hitoshura25/cvefixes huggingface dataset:
CVE-2023-25653 (JavaScript, published 2023-02-16T19:15Z)
Description: value: node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in `node-jose` can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation.  For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the "fallback" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node `crypto` module is available in the JS environment where `node-jose` is being run.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/cisco/node-jose
Files changed:
lib/deps/ecc/math.js
lib/deps/forge.js
test/algorithms/ecc-test.js
Commit message: Merge pull request from GHSA-5h4j-qrvg-9xhw



Vulnerable code:

Fixed code:
  if (x.s < 0) { throw Error("Barrett reduction on negative input"); }
// Ensure that the jsbn modInverse function always returns a positive result
const originalModInverse = forge.jsbn.BigInteger.prototype.modInverse;
const positiveModInverse = function(m) {
  const inv = originalModInverse.apply(this, [m]);
  return inv.mod(m);
}

forge.jsbn.BigInteger.prototype.modInverse = positiveModInverse;

/*!
 *
 * Copyright (c) 2015 Cisco Systems, Inc. See LICENSE file.
 */
"use strict";

var assert = require("chai").assert;

const CURVES = require('../../lib/deps/ecc/curves.js');
const BigInteger = require('../../lib/deps/forge').jsbn.BigInteger;

describe("ecc/positive", function() {
  const negativeModInverseCases = [
    '101067240514044546216936289506154965497874315269115226505131909313278720169941',
    '47260992668897782856940293132731814279826643476197468731642996160637470667669',
  ]
  
  const p = CURVES["P-256"].curve.p;

  const runner = () => {
    for (const kStr of negativeModInverseCases) {
      const k = new BigInteger(kStr);
      const kinv = k.modInverse(p);
      assert.isAtLeast(kinv.s, 0, "Negative mod inverse");
    }
  };

  it('normalizes negative modular inverses', runner);
})
CVE-2023-2954 (Unknown, published 2023-05-29T07:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/liangliangyy/djangoblog
Files changed:
Commit message: Merge pull request #662 from liangliangyy/dev

fix xss

Vulnerable code:

Fixed code:
CVE-2023-26123 (C, published 2023-04-14T05:15Z)
Description: value: Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscripten_run_script function.**Note:** This vulnerability is present only when compiling raylib for PLATFORM_WEB. All the other Desktop/Mobile/Embedded platforms are not affected.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/raysan5/raylib
Files changed:
src/rcore.c
Commit message: ADDED: Security check for `emscripten_run_script()` #2954


Vulnerable code:
    emscripten_run_script(TextFormat("navigator.clipboard.writeText('%s')", text));

    // Small security check trying to avoid (partially) malicious code...
    // sorry for the inconvenience when you hit this point...
    if (strchr(url, '\'') != NULL)
    {
        TRACELOG(LOG_WARNING, "SYSTEM: Provided URL is not valid");
    }

Fixed code:
    // Security check to (partially) avoid malicious code
    if (strchr(text, '\'') != NULL) TRACELOG(LOG_WARNING, "SYSTEM: Provided Clipboard could be potentially malicious, avoid [\'] character");
    else emscripten_run_script(TextFormat("navigator.clipboard.writeText('%s')", text));
/*
*/
    // Security check to (partially) avoid malicious code on PLATFORM_WEB
    if (strchr(fileName, '\'') != NULL) { TRACELOG(LOG_WARNING, "SYSTEM: Provided fileName could be potentially malicious, avoid [\'] character");  return; }

    // Security check to (aprtially) avoid malicious code on PLATFORM_WEB
    if (strchr(url, '\'') != NULL) TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'] character");
CVE-2020-11683 (C, published 2020-09-14T14:15Z)
Description: value: A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/linux4sam/at91bootstrap
Files changed:
driver/secure.c
Commit message: driver: secure: use consttime_memequal for memory comparison

Do  not  use memcmp() to compare security critical data, such as
cryptographic secrets, because the required CPU time depends on the
number of equal bytes.
Instead, a function that performs comparisons in constant time is required.
Warning: consttime_memequal returns 0 if data are NOT equal, and 1 if they are
equal.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Reviewed-by: Nicolas Ferre <nicolas.ferre@microchip.com>


Vulnerable code:
		if (memcmp(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))

Fixed code:
		if (!consttime_memequal(cmac, computed_cmac, AT91_AES_BLOCK_SIZE_BYTE))
CVE-2022-4860 (Python, published 2022-12-30T12:15Z)
Description: value: A vulnerability was found in KBase Metrics. It has been classified as critical. This affects the function upload_user_data of the file source/daily_cron_jobs/methods_upload_user_stats.py. The manipulation leads to sql injection. The patch is named 959dfb6b05991e30b0fa972a1ecdcaae8e1dae6d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217059.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/kbase/metrics
Files changed:
source/daily_cron_jobs/methods_upload_user_stats.py
Commit message: fixed sql update to avoid sql injection


Vulnerable code:
    #print("dev_tokens_users: " + str(dev_tokens_users))

    ####################
    # TRIED DO UPDATE WITH PASSED LIST NONE OF THIS WORKED
    # HAD To build up the entire string
    #    update_new_dev_tokens_statement = (
    #        "update user_info set dev_token_first_seen = now() "
    #        "where dev_token_first_seen is null and "
    #        "username in (%s)"
    #        )
    #    sql_params = ",".join(dev_tokens_users)
    #    sql_params = (dev_tokens_users,)
    #    sql_params = ([str(dev_tokens_users)])
    #    cursor.execute(update_new_dev_tokens_statement, [sql_params])
    #    cursor.execute("update user_info set dev_token_first_seen = now() "
    #                   "where dev_token_first_seen is null and "
    #                   "username in (%s)" % ', '.join('?' * len(dev_tokens_users)), dev_tokens_users)
    #    update_new_dev_tokens_statement = (
    #        "update user_info set dev_token_first_seen = now() "
    #        "where dev_token_first_seen is null and "
    #        "username in (%s)" % ', '.join('?' * len(dev_tokens_users)), dev_tokens_users
    #        )
    #    cursor.execute("SELECT foo.y FROM foo WHERE foo.x in (%s)" % ', '.join('?' * len(s)), s)
    dev_tokens_string = "', '".join(dev_tokens_users)
        "username in ('" + dev_tokens_string + "')"
    cursor.execute(update_new_dev_tokens_statement)

Fixed code:
        "username in (" + ("%s, " * (len(dev_tokens_users) - 1)) + "%s)"
#    print("update_new_dev_tokens_statement : " + update_new_dev_tokens_statement)
    update_dev_tokens_prep_cursor = db_connection.cursor(prepared=True)
    update_dev_tokens_prep_cursor.execute(update_new_dev_tokens_statement, dev_tokens_users)
CVE-2017-10965 (Unknown, published 2017-07-07T14:29Z)
Description: value: An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/irssi/irssi
Files changed:
Commit message: Merge branch 'security' into 'master'

Security

Closes #10

See merge request !17

Vulnerable code:

Fixed code:
CVE-2017-10966 (Unknown, published 2017-07-07T14:29Z)
Description: value: An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/irssi/irssi
Files changed:
Commit message: Merge branch 'security' into 'master'

Security

Closes #10

See merge request !17

Vulnerable code:

Fixed code:
CVE-2017-7191 (Unknown, published 2017-03-27T17:59Z)
Description: value: The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/irssi/irssi
Files changed:
Commit message: Merge branch 'netjoin-timeout' into 'master'

fe-netjoin: remove irc servers on "server disconnected" signal

Closes #7

See merge request !10


Vulnerable code:

Fixed code:
CVE-2019-13045 (Unknown, published 2019-06-29T14:15Z)
Description: value: Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/irssi/irssi
Files changed:
Commit message: Merge pull request #1058 from ailin-nemui/sasl-reconnect

copy sasl username and password values

Vulnerable code:

Fixed code:
CVE-2020-36658 (Perl, published 2023-01-27T05:15Z)
Description: value: In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/LemonLDAPNG/Apache-Session-LDAP
Files changed:
lib/Apache/Session/LDAP.pm
lib/Apache/Session/Store/LDAP.pm
Commit message: Add ldapVerify option for SSL cert validation


Vulnerable code:
    ) or die( 'Unable to connect to ' . join( ' ', @servers ) );
        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );

Fixed code:
    ldapVerify           => 'require',
    ldapCAFile           => '/etc/ssl/certs/ca-certificates.crt',
    # Compatibility
    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};

        verify  => $self->{args}->{ldapVerify} || "require",
        ( $caFile ? ( cafile => $caFile ) : () ),
        ( $caPath ? ( capath => $caPath ) : () ),

    ) or die( 'Unable to connect to ' . join( ' ', @servers ) . ': ' . $@ );

        $h{verify} ||= ( $self->{args}->{ldapVerify} || "require" );
        $h{cafile} ||= $caFile if ($caFile);
        $h{capath} ||= $caPath if ($caPath);
CVE-2020-21572 (C, published 2021-11-02T18:15Z)
Description: value: Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, allows attackers to cause a denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/trgil/gilcc
Files changed:
src/src_parser.c
Commit message: Fix parser tmp-buffer overflow issue


Vulnerable code:
                    } else if (pbuf.tmp_indx && 

Fixed code:
                    } else if (pbuf.tmp_indx &&
                    p_buf_write_tmp(&pbuf, tmp_fd);
                    p_buf_write_tmp(&pbuf, tmp_fd);
CVE-2020-28919 (Python, published 2022-01-15T17:15Z)
Description: value: A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tribe29/checkmk
Files changed:
cmk/gui/escaping.py
tests/unit/cmk/gui/test_htmllib_Escaper.py
Commit message: Rewrite matching a href unescape regex to separate attributes

The goal of this commit is to separate the values of the href and target
attributes in dedicated match groups. We also exclude the quotes from the
match groups to simplify the code.

Change-Id: I1e64946a1a426d81284b3173db43135ee0d1debc


Vulnerable code:
_QUOTE = re.compile(r"(?:&quot;|&#x27;)")
_A_HREF = re.compile(r'&lt;a href=((?:&quot;|&#x27;).*?(?:&quot;|&#x27;))&gt;')
        text = text.replace(a_href.group(0), u"<a href=%s>" % _QUOTE.sub(u"\"", a_href.group(1)))
    return text.replace(u"&amp;nbsp;", u"&nbsp;")

Fixed code:
_A_HREF = re.compile(
    r'&lt;a href=(?:(?:&quot;|&#x27;)(.*?)(?:&quot;|&#x27;))(?: target=(?:(?:&quot;|&#x27;)(.*?)(?:&quot;|&#x27;)))?&gt;'
)
        href = a_href.group(1)
        target = a_href.group(2)

        if target:
            unescaped_tag = "<a href=\"%s\" target=\"%s\">" % (href, target)
        else:
            unescaped_tag = "<a href=\"%s\">" % href

        text = text.replace(a_href.group(0), unescaped_tag)
    return text.replace("&amp;nbsp;", u"&nbsp;")
        # Links with target 1st and href 2nd will not be unescaped
        ("<a target=\"123\" href=\"xyz\">abc</a>",
         "&lt;a target=&quot;123&quot; href=&quot;xyz&quot;&gt;abc</a>"),
        # At the moment also javascript URLs are accepted. This will be refused in the next step
        ("<a href=\"javascript:alert(1)\">abc</a>", None),
CVE-2020-28919 (Python, published 2022-01-15T17:15Z)
Description: value: A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tribe29/checkmk
Files changed:
cmk/gui/escaping.py
tests/unit/cmk/gui/test_htmllib_Escaper.py
Commit message: Prevent non http/https links from being unescaped

Our permissive HTML escaping is preserving some HTML tags, which includes basic
link tags (a tag with href and optional target attributes). Previous versions
were not inspecting the value of href, which made it possible to add links with
e.g. a "javascript:" protocol. This opened some XSS attack vectors.

After this change it is only possible to link to http and https protocols. All
other links will not be unescaped.

Change-Id: I6e029ecc52f3dd3fc1f213c7f809332e3e49b3ee


Vulnerable code:
        # At the moment also javascript URLs are accepted. This will be refused in the next step
        ("<a href=\"javascript:alert(1)\">abc</a>", None),

Fixed code:
from urllib.parse import urlparse

        parsed = urlparse(href)
        if parsed.scheme != "" and parsed.scheme not in ["http", "https"]:
            continue  # Do not unescape links containing disallowed URLs

        # Only http/https are allowed as schemes
        ("<a href=\"http://checkmk.com/\">abc</a>", None),
        ("<a href=\"https://checkmk.com/\">abc</a>", None),
        ("<a href=\"HTTP://CHECKMK.COM/\">abc</a>", None),
        ("<a href=\"ftp://checkmk.com/\">abc</a>",
         "&lt;a href=&quot;ftp://checkmk.com/&quot;&gt;abc</a>"),
        ("<a href=\"javascript:alert(1)\">abc</a>",
         "&lt;a href=&quot;javascript:alert(1)&quot;&gt;abc</a>"),
CVE-2024-27093 (Go, published 2024-02-26T22:15Z)
Description: value: Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database).  When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result.  Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully.  Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability.  This vulnerability is patched in version 0.20240226.1425+ref.53868a8.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/stacklok/minder
Files changed:
internal/controlplane/handlers_githubwebhooks.go
Commit message: Fix client crash with fix for GHSA-q6h8-4j2v-pjg4 (#2432)



Vulnerable code:

Fixed code:
		// We will overwrite this later when we've looked it up from the provider,
		// but existing clients expect a message here, so let's add one.
		Repository: &pb.Repository{
			Name:  repo.Name,  // Not normalized, from client
			Owner: repo.Owner, // Not normalized, from client
		},