hitoshura25/cvefixes huggingface dataset:
CVE-2021-43849 (Swift, published 2021-12-23T17:15Z)
Description: value: cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio
Files changed:
src/ios/Fingerprint.swift
Commit message: Update Fingerprint.swift

fix crash issue on device

Vulnerable code:
            let invalidateOnEnrollment = (data?["invalidateOnEnrollment"] as? Bool) ?? false
        if let description = data?["description"] as! String? {
        if let secret = data?["secret"] as? String {

Fixed code:
import Cordova
                @unknown default:
                    fatalError()
            let invalidateOnEnrollment = (data?.object(forKey: "invalidateOnEnrollment") as? Bool) ?? false
        if let description = data?.object(forKey: "description") as! String? {
        if let secret = data?.object(forKey: "secret") as? String {
CVE-2024-36105 (Python, published 2024-05-27T18:15Z)
Description: value: dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to `INADDR_ANY (0.0.0.0)` or `IN6ADDR_ANY (::)` exposes an application on all network interfaces, increasing the risk of unauthorized access. As stated in the Python docs, a special form for address is accepted instead of a host address: `''` represents `INADDR_ANY`, equivalent to `"0.0.0.0"`. On systems with IPv6, '' represents `IN6ADDR_ANY`, which is equivalent to `"::"`. A user who serves docs on an unsecured public network, may unknowingly be hosting an unsecured (http) web site for any remote user/system to access on the same network. The issue has has been mitigated in dbt-core v1.6.15, dbt-core v1.7.15, and dbt-core v1.8.1 by binding to localhost explicitly by default in `dbt docs serve`.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dbt-labs/dbt-core
Files changed:
.changes/unreleased/Security-20240522-094540.yaml
core/dbt/task/docs/serve.py
tests/unit/task/docs/test_serve.py
Commit message: change port bind and add a unittest (#10208)



Vulnerable code:
        with socketserver.TCPServer(("", port), SimpleHTTPRequestHandler) as httpd:

Fixed code:
kind: Security
body: Explicitly bind to localhost in docs serve
time: 2024-05-22T09:45:40.748185-04:00
custom:
  Author: ChenyuLInx michelleark
  Issue: "10209"
        with socketserver.TCPServer(("127.0.0.1", port), SimpleHTTPRequestHandler) as httpd:
from http.server import SimpleHTTPRequestHandler
from unittest.mock import MagicMock, patch

import pytest

from dbt.task.docs.serve import ServeTask


@pytest.fixture
def serve_task():
    # Set up
    task = ServeTask(config=MagicMock(), args=MagicMock())
    task.config.project_target_path = "."
    task.args.port = 8000
    return task


def test_serve_bind_to_127(serve_task):
    serve_task.args.browser = False
    with patch("dbt.task.docs.serve.socketserver.TCPServer") as patched_TCPServer:
        patched_TCPServer.return_value = MagicMock()
        serve_task.run()
        patched_TCPServer.assert_called_once_with(("127.0.0.1", 8000), SimpleHTTPRequestHandler)
CVE-2024-0217 (C, published 2024-01-03T17:15Z)
Description: value: A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/PackageKit/PackageKit
Files changed:
src/pk-transaction.c
Commit message: pk-transaction: Check that Finished signal is emitted at most once

While I haven’t seen it being emitted more than once, the transaction
code is quite complex, and it would make things more robust to add a
check to verify this.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>


Vulnerable code:

Fixed code:
	gboolean		 emitted_finished;
	g_assert (!transaction->priv->emitted_finished);
	transaction->priv->emitted_finished = TRUE;
CVE-2022-43995 (C, published 2022-11-02T14:15Z)
Description: value: Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/sudo-project/sudo
Files changed:
plugins/sudoers/auth/passwd.c
Commit message: Fix CVE-2022-43995, potential heap overflow for passwords < 8 characters.
Starting with sudo 1.8.0 the plaintext password buffer is dynamically
sized so it is not safe to assume that it is at least 9 bytes in size.
Found by Hugo Lefeuvre (University of Manchester) with ConfFuzz.


Vulnerable code:
    char sav, *epass;
     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
    sav = pass[8];
    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
	pass[8] = '\0';
    pass[8] = sav;

Fixed code:
    char des_pass[9], *epass;
    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) {
	strlcpy(des_pass, pass, sizeof(des_pass));
	pass = des_pass;
    }
CVE-2020-19858 (C++, published 2022-01-21T13:15Z)
Description: value: Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/plutinosoft/Platinum
Files changed:
Source/Core/PltHttpServer.cpp
Commit message: Fix vulnerability around urls crafter as http://host/../secret.foo (#24)



Vulnerable code:
    if ((file_path.Find("/..") >= 0) || (file_path.Find("\\..") >= 0) ||

Fixed code:
    if ((file_path.Find("../") >= 0) || (file_path.Find("..\\") >= 0) ||
CVE-2018-10757 (JavaScript, published 2018-05-05T19:29Z)
Description: value: CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dukereborn/cmum
Files changed:
CHANGELOG
js/ajaxcalls.js
js/cmum.js
Commit message: Check for invalid characters in username and password


Vulnerable code:

Fixed code:
[+] Check for invalid characters in username and password
		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
			if(alphanumeric(username)==false) {
				toastr.error('Username contains invalid characters');
				newuser.user.focus();
			} else if(alphanumeric(password)==false) {
				toastr.error('Password contains invalid characters');
				newuser.password.focus();
			}
		} else if(alphanumeric(username)==false || alphanumeric(password)==false) {
			if(alphanumeric(username)==false) {
				toastr.error('Username contains invalid characters');
				newuser.user.focus();
			} else if(alphanumeric(password)==false) {
				toastr.error('Password contains invalid characters');
				newuser.password.focus();
			}
}

function alphanumeric(inputtxt) { 
	var letters = /^[0-9a-zA-Z]+$/;
		if (letters.test(inputtxt)) {
			return true;
		} else {
			return false;
		}
CVE-2018-18206 (Go, published 2018-10-10T09:29Z)
Description: value: In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/Bytom/bytom
Files changed:
p2p/discover/net.go
Commit message: p2p/discv5: fix idx can be negative after uint convert to int(can cause crash) (#1307)



Vulnerable code:
	if data.Idx < 0 || int(data.Idx) >= len(data.Topics) {

Fixed code:
	if int(data.Idx) < 0 || int(data.Idx) >= len(data.Topics) {
CVE-2015-3454 (JavaScript, published 2017-09-06T21:29Z)
Description: value: TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/VulcanJS/Vulcan
Files changed:
lib/publications.js
server/publications/users.js
Commit message: do not publish password bcrypt token


Vulnerable code:
  var user = Meteor.users.find({_id: this.userId});

Fixed code:
// options for your own user account (for security reasons, block certain properties)
ownUserOptions = {
  'services.password.bcrypt': false
}

  var user = Meteor.users.find({_id: this.userId}, {fields: ownUserOptions});
CVE-2022-25850 (Go, published 2022-05-01T16:15Z)
Description: value: The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/hoppscotch/proxyscotch
Files changed:
libproxy/proxy.go
server/server.go
Commit message: feat: ability to have a blacklist of target urls for proxy to make calls to


Vulnerable code:
	libproxy.Initialize(*tokenPtr, *hostPtr, *allowedOriginsPtr, *bannedOutputsPtr, onProxyStateChangeServer, false, finished)

Fixed code:
	bannedDests        []string
func isAllowedDest(dest string) bool {
	for _, b := range bannedDests {
		if b == dest {
			return false
		}
	}

	return true
}

	initialBannedDests string,
	if initialBannedDests != "" {
		bannedDests = strings.Split(initialBannedDests, ",")
	} else {
		bannedDests = []string{}
	}
	// Block requests to illegal destinations
	if !isAllowedDest(proxyRequest.URL.Hostname()) {
		log.Print("A request to a banned destination was made.")
		_, _ = fmt.Fprintln(response, "{\"success\": false, \"data\":{\"message\":\"(Proxy Error) Request cannot be to this destination.\"}}")
		return
	}

	bannedDestsPtr := flag.String("banned-dests", "", "a comma separated list of banned proxy destinations.")

	libproxy.Initialize(*tokenPtr, *hostPtr, *allowedOriginsPtr, *bannedOutputsPtr, *bannedDestsPtr, onProxyStateChangeServer, false, finished)
CVE-2019-14667 (Other, published 2019-08-05T20:15Z)
Description: value: Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
resources/views/v1/transactions/convert.twig
Commit message: Fix #2363


Vulnerable code:
                        {{ ExpandedForm.staticText('description', '<a href="'~route('transactions.show', journal.id)~'">'~journal.description~'</a>') }}

Fixed code:
                        {{ ExpandedForm.staticText('description', '<a href="'~route('transactions.show', journal.id)~'">'~journal.description|escape~'</a>') }}
CVE-2019-14668 (Other, published 2019-08-05T20:15Z)
Description: value: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
resources/views/v1/transactions/links/delete.twig
Commit message: Fix #2364


Vulnerable code:
                        <h3 class="box-title">{{ trans('firefly.delete_journal_link', {source: link.source.description, destination: link.destination.description, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}</h3>
                            {{ trans('form.journal_link_areYouSure', {source: link.source.description, destination: link.destination.description, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}

Fixed code:
                        <h3 class="box-title">{{ trans('firefly.delete_journal_link', {source: link.source.description|escape, destination: link.destination.description|escape, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}</h3>
                            {{ trans('form.journal_link_areYouSure', {source: link.source.description|escape, destination: link.destination.description|escape, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}
CVE-2019-14669 (Other, published 2019-08-05T20:15Z)
Description: value: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
resources/views/v1/reports/audit/report.twig
Commit message: Fix #2366


Vulnerable code:
                            account_name: account.name,
                            account_name: account.name,
                            account_name: account.name,

Fixed code:
                            account_name: account.name|escape,
                            account_name: account.name|escape,
                            account_name: account.name|escape,
CVE-2019-14670 (PHP, published 2019-08-05T20:15Z)
Description: value: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Http/Controllers/Rule/CreateController.php
Commit message: Fix #2365


Vulnerable code:
        $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => $bill->name]));

Fixed code:
        $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => e($bill->name)]));
CVE-2019-14671 (PHP, published 2019-08-05T20:15Z)
Description: value: Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
Commit message: Fix #2367


Vulnerable code:

Fixed code:
        // sanitize FinTS URL.
        $config['fints_url'] = $this->validURI($config['fints_url']) ? $config['fints_url'] : '';

    /**
     * @param string $fints_url
     *
     * @return bool
     */
    private function validURI(string $fintsUri): bool
    {
        $res = filter_var($fintsUri, FILTER_VALIDATE_URL);
        if (false === $res) {
            return false;
        }
        $scheme = parse_url($fintsUri, PHP_URL_SCHEME);

        return 'https' === $scheme;
    }
CVE-2019-14672 (PHP, published 2019-08-05T20:15Z)
Description: value: Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Support/Http/Controllers/UserNavigation.php
Commit message: Fix #2370


Vulnerable code:
            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => $account->name, 'id' => $account->id]));
            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => $account->name, 'id' => $account->id]));

Fixed code:
            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => e($account->name), 'id' => $account->id]));
            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => e($account->name), 'id' => $account->id]));
CVE-2021-3663 (PHP, published 2021-07-25T14:15Z)
Description: value: firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Http/Controllers/Auth/LoginController.php
Commit message: Add missing rate limiter.


Vulnerable code:
    use AuthenticatesUsers;

Fixed code:
use Illuminate\Foundation\Auth\ThrottlesLogins;
    use AuthenticatesUsers, ThrottlesLogins;