hitoshura25/cvefixes huggingface dataset:
CVE-2022-22115 (JavaScript, published 2022-01-10T16:15Z)
Description: value: In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.
Severity: LOW (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sismics/docs
Files changed:
docs-web/src/main/webapp/src/app/docs/app.js
docs-web/src/main/webapp/src/app/share/app.js
Commit message: escape ngTranslate parameters


Vulnerable code:
    .useSanitizeValueStrategy(null)
      .useSanitizeValueStrategy(null)

Fixed code:
    .useSanitizeValueStrategy('escapeParameters')
      .useSanitizeValueStrategy('escapeParameters')
CVE-2022-23530 (YAML, published 2022-12-16T23:15Z)
Description: value: GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten.  This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/DataDog/guarddog
Files changed:
.github/semgrep-rules/insecure-unpack-archive.yml
.github/workflows/semgrep.yml
guarddog/scanners/package_scanner.py
Commit message: Securely extract PyPI .tar.gz archives (#102)

* Add Semgrep rule and run custom Semgrep rules in CI for SAST

* Securely extract remote .tar.gz files

Vulnerable code:
        if: always()
import shutil
import tarsafe  # type: ignore
        shutil.unpack_archive(zippath, unzippedpath)
        os.remove(zippath)

Fixed code:
rules:
  - id: insecure-shutil-unpack-archive-use
    message: The Python 'shutil' shutil.extract_archive is vulnerable to
      arbitrary file overwrites
    languages:
      - python
    severity: ERROR
    metadata:
      category: security
      technology:
        - python
      owasp:
        - A06:2017 - Security Misconfiguration
        - A05:2021 - Security Misconfiguration
      cwe:
        - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory
          ('Path Traversal')"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    pattern-either:
      - pattern: |
          shutil.unpack_archive(...)
      - run: semgrep --config .github/semgrep-rules --sarif --output semgrep-custom.sarif ./guarddog
          category: semgrep-builtin

      - name: Upload SARIF file for custom Semgrep rules for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v2
        with:
          category: semgrep-custom
          sarif_file: semgrep-custom.sarif
          
import tarsafe  # type:ignore
        if zippath.endswith('.tar.gz'):
            tarsafe.open(zippath).extractall(unzippedpath)
            os.remove(zippath)
        else:
            raise ValueError("unsupported archive extension: " + zippath)
CVE-2014-3119 (PHP, published 2020-01-31T21:15Z)
Description: value: Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/web2project/web2project
Files changed:
includes/main_functions.php
Commit message: adding some more things to filter


Vulnerable code:
            $result  = preg_replace("/<>'\"\[\]{}:;/", "", $_result);

Fixed code:
            $result  = preg_replace("/<>\`'\"\[\]{}():;/", "", $_result);
CVE-2014-3119 (PHP, published 2020-01-31T21:15Z)
Description: value: Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/web2project/web2project
Files changed:
do_updatecontact.php
updatecontact.php
Commit message: filtering the update key a bit better


Vulnerable code:

Fixed code:
$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
CVE-2024-31209 (Other, published 2024-04-04T16:15Z)
Description: value: oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/erlef/oidcc
Files changed:
src/oidcc_provider_configuration_worker.erl
Commit message: Merge pull request from GHSA-mj35-2rgf-cv8p



Vulnerable code:
get_ets_table_name(WorkerName) when is_atom(WorkerName) ->
    {ok, erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table")};
        {local, WorkerName} ->
            Name = erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table"),

Fixed code:
get_ets_table_name(Name) when is_atom(Name) ->
    {ok, Name};
        {local, Name} ->
CVE-2020-36541 (PHP, published 2022-06-07T18:15Z)
Description: value: A vulnerability was found in Demokratian. It has been rated as critical. Affected by this issue is some unknown functionality of the file basicos_php/genera_select.php. The manipulation of the argument id_provincia with the input -1%20union%20all%20select%201,2,3,4,database() leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://bitbucket.org/csalgadow/demokratian_votaciones
Files changed:
basicos_php/genera_select.php
Commit message: error de tipo de dato

Cambiamos el filtro contra sql inyection para que detecte solo datos numéricos

Vulnerable code:
$id_provincia = fn_filtro($con, $_GET['id_provincia']);

Fixed code:
$id_provincia = fn_filtro_numerico($con, $_GET['id_provincia']);
CVE-2016-10027 (Java, published 2017-01-12T23:59Z)
Description: value: Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/igniterealtime/Smack
Files changed:
smack-core/src/main/java/org/jivesoftware/smack/AbstractXMPPConnection.java
smack-tcp/src/main/java/org/jivesoftware/smack/tcp/XMPPTCPConnection.java
Commit message: Move TLS Required check at the end of connect()

It was a *very* bad idea to perform the SecurityMode.Required check in
the connection's reader thread and not at the end of
AbstractXMPPConnectin's connect(). :/

This behavior dates back to 8e750912a765f77a4f178a4f307a8b42c2afb5ae

Fixes SMACK-739


Vulnerable code:
import org.jivesoftware.smack.SmackException.SecurityRequiredByClientException;
import org.jivesoftware.smack.SmackException.SecurityRequiredException;
    protected void afterFeaturesReceived() throws SecurityRequiredException, NotConnectedException, InterruptedException {
        // If TLS is required but the server doesn't offer it, disconnect
        // from the server and throw an error. First check if we've already negotiated TLS
        // and are secure, however (features get parsed a second time after TLS is established).
        if (!isSecureConnection() && startTlsFeature == null
                        && getConfiguration().getSecurityMode() == SecurityMode.required) {
            throw new SecurityRequiredByClientException();
        }

Fixed code:
import org.jivesoftware.smack.SmackException.SecurityRequiredByClientException;
        // If TLS is required but the server doesn't offer it, disconnect
        // from the server and throw an error. First check if we've already negotiated TLS
        // and are secure, however (features get parsed a second time after TLS is established).
        if (!isSecureConnection() && getConfiguration().getSecurityMode() == SecurityMode.required) {
            throw new SecurityRequiredByClientException();
        }

    protected void afterFeaturesReceived() throws NotConnectedException, InterruptedException {
CVE-2016-10027 (Java, published 2017-01-12T23:59Z)
Description: value: Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/igniterealtime/Smack
Files changed:
smack-core/src/main/java/org/jivesoftware/smack/AbstractXMPPConnection.java
smack-tcp/src/main/java/org/jivesoftware/smack/tcp/XMPPTCPConnection.java
Commit message: Move TLS Required check at the end of connect()

It was a *very* bad idea to perform the SecurityMode.Required check in
the connection's reader thread and not at the end of
AbstractXMPPConnectin's connect(). :/

This behavior dates back to 8e750912a765f77a4f178a4f307a8b42c2afb5ae

Fixes SMACK-739


Vulnerable code:
import org.jivesoftware.smack.SmackException.ConnectionException;
import org.jivesoftware.smack.SmackException.SecurityRequiredException;
    protected void afterFeaturesReceived() throws SecurityRequiredException, NotConnectedException {
        // If TLS is required but the server doesn't offer it, disconnect
        // from the server and throw an error. First check if we've already negotiated TLS
        // and are secure, however (features get parsed a second time after TLS is established).
        if (!isSecureConnection() && startTlsFeature == null
                        && getConfiguration().getSecurityMode() == SecurityMode.required) {
            throw new SecurityRequiredByClientException();
        }

Fixed code:

import org.jivesoftware.smack.SmackException.ConnectionException;
        // If TLS is required but the server doesn't offer it, disconnect
        // from the server and throw an error. First check if we've already negotiated TLS
        // and are secure, however (features get parsed a second time after TLS is established).
        if (!isSecureConnection() && getConfiguration().getSecurityMode() == SecurityMode.required) {
            shutdown();
            throw new SecurityRequiredByClientException();
        }

    protected void afterFeaturesReceived() throws NotConnectedException {
CVE-2017-20160 (JavaScript, published 2022-12-31T20:15Z)
Description: value: A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is db94f7391ad0a16dcfcba8b9be1af385b25c42db. It is recommended to upgrade the affected component. The identifier VDB-217149 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/flitto/express-param
Files changed:
lib/fetchParams.js
Commit message: feat: Improve fetchParams

* Add geo-info to extra options
* protect against HTTP Parameter Pollution attacks
* Add int, float type options for parameters


Vulnerable code:
    return req.params[keyName];
    return req.body[keyName];
    return req.query[keyName];
  } else {
    return undefined;
  for (var i = 0, li = required_expressions.length; i <li ; i++) {
    if (keyInfo.type === 'number') {
      options[key] = parseFloat(val);

Fixed code:
  var value;

    value = req.params[keyName];
    value = req.body[keyName];
    value = req.query[keyName];
  }

  if (Array.isArray(value)) {
    value = value[value.length - 1];

  return value;
    var typeMap = {
      int: parseInt,
      float: parseFloat,
      number: parseFloat
    };

    var idx = Object.keys(typeMap).indexOf(keyInfo.type);
    if (idx >= 0) {
      options[key] = typeMap[keyInfo.type](val);
    }

  for (var i = 0, li = required_expressions.length; i < li; i++) {

    var typeMap = {
      int: parseInt,
      float: parseFloat,
      number: parseFloat
    };

    var idx = Object.keys(typeMap).indexOf(keyInfo.type);
    if (idx >= 0) {

      if (keyInfo.type == 'int' && !_.isSafeInteger(val)) {
        err = new Error('The parameter value is not a integer : ' + key);
        err.code = 400;
        break;
      }

      options[key] = typeMap[keyInfo.type](val);
CVE-2023-2191 (Other, published 2023-04-20T02:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/azuracast/azuracast
Files changed:
templates/main.phtml
Commit message: Escape user display name in menu.


Vulnerable code:
            <?= $user->getDisplayName() ?>

Fixed code:
            <?= $this->e($user->getDisplayName()) ?>
CVE-2020-8945 (Other, published 2020-02-12T18:15Z)
Description: value: The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/containers/image
Files changed:
go.mod
go.sum
Commit message: Update to github.com/mtrmac/gpgme@v0.1.1

This primarily includes https://github.com/proglottis/gpgme/pull/23 ,
fixing use-after-free crashes.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>


Vulnerable code:
	github.com/mtrmac/gpgme v0.0.0-20170102180018-b2432428689c

Fixed code:
	github.com/mtrmac/gpgme v0.1.1
github.com/mtrmac/gpgme v0.0.0-20200118211431-ce00817b8a3f h1:Td/Gr8BXYbQ0vXQUHhkleCzd7f+WTDQdVCmlqOUwMKo=
github.com/mtrmac/gpgme v0.0.0-20200118211431-ce00817b8a3f/go.mod h1:GYYHnGSuS7HK3zVS2n3y73y0okK/BeKzwnn5jgiVFNI=
github.com/mtrmac/gpgme v0.1.1 h1:a5ISnvahzTzBH0m/klhehN68N+9+/jLwhpPFtH3oPAQ=
github.com/mtrmac/gpgme v0.1.1/go.mod h1:GYYHnGSuS7HK3zVS2n3y73y0okK/BeKzwnn5jgiVFNI=
golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
CVE-2023-39150 (C++, published 2023-09-12T13:15Z)
Description: value: ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Maximus5/ConEmu
Files changed:
src/ConEmuCD/ConAnsiImpl.cpp
src/ConEmuHk/Ansi.cpp
Commit message: gh-2536: Do not emit control characters in title reports (capability fix).


Vulnerable code:
		const char ch = *pc >= 0x20 ? *pc : L' ';

		const char ch = *pc >= 0x20 ? *pc : L' ';

Fixed code:
		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
		const char ch = (*pc == 0x1B || *pc >= 0x20) ? *pc : L' ';
CVE-2014-125045 (PHP, published 2023-01-05T22:15Z)
Description: value: A vulnerability has been found in meol1 and classified as critical. Affected by this vulnerability is the function GetAnimal of the file opdracht4/index.php. The manipulation of the argument where leads to sql injection. The identifier of the patch is 82441e413f87920d1e8f866e8ef9d7f353a7c583. It is recommended to apply a patch to fix this issue. The identifier VDB-217525 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Miesvanderlippe/meol1
Files changed:
opdracht4/index.php
Commit message: Opdracht 4 | Fixed SQL injection 3x

Disabled fake prepares
Bindparams for dynamic contents
HEXing of values

This still is injectable on my USBWebserver BTW :/


Vulnerable code:
		    
		    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
		    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
		$whereCondition = 'WHERE ' . (is_numeric($where) ? 'id=\''.$where.'\'' : 'naam=\''.$where.'\'');

Fixed code:
			    PDO::ATTR_EMULATE_PREPARES => false,
			    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
			    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
		$whereCondition = 'WHERE ' . (is_numeric($where) ? 'id=UNHEX(:where)' : 'naam=UNHEX(:where)');
		$where = bin2hex($where);

		$reponse->bindParam(':where', $where);
CVE-2015-10027 (Unknown, published 2023-01-07T17:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in hydrian TTRSS-Auth-LDAP. Affected by this issue is some unknown functionality of the component Username Handler. The manipulation leads to ldap injection. Upgrading to version 2.0b1 is able to address this issue. The patch is identified as a7f7a5a82d9202a5c40d606a5c519ba61b224eb8. It is recommended to upgrade the affected component. VDB-217622 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/hydrian/TTRSS-Auth-LDAP
Files changed:
Commit message: Merge pull request #14 from tsmgeek/master

Pull to properly escape provided username to prevent exploit. 

Vulnerable code:

Fixed code: