hitoshura25/cvefixes huggingface dataset:
CVE-2021-37491 (C++, published 2023-02-07T14:15Z)
Description: value: An issue discovered in src/wallet/wallet.cpp in Dogecoin Project Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive information via CWallet::CreateTransaction() function.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bitcoin/bitcoin
Files changed:
src/wallet/wallet.cpp
Commit message: shuffle selected coins before transaction finalization


Vulnerable code:
                // Fill vin
                // Note how the sequence number is set to non-maxint so that
                // the nLockTime set above actually works.
                //
                // BIP125 defines opt-in RBF as any nSequence < maxint-1, so
                // we use the highest possible value in that range (maxint-2)
                // to avoid conflicting with other possible uses of nSequence,
                // and in the spirit of "smallest possible change from prior
                // behavior."
                const uint32_t nSequence = coin_control.signalRbf ? MAX_BIP125_RBF_SEQUENCE : (CTxIn::SEQUENCE_FINAL - 1);
                for (const auto& coin : setCoins)
                    txNew.vin.push_back(CTxIn(coin.outpoint,CScript(),
                                              nSequence));
            for (const auto& coin : setCoins)

Fixed code:
                // Dummy fill vin for maximum size estimation
                for (const auto& coin : setCoins) {
                    txNew.vin.push_back(CTxIn(coin.outpoint,CScript()));
                }
        // Shuffle selected coins and fill in final vin
        txNew.vin.clear();
        std::vector<CInputCoin> selected_coins(setCoins.begin(), setCoins.end());
        std::shuffle(selected_coins.begin(), selected_coins.end(), FastRandomContext());

        // Note how the sequence number is set to non-maxint so that
        // the nLockTime set above actually works.
        //
        // BIP125 defines opt-in RBF as any nSequence < maxint-1, so
        // we use the highest possible value in that range (maxint-2)
        // to avoid conflicting with other possible uses of nSequence,
        // and in the spirit of "smallest possible change from prior
        // behavior."
        const uint32_t nSequence = coin_control.signalRbf ? MAX_BIP125_RBF_SEQUENCE : (CTxIn::SEQUENCE_FINAL - 1);
        for (const auto& coin : selected_coins) {
            txNew.vin.push_back(CTxIn(coin.outpoint, CScript(), nSequence));
        }

            for (const auto& coin : selected_coins)
CVE-2021-37492 (C++, published 2023-02-07T21:15Z)
Description: value: An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via CWallet::CreateTransactionAll() function.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bitcoin/bitcoin
Files changed:
src/wallet/wallet.cpp
Commit message: shuffle selected coins before transaction finalization


Vulnerable code:
                // Fill vin
                // Note how the sequence number is set to non-maxint so that
                // the nLockTime set above actually works.
                //
                // BIP125 defines opt-in RBF as any nSequence < maxint-1, so
                // we use the highest possible value in that range (maxint-2)
                // to avoid conflicting with other possible uses of nSequence,
                // and in the spirit of "smallest possible change from prior
                // behavior."
                const uint32_t nSequence = coin_control.signalRbf ? MAX_BIP125_RBF_SEQUENCE : (CTxIn::SEQUENCE_FINAL - 1);
                for (const auto& coin : setCoins)
                    txNew.vin.push_back(CTxIn(coin.outpoint,CScript(),
                                              nSequence));
            for (const auto& coin : setCoins)

Fixed code:
                // Dummy fill vin for maximum size estimation
                for (const auto& coin : setCoins) {
                    txNew.vin.push_back(CTxIn(coin.outpoint,CScript()));
                }
        // Shuffle selected coins and fill in final vin
        txNew.vin.clear();
        std::vector<CInputCoin> selected_coins(setCoins.begin(), setCoins.end());
        std::shuffle(selected_coins.begin(), selected_coins.end(), FastRandomContext());

        // Note how the sequence number is set to non-maxint so that
        // the nLockTime set above actually works.
        //
        // BIP125 defines opt-in RBF as any nSequence < maxint-1, so
        // we use the highest possible value in that range (maxint-2)
        // to avoid conflicting with other possible uses of nSequence,
        // and in the spirit of "smallest possible change from prior
        // behavior."
        const uint32_t nSequence = coin_control.signalRbf ? MAX_BIP125_RBF_SEQUENCE : (CTxIn::SEQUENCE_FINAL - 1);
        for (const auto& coin : selected_coins) {
            txNew.vin.push_back(CTxIn(coin.outpoint, CScript(), nSequence));
        }

            for (const auto& coin : selected_coins)
CVE-2023-36823 (Unknown, published 2023-07-06T16:15Z)
Description: value: Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rgrove/sanitize
Files changed:
Commit message: Merge pull request from GHSA-f5ww-cq3m-q3g7

Escape `</` to prevent a style element from being closed prematurely

Vulnerable code:

Fixed code:
CVE-2021-41280 (Unknown, published 2021-11-19T20:15Z)
Description: value: Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sharetribe/sharetribe
Files changed:
Commit message: Merge pull request #82 from sharetribe/fix-insecure-open

Fix insecure open

Vulnerable code:

Fixed code:
CVE-2012-2395 (Unknown, published 2012-06-16T00:55Z)
Description: value: Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/cobbler/cobbler
Files changed:
Commit message: Merge pull request #164 from jimi1283/powerpipe

Reworking of power commands to use STDIN

Vulnerable code:

Fixed code:
CVE-2021-40323 (Unknown, published 2021-10-04T06:15Z)
Description: value: Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/cobbler/cobbler
Files changed:
Commit message: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites

Vulnerable code:

Fixed code:
CVE-2021-40324 (Unknown, published 2021-10-04T06:15Z)
Description: value: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/cobbler/cobbler
Files changed:
Commit message: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites

Vulnerable code:

Fixed code:
CVE-2021-40325 (Unknown, published 2021-10-04T06:15Z)
Description: value: Cobbler before 3.3.0 allows authorization bypass for modification of settings.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cobbler/cobbler
Files changed:
Commit message: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites

Vulnerable code:

Fixed code:
CVE-2022-0860 (Unknown, published 2022-03-11T13:15Z)
Description: value: Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/cobbler/cobbler
Files changed:
Commit message: Merge pull request from GHSA-mcg6-h362-cmq5

Security: Fix CVE-2022-0860

Vulnerable code:

Fixed code:
CVE-2011-1488 (Other, published 2019-11-14T02:15Z)
Description: value: A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/rsyslog/rsyslog
Files changed:
ChangeLog
runtime/batch.h
runtime/ruleset.c
Commit message: bugfix: fixed a memory leak and potential abort condition

this could happen if multiple rulesets were used and some output batches
contained messages belonging to more than one ruleset.
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218


Vulnerable code:
	memcpy(pDest, pSrc, sizeof(batch_obj_t));
	CHKiRet(batchInit(&snglRuleBatch, pBatch->nElem));
	snglRuleBatch.pbShutdownImmediate = pBatch->pbShutdownImmediate;

	while(1) { /* loop broken inside */

			FINALIZE; /* everything processed */
				batchCopyElem(&(snglRuleBatch.pElem[iNew++]), &(pBatch->pElem[i]));
	}
	batchFree(&snglRuleBatch);

Fixed code:
- bugfix: fixed a memory leak and potential abort condition
  this could happen if multiple rulesets were used and some output batches
  contained messages belonging to more than one ruleset.
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218
 * Note that all working fields are reset to zeros. If that were 
 * not done, we would have potential problems with invalid
 * or double pointer frees.
	memset(pDest, 0, sizeof(batch_obj_t));
	pDest->pUsrp = pSrc->pUsrp;
	pDest->state = pSrc->state;
	pBatch->iDoneUpTo = 0;
	int bHaveUnprocessed;	/* do we (still) have unprocessed entries? (loop term predicate) */
	do {
		bHaveUnprocessed = 0;
			break; /* everything processed */
		CHKiRet(batchInit(&snglRuleBatch, pBatch->nElem));
		snglRuleBatch.pbShutdownImmediate = pBatch->pbShutdownImmediate;
				/* for performance reasons, we copy only those members that we actually need */
				snglRuleBatch.pElem[iNew].pUsrp = pBatch->pElem[i].pUsrp;
				snglRuleBatch.pElem[iNew].state = pBatch->pElem[i].state;
				++iNew;
			} else {
				bHaveUnprocessed = 1;
		batchFree(&snglRuleBatch);
	} while(bHaveUnprocessed == 1);
CVE-2011-1489 (Other, published 2019-11-14T02:15Z)
Description: value: A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/rsyslog/rsyslog
Files changed:
ChangeLog
runtime/batch.h
runtime/ruleset.c
Commit message: bugfix: fixed a memory leak and potential abort condition

this could happen if multiple rulesets were used and some output batches
contained messages belonging to more than one ruleset.
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218


Vulnerable code:
	memcpy(pDest, pSrc, sizeof(batch_obj_t));
	CHKiRet(batchInit(&snglRuleBatch, pBatch->nElem));
	snglRuleBatch.pbShutdownImmediate = pBatch->pbShutdownImmediate;

	while(1) { /* loop broken inside */

			FINALIZE; /* everything processed */
				batchCopyElem(&(snglRuleBatch.pElem[iNew++]), &(pBatch->pElem[i]));
	}
	batchFree(&snglRuleBatch);

Fixed code:
- bugfix: fixed a memory leak and potential abort condition
  this could happen if multiple rulesets were used and some output batches
  contained messages belonging to more than one ruleset.
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218
 * Note that all working fields are reset to zeros. If that were 
 * not done, we would have potential problems with invalid
 * or double pointer frees.
	memset(pDest, 0, sizeof(batch_obj_t));
	pDest->pUsrp = pSrc->pUsrp;
	pDest->state = pSrc->state;
	pBatch->iDoneUpTo = 0;
	int bHaveUnprocessed;	/* do we (still) have unprocessed entries? (loop term predicate) */
	do {
		bHaveUnprocessed = 0;
			break; /* everything processed */
		CHKiRet(batchInit(&snglRuleBatch, pBatch->nElem));
		snglRuleBatch.pbShutdownImmediate = pBatch->pbShutdownImmediate;
				/* for performance reasons, we copy only those members that we actually need */
				snglRuleBatch.pElem[iNew].pUsrp = pBatch->pElem[i].pUsrp;
				snglRuleBatch.pElem[iNew].state = pBatch->pElem[i].state;
				++iNew;
			} else {
				bHaveUnprocessed = 1;
		batchFree(&snglRuleBatch);
	} while(bHaveUnprocessed == 1);
CVE-2011-1490 (Other, published 2019-11-14T02:15Z)
Description: value: A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/rsyslog/rsyslog
Files changed:
ChangeLog
runtime/batch.h
runtime/ruleset.c
Commit message: bugfix: fixed a memory leak and potential abort condition

this could happen if multiple rulesets were used and some output batches
contained messages belonging to more than one ruleset.
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218


Vulnerable code:
	memcpy(pDest, pSrc, sizeof(batch_obj_t));
	CHKiRet(batchInit(&snglRuleBatch, pBatch->nElem));
	snglRuleBatch.pbShutdownImmediate = pBatch->pbShutdownImmediate;

	while(1) { /* loop broken inside */

			FINALIZE; /* everything processed */
				batchCopyElem(&(snglRuleBatch.pElem[iNew++]), &(pBatch->pElem[i]));
	}
	batchFree(&snglRuleBatch);

Fixed code:
- bugfix: fixed a memory leak and potential abort condition
  this could happen if multiple rulesets were used and some output batches
  contained messages belonging to more than one ruleset.
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218
 * Note that all working fields are reset to zeros. If that were 
 * not done, we would have potential problems with invalid
 * or double pointer frees.
	memset(pDest, 0, sizeof(batch_obj_t));
	pDest->pUsrp = pSrc->pUsrp;
	pDest->state = pSrc->state;
	pBatch->iDoneUpTo = 0;
	int bHaveUnprocessed;	/* do we (still) have unprocessed entries? (loop term predicate) */
	do {
		bHaveUnprocessed = 0;
			break; /* everything processed */
		CHKiRet(batchInit(&snglRuleBatch, pBatch->nElem));
		snglRuleBatch.pbShutdownImmediate = pBatch->pbShutdownImmediate;
				/* for performance reasons, we copy only those members that we actually need */
				snglRuleBatch.pElem[iNew].pUsrp = pBatch->pElem[i].pUsrp;
				snglRuleBatch.pElem[iNew].state = pBatch->pElem[i].state;
				++iNew;
			} else {
				bHaveUnprocessed = 1;
		batchFree(&snglRuleBatch);
	} while(bHaveUnprocessed == 1);
CVE-2017-12588 (Unknown, published 2017-08-06T14:29Z)
Description: value: The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/rsyslog/rsyslog
Files changed:
Commit message: Merge pull request #1565 from Whissi/fix-format-security-issue-in-zmq-modules

Fix format security issue in zmq3 modules

Vulnerable code:

Fixed code:
CVE-2022-24903 (Unknown, published 2022-05-06T00:15Z)
Description: value: Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/rsyslog/rsyslog
Files changed:
Commit message: Merge pull request from GHSA-ggw7-xr6h-mmr8

net bugfix: potential buffer overrun

Vulnerable code:

Fixed code:
CVE-2021-39230 (Other, published 2021-09-21T17:15Z)
Description: value: Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FrankEnderman/Butter
Files changed:
Trinity.bat
Commit message: refined broken mode

Vulnerable code:
echo %random%%random%%random%%random%%random%%random%%random%
timeout /T 2 /NOBREAK >nul

Fixed code:
timeout /T 1 /NOBREAK >nul
echo %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%
timeout /T 5 /NOBREAK >nul