hitoshura25/cvefixes huggingface dataset:
CVE-2024-35185 (Go, published 2024-05-16T16:15Z)
Description: value: Minder is a software supply chain security platform. Prior to version 0.0.49, the Minder REST ingester is vulnerable to a denial of service attack via an attacker-controlled REST endpoint that can crash the Minder server. The REST ingester allows users to interact with REST endpoints to fetch data for rule evaluation. When fetching data with the REST ingester, Minder sends a request to an endpoint and will use the data from the body of the response as the data to evaluate against a certain rule. If the response is sufficiently large, it can drain memory on the machine and crash the Minder server. The attacker can control the remote REST endpoints that Minder sends requests to, and they can configure the remote REST endpoints to return responses with large bodies. They would then instruct Minder to send a request to their configured endpoint that would return the large response which would crash the Minder server. Version 0.0.49 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/stacklok/minder
Files changed:
internal/engine/ingester/rest/rest.go
internal/engine/ingester/rest/rest_test.go
Commit message: Merge pull request from GHSA-fjw8-3gp8-4cvx

This ensures that a malicious (or faulty) REST server does not crash
minder with too big requests. Minder will thus limit requests body reads
to 1Mb.

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

Vulnerable code:
		dec := json.NewDecoder(body)
		data, err = io.ReadAll(body)

Fixed code:

	// MaxBytesLimit is the maximum number of bytes to read from the response body
	// We limit to 1MB to prevent abuse
	MaxBytesLimit int64 = 1 << 20
	lr := io.LimitReader(body, MaxBytesLimit)

		dec := json.NewDecoder(lr)
		data, err = io.ReadAll(lr)
	"encoding/binary"

func TestIngestor_parseBodyDoesNotReadTooLargeRequests(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name    string
		cfg     *pb.RestType
		body    string
		wantErr bool
	}{
		{
			name: "raw",
			cfg:  &pb.RestType{},
			// really large body
			// casting to `int` should work.
			body: strings.Repeat("a", int(MaxBytesLimit)+1),
			// This case does not error, it simply truncates.
			wantErr: false,
		},
		{
			name: "json",
			cfg: &pb.RestType{
				Parse: "json",
			},
			// really large body
			// casting to `int` should work.
			body: "{\"a\":\"" + strings.Repeat("a", int(MaxBytesLimit)+1) + "\"}",
			// This case will error out, as truncating
			// makes the JSON invalid.
			wantErr: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			t.Parallel()

			rdi := &Ingestor{
				restCfg: tt.cfg,
			}

			got, err := rdi.parseBody(strings.NewReader(tt.body))
			if tt.wantErr {
				assert.Error(t, err, "expected error")
			} else {
				assert.NoError(t, err, "expected no error")
				assert.Equal(t, int(MaxBytesLimit), binary.Size(got), "expected body to be truncated")
			}
		})
	}
}
CVE-2024-35194 (Go, published 2024-05-20T21:15Z)
Description: value: Minder is a software supply chain security platform. Prior to version 0.0.50, Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the user control both the template and the params for it, and in a subset of these cases, Minder reads the generated template entirely into memory. When Minders templating meets both of these conditions, an attacker is able to generate large enough templates that Minder will exhaust memory and crash. This vulnerability is fixed in 0.0.50.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/stacklok/minder
Files changed:
internal/verifier/sigstore/container/container.go
Commit message: Merge pull request from GHSA-8fmj-33gw-g7pw

Similarly to other readers, this also limits the size. In this case, it
was set to 10MB, since attestations can get pretty big.

Signed-off-by: Juan Antonio Osorio <ozz@stacklok.com>

Vulnerable code:
	if err := json.NewDecoder(resp.Body).Decode(&attestationReply); err != nil {
	manifest, err := v1.ParseManifest(bytes.NewReader(mf))

Fixed code:
	"io"

	// MaxAttestationsBytesLimit is the maximum number of bytes we're willing to read from the attestation endpoint
	// We'll limit this to 10mb for now
	MaxAttestationsBytesLimit int64 = 10 * 1024 * 1024
	lr := io.LimitReader(resp.Body, MaxAttestationsBytesLimit)
	if err := json.NewDecoder(lr).Decode(&attestationReply); err != nil {
	r := io.LimitReader(bytes.NewReader(mf), MaxAttestationsBytesLimit)
	manifest, err := v1.ParseManifest(r)
CVE-2022-23535 (C#, published 2023-02-24T23:15Z)
Description: value: LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to POCO classes. When instances of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe  object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/mbdavid/LiteDB
Files changed:
LiteDB.sln
LiteDB/Client/Mapper/BsonMapper.Deserialize.cs
LiteDB/LiteDB.csproj
LiteDB/Utils/LiteException.cs
Commit message: Adding testing for Process object deserializaion rule


Vulnerable code:
# Visual Studio Version 16
VisualStudioVersion = 16.0.29609.76
                    if (!type.IsAssignableFrom(actualType)) throw LiteException.DataTypeNotAssignable(type.FullName, actualType.FullName);
    <TargetFrameworks>net45;netstandard1.3;netstandard2.0</TargetFrameworks>

Fixed code:
# Visual Studio Version 17
VisualStudioVersion = 17.1.32328.378

                    // avoid initialize class that are not assignable 
                    if (!type.IsAssignableFrom(actualType))
                    {
                        throw LiteException.DataTypeNotAssignable(type.FullName, actualType.FullName);
                    }

                    // avoid use of "System.Diagnostics.Process" in object type definition
                    // using String test to work in .netstandard 1.3
                    if (actualType.FullName.Equals("System.Diagnostics.Process", StringComparison.OrdinalIgnoreCase) &&
                        actualType.Assembly.GetName().Name.Equals("System", StringComparison.OrdinalIgnoreCase))
                    {
                        throw LiteException.AvoidUseOfProcess();
                    }
    <TargetFrameworks>net4.5;netstandard1.3;netstandard2.0</TargetFrameworks>
        public const int AVOID_USE_OF_PROCESS = 215;
        internal static LiteException AvoidUseOfProcess()
        {
            return new LiteException(AVOID_USE_OF_PROCESS, $"LiteDB do not accept System.Diagnostics.Process class in deserialize mapper");
        }
CVE-2020-36420 (Other, published 2021-07-15T00:15Z)
Description: value: Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/jech/polipo
Files changed:
README
Commit message: Rephrase README.


Vulnerable code:
Polipo is obsolete
==================
When it was first written, Polipo was probably the best HTTP proxy
available.  Since then, the web protocols have changed, and Polipo hasn't
kept up -- it has no support for HTTP/2.0 or the WebSocket protocol.

Polipo will no longer be maintained.

Fixed code:
Polipo is no longer maintained
==============================
Polipo is no longer maintained.  Sorry.
CVE-2021-41185 (Python, published 2021-10-26T15:15Z)
Description: value: Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/kizniche/Mycodo
Files changed:
CHANGELOG.md
mycodo/mycodo_flask/routes_general.py
Commit message: Fix file exploit vulnerability (#1105)


Vulnerable code:
## 8.12.7 (Unreleased)
            return send_file(file_path, as_attachment=True)
        return send_file(path_file, mimetype='image/jpeg')

Fixed code:
## 8.12.7 (2021-10-25)

This is a bugfix release that includes a fix to a severe security vulnerability. It is recommended that all users that have Mycodo exposed to the internet and allow guest access upgrade to patch this vulnerability. Users that only run Mycodo on a local network and/or don't allow unknown user (i.e. guest) access likely won't be affected.
 - Fix file exploit vulnerability ([#1105](https://github.com/kizniche/mycodo/issues/1105))
            if os.path.abspath(file_path).startswith(PATH_NOTE_ATTACHMENTS):
                return send_file(file_path, as_attachment=True)
        if os.path.abspath(path_file).startswith(path):
            return send_file(path_file, mimetype='image/jpeg')
CVE-2022-37109 (Python, published 2022-11-14T21:15Z)
Description: value: patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the password hash is also used as the cookie secret, so an attacker can generate his own authentication cookie.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/patrickfuller/camp
Files changed:
README.md
server.py
Commit message: Fix vulnerability and add warning


Vulnerable code:
![](img/example.png)
#### USB Camera
#### Password
Note that this level of password protection is basic - it's fine for keeping the
occasional stranger out, but won't stand up to targeted hacking.
#### Run on startup
#### Customization
import threading
        if hashlib.sha512(password).hexdigest() == PASSWORD:
class ErrorHandler(tornado.web.RequestHandler):
    def get(self):
        self.send_error(status_code=403)


            (r"/static/password.txt", ErrorHandler),
            (r'/static/(.*)', tornado.web.StaticFileHandler, {'path': ROOT})]
application = tornado.web.Application(handlers, cookie_secret=PASSWORD)

Fixed code:
**USE AT YOUR OWN RISK. SEE [#11](https://github.com/patrickfuller/camp/issues/11) FOR MORE.**

![](static/img/example.png)
### USB Camera
### Password
**Note that this level of password protection is basic.** It's fine for keeping the occasional stranger out but won't stand up to targeted hacking.
### Run on startup
### Customization
        if hashlib.sha512(password.encode()).hexdigest() == PASSWORD:
            (r'/static/(.*)', tornado.web.StaticFileHandler, {'path': os.path.join(ROOT, 'static')})]

secret = base64.b64encode(os.urandom(50)).decode('ascii')
application = tornado.web.Application(handlers, cookie_secret=secret)
CVE-2019-12395 (Unknown, published 2019-05-28T13:29Z)
Description: value: In Webbukkit Dynmap 3.0-beta-3 or below, due to a missing login check in servlet/MapStorageHandler.java, an attacker can see a map image without login even if victim enables login-required in setting.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/webbukkit/dynmap
Files changed:
Commit message: Merge pull request #2475 from Ry0taK/v3.0

Fix required login bypass vulnerability

Vulnerable code:

Fixed code:
CVE-2021-35065 (JavaScript, published 2022-12-26T07:15Z)
Description: value: The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/gulpjs/glob-parent
Files changed:
index.js
test/index.test.js
Commit message: fix: Resolve ReDoS vulnerability from CVE-2021-35065 (#49)



Vulnerable code:
var enclosure = /[{[].*\/.*[}\]]$/;
  if (enclosure.test(str)) {

Fixed code:
  if (isEnclosure(str)) {


function isEnclosure(str) {
  var lastChar = str.slice(-1)

  var enclosureStart;
  switch (lastChar) {
    case '}':
      enclosureStart = '{';
      break;
    case ']':
      enclosureStart = '[';
      break;
    default:
      return false;
  }

  var foundIndex = str.indexOf(enclosureStart);
  if (foundIndex < 0) {
    return false;
  }

  return str.slice(foundIndex + 1, -1).includes(slash);
}

  it('should finish in reasonable time for \'{\' + \'/\'.repeat(n) [CVE-2021-35065]', function(done) {
    this.timeout(1000);
    gp('{' + '/'.repeat(500000));
    done();
  });

  it('should finish in reasonable time for \'{\'.repeat(n)', function(done) {
    this.timeout(1000);
    gp('{'.repeat(500000));
    done();
  });

  it('should finish in reasonable time for \'(\'.repeat(n)', function(done) {
    this.timeout(1000);
    gp('('.repeat(500000));
    done();
  });
CVE-2020-11075 (Unknown, published 2020-05-27T22:15Z)
Description: value: In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.
Severity: MEDIUM (CVSS v3 base score: 9.9)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/anchore/anchore-engine
Files changed:
Commit message: Merge pull request #431 from anchore/dev/nurmi/osoverride_skopeo_update

Ensure only supported os overrides are used in skopeo download comman…

Vulnerable code:

Fixed code:
CVE-2022-31549 (Unknown, published 2022-07-11T01:15Z)
Description: value: The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/olmax99/helm-flask-celery
Files changed:
Commit message: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability

Vulnerable code:

Fixed code:
CVE-2019-15150 (PHP, published 2019-08-19T04:15Z)
Description: value: In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Schine/MW-OAuth2Client
Files changed:
SpecialOAuth2Client.php
extension.json
Commit message: Enforce/verify state parameter of callback

This fixes a security vulnerability where a malicious actor can bypass authentication via a clickjacking attack (CSRF vulnerability).

Signed-off-by: schema <schema@star-made.org>


Vulnerable code:

			// Failed to get the access token or user details.

	"version": "0.3",

Fixed code:
		global $wgRequest;

			$storedState = $wgRequest->getSession()->get('oauth2state');
			// Enforce the `state` parameter to prevent clickjacking/CSRF
			if(isset($storedState) && $storedState != $_GET['state']) {
				if(isset($_GET['state'])) {
					throw new UnexpectedValueException("State parameter of callback does not match original state");
				} else {
					throw new UnexpectedValueException("Required state parameter missing");
				}
			}
			exit($e->getMessage()); // Failed to get the access token or user details.
		} catch (UnexpectedValueException $e) {
	"version": "0.4",
CVE-2020-36617 (C, published 2022-12-18T15:15Z)
Description: value: A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/ewxrjk/sftpserver
Files changed:
parse.c
Commit message: Fix handle mis-parse

This could lead to the server process
accessing uninitialized data.

In some deployment models this would
be a vulnerability. However, the README
specifically warns about avoiding such
deployment models, so this patch is not
going to be treated as a vulnerability fix.


Vulnerable code:
  if((rc = sftp_parse_uint32(job, &len)) != SSH_FX_OK || len != 8 ||
     (rc = sftp_parse_uint32(job, &id->id)) != SSH_FX_OK ||

Fixed code:
  if((rc = sftp_parse_uint32(job, &len)) != SSH_FX_OK)
    return rc;
  if(len != 8)
    return SSH_FX_BAD_MESSAGE;
  if((rc = sftp_parse_uint32(job, &id->id)) != SSH_FX_OK ||
CVE-2021-41189 (Unknown, published 2021-10-29T18:15Z)
Description: value: DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.
Severity: HIGH (CVSS v3 base score: 7.2)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/DSpace/DSpace
Files changed:
Commit message: Merge pull request from GHSA-cf2j-vf36-c6w8

Default groups issue

Vulnerable code:

Fixed code:
CVE-2024-38364 (Unknown, published 2024-06-26T00:15Z)
Description: value: DSpace is an open source software is a turnkey repository application used by more than 2,000 organizations and institutions worldwide to provide durable access to digital resources. In DSpace 7.0 through 7.6.1, when an HTML, XML or JavaScript Bitstream is downloaded, the user's browser may execute any embedded JavaScript. If that embedded JavaScript is malicious, there is a risk of an XSS attack. This vulnerability has been patched in version 7.6.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/DSpace/DSpace
Files changed:
Commit message: Merge pull request #9638 from tdonohue/avoid_inline_js

Update configuration to always download HTML/JS/XML Bitstreams (no inline display)

Vulnerable code:

Fixed code: