hitoshura25/cvefixes huggingface dataset:
CVE-2021-41149 (Unknown, published 2021-10-19T18:15Z)
Description: value: Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/awslabs/tough
Files changed:
Commit message: Merge pull request from GHSA-x3r5-q6mj-m485

sanitize target names and delegate role names

Vulnerable code:

Fixed code:
CVE-2021-41150 (Unknown, published 2021-10-19T20:15Z)
Description: value: Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/awslabs/tough
Files changed:
Commit message: Merge pull request from GHSA-x3r5-q6mj-m485

sanitize target names and delegate role names

Vulnerable code:

Fixed code:
CVE-2021-41128 (Other, published 2021-10-06T18:15Z)
Description: value: Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions all CSV Exports (Statistics & BAG MED) contain a CSV Injection Vulnerability. Users of the system are able to submit formula as exported fields which then get executed upon ingestion of the exported file. There is no validation or sanitization of these formula fields and so malicious may construct malicious code. This vulnerability has been resolved in version 1.30.4. There are no workarounds and all users are advised to upgrade their package.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/jshmrtn/hygeia
Files changed:
apps/hygeia/lib/hygeia/case_context.ex
apps/hygeia/lib/hygeia/statistics_context.ex
apps/hygeia/mix.exs
mix.lock
Commit message: Merge pull request from GHSA-8pwv-jhj2-2369



Vulnerable code:
    |> CSV.encode()
    CSV.encode(export)
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
    |> CSV.encode()
      {:csv, "~> 2.4"},
  "csv": {:hex, :csv, "2.4.1", "50e32749953b6bf9818dbfed81cf1190e38cdf24f95891303108087486c5925e", [:mix], [{:parallel_stream, "~> 1.0.4", [hex: :parallel_stream, repo: "hexpm", optional: false]}], "hexpm", "54508938ac67e27966b10ef49606e3ad5995d665d7fc2688efb3eab1307c9079"},

Fixed code:
    |> CSV.encode(escape_formulas: true)
    CSV.encode(export, escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
    |> CSV.encode(escape_formulas: true)
      # TODO: Revert back to the released version when the following PR is
      # merged and released:
      # - https://github.com/beatrichartz/csv/pull/104
      {:csv, "~> 2.4", github: "jshmrtn/csv", branch: "formular_escaping"},
  "csv": {:git, "https://github.com/jshmrtn/csv.git", "faef83ef956e132911c4b44891ce0d48904577c0", [branch: "formular_escaping"]},
CVE-2016-1587 (Unknown, published 2019-04-22T16:29Z)
Description: value: The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/snapcore/snapweb
Files changed:
Commit message: Merge pull request #84 from dbarth/token

Access Token

Vulnerable code:

Fixed code:
CVE-2022-46162 (JavaScript, published 2022-11-30T23:15Z)
Description: value: discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discourse-bccode plugin. This vulnerability only affects sites which have the discourse-bbcode plugin installed and enabled. This issue is patched in commit 91478f5. As a workaround, ensure that the Content Security Policy is enabled and monitor any posts that contain bbcode.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/discourse-bbcode
Files changed:
assets/javascripts/lib/discourse-markdown/bbcode.js
spec/pretty_text_spec.rb
Commit message: SECURITY: Fix allowed font names (#41)

Limit the allowed names for fonts and added some tests.

Vulnerable code:
        return /^(font-size:(xx-small|x-small|small|medium|large|x-large|xx-large|[0-9]{1,3}%)|background-color:#?[a-zA-Z0-9]+|color:#?[a-zA-Z0-9]+|font-family:[\s\S]+)$/.exec(

Fixed code:
        return /^(font-size:(xx-small|x-small|small|medium|large|x-large|xx-large|[0-9]{1,3}%)|background-color:#?[a-zA-Z0-9]+|color:#?[a-zA-Z0-9]+|font-family:'[a-zA-Z0-9\s-]+')$/.exec(
  it 'can apply font bbcode with hyphen' do
    cooked = PrettyText.cook "hello [font=sans-serif]sans-serif[/font] text"
    html = '<p>hello <span style="font-family:\'sans-serif\'">sans-serif</span> text</p>'

    expect(cooked).to eq(html)
  end

  it 'can apply font bbcode with space' do
    cooked = PrettyText.cook "hello [font=Times New Roman]Times New Roman[/font] text"
    html = '<p>hello <span style="font-family:\'Times New Roman\'">Times New Roman</span> text</p>'

    expect(cooked).to eq(html)
  end

  it 'only uses fonts with valid text' do
    cooked = PrettyText.cook "hello [font=ui-monospace';]usa[/font] text"
    html = '<p>hello <span>usa</span> text</p>'

    expect(cooked).to eq(html)
  end
CVE-2022-0841 (Other, published 2022-03-03T16:15Z)
Description: value: OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ljharb/npm-lockfile
Files changed:
.eslintrc
getLockfile.js
Commit message: [Fix] reject invalid `only` values


Vulnerable code:

Fixed code:
		"max-lines-per-function": 0,
	if (only && only !== 'prod' && only !== 'production') {
		return Promise.reject(colors.red('`only`, when provided, must be "prod" or "production"'));
	}
CVE-2016-10210 (C, published 2017-04-03T05:59Z)
Description: value: libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/VirusTotal/yara
Files changed:
libyara/re_lexer.c
libyara/re_lexer.l
tests/test-rules.c
Commit message: re_lexer: Make reading escape sequences more robust (#586)

* Add test for issue #503

* re_lexer: Make reading escape sequences more robust

This commit fixes parsing incomplete escape sequences at the end of a
regular expression and parsing things like \xxy (invalid hex digits)
which before were silently turned into (char)255.

Close #503

* Update re_lexer.c


Vulnerable code:
     *       existing scanners that call yyless() from OUTSIDE re_yylex. 
    
					   
    yyerror(yyscanner, lex_env, "unexpected end of buffer");
      yyerror(yyscanner, lex_env, "unexpected end of buffer");
    yyerror(yyscanner, lex_env, "unexpected end of buffer");
		   
								  
				
 * @return the newly allocated buffer state object. 
    
    
	
	
    
    
    
  if (text[1] == EOF)
    if (text[2] == EOF)
    if (text[3] == EOF)
    yyerror(yyscanner, lex_env, "unexpected end of buffer");
      yyerror(yyscanner, lex_env, "unexpected end of buffer");
    yyerror(yyscanner, lex_env, "unexpected end of buffer");
  if (text[1] == EOF)
    if (text[2] == EOF)
    if (text[3] == EOF)

Fixed code:
     *       existing scanners that call yyless() from OUTSIDE re_yylex.

					
    yyerror(yyscanner, lex_env, "illegal escape sequence");
      yyerror(yyscanner, lex_env, "illegal escape sequence");
    yyerror(yyscanner, lex_env, "illegal escape sequence");
		


 * @return the newly allocated buffer state object.







  if (text[1] == EOF || text[1] == 0)
    if (!isxdigit(text[2]))
    if (!isxdigit(text[3]))
    yyerror(yyscanner, lex_env, "illegal escape sequence");
      yyerror(yyscanner, lex_env, "illegal escape sequence");
    yyerror(yyscanner, lex_env, "illegal escape sequence");
  if (text[1] == EOF || text[1] == 0)
    if (!isxdigit(text[2]))
    if (!isxdigit(text[3]))

  // test case for issue #503, \x without two following hex-digits
  assert_regexp_syntax_error("\\x0");
  assert_regexp_syntax_error("\\x");

  assert_regexp_syntax_error("\\xxy");
CVE-2017-11328 (C, published 2017-07-17T13:18Z)
Description: value: Heap buffer overflow in the yr_object_array_set_item() function in object.c in YARA 3.x allows a denial-of-service attack by scanning a crafted .NET file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/VirusTotal/yara
Files changed:
libyara/modules/tests.c
libyara/object.c
tests/test-rules.c
Commit message: Fix heap overflow (reported by Jurriaan Bremer)

When setting a new array item with yr_object_array_set_item() the array size is doubled if the index for the new item is larger than the already allocated ones. No further checks were made to ensure that the index fits into the array after doubling its capacity. If the array capacity was for example 64, and a new object is assigned to an index larger than 128 the overflow occurs. As yr_object_array_set_item() is usually invoked with indexes that increase monotonically by one, this bug never triggered before. But the new "dotnet" module has the potential to allow the exploitation of this bug by scanning a specially crafted .NET binary.


Vulnerable code:
    count = yr_max(64, (index + 1) * 2);

Fixed code:
  set_integer(256, module_object, "integer_array[%i]", 256);
    count = 64;

    while (count <= index)
      count *= 2;

    while (count <= index)
      count *= 2;

  assert_true_rule(
      "import \"tests\" \
       rule test { \
        condition: tests.integer_array[256] == 256 \
      }",
      NULL);
CVE-2017-5924 (Other, published 2017-04-03T05:59Z)
Description: value: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/VirusTotal/yara
Files changed:
libyara/grammar.y
Commit message: Make sure that loop depth is greater than 0 before decrementing it.


Vulnerable code:
        compiler->loop_depth--;
        compiler->loop_identifier[compiler->loop_depth] = NULL;

Fixed code:
        if (compiler->loop_depth > 0)
        {
          compiler->loop_depth--;
          compiler->loop_identifier[compiler->loop_depth] = NULL;
        }
CVE-2017-9465 (C, published 2017-06-06T21:29Z)
Description: value: The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/VirusTotal/yara
Files changed:
libyara/re.c
libyara/scan.c
Commit message: Fix buffer overrun (issue #678). Add assert for detecting this kind of issues earlier.


Vulnerable code:
            next_input = input + i * input_incr;


Fixed code:
            next_input = input + i * input_incr;

          bytes_matched = yr_min(bytes_matched, max_bytes_matched);
  // make sure that match fits into the data.
  assert(match_offset + match_length <= callback_args->data_size);
CVE-2022-45182 (PHP, published 2022-11-11T20:15Z)
Description: value: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash
Files changed:
dstarrepeater/link_manager.php
Commit message: Update link_manager.php

probably better fix for #169

Vulnerable code:

	$module = substr($_POST["Module"], 0, 7);
	$module = preg_replace("/[^a-zA-Z0-9]+/", "", $module);

Fixed code:
if ($_POST["Link"] == "UNLINK") {
	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
	}
	
	$module = $_POST["Module"];
CVE-2022-45182 (PHP, published 2022-11-11T20:15Z)
Description: value: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash
Files changed:
admin/admin.php
Commit message: Update admin.php

More fixes relating to #169

Vulnerable code:

Fixed code:
if ($_POST["Link"] == "UNLINK") {
	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
	}
CVE-2022-45182 (PHP, published 2022-11-11T20:15Z)
Description: value: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash
Files changed:
dstarrepeater/link_manager.php
Commit message: Update link_manager.php

Fix #169

Vulnerable code:
	$module = $_POST["Module"];

Fixed code:
	$module = substr($_POST["Module"], 0, 7);
	$module = preg_replace("/[^a-zA-Z0-9]+/", "", $module);
CVE-2022-36087 (Unknown, published 2022-09-09T21:15Z)
Description: value: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/oauthlib/oauthlib
Files changed:
Commit message: Merge pull request from GHSA-3pgj-pg6c-r5p7

Improve test coverage of IPv6 parsing

Vulnerable code:

Fixed code:
CVE-2019-20627 (C#, published 2020-03-23T17:15Z)
Description: value: AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/ravibpatel/AutoUpdater.NET
Files changed:
AutoUpdater.NET/AutoUpdater.cs
AutoUpdater.NET/Properties/AssemblyInfo.cs
AutoUpdater.NET/build/Autoupdater.NET.Official.nuspec
appveyor.yml
Commit message: Fixed an XML external entity (XXE) vulnerability.


Vulnerable code:
                        XmlDocument receivedAppCastDocument = new XmlDocument();

[assembly: AssemblyVersion("1.5.7.0")]
[assembly: AssemblyFileVersion("1.5.7.0")]
        <version>1.5.7</version>
version: 1.5.7.{build}
  my_version: 1.5.7

Fixed code:
                        XmlDocument receivedAppCastDocument = new XmlDocument {XmlResolver = null};
[assembly: AssemblyVersion("1.5.8.0")]
[assembly: AssemblyFileVersion("1.5.8.0")]
        <version>1.5.8</version>
version: 1.5.8.{build}
  my_version: 1.5.8
CVE-2013-10028 (PHP, published 2023-06-04T19:15Z)
Description: value: A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. The attack may be launched remotely. The name of the patch is 3339b42316c5edf73e56eb209b6a3bb3e868d6ed. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230660.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/eelv-newsletter
Files changed:
lettreinfo.php
Commit message: XSS fix

git-svn-id: https://plugins.svn.wordpress.org/eelv-newsletter/trunk@698982 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
        $news_reg_return.= strip_tags($email).' : '.__('invalid address', 'eelv_lettreinfo');

Fixed code:
        $news_reg_return.= '<b>'.htmlspecialchars(strip_tags($email)).'</b> : '.__('invalid address', 'eelv_lettreinfo');
CVE-2023-49281 (Python, published 2023-12-01T22:15Z)
Description: value: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Cainor/Calendarinho
Files changed:
CalendarinhoApp/authentication.py
Commit message: Full Fix for Open Redirect Issue #1


Vulnerable code:
                    print("Good People")
                    print("fucking bad shit")

Fixed code:
CVE-2023-49281 (Python, published 2023-12-01T22:15Z)
Description: value: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Cainor/Calendarinho
Files changed:
CalendarinhoApp/authentication.py
Commit message: Fix Open Redirect - Thanks to @7hj4


Vulnerable code:
                if 'next' in request.POST:
                    return HttpResponseRedirect(request.POST.get('next'))

Fixed code:
                next_url = request.POST.get('next', '')
                if next_url and next_url.startswith('/'):
                    return HttpResponseRedirect(next_url)