/cli/validator.py
Commit message: Fix improper validation in `file:<location>` syntax


Vulnerable code:
def validate_url(url):
    if os.path.exists(url):
        with open(url, 'r') as opener:
            content = opener.read()
    else:
        content = url
    for _url in content.splitlines():
            file_path = urls

Fixed code:
def _try_read(path):
    if not os.path.exists(path):
        return None
    
    with open(path, 'r') as o:
        return o.read()
def validate_url(url):
    for _url in url.splitlines():
            file_content = _try_read(urls)
            file_path = file_content if file_content is not None else urls
CVE-2017-0906 (Python, published 2017-11-13T17:29Z)
Description: value: The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/recurly/recurly-client-python
Files changed:
recurly/resource.py
Commit message: Fix SSRF: do not use urljoin, quote uuids


Vulnerable code:
from six.moves.urllib.parse import urlencode, urljoin, urlsplit

        url = urljoin(recurly.base_uri(), cls.member_path % (uuid,))
        url = urljoin(recurly.base_uri(), cls.collection_path)
        url = urljoin(recurly.base_uri(), cls.collection_path)
        url = urljoin(recurly.base_uri(), self.collection_path)

Fixed code:
from six.moves.urllib.parse import urlencode, urlsplit, quote
        uuid = quote(str(uuid))
        url = recurly.base_uri() + (cls.member_path % (uuid,))
        url = recurly.base_uri() + cls.collection_path
        url = recurly.base_uri() + cls.collection_path
        url = recurly.base_uri() + self.collection_path
CVE-2019-11808 (Java, published 2019-05-07T07:29Z)
Description: value: Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: CWE-338 \u2014 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
Repository: https://github.com/ratpack/ratpack
Files changed:
ratpack-session/src/main/java/ratpack/session/SessionModule.java
ratpack-session/src/main/java/ratpack/session/internal/DefaultSessionIdGenerator.java
Commit message: Use UUID directly for generating session IDs


Vulnerable code:
import java.util.concurrent.ThreadLocalRandom;
    ThreadLocalRandom random = ThreadLocalRandom.current();
    UUID uuid = new UUID(random.nextLong(), random.nextLong());
    return AsciiString.of(uuid.toString());

Fixed code:
  @Singleton
import com.google.inject.Singleton;
@Singleton
    return AsciiString.cached(UUID.randomUUID().toString());
CVE-2019-17513 (Other, published 2019-10-18T03:15Z)
Description: value: An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/ratpack/ratpack
Files changed:
ratpack-core/src/test/groovy/ratpack/http/ResponseHeaderValidationSpec.groovy
Commit message: Add test for response header validation


Vulnerable code:

Fixed code:
/*
 * Copyright 2019 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package ratpack.http

import ratpack.test.internal.RatpackGroovyDslSpec

class ResponseHeaderValidationSpec extends RatpackGroovyDslSpec {

  def "invalid header values yield exception"() {
    when:
    handlers {
      all {
        try {
          header("Test", "value\r\nAnotherHeader: another value")
          render "ok"
        } catch (e) {
          render e.toString()
        }
      }
    }

    then:
    def response = get()
    response.headers.names == ['content-type', 'content-length'].toSet()
    response.body.text == "java.lang.IllegalArgumentException: only ' ' and '\\t' are allowed after '\\n': value\r\nAnotherHeader: another value"
  }

}
CVE-2019-17513 (Java, published 2019-10-18T03:15Z)
Description: value: An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/ratpack/ratpack
Files changed:
ratpack-core/src/main/java/ratpack/server/internal/NettyHandlerAdapter.java
Commit message: Enable HTTP header validation


Vulnerable code:
    HttpHeaders nettyHeaders = new DefaultHttpHeaders(false);

Fixed code:
    HttpHeaders nettyHeaders = new DefaultHttpHeaders();
CVE-2021-25962 (Python, published 2021-09-29T14:15Z)
Description: value: “Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/shuup/shuup
Files changed:
CHANGELOG.md
shuup/reports/writer.py
Commit message: Reports: clean malicius content from the HTML and CSV exporters


Vulnerable code:
            self.data.append([format_data(data, format_iso_dates=True) for data in datum])
                self.data.append([format_data(data) for data in datum])
            self.worksheet.append([format_data(data) for data in datum])
                self.worksheet.append([format_data(data) for data in datum])
        self.output.append(format_data(content, format_money_values=True))

Fixed code:
- Reports: clean malicius content from the HTML and CSV exporters
import bleach
def remove_unsafe_chars(data):
    if isinstance(data, str):
        return "".join([char for char in data if char not in ("=", "+", "-")])

    return data


            self.data.append([format_data(remove_unsafe_chars(data), format_iso_dates=True) for data in datum])
                self.data.append([format_data(remove_unsafe_chars(data)) for data in datum])
            self.worksheet.append([format_data(remove_unsafe_chars(data)) for data in datum])
                self.worksheet.append([format_data(remove_unsafe_chars(data)) for data in datum])
        self.output.append(bleach.clean(str(format_data(content, format_money_values=True)), strip=True))
CVE-2020-19490 (C, published 2021-07-21T18:15Z)
Description: value: tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/syoyo/tinyexr
Files changed:
tinyexr.h
Commit message: Make line_no with too large value(2**20) invalid. Fixes #124


Vulnerable code:
// #include <iostream> // debug

Fixed code:
//#include <iostream> // debug

#ifdef __GNUC__
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wunused-function"
#endif
#ifdef __GNUC__
#pragma GCC diagnostic pop
#endif


        } else if ((line_no > (2 << 20)) || (line_no < -(2 << 20))) {
          // Too large value. Assume this is invalid
          // 2**20 = 1048576 = heuristic value.
          invalid_data = true;
CVE-2020-35605 (Other, published 2020-12-21T20:15Z)
Description: value: The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/kovidgoyal/kitty
Files changed:
docs/changelog.rst
kitty/graphics.c
Commit message: Graphics protocol: Dont return filename in the error message when opening file fails, since filenames can contain control characters

Fixes #3128


Vulnerable code:
            if (fd == -1) ABRT(EBADF, "Failed to open file %s for graphics transmission with error: [%d] %s", fname, errno, strerror(errno));

Fixed code:
- Graphics protocol: Dont return filename in the error message when opening file
  fails, since filenames can contain control characters (:iss:`3128`)

            if (fd == -1) ABRT(EBADF, "Failed to open file for graphics transmission with error: [%d] %s", errno, strerror(errno));
CVE-2022-41322 (Python, published 2022-09-23T05:15Z)
Description: value: In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/kovidgoyal/kitty
Files changed:
docs/changelog.rst
kitty/notify.py
kitty/window.py
kitty_tests/datatypes.py
Commit message: Sanitize notifications ids as they are retransmitted over the TTY


Vulnerable code:
from typing import Dict, Optional, Callable
                cmd.identifier = v
from .notify import NotificationCommand, handle_notification_cmd

Fixed code:
- Fix an issue where notification identifiers were not sanitized leading to
  code execution if the user clicked on a notification popup from a malicious
  source. Thanks to Carter Sande for discovering this vulnerability.

import re
from typing import Callable, Dict, Optional
from .types import run_once
@run_once
def sanitize_identifier_pat() -> 're.Pattern[str]':
    return re.compile(r'[^a-zA-Z0-9-_+.]+')


                cmd.identifier = sanitize_identifier_pat().sub('', v)
from .notify import NotificationCommand, handle_notification_cmd, sanitize_identifier_pat
        identifier = sanitize_identifier_pat().sub('', identifier)

    def test_notify_identifier_sanitization(self):
        from kitty.notify import sanitize_identifier_pat
        self.ae(sanitize_identifier_pat().sub('', '\x1b\nabc\n[*'), 'abc')