hitoshura25/cvefixes huggingface dataset:
CVE-2024-39919 (TypeScript, published 2024-07-15T20:15Z)
Description: value: @jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The package includes an `ALLOW_LIST` where the host can specify which services the user is permitted to capture screenshots of. By default, capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] is allowed. If someone hosts this project on a server, users could then capture screenshots of other web services running locally. This issue has been addressed in version 2.1.1 with the addition of a blocklist. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jasonraimondi/url-to-png
Files changed:
.env.sample
src/app.ts
src/lib/utils.ts
src/middlewares/allow_list.ts
src/middlewares/block_list.ts
Commit message: block list


Vulnerable code:
import { formatAllowList } from "./lib/utils.js";
    const allowList = formatAllowList(process.env.ALLOW_LIST);
export function formatAllowList(allowList: string): string[] {
    const isValidDomain = allowList.includes(new URL(input.url).host);

Fixed code:
# Comma-separated list of allowed domains for screenshots (optional)
# BLOCK_LIST=example.com

import { formatUrlList } from "./lib/utils.js";
import { handleBlockListMiddleware } from "./middlewares/block_list.js";
  if (process.env.BLOCK_LIST && process.env.BLOCK_LIST.trim() !== "") {
    const allowList = formatUrlList(process.env.BLOCK_LIST);
    logger.info(`Blocked Domains: ${allowList.join(", ")}`);
    app.use("/", handleBlockListMiddleware(allowList));
  }

    const allowList = formatUrlList(process.env.ALLOW_LIST);
export function formatUrlList(allowList: string): string[] {
    const newurl = new URL(input.url).host;
    logger.info(`URL new: ${newurl}`);
    const isValidDomain = allowList.includes(newurl);
// blockedHostsMiddleware.ts
import { Context } from "hono";
import { HTTPException } from "hono/http-exception";

import { AppEnv } from "../app.js";
import { logger } from "../lib/logger.js";

export function handleBlockListMiddleware(blockList: string[]) {
  return async (c: Context<AppEnv>, next: () => Promise<void>) => {
    const input = c.get("input");
    const urlHost = new URL(input.url).host;
    logger.info(`Request URL host: ${urlHost}`);

    // Check if the host is in the block list
    if (blockList.includes(urlHost)) {
      logger.warn(`Blocked request to ${input.url} - host is in block list`);
      throw new HTTPException(403, { message: "Access to this URL is forbidden" });
    }

    await next();
  };
}
CVE-2020-26255 (PHP, published 2020-12-08T15:15Z)
Description: value: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/getkirby-v2/panel
Files changed:
app/src/panel/models/page/uploader.php
Commit message: Prevent phar upload in file upload validation


Vulnerable code:
<?php 
      $this->upload();      
      $file->createMeta(false);      
    kirby()->trigger($event, $file);          
    $file   = $this->file;    
    $forbiddenExtensions = array('php', 'html', 'htm', 'exe', kirby()->option('content.file.extension', 'txt'));
    if(str::contains($extension, 'php')) {
    } 
}

Fixed code:
<?php
      $this->upload();
      $file->createMeta(false);
    kirby()->trigger($event, $file);
    $file   = $this->file;
    $forbiddenExtensions = array('php', 'phar', 'html', 'htm', 'exe', kirby()->option('content.file.extension', 'txt'));
    if(str::contains($extension, 'php') || str::contains($extension, 'phar')) {
    }
}
CVE-2024-25122 (Ruby, published 2024-02-13T19:15Z)
Description: value: sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or an unwitting, but authorized, victim, who has received a disguised / crafted link, to successfully execute malicious code, which could potentially steal cookies, session data, or local storage data from the app the sidekiq-unique-jobs web UI is mounted in. 1. `/changelogs`, 2. `/locks` or 3. `/expiring_locks`. This issue has been addressed in versions 7.1.33 and 8.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mhenrixon/sidekiq-unique-jobs
Files changed:
lib/sidekiq_unique_jobs/web.rb
Commit message: fix(xss): sanitize parameters (#829)



Vulnerable code:
        @filter         = params[:filter] || "*"
        @count          = (params[:count] || 100).to_i
        @current_cursor = params[:cursor].to_i
        @prev_cursor    = params[:prev_cursor].to_i
        @filter         = params[:filter] || "*"
        @count          = (params[:count] || 100).to_i
        @current_cursor = params[:cursor].to_i
        @prev_cursor    = params[:prev_cursor].to_i
        @filter         = params[:filter] || "*"
        @count          = (params[:count] || 100).to_i
        @current_cursor = params[:cursor].to_i
        @prev_cursor    = params[:prev_cursor].to_i
        @digest = params[:digest]
        digests.delete_by_digest(params[:digest])
        expiring_digests.delete_by_digest(params[:digest])
        @digest = params[:digest]

Fixed code:
        @filter         = h(params[:filter] || "*")
        @count          = h(params[:count] || 100).to_i
        @current_cursor = h(params[:cursor]).to_i
        @prev_cursor    = h(params[:prev_cursor]).to_i
        @filter         = h(params[:filter]) || "*"
        @count          = h(params[:count] || 100).to_i
        @current_cursor = h(params[:cursor]).to_i
        @prev_cursor    = h(params[:prev_cursor]).to_i
        @filter         = h(params[:filter]) || "*"
        @count          = h(params[:count] || 100).to_i
        @current_cursor = h(params[:cursor]).to_i
        @prev_cursor    = h(params[:prev_cursor]).to_i
        @digest = h(params[:digest])
        digests.delete_by_digest(h(params[:digest]))
        expiring_digests.delete_by_digest(h(params[:digest]))
        @digest = h(params[:digest])
CVE-2023-41316 (Kotlin, published 2023-09-07T20:15Z)
Description: value: Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitation emails which appear as legitimate org invitations. Bad actors may direct users to malicious website or execute javascript in the context of the users browser. This vulnerability has been addressed in version 3.29.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tolgee/tolgee-platform
Files changed:
backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationControllerInvitingTest.kt
backend/data/src/main/kotlin/io/tolgee/component/email/InvitationEmailSender.kt
Commit message: fix: sanitize project/org name in invitation emails (#1898)



Vulnerable code:
    return "You have been invited to $toWhat $name in Tolgee."

Fixed code:
  @Test
  fun `e-mail is sanitized`() {
    dummyDto.name = "Test org <a href='https://evil.local'>test</a>"
    val organization = prepareTestOrganization()

    inviteWithUserWithNameAndEmail(organization.id)
    emailTestUtil.verifyEmailSent()

    val messageContent = emailTestUtil.messageContents.single()
    assertThat(messageContent).doesNotContain("<a href='https://evil.local")
    assertThat(messageContent).contains("&lt;a href=&#39;https://evil.local")
  }

import org.springframework.web.util.HtmlUtils
      ?: throw IllegalStateException("Both the organization and the project are null??")
    val escapedName = HtmlUtils.htmlEscape(name)
    return "You have been invited to $toWhat $escapedName in Tolgee."
CVE-2023-41316 (Kotlin, published 2023-09-07T20:15Z)
Description: value: Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitation emails which appear as legitimate org invitations. Bad actors may direct users to malicious website or execute javascript in the context of the users browser. This vulnerability has been addressed in version 3.29.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tolgee/tolgee-platform
Files changed:
backend/app/src/test/kotlin/io/tolgee/api/v2/controllers/organizationController/OrganizationControllerInvitingTest.kt
backend/data/src/main/kotlin/io/tolgee/component/email/InvitationEmailSender.kt
Commit message: fix: sanitize project/org name in invitation emails (#1898)



Vulnerable code:
    return "You have been invited to $toWhat $name in Tolgee."

Fixed code:
  @Test
  fun `e-mail is sanitized`() {
    dummyDto.name = "Test org <a href='https://evil.local'>test</a>"
    val organization = prepareTestOrganization()

    inviteWithUserWithNameAndEmail(organization.id)
    emailTestUtil.verifyEmailSent()

    val messageContent = emailTestUtil.messageContents.single()
    assertThat(messageContent).doesNotContain("<a href='https://evil.local")
    assertThat(messageContent).contains("&lt;a href=&#39;https://evil.local")
  }

import org.springframework.web.util.HtmlUtils
      ?: throw IllegalStateException("Both the organization and the project are null??")
    val escapedName = HtmlUtils.htmlEscape(name)
    return "You have been invited to $toWhat $escapedName in Tolgee."
CVE-2024-32470 (Kotlin, published 2024-04-18T15:15Z)
Description: value: Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4. 
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tolgee/tolgee-platform
Files changed:
backend/security/src/main/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptor.kt
backend/security/src/test/kotlin/io/tolgee/security/authorization/ProjectAuthorizationInterceptorTest.kt
Commit message: fix: Admin should not bypass auth when using API key (#2257)



Vulnerable code:
      if (!isAdmin) {

Fixed code:
      if (!isAdmin || authenticationFacade.isProjectApiKeyAuth) {
import io.tolgee.model.UserAccount
  @Test
  fun `rejects access if the user is admin and authorizes with API key`() {
    Mockito.`when`(authenticationFacade.isApiAuthentication).thenReturn(false)
    Mockito.`when`(userAccount.role).thenReturn(UserAccount.Role.ADMIN)

    Mockito.`when`(securityService.getCurrentPermittedScopes(1337L))
      .thenReturn(setOf(Scope.KEYS_VIEW))

    mockMvc.perform(MockMvcRequestBuilders.get("/v2/projects/1337/requires-single-scope")).andIsOk

    Mockito.`when`(authenticationFacade.isProjectApiKeyAuth).thenReturn(true)
    Mockito.`when`(userAccount.role).thenReturn(UserAccount.Role.ADMIN)

    mockMvc.perform(MockMvcRequestBuilders.get("/v2/projects/1337/requires-single-scope")).andIsForbidden
  }
CVE-2016-10009 (Other, published 2017-01-05T02:59Z)
Description: value: Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/ssh-agent.1
usr.bin/ssh/ssh-agent.c
Commit message: add a whitelist of paths from which ssh-agent will load (via
ssh-pkcs11-helper) a PKCS#11 module; ok markus@


Vulnerable code:
.\" $OpenBSD: ssh-agent.1,v 1.62 2015/11/15 23:54:15 jmc Exp $
.Dd $Mdocdate: November 15 2015 $
/* $OpenBSD: ssh-agent.c,v 1.214 2016/09/12 01:22:38 deraadt Exp $ */
	char *provider = NULL, *pin;
	count = pkcs11_add_provider(provider, pin, &keys);
			id->provider = xstrdup(provider);
			id->comment = xstrdup(provider); /* XXX */
	    "                 [-t life] [command [arg ...]]\n"
	while ((ch = getopt(ac, av, "cDdksE:a:t:")) != -1) {
	if (pledge("stdio cpath unix id proc exec", NULL) == -1)

Fixed code:
.\" $OpenBSD: ssh-agent.1,v 1.63 2016/11/30 03:07:37 djm Exp $
.Dd $Mdocdate: November 30 2016 $
.Op Fl P Ar pkcs11_whitelist
.It Fl P
Specify a pattern-list of acceptable paths for PKCS#11 shared libraries
that may be added using the
.Fl s
option to
.Xr ssh-add 1 .
The default is to allow loading PKCS#11 libraries from
.Dq /usr/lib/*,/usr/local/lib/* .
PKCS#11 libraries that do not match the whitelist will be refused.
See PATTERNS in
.Xr ssh_config 5
for a description of pattern-list syntax.
/* $OpenBSD: ssh-agent.c,v 1.215 2016/11/30 03:07:37 djm Exp $ */
#include "match.h"
#ifndef DEFAULT_PKCS11_WHITELIST
# define DEFAULT_PKCS11_WHITELIST "/usr/lib/*,/usr/local/lib/*"
#endif

/* PKCS#11 path whitelist */
static char *pkcs11_whitelist;

	char *provider = NULL, *pin, canonical_provider[PATH_MAX];
	if (realpath(provider, canonical_provider) == NULL) {
		verbose("failed PKCS#11 add of \"%.100s\": realpath: %s",
		    provider, strerror(errno));
		goto send;
	}
	if (match_pattern_list(canonical_provider, pkcs11_whitelist, 0) != 1) {
		verbose("refusing PKCS#11 add of \"%.100s\": "
		    "provider not whitelisted", canonical_provider);
		goto send;
	}
	debug("%s: add %.100s", __func__, canonical_provider);
	count = pkcs11_add_provider(canonical_provider, pin, &keys);
			id->provider = xstrdup(canonical_provider);
			id->comment = xstrdup(canonical_provider); /* XXX */
	    "                 [-P pkcs11_whitelist] [-t life] [command [arg ...]]\n"
	while ((ch = getopt(ac, av, "cDdksE:a:P:t:")) != -1) {
		case 'P':
			if (pkcs11_whitelist != NULL)
				fatal("-P option already specified");
			pkcs11_whitelist = xstrdup(optarg);
			break;
	if (pkcs11_whitelist == NULL)
		pkcs11_whitelist = xstrdup(DEFAULT_PKCS11_WHITELIST);

	if (pledge("stdio rpath cpath unix id proc exec", NULL) == -1)
CVE-2016-10010 (C, published 2017-01-05T02:59Z)
Description: value: sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/serverloop.c
Commit message: disable Unix-domain socket forwarding when privsep is disabled


Vulnerable code:
/* $OpenBSD: serverloop.c,v 1.188 2016/11/30 03:00:05 djm Exp $ */
	    !no_port_forwarding_flag && !options.disable_forwarding) {
		    || no_port_forwarding_flag || options.disable_forwarding) {

Fixed code:
/* $OpenBSD: serverloop.c,v 1.189 2016/12/14 00:36:34 djm Exp $ */
	    !no_port_forwarding_flag && !options.disable_forwarding &&
	    use_privsep) {
		    || no_port_forwarding_flag || options.disable_forwarding ||
		    !use_privsep) {
CVE-2016-10011 (C, published 2017-01-05T02:59Z)
Description: value: authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-320 \u2014 Key Management Errors
Weaknesses in this category are related to errors in the management of cryptographic keys.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/authfile.c
Commit message: use sshbuf_allocate() to pre-allocate the buffer used for loading
keys. This avoids implicit realloc inside the buffer code, which
might theoretically leave fragments of the key on the heap. This
doesn't appear to happen in practice for normal sized keys, but
was observed for novelty oversize ones.

Pointed out by Jann Horn of Project Zero; ok markus@


Vulnerable code:
/* $OpenBSD: authfile.c,v 1.121 2016/04/09 12:39:30 djm Exp $ */
	int r;

Fixed code:
/* $OpenBSD: authfile.c,v 1.122 2016/11/25 23:24:45 djm Exp $ */
	int r, dontmax = 0;
	/*
	 * Pre-allocate the buffer used for the key contents and clamp its
	 * maximum size. This ensures that key contents are never leaked via
	 * implicit realloc() in the sshbuf code.
	 */
	if ((st.st_mode & S_IFREG) == 0 || st.st_size <= 0) {
		st.st_size = 64*1024; /* 64k should be enough for anyone :) */
		dontmax = 1;
	}
	if ((r = sshbuf_allocate(blob, st.st_size)) != 0 ||
	    (dontmax && (r = sshbuf_set_max_size(blob, st.st_size)) != 0))
		return r;
CVE-2017-15906 (C, published 2017-10-26T03:29Z)
Description: value: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/sftp-server.c
Commit message: disallow creation (of empty files) in read-only mode; reported by
Michal Zalewski, feedback & ok deraadt@


Vulnerable code:
/* $OpenBSD: sftp-server.c,v 1.110 2016/09/12 01:22:38 deraadt Exp $ */
	    ((flags & O_ACCMODE) == O_WRONLY ||
	    (flags & O_ACCMODE) == O_RDWR)) {

Fixed code:
/* $OpenBSD: sftp-server.c,v 1.111 2017/04/04 00:24:56 djm Exp $ */
	    ((flags & O_ACCMODE) != O_RDONLY ||
	    (flags & (O_CREAT|O_TRUNC)) != 0)) {
CVE-2018-15473 (C, published 2018-08-17T19:29Z)
Description: value: OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/auth2-gss.c
usr.bin/ssh/auth2-hostbased.c
usr.bin/ssh/auth2-pubkey.c
Commit message: delay bailout for invalid authenticating user until after the packet
containing the request has been fully parsed. Reported by Dariusz Tytko
and Michał Sajdak; ok deraadt


Vulnerable code:
/* $OpenBSD: auth2-gss.c,v 1.28 2018/07/10 09:13:30 djm Exp $ */
	if (!authctxt->valid || authctxt->user == NULL)
		return (0);

/* $OpenBSD: auth2-hostbased.c,v 1.35 2018/07/09 21:35:50 markus Exp $ */
	if (!authctxt->valid) {
		debug2("%s: disabled because of invalid user", __func__);
		return 0;
	}
/* $OpenBSD: auth2-pubkey.c,v 1.82 2018/07/11 18:55:11 markus Exp $ */
	struct sshbuf *b;
	char *pkalg, *userstyle = NULL, *key_s = NULL, *ca_s = NULL;
	u_char *pkblob, *sig, have_sig;
	if (!authctxt->valid) {
		debug2("%s: disabled because of invalid user", __func__);
		return 0;
	}

		free(sig);

Fixed code:
/* $OpenBSD: auth2-gss.c,v 1.29 2018/07/31 03:10:27 djm Exp $ */
	if (!authctxt->valid || authctxt->user == NULL) {
		debug2("%s: disabled because of invalid user", __func__);
		free(doid);
		return (0);
	}

/* $OpenBSD: auth2-hostbased.c,v 1.36 2018/07/31 03:10:27 djm Exp $ */
	if (!authctxt->valid || authctxt->user == NULL) {
		debug2("%s: disabled because of invalid user", __func__);
		goto done;
	}

/* $OpenBSD: auth2-pubkey.c,v 1.83 2018/07/31 03:10:27 djm Exp $ */
	struct sshbuf *b = NULL;
	char *pkalg = NULL, *userstyle = NULL, *key_s = NULL, *ca_s = NULL;
	u_char *pkblob = NULL, *sig = NULL, have_sig;
		if (!authctxt->valid || authctxt->user == NULL) {
			debug2("%s: disabled because of invalid user",
			    __func__);
			goto done;
		}
		if (!authctxt->valid || authctxt->user == NULL) {
			debug2("%s: disabled because of invalid user",
			    __func__);
			goto done;
		}
	free(sig);