hitoshura25/cvefixes huggingface dataset:
CVE-2014-125031 (PHP, published 2023-01-02T08:15Z)
Description: value: A vulnerability was found in kirill2485 TekNet. It has been classified as problematic. Affected is an unknown function of the file pages/loggedin.php. The manipulation of the argument statusentery leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 1c575340539f983333aa43fc58ecd76eb53e1816. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217176.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kirill2485/TekNet
Files changed:
index.php
login.php
pages/loggedin.php
version.php
Commit message: Fixed an SQL injection vulnerability in loggedin.php


Vulnerable code:
		<title>TekNet Beta Registration</title>
				<h1>TekNet Beta Registration <span> Register to be one of the first beta users on our site</h1>	
			<section class="color-1">
				Please make sure you are over the age of 13, as it would be illegal for us to knowingly collect information from people under the age of 13. Registration is open to PAUSD students only. Scroll down for all of the FAQ's.



				<h1>TekNet Login <span>Welcome back, please login</h1>	
    echo "Buzz posted";
	TheTekNet Version 0.05 Alpha

Fixed code:
		<title>Beta Registration</title>
						<img src="images/theteknet.png">

				<h1>Beta Registration <span> Register to be one of the first beta users on our site</h1>	
		<br>
					Please make sure you are over the age of 13, as it would be illegal for us to knowingly collect information from people under the age of 13. Registration is open to PAUSD students only. Scroll down for all of the FAQ's.
			<br>
			
			
<a href="index.php"><img src="images/theteknet.png"></a>
				<h1>Login <span>Welcome back, please login</h1>	


	<center><img src="../images/theteknet.png"></center>
$position = strpos($statusentery,"<");
if ($position === 0){
	echo "Sorry, for security purposes we do not allow characters such as <";
	exit;
}
    echo "<script>document.location.href='http://www.theteknet.com'</script>";
<br>
	TheTekNet Version 0.09 Alpha -- Codename: Mentos
CVE-2019-10795 (JavaScript, published 2020-02-18T16:15Z)
Description: value: undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Severity: MEDIUM (CVSS v3 base score: 6.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/remy/undefsafe
Files changed:
lib/undefsafe.js
test/misc.test.js
Commit message: fix: prevent changes in prototype chain


Vulnerable code:

Fixed code:
    if (Object.getOwnPropertyNames(obj).indexOf(key) == -1) {
      return undefined;
    }

var test = require('tap').test;
var undefsafe = require('../lib/undefsafe');

test('cannot modify prototype chain', function(t) {
  const pre = {}.__proto__.toString;
  var payload = '__proto__.toString';
  undefsafe({ a: 'b' }, payload, 'JHU');
  t.notEqual({}.toString, 'JHU');
  ({}.__proto__.toString = pre); // restore
  t.end();
});
CVE-2023-27478 (C++, published 2023-03-07T18:15Z)
Description: value: libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/awesomized/libmemcached
Files changed:
src/libmemcached/purge.cc
src/libmemcached/response.cc
test/tests/memcached/noblock.cpp
Commit message: revert most of d7a0084bf99d618d1dc26a54fd413db7ae8b8e63

See php-memcached-dev/php-memcached#531


Vulnerable code:
      if (rc == MEMCACHED_TIMEOUT) {
        break;
      }
  if (memcached_fatal(rc) && rc != MEMCACHED_TIMEOUT) {
      if(!timeout) {
        --i;
      }

Fixed code:
  if (memcached_fatal(rc)) {
CVE-2021-31414 (JSON, published 2021-04-16T04:15Z)
Description: value: The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/LaurentTreguier/vscode-rpm-spec
Files changed:
package.json
Commit message: Add scopes to configuration points


Vulnerable code:
                    "description": "Lint RPM spec files with rpmlint"
                    "description": "Path to 'rpmlint' command"

Fixed code:
                    "description": "Lint RPM spec files with rpmlint",
                    "scope": "machine"
                    "description": "Path to 'rpmlint' command",
                    "scope": "machine"
CVE-2020-28471 (JavaScript, published 2022-07-25T14:15Z)
Description: value: This affects the package properties-reader before 2.2.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/steveukx/properties
Files changed:
src/properties-reader.js
test/fix-prototype-pollution.spec.js
Commit message: Test case covering the use of `__proto__` as a section name
Closes #40


Vulnerable code:
      source = (source[step] = source[step] || {});

Fixed code:
const has = Object.prototype.hasOwnProperty.call.bind(Object.prototype.hasOwnProperty);


      if (!has(source, step)) {
         Object.defineProperty(source, step, { value: Object.create(null) });
      }

      source = source[step]
const {createTestContext} = require('./__fixtues__/create-test-context');

const propertiesReader = require('../');

describe('prototype-pollution', () => {
   let context;

   beforeEach(async () => {
      context = await createTestContext();
   });

   it('does not pollute global Object.prototype', async () => {
      const file = `
         [__proto__]
            polluted = polluted
            parsed = true
      `;
      const props = propertiesReader(await context.file('props.ini', file));

      expect(({}).polluted).toBeUndefined();
      expect(props.path().__proto__.polluted).toBe('polluted');
      expect(props.getRaw('__proto__.polluted')).toBe('polluted');
      expect(props.get('__proto__.polluted')).toBe('polluted');
      expect(props.getRaw('__proto__.parsed')).toBe('true');
      expect(props.get('__proto__.parsed')).toBe(true);
   });

});
CVE-2021-44896 (Unknown, published 2022-01-01T23:15Z)
Description: value: DMP Roadmap before 3.0.4 allows XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/DMPRoadmap/roadmap
Files changed:
Commit message: Merge branch 'development' into remove_vulnerability_XSS_hack

Vulnerable code:

Fixed code:
CVE-2021-3918 (JavaScript, published 2021-11-13T09:15Z)
Description: value: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/kriszyp/json-schema
Files changed:
.gitignore
lib/validate.js
test/tests.js
Commit message: Don't allow __proto__ property to be used for schema default/coerce, fixes #84


Vulnerable code:
				if(objTypeDef.hasOwnProperty(i)){

Fixed code:
yarn.lock
.vscode
				if(objTypeDef.hasOwnProperty(i) && i != '__proto__'){
    prototypePollution: function() {
        console.log('testing')
        const instance = JSON.parse(`
        {
        "$schema":{
            "type": "object",
            "properties":{
            "__proto__": {
                "type": "object",
                
                "properties":{
                "polluted": {
                    "type": "string",
                    "default": "polluted"
                }
                }
            }
            },
            "__proto__": {}
        }
        }`);

        const a = {};
        validate(instance);
        assert.equal(a.polluted, undefined);
    }
CVE-2017-0904 (Ruby, published 2017-11-13T17:29Z)
Description: value: The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/jtdowney/private_address_check
Files changed:
lib/private_address_check.rb
test/private_address_check_test.rb
Commit message: Fix bypass bug with malformed addresses

The Ruby Resolv library can return an empty array from getaddresses for
some atypical IP address encodings. This was brought to my attention by
@EdOverflow.


Vulnerable code:

Fixed code:
    return true if ips.empty?


  def test_private_address_for_malformed_addresses
    assert PrivateAddressCheck.resolves_to_private_address?("127.1")
  end
CVE-2018-3759 (Ruby, published 2018-06-13T15:29Z)
Description: value: private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/jtdowney/private_address_check
Files changed:
README.md
lib/private_address_check/tcpsocket_ext.rb
test/private_address_check/tcpsocket_ext_test.rb
Commit message: Fix TOCTOU bug

This fixes the time of check to time of use (TOCTOU) bug reported by Sajjad
Hashemian.


Vulnerable code:

  def initialize(remote_host, remote_port, local_host = nil, local_port = nil)
    if Thread.current[:private_address_check] && PrivateAddressCheck.resolves_to_private_address?(remote_host)

    initialize_without_private_address_check(remote_host, remote_port, local_host, local_port)
        TCPSocket.new("localhost", 80)

Fixed code:
## Security

If you've found a security issue in `private_address_check`, please reach out to @jtdowney via email to report.

### Time of check to time of use

A library like `private_address_check` is going to be easily susceptible to attacks like [time of check to time of use](https://en.wikipedia.org/wiki/Time_of_check_to_time_of_use). DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address by the subsequent resolution is a private address. There are some possible defenses and workarounds:

- Use the TCPSocket extension in this library which checks the address the socket uses. This is most useful if your system is built on native Ruby like Net::HTTP.
- Use a feature like the `resolve` capability in curl and [curb](https://www.rubydoc.info/github/taf2/curb/Curl/Easy#resolve=-instance_method) to force the resolution to a pre-checked IP address.
- Implement your own caching DNS resolver with something like dnsmasq or unbound. These tools let you set a minimum cache time that can override the TTL of 0.
  def initialize(*args)
    initialize_without_private_address_check(*args)
    if Thread.current[:private_address_check] && PrivateAddressCheck.resolves_to_private_address?(remote_address.ip_address)
    server = TCPServer.new(63453)
    thread = Thread.start { server.accept }
        TCPSocket.new("localhost", 63453)
  ensure
    thread.exit if thread
CVE-2019-10907 (Java, published 2019-04-07T14:29Z)
Description: value: Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/airsonic/airsonic
Files changed:
airsonic-main/src/main/java/org/airsonic/player/security/GlobalSecurityConfig.java
Commit message: Use a random key to "encrypt" the remember-me cookie's value

Since Spring's default remember-me technique is
terrible security-wise (`user:timstamp:md5(use:timestamp:password:key)`),
we should at least use a random key, instead of a fixed one,
otherwise, and attacker able to capture the cookies
might be able to trivially bruteforce offline
the password of the associated user.


Vulnerable code:
                    .and().rememberMe().key("airsonic");
}

Fixed code:
import java.security.SecureRandom;

    private static final String key;

    static {
      byte[] array = new byte[32];
      new SecureRandom().nextBytes(array);
      key = new String(array);
    }

                    .and().rememberMe().key(key);
}
CVE-2019-10908 (Java, published 2019-04-07T14:29Z)
Description: value: In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-335 \u2014 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
Repository: https://github.com/airsonic/airsonic
Files changed:
airsonic-main/src/main/java/org/airsonic/player/controller/RecoverController.java
Commit message: Generate new passwords in a secure way

Previously, lost passwords were generated via
org.apache.commons.lang.RandomStringUtils,
which is using java.util.Random internally.

This PRNG is has a 48-bit seed, that can easily be bruteforced
if an attacker is able to get the PRNG's output, for example
but resetting their own account multiple times,
leading to trivial privileges escalation attacks.

This commit makes use of java.security.SecureRandom
instead.


Vulnerable code:
import org.apache.commons.lang.RandomStringUtils;
                String password = RandomStringUtils.randomAlphanumeric(8);

Fixed code:
import java.security.SecureRandom;
    private static final String SYMBOLS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890";
    private final SecureRandom random = new SecureRandom();
    private static final int PASSWORD_LENGTH = 32;

                StringBuilder sb = new StringBuilder(PASSWORD_LENGTH);
                for(int i=0; i<PASSWORD_LENGTH; i++) {
                  int index = random.nextInt(SYMBOLS.length());
                  sb.append(SYMBOLS.charAt(index));
                }
                String password = sb.toString();
CVE-2023-22903 (Python, published 2023-01-10T06:15Z)
Description: value: api/views/user.py in LibrePhotos before e19e539 has incorrect access control.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/LibrePhotos/librephotos
Files changed:
api/views/user.py
ownphotos/urls.py
Commit message: Fix incorrect access controll


Vulnerable code:
from rest_framework.permissions import AllowAny, IsAdminUser
    permission_classes = (IsUserOrReadOnly,)
        elif self.action == "list":
            self.permission_classes = (AllowAny,)
        elif self.request.method == "GET" or self.request.method == "POST":
        else:
            self.permission_classes = (IsUserOrReadOnly,)

Fixed code:
from rest_framework.permissions import AllowAny, IsAdminUser, IsAuthenticated
class IsFirstTimeSetupView(APIView):
    permission_classes = (AllowAny,)

    def get(self, request, format=None):
        try:
            return Response({"isFirstTimeSetup": not User.objects.filter(is_superuser=True).exists()})
        except Exception as e:
            logger.exception(str(e))
            return Response({"message": str(e)})
    permission_classes = (IsAdminUser,)
        if self.request.method == "POST":
    def create(self, request, *args, **kwargs):
        if User.objects.filter(is_superuser=True).exists() and not request.user.is_superuser:
            return Response(status=status.HTTP_401_UNAUTHORIZED)
        return super(UserViewSet, self).create(request, *args, **kwargs)

    url(r"^api/firsttimesetup", user.IsFirstTimeSetupView.as_view()),
CVE-2014-3219 (C++, published 2018-02-09T22:29Z)
Description: value: fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/fish-shell/fish-shell
Files changed:
env.cpp
share/functions/__fish_print_packages.fish
Commit message: avoid symlink attacks in __fish_print_packages and spawning fishd

 * use $XDG_CACHE_HOME for __fish_print_packages completion caches
 * when starting fishd, redirect fishd output to /dev/null, not a
   predictable path

Fix for CVE-2014-3219.

Closes #1440.


Vulnerable code:
#define FISHD_CMD L"fishd ^ /tmp/fishd.log.%s"
		set cache_file /tmp/.pac-cache.$USER
		set cache_file /tmp/.yum-cache.$USER
		set cache_file /tmp/.rpm-cache.$USER

Fixed code:
#define FISHD_CMD L"fishd ^ /dev/null"
	# Set up cache directory
	if test -z "$XDG_CACHE_HOME"
		set XDG_CACHE_HOME $HOME/.cache
	end
	mkdir -m 700 -p $XDG_CACHE_HOME

		set cache_file $XDG_CACHE_HOME/.pac-cache.$USER
		set cache_file $XDG_CACHE_HOME/.yum-cache.$USER
		set cache_file $XDG_CACHE_HOME/.rpm-cache.$USER
CVE-2023-49284 (C++, published 2023-12-05T00:15Z)
Description: value: fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.6)
Weakness: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Repository: https://github.com/fish-shell/fish-shell
Files changed:
src/common.cpp
tests/checks/basic.fish
Commit message: Encode all ENCODE_DIRECT codepoints with encode_direct


Vulnerable code:
            if (wc >= ENCODE_DIRECT_BASE && wc < ENCODE_DIRECT_BASE + 256) {
                use_encode_direct = true;
            } else if (wc == INTERNAL_SEPARATOR) {

Fixed code:
            if (fish_reserved_codepoint(wc)) {
        if (fish_reserved_codepoint(*result_char_or_none)) {
            return none();
        }
$fish -c 'echo \ufdd2"fart"'
# CHECKERR: fish: Invalid token '\ufdd2"fart"'
# CHECKERR: echo \ufdd2"fart"
# CHECKERR: ^~~~~~~~~~~^

echo (sh -c 'printf $\'\ufdd2foo\'') | string escape
# CHECK: \Xef\Xb7\X92foo