hitoshura25/cvefixes huggingface dataset:
CVE-2023-28100 (C, published 2023-03-16T16:15Z)
Description: value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/flatpak/flatpak
Files changed:
common/flatpak-run.c
tests/test-seccomp.sh
tests/try-syscall.c
Commit message: run: Prevent TIOCLINUX ioctl, the same as TIOCSTI

The TIOCLINUX ioctl is only available on Linux virtual consoles such as
/dev/tty1. It has several Linux-specific functions, one of which is a
copy/paste operation which can be used for attacks similar to TIOCSTI.

This vulnerability does not affect typical graphical terminal emulators
such as xterm, gnome-terminal and Konsole, and Flatpak is primarily
designed to be run from a Wayland or X11 graphical environment, so this
is relatively unlikely to be a practical problem.

CVE-2023-28100, GHSA-7qpw-3vjv-xrqp

Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
Signed-off-by: Simon McVittie <smcv@debian.org>


Vulnerable code:
echo "1..16"

Fixed code:
    /* In the unlikely event that the controlling tty is a Linux virtual
     * console (/dev/tty2 or similar), copy/paste operations have an effect
     * similar to TIOCSTI (CVE-2023-28100) */
    {SCMP_SYS (ioctl), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, 0xFFFFFFFFu, (int) TIOCLINUX)},
echo "1..18"
  echo "# ioctl TIOCLINUX (CVE-2023-28100)"
  e=0
  try_syscall "ioctl TIOCLINUX" || e="$?"
  assert_streq "$e" "$EPERM"
  ok "ioctl TIOCLINUX blocked"

      else if (strcmp (arg, "ioctl TIOCLINUX") == 0)
        {
          /* If not blocked by seccomp, this will fail with EBADF */
          if (ioctl (-1, TIOCLINUX, WRONG_POINTER) != 0)
            {
              errsv = errno;
              perror (arg);
            }
        }
CVE-2023-28101 (C, published 2023-03-16T16:15Z)
Description: value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/flatpak/flatpak
Files changed:
app/flatpak-cli-transaction.c
Commit message: cli-transaction: Escape any special characters in the EOL reason

CVE-2023-28101, GHSA-h43h-fwqx-mpp8

Signed-off-by: Simon McVittie <smcv@collabora.com>


Vulnerable code:
      g_print ("   %s\n", reason);

Fixed code:
      g_autofree char *escaped_reason = flatpak_escape_string (reason,
                                                               FLATPAK_ESCAPE_ALLOW_NEWLINES |
                                                               FLATPAK_ESCAPE_DO_NOT_QUOTE);
      g_print ("   %s\n", escaped_reason);
CVE-2024-32462 (C, published 2024-04-18T18:15Z)
Description: value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/flatpak/flatpak
Files changed:
app/flatpak-builtins-build.c
common/flatpak-dir.c
common/flatpak-run-dbus.c
common/flatpak-run.c
Commit message: When starting non-static command using bwrap use "--"

This ensures that the command is not taken to be a bwrap option.

Resolves: CVE-2024-32462
Resolves: GHSA-phv6-cpc2-2fgj
Signed-off-by: Alexander Larsson <alexl@redhat.com>
[smcv: Fix DISABLE_SANDBOXED_TRIGGERS code path]
[smcv: Make flatpak_run_maybe_start_dbus_proxy() more obviously correct]
Signed-off-by: Simon McVittie <smcv@collabora.com>


Vulnerable code:
  flatpak_bwrap_add_args (bwrap, command, NULL);
  flatpak_bwrap_add_arg (bwrap, command);

Fixed code:
  flatpak_bwrap_add_args (bwrap, "--", command, NULL);

                                  "--",
  /* End of options: the next argument will be the executable name */
  flatpak_bwrap_add_arg (bwrap, "--");

  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
CVE-2024-37301 (Python, published 2024-06-11T19:16Z)
Description: value: Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/adfinis/document-merge-service
Files changed:
document_merge_service/api/jinja.py
Commit message: fix: use a sandboxed environment (#763)



Vulnerable code:
from jinja2 import Environment, pass_context
    jinja_env = Environment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)

Fixed code:
from jinja2 import pass_context
from jinja2.sandbox import SandboxedEnvironment
    jinja_env = SandboxedEnvironment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
CVE-2010-5312 (JavaScript, published 2014-11-24T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jquery/jquery-ui
Files changed:
ui/jquery.ui.dialog.js
Commit message: Dialog: Extract setting the title into a _title method, use .text() to prevent XSS. Fixes #6016 - Dialog: Title XSS Vulnerability.


Vulnerable code:
			.html( this.options.title || "&#160;" )
			// convert whatever was passed in to a string, for html() to not throw up
			$( ".ui-dialog-title", this.uiDialogTitlebar )
				.html( "" + ( value || "&#160;" ) );

Fixed code:
		this._title( uiDialogTitle );
	_title: function( title ) {
		if ( !this.options.title ) {
			title.html( "&#160;" );
		}
		title.text( this.options.title );
	},

			this._title( this.uiDialogTitlebar.find( ".ui-dialog-title" ) );
CVE-2012-6662 (JavaScript, published 2014-11-24T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jquery/jquery-ui
Files changed:
demos/autocomplete/combobox.html
tests/unit/tooltip/tooltip_options.js
ui/jquery.ui.tooltip.js
Commit message: Tooltip: Escape the title attribute so that it's treated as text and not HTML. Fixes #8861 - Tooltip: XSS vulnerability in default content.


Vulnerable code:
							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
			return $( this ).attr( "title" );

Fixed code:
							.attr( "title", value + " didn't match any item" )
test( "content: default; HTML escaping", function() {
	expect( 2 );
	var scriptText = "<script>$.ui.tooltip.hacked = true;</script>",
		element = $( "#tooltipped1" );

	$.ui.tooltip.hacked = false;
	element.attr( "title", scriptText )
		.tooltip()
		.tooltip( "open" );
	equal( $.ui.tooltip.hacked, false, "script did not execute" );
	deepEqual( $( "#" + element.data( "ui-tooltip-id" ) ).text(), scriptText,
		"correct tooltip text" );
});

			var title = $( this ).attr( "title" );
			// Escape title, since we're going from an attribute to raw HTML
			return $( "<a>" ).text( title ).html();
CVE-2012-6662 (HTML, published 2014-11-24T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jquery/jquery-ui
Files changed:
demos/autocomplete/combobox.html
Commit message: Autocomplete demo: Combobox: Encode search term inside tooltips. Fixes #8859 - Autocomplete: XSS in combobox demo.


Vulnerable code:
							.attr( "title", value + " didn't match any item" )

Fixed code:
							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
CVE-2016-7103 (JavaScript, published 2017-03-15T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jquery/jquery-ui
Files changed:
tests/unit/dialog/options.js
ui/widgets/dialog.js
Commit message: Dialog: Escape closeText option before passing it to button

Ref gh-1632
Fixes jquery/api.jqueryui.com#281


Vulnerable code:
	expect( 3 );
				label: this.options.closeText,
				label: "" + value

Fixed code:
	expect( 4 );

	element = $( "<div></div>" ).dialog( { closeText: "<span>foo</span>" } );
		equal( $.trim( element.dialog( "widget" ).find( ".ui-dialog-titlebar-close" ).text() ), "<span>foo</span>",
			"closeText is escaped" );
	element.remove();
				label: $( "<a>" ).text( this.options.closeText ).html(),
				label: $( "<a>" ).text( "" + this.options.closeText ).html()
CVE-2021-41184 (JavaScript, published 2021-10-26T15:15Z)
Description: value: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jquery/jquery-ui
Files changed:
tests/unit/position/core.js
ui/position.js
Commit message: Position: Make sure `of` is treated as a CSS selector

Closes gh-1955

Vulnerable code:
	assert.expect( 9 + ( scrollTopSupport() ? 1 : 0 ) );
		target = $( options.of ),

Fixed code:
	assert.expect( 10 + ( scrollTopSupport() ? 1 : 0 ) );

	var done = assert.async();

	try {
		$( "#elx" ).position( {
			my: "left top",
			at: "right bottom",
			of: "<img onerror='window.globalOf=true' src='/404' />",
			collision: "none"
		} );
	} catch ( e ) {}

	setTimeout( function() {
		assert.equal( window.globalOf, undefined, "of treated as a selector" );
		delete window.globalOf;
		done();
	}, 500 );
			delete feedback.target.element.prevObject;

		// Make sure string options are treated as CSS selectors
		target = typeof options.of === "string" ?
			$( document ).find( options.of ) :
			$( options.of ),
CVE-2021-21413 (C++, published 2021-03-30T23:15Z)
Description: value: isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a Reference instance to an attacker they would be able to use it to acquire a Reference to the nodejs context's Function object. Similar application-specific attacks could be possible by modifying the local prototype of other API objects. Access to NativeModule objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution. This is addressed in v4.0.0 through a series of related changes.
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-913 \u2014 Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Repository: https://github.com/laverdet/isolated-vm
Files changed:
src/module/native_module_handle.cc
Commit message: Disallow NativeModule creation unless main isolate


Vulnerable code:

Fixed code:
	if (!IsolateEnvironment::GetCurrent()->IsDefault()) {
		throw RuntimeGenericError("NativeModule may only be instantiated from default nodejs isolate");
	}
CVE-2022-39266 (Markdown, published 2022-09-29T18:15Z)
Description: value: isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/laverdet/isolated-vm
Files changed:
README.md
Commit message: Add note about `cachedData`


Vulnerable code:

Fixed code:
*NOTE*: CachedData contains compiled machine code. That means you should not accept `cachedData`
payloads from a user, otherwise they may be able to run arbitrary code.
CVE-2022-39266 (Markdown, published 2022-09-29T18:15Z)
Description: value: isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-693 \u2014 Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Repository: https://github.com/laverdet/isolated-vm
Files changed:
README.md
Commit message: Add note about `cachedData`


Vulnerable code:

Fixed code:
*NOTE*: CachedData contains compiled machine code. That means you should not accept `cachedData`
payloads from a user, otherwise they may be able to run arbitrary code.
CVE-2019-14430 (PHP, published 2019-08-20T14:15Z)
Description: value: plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/YouPHPTube/YouPHPTube
Files changed:
plugin/Audit/Objects/AuditTable.php

Vulnerable code:
        $this->values = $values;

Fixed code:
        $this->values = str_replace(array("'","\\"), array("",""), $values);
CVE-2019-16124 (PHP, published 2019-09-09T02:15Z)
Description: value: In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/YouPHPTube/YouPHPTube
Files changed:
install/checkConfiguration.php
Commit message: secury fix to not allow recreate the config file

Vulnerable code:

Fixed code:
if (file_exists("../videos/configuration.php")) {
    error_log("Can not create configuration again: ".  json_encode($_SERVER));
    exit;
}
CVE-2021-21384 (JavaScript, published 2021-03-19T00:15Z)
Description: value: shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/ericcornelissen/shescape
Files changed:
CHANGELOG.md
src/unix.js
src/win.js
test/unix.test.js
test/win.test.js
Commit message: Strip null characters from arguments

Update both the Unix and Windows `escapeShellArg` implementation to
strip null characters from input. Null characters can be used to at
least cause errors and potentially execute arbitrary commands (depending
on the shell).

This bug was found due to the new fuzzing logic.


Vulnerable code:
- _No changes yet_
  return arg.replace(/'/g, `'\\''`);
  return arg.replace(/"/g, `""`);

Fixed code:
- Strip null characters from arguments.
  return arg.replace(/\u{0}/gu, "").replace(/'/g, `'\\''`);
  return arg.replace(/\u{0}/gu, "").replace(/"/g, `""`);

  describe("null characters", function () {
    const nullChar = String.fromCharCode(0);

    it("removes one null character", function () {
      const input = `foo' && ls${nullChar} -al ; echo 'bar`;
      const output = escapeShellArg(input);
      assert.strictEqual(output, `foo'\\'' && ls -al ; echo '\\''bar`);
    });

    it("removes multiple null character", function () {
      const input = `foo'${nullChar}&&ls -al${nullChar};echo 'bar`;
      const output = escapeShellArg(input);
      assert.strictEqual(output, `foo'\\''&&ls -al;echo '\\''bar`);
    });
  });

  describe("null characters", function () {
    const nullChar = String.fromCharCode(0);

    it("removes one null character", function () {
      const input = `foo" && ls${nullChar} -al ; echo "bar`;
      const output = escapeShellArg(input);
      assert.strictEqual(output, `foo"" && ls -al ; echo ""bar`);
    });

    it("removes multiple null character", function () {
      const input = `foo"${nullChar}&&ls -al${nullChar};echo "bar`;
      const output = escapeShellArg(input);
      assert.strictEqual(output, `foo""&&ls -al;echo ""bar`);
    });
  });