hitoshura25/cvefixes huggingface dataset:
CVE-2022-24794 (JavaScript, published 2022-03-31T23:15Z)
Description: value: Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/auth0/express-openid-connect
Files changed:
lib/context.js
test/requiresAuth.tests.js
Commit message: Merge pull request from GHSA-7p99-3798-f85c



Vulnerable code:
      returnTo = req.originalUrl;

Fixed code:
      // Collapse any leading slashes to a single slash to prevent Open Redirects
      returnTo = req.originalUrl.replace(/^\/+/, '/');

  it('should collapse leading slashes on returnTo', async () => {
    server = await createServer(auth(defaultConfig));
    const payloads = ['//google.com', '///google.com', '//google.com'];
    for (const payload of payloads) {
      const response = await request({ url: `${baseUrl}${payload}` });
      const state = new URL(response.headers.location).searchParams.get(
        'state'
      );
      const decoded = Buffer.from(state, 'base64');
      const parsed = JSON.parse(decoded);

      assert.equal(response.statusCode, 302);
      assert.include(response.headers.location, 'https://op.example.com');
      assert.equal(parsed.returnTo, '/google.com');
    }
  });
CVE-2020-36403 (C, published 2021-07-01T03:15Z)
Description: value: HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/samtools/htslib
Files changed:
vcf.c
Commit message: Fix check for VCF record size

The check for excessive record size in vcf_parse_format() only
looked at individual fields.  It was therefore possible to
exceed the limit and overflow fmt_aux_t::offset by having
multiple fields with a combined size that went over INT_MAX.
Fix by including the amount of memory used so far in the check.

Credit to OSS-Fuzz
Fixes oss-fuzz 24097


Vulnerable code:
        f->offset = mem->l;
        if (v->n_sample * (uint64_t)f->size > INT_MAX) {

Fixed code:
        if ((uint64_t) mem->l + v->n_sample * (uint64_t)f->size > INT_MAX) {

        f->offset = mem->l;
CVE-2012-0863 (C++, published 2012-04-30T14:55Z)
Description: value: Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/mumble-voip/mumble
Files changed:
src/mumble/Database.cpp
src/mumble/Settings.cpp
Commit message: Explicitly remove file permissions for settings and DB


Vulnerable code:

Fixed code:
	{
		QFile f(db.databaseName());
		f.setPermissions(f.permissions() & ~(QFile::ReadGroup | QFile::WriteGroup | QFile::ExeGroup | QFile::ReadOther | QFile::WriteOther | QFile::ExeOther));
	}

	settings_ptr->setValue(QLatin1String("version"), QLatin1String(MUMTEXT(MUMBLE_VERSION_STRING)));
	settings_ptr->sync();

#if defined(Q_OS_WIN) || defined(Q_OS_MAC)
	if (settings_ptr->format() == QSettings::IniFormat)
#endif
        {
               QFile f(settings_ptr->fileName());
               f.setPermissions(f.permissions() & ~(QFile::ReadGroup | QFile::WriteGroup | QFile::ExeGroup | QFile::ReadOther | QFile::WriteOther | QFile::ExeOther));
        }
CVE-2018-10937 (Unknown, published 2018-09-11T16:29Z)
Description: value: A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openshift/console
Files changed:
Commit message: Merge pull request #461 from spadgett/proxy

Bug 1622372 - Require CSRF token on all proxied requests

Vulnerable code:

Fixed code:
CVE-2023-37457 (C, published 2023-12-14T20:15Z)
Description: value: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.
Severity: nan (CVSS v3 base score: 8.2)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/asterisk/asterisk
Files changed:
res/res_pjsip_header_funcs.c
Commit message: res_pjsip_header_funcs: Duplicate new header value, don't copy.

When updating an existing header the 'update' code incorrectly
just copied the new value into the existing buffer. If the
new value exceeded the available buffer size memory outside
of the buffer would be written into, potentially causing
a crash.

This change makes it so that the 'update' now duplicates
the new header value instead of copying it into the existing
buffer.


Vulnerable code:
	pj_strcpy2(&((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);

Fixed code:
	pj_pool_t *pool = data->channel->session->inv_session->dlg->pool;
	pj_strdup2(pool, &((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
CVE-2023-49294 (C, published 2023-12-14T20:15Z)
Description: value: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/asterisk/asterisk
Files changed:
main/manager.c
Commit message: manager.c: Prevent path traversal with GetConfig.

When using AMI GetConfig, it was possible to access files outside of the
Asterisk configuration directory by using filenames with ".." and "./"
even while live_dangerously was not enabled. This change resolves the
full path and ensures we are still in the configuration directory before
attempting to access the file.


Vulnerable code:
	if (!live_dangerously && !strncasecmp(filename, "/", 1) &&
		 strncasecmp(filename, ast_config_AST_CONFIG_DIR, strlen(ast_config_AST_CONFIG_DIR))) {
	if (restrictedFile(fn)) {

Fixed code:
/**
 * \brief Check if a file is restricted or not
 *
 * \return 0 on success
 * \return 1 on restricted file
 * \return -1 on failure
 */
	char *stripped_filename;
	RAII_VAR(char *, path, NULL, ast_free);
	RAII_VAR(char *, real_path, NULL, ast_free);

	if (live_dangerously) {
		return 0;
	}

	stripped_filename = ast_strip(ast_strdupa(filename));

	/* If the file path starts with '/', don't prepend ast_config_AST_CONFIG_DIR */
	if (stripped_filename[0] == '/') {
		real_path = realpath(stripped_filename, NULL);
	} else {
		if (ast_asprintf(&path, "%s/%s", ast_config_AST_CONFIG_DIR, stripped_filename) == -1) {
			return -1;
		}
		real_path = realpath(path, NULL);
	}

	if (!real_path) {
		return -1;
	}

	if (!ast_begins_with(real_path, ast_config_AST_CONFIG_DIR)) {

	int ret = 0;
	ret = restrictedFile(fn);
	if (ret == 1) {
	} else if (ret == -1) {
		astman_send_error(s, m, "Config file not found");
		return 0;
CVE-2023-33658 (C, published 2023-06-08T12:15Z)
Description: value: A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/nanomq/NanoNNG
Files changed:
src/mqtt/transport/tls/mqtt_tls.c
src/sp/transport/mqtts/broker_tls.c
src/sp/transport/mqttws/nmq_websocket.c
Commit message: * FIX [transport] fix #1153 https://github.com/emqx/nanomq/issues/1153 for other transport


Vulnerable code:
			packet_id = nni_msg_get_pub_pid(msg);
			packet_id = nni_msg_get_pub_pid(msg);
				packet_id = nni_msg_get_pub_pid(smsg);
				ack       = true;

Fixed code:
			} else {
				log_warn("Wrong QoS level!");
				rv = PROTOCOL_ERROR;
				goto recv_error;
			}
			if ((packet_id = nni_msg_get_pub_pid(msg)) == 0) {
				rv = PROTOCOL_ERROR;
				goto recv_error;
			} else {
				log_warn("Wrong QoS level!");
				rv = PROTOCOL_ERROR;
				goto recv_error;
			}
			if ((packet_id = nni_msg_get_pub_pid(msg)) == 0) {
				rv = PROTOCOL_ERROR;
				goto recv_error;
				} else {
					log_warn("Wrong QoS level!");
					rv = PROTOCOL_ERROR;
					goto recv_error;
				}
				if ((packet_id = nni_msg_get_pub_pid(msg)) ==
				    0) {
					rv = PROTOCOL_ERROR;
					goto recv_error;
				ack = true;
CVE-2021-3766 (JavaScript, published 2021-09-06T12:15Z)
Description: value: objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/Vincit/objection.js
Files changed:
lib/utils/objectUtils.js
Commit message: Security Fix for Prototype Pollution

Fix prototype pollution when path components are not strings

Vulnerable code:
  for (let i = 0, l = keys.length; i < l; ++i) {

Fixed code:
    if (key === '__proto__') {
      return false;
    }
  for (let i = 0, l = keys.length; i < l; ++i) {    
    if (keys[i] === '__proto__') {
      return false;
    }
CVE-2024-36109 (Other, published 2024-05-28T19:15Z)
Description: value: CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows `<script>` tags to be included which execute when published. This issue has been addressed in commit `419862a9c9879c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sagemathinc/cocalc
Files changed:
src/packages/frontend/components/html-ssr.tsx
Commit message: fix XSS with Markdown on share server vulnerability

- https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
- this removes some math rendering support and may cause "user
  frustration", but it is worth it and the right thing to do.


Vulnerable code:
      script: ["type"],
      if (tag == "script" && name == "type") {
        if (value.toLowerCase().startsWith("math/tex")) {
          if (value.includes("display")) {
            return "math/tex; mode=display";
          } else {
            return "math/tex";
          }
        }
        return "";
      }
                : undefined

Fixed code:
    // SECURITY: whitelist note -- we had tried to explicitly allow mathjax script tags in sanitized html
    // by whitelisting and scanning.  However, this didn't properly work (perhaps due to some update)
    // and resulted in a security vulnerability:
    //    https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
    // The fix is completley removing any whitelisting of any script tags.  The feature of
    // mathjax in html is not important enough to support, and too dangerous -- even if it worked,
    // it would probably be an easy attack vector by just making up fake mathjax.
                : undefined,
CVE-2020-27387 (PHP, published 2020-11-05T02:15Z)
Description: value: An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/ttimot24/HorizontCMS
Files changed:
app/Controllers/FileManagerController.php
Commit message: Security bug fix.


Vulnerable code:
                   $images[] = $file->store(str_replace("storage/", "", $this->request->input('dir_path')));
            if(\Storage::move($this->request->input('old_file'), $this->request->input('new_file'))){

Fixed code:
    private function validationRegex(){
        return '/^.*\.('.implode('|',["php","php5","php7"]).')$/i';
    }

                    
                    if(!preg_match($this->validationRegex(), strtolower($file))){
                        $images[] = $file->store(str_replace("storage/", "", $this->request->input('dir_path')));
                    }
            $new_file = $this->request->input('new_file');

            if(!preg_match($this->validationRegex(), strtolower($new_file)) && \Storage::move($this->request->input('old_file'), $new_file)){
CVE-2023-0055 (Python, published 2023-01-04T22:15Z)
Description: value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-319 \u2014 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/__init__.py
Commit message: Set 'Secure' Attribute in session cookie


Vulnerable code:
        # NOTE: enable autoescape for all file extensions (included .js)

Fixed code:
        # NOTE: enable auto escape for all file extensions (including .js)
        app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
CVE-2023-0057 (Python, published 2023-01-05T01:15Z)
Description: value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/__init__.py
Commit message: Add X-Frame-Options: DENY header


Vulnerable code:
        Register error handlers.

Fixed code:
        Register app handlers.
        @app.after_request
        def deny_iframe(response):
            response.headers["X-Frame-Options"] = "DENY"
            return response
CVE-2023-0227 (Python, published 2023-01-12T01:15Z)
Description: value: Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/core/api/__init__.py
src/pyload/core/database/user_database.py
src/pyload/webui/app/helpers.py
Commit message: fix issue that caused the session not expire after user was deleted


Vulnerable code:
        Lists occured events, may be affected to changes in future.
    return session.get("name") and session.get(
        "authenticated"
    )  # NOTE: why checks name?

Fixed code:
        Lists occurred events, may be affected to changes in the future.
    def user_exists(self, username):
        """
        Check if a user actually exists in the database.

        :param username:
        :return: boolean
        """
        return self.pyload.db.user_exists(username)

    @style.queue
    def user_exists(self, user):
        self.c.execute("SELECT name FROM users WHERE name=?", (user,))
        return self.c.fetchone() is not None

    api = flask.current_app.config["PYLOAD_API"]
    user = session.get("name")
    authenticated = session.get("authenticated")

    return authenticated and api.user_exists(user)
CVE-2023-0297 (Python, published 2023-01-14T03:15Z)
Description: value: Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/core/utils/misc.py
Commit message: fix arbitrary python code execution by abusing js2py functionality


Vulnerable code:
import socket
from .check import is_mapping

Fixed code:
js2py.disable_pyimport()
CVE-2023-0434 (Python, published 2023-01-22T01:15Z)
Description: value: Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/core/config/parser.py
Commit message: validate time config values


Vulnerable code:
                value = "0:00"
            if ":" not in value:
            return "" if value in (None, "") else os.path.realpath(os.path.expanduser(os.fsdecode(value)))

Fixed code:
            default_value = "0:00"
                value = default_value
            elif ":" not in value:

            hours, seconds = value.split(":", 1)
            if (
                hours.isnumeric()
                and seconds.isnumeric()
                and 0 <= int(hours) <= 23
                and 0 <= int(seconds) <= 59
            ):
                pass
            else:
                value = default_value

            return (
                ""
                if value in (None, "")
                else os.path.realpath(os.path.expanduser(os.fsdecode(value)))
            )
CVE-2023-0488 (JavaScript, published 2023-01-26T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/themes/modern/static/css/base.css
src/pyload/webui/app/themes/modern/templates/js/packages.js
src/pyload/webui/app/themes/pyplex/templates/js/packages.js
Commit message: make queue/collector links unclickable to prevent XSS


Vulnerable code:

.modal-dialog {
    margin-top: 10px;
}
                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                       "<span style='font-size: 16px; font-weight: bold;'><a href='" + link.url + "'>" + link.name + "</a></span><br/>" +

Fixed code:
                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +
                       "<span style='font-size: 16px; font-weight: bold;'><a onclick='return false' href='" + link.url + "'>" + link.name + "</a></span><br/>" +