hitoshura25/cvefixes huggingface dataset:
CVE-2023-0509 (Python, published 2023-01-26T22:15Z)
Description: value: Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
Severity: nan (CVSS v3 base score: 7.4)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/core/config/default.cfg
src/pyload/core/network/http/http_request.py
src/pyload/core/network/request_factory.py
Commit message: enable SSL certificate verification by default, add option to disable it


Vulnerable code:
        self.c.setopt(pycurl.SSL_VERIFYPEER, 0)
            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36",

Fixed code:
    bool ssl_verify : "Peer's SSL certificate verification" = True
        self.c.setopt(pycurl.SSL_VERIFYPEER, 1)
            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0",
        if "ssl_verify" in options:
            self.c.setopt(pycurl.SSL_VERIFYPEER, 1 if options["ssl_verify"] else 0)

            "ssl_verify": self.pyload.config.get("general", "ssl_verify"),
CVE-2024-21644 (HTML, published 2024-01-08T14:15Z)
Description: value: pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/blueprints/app_blueprint.py
src/pyload/webui/app/templates/info.html
src/pyload/webui/app/themes/modern/templates/info.html
src/pyload/webui/app/themes/pyplex/templates/info.html
Commit message: fix GHSA-mqpq-2p68-46fv security advisory


Vulnerable code:
        "config": api.get_userdir(),
{% block title %}{{ _("Information") }} - {{ super() }} {% endblock %}
{% block subtitle %}{{ _("Information") }}{% endblock %}
<h3>{{ _("Support") }}</h3>
<h3>{{ _("System") }}</h3>
        <td>{{ _("Python version:") }}</td>
        <td>{{ python }}</td>
        <td>{{ _("OS platform:") }}</td>
        <td>{{ os }}</td>
<h3>{{ _("Storage") }}</h3>
        <td>{{ _("Download folder:") }}</td>
        <td>{{ download }}</td>
        <td>{{ _("Available space:") }}</td>
        <td>{{ freespace }}</td>
<h3>{{ _("pyLoad") }}</h3>
        <td>{{ _("Version:") }}</td>
        <td>{{ version }}</td>
        <td>{{ _("Installation folder:") }}</td>
        <td>{{ folder }}</td>
        <td>{{ _("Config folder:") }}</td>
        <td>{{ config }}</td>
        <td>{{ _("Language:") }}</td>
        <td>{{ language }}</td>
        <td>{{ _("WebUI port:") }}</td>
        <td>{{ webif }}</td>
  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
  <dd class="col-xs-12 col-sm-9">{{config}}</dd>

Fixed code:
        "config_folder": api.get_userdir(),
{% block title %}{{_("Information")}} - {{super()}} {% endblock %}
{% block subtitle %}{{_("Information")}}{% endblock %}
<h3>{{_("Support")}}</h3>
<h3>{{_("System")}}</h3>
        <td>{{_("Python version:")}}</td>
        <td>{{python}}</td>
        <td>{{_("OS platform:")}}</td>
        <td>{{os}}</td>
<h3>{{_("Storage")}}</h3>
        <td>{{_("Download folder:")}}</td>
        <td>{{download}}</td>
        <td>{{_("Available space:")}}</td>
        <td>{{freespace}}</td>
<h3>{{_("pyLoad")}}</h3>
        <td>{{_("Version:")}}</td>
        <td>{{version}}</td>
        <td>{{_("Installation folder:")}}</td>
        <td>{{folder}}</td>
        <td>{{_("Config folder:")}}</td>
        <td>{{config_folder}}</td>
        <td>{{_("Language:")}}</td>
        <td>{{language}}</td>
        <td>{{_("WebUI port:")}}</td>
        <td>{{webif}}</td>
  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
CVE-2024-21645 (Python, published 2024-01-08T14:15Z)
Description: value: pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/blueprints/api_blueprint.py
src/pyload/webui/app/blueprints/app_blueprint.py
Commit message: fix GHSA-ghmw-rwh8-6qmr security advisory


Vulnerable code:
        log.error(f"Login failed for user '{user}'")
    log.info(f"User '{user}' successfully logged in")
            log.error(f"Login failed for user '{user}'")
        log.info(f"User '{user}' successfully logged in")

Fixed code:
    sanitized_user = user.replace("\n", "\\n").replace("\r", "\\r")
        log.error(f"Login failed for user '{sanitized_user}'")
    log.info(f"User '{sanitized_user}' successfully logged in")
        sanitized_user = user.replace("\n", "\\n").replace("\r", "\\r")
            log.error(f"Login failed for user '{sanitized_user}'")
        log.info(f"User '{sanitized_user}' successfully logged in")
CVE-2024-22416 (Python, published 2024-01-18T00:15Z)
Description: value: pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/__init__.py
Commit message: fix GHSA-pgpj-v85q-h5fm security advisory (2)


Vulnerable code:
        app.config["SESSION_COOKIE_SAMESITE"] = "None"

Fixed code:
        app.config["SESSION_COOKIE_SAMESITE"] = "Strict"
CVE-2024-22416 (Other, published 2024-01-18T00:15Z)
Description: value: pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/pyload/pyload
Files changed:
setup.cfg
src/pyload/webui/app/__init__.py
Commit message: fix GHSA-pgpj-v85q-h5fm security advisory


Vulnerable code:
    Flask;python_version<"3.8"
    Flask~=2.3.0;python_version>="3.8"
    Flask-Session~=0.3;python_version<"3.7"
    Flask-Session2~=1.3;python_version>="3.7"

Fixed code:
    Flask
    Flask-Session~=0.4.1;python_version<"3.7"
    Flask-Session;python_version>="3.7"
        app.config["SESSION_COOKIE_SAMESITE"] = "None"
CVE-2024-24808 (Python, published 2024-02-06T04:15Z)
Description: value: pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login. This vulnerability has been patched with commit fe94451.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/pyload/pyload
Files changed:
src/pyload/webui/app/blueprints/app_blueprint.py
src/pyload/webui/app/helpers.py
Commit message: fix GHSA-g3cm-qg2v-2hj5 security advisory


Vulnerable code:
    next = get_redirect_url(fallback=flask.url_for("app.dashboard"))
            return render_template("login.html", next=next, errors=True)
        return flask.redirect(next)
                return flask.redirect(next)
    return render_template("login.html", next=next)
from urllib.parse import unquote, urljoin, urlparse
    ref_url = urlparse(flask.request.host_url)
    test_url = urlparse(urljoin(flask.request.host_url, location))
    return test_url.scheme in ('http', 'https') and ref_url.netloc == test_url.netloc
    login_url = urljoin(flask.request.url_root, flask.url_for('app.login'))
    request_url = unquote(flask.request.url)
    for location in flask.request.values.get("next"), flask.request.referrer:
        if not location:
            continue
        if location in (request_url, login_url):  # don't redirect to same location
            continue
        if is_safe_url(location):
            return location
    return fallback
                        next=flask.request.url

Fixed code:
    next_url = get_redirect_url(fallback="app.dashboard")
            return render_template("login.html", errors=True)
        return flask.redirect(next_url)
                return flask.redirect(next_url)
    return render_template("login.html")
from urllib.parse import urljoin, urlparse
import werkzeug.routing.exceptions
    location_urlp = urlparse(location)
    #: if relative URL then must start with "/"
    if not location_urlp.netloc and location[0] != "/":
        return False
    host_urlp = urlparse(flask.request.host_url)
    test_urlp = urlparse(urljoin(flask.request.host_url, location))
    return test_urlp.scheme in ('http', 'https') and host_urlp.netloc == test_urlp.netloc
    next_arg = flask.request.values.get("next")
    redirect_url = flask.url_for(fallback)
    if next_arg and next_arg != "login":  # don't redirect to same location
        try:
            redirect_url = flask.url_for(f"app.{next_arg}")
        except werkzeug.routing.exceptions.BuildError:
            pass

    return urljoin(flask.request.url_root, redirect_url)
                        next=flask.request.endpoint.split(".")[-1]
CVE-2023-33955 (Other, published 2023-05-30T07:15Z)
Description: value: Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.


Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/minio/console
Files changed:
portal-ui/src/common/utils.ts
portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ListObjects/IconWithLabel.tsx
Commit message: Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)

Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>

Vulnerable code:
        {strings[strings.length - 1]}

Fixed code:

// replaces bad unicode characters
export const replaceUnicodeChar = (inputString: string): string => {
  let unicodeChar = "\u202E";
  return inputString.split(unicodeChar).join("<�202e>");
};
import { replaceUnicodeChar } from "../../../../../../common/utils";
        {replaceUnicodeChar(strings[strings.length - 1])}
CVE-2024-35175 (Go, published 2024-05-14T22:15Z)
Description: value: sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tg123/sshpiper
Files changed:
cmd/sshpiperd/daemon.go
cmd/sshpiperd/main.go
go.mod
go.sum
Commit message: replace with proxy protocol listener


Vulnerable code:
	// if len(plugins) == 1 {
	// 	return plugins[0].InstallPiperConfig(d.config)
	// }


Fixed code:
	if len(plugins) == 1 {
		return plugins[0].InstallPiperConfig(d.config)
	}
	"github.com/pires/go-proxyproto"
			d.lis = &proxyproto.Listener{Listener: d.lis}

	github.com/pires/go-proxyproto v0.6.2
github.com/pires/go-proxyproto v0.6.2 h1:KAZ7UteSOt6urjme6ZldyFm4wDe/z0ZUP0Yv0Dos0d8=
github.com/pires/go-proxyproto v0.6.2/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
CVE-2024-35175 (Go, published 2024-05-14T22:15Z)
Description: value: sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tg123/sshpiper
Files changed:
cmd/sshpiperd/main.go
Commit message: Merge pull request from GHSA-4w53-6jvp-gg52

* feat: Add support for allowed proxy addresses

This commit adds support for allowed proxy addresses, which allows only connections from these IP ranges to send a proxy header based on the PROXY protocol. If the allowed proxy addresses are empty, the PROXY protocol support is disabled.

* Update cmd/sshpiperd/main.go

Co-authored-by: Peter G <97112726+pgibson1-godaddy@users.noreply.github.com>

---------

Co-authored-by: Peter G <97112726+pgibson1-godaddy@users.noreply.github.com>

Vulnerable code:
			d.lis = &proxyproto.Listener{Listener: d.lis}

Fixed code:
			&cli.StringSliceFlag{
				Name:  "allowed-proxy-addresses",
				Value: cli.NewStringSlice(),
				Usage: "allowed proxy addresses, only connections from these ip ranges are allowed to send a proxy header based on the PROXY protocol, empty will disable the PROXY protocol support",
			},

			allowedproxyaddresses := ctx.StringSlice("allowed-proxy-addresses")

			if len(allowedproxyaddresses) > 0 {
				proxypolicy, err := proxyproto.LaxWhiteListPolicy(allowedproxyaddresses)
				if err != nil {
					return err
				}

				d.lis = &proxyproto.Listener{Listener: d.lis, Policy: proxypolicy}
			}
CVE-2018-1000070 (Python, published 2018-03-13T15:29Z)
Description: value: Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in main program, file src/messagetypes/__init__.py function constructObject that can result in Code Execution. This attack appears to be exploitable via remote attacker using a malformed message which must be processed by the victim - e.g. arrive from any sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/Bitmessage/PyBitmessage
Files changed:
src/messagetypes/__init__.py
Commit message: Fix message encoding bug

- prevent loading invalid message types


Vulnerable code:
        classBase = eval(data[""] + "." + data[""].title())
    except NameError:
        logger.error("Don't know how to handle message type: \"%s\"", data[""])

Fixed code:
        m = import_module("messagetypes." + data[""])
        classBase = getattr(m, data[""].title())
    except (NameError, ImportError):
        logger.error("Don't know how to handle message type: \"%s\"", data[""], exc_info=True)
CVE-2014-7193 (Unknown, published 2014-12-25T11:59Z)
Description: value: The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/hapijs/crumb
Files changed:
Commit message: Merge pull request #16 from spumko/security-updates

Security update

Vulnerable code:

Fixed code:
CVE-2012-4573 (Python, published 2012-11-11T13:00Z)
Description: value: The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/openstack/glance
Files changed:
glance/api/v1/images.py
glance/tests/stubs.py
glance/tests/unit/v1/test_api.py
glance/tests/utils.py
Commit message: Delete from store after registry delete.

Because we rely on the registry to determine authorization in the glance
v1 api, we must attempt a registry delete before deleting an image from
the image store.

This patch includes the test for the bug, which was posted separately
on the bug.

Fixes bug 1065187.

Change-Id: I1a06b7c7421524066c684539e2f3516c4ed2c475


Vulnerable code:
        status = 'deleted'
                    status = 'pending_delete'

            registry.update_image_metadata(req.context, id, {'status': status})
            registry.delete_image_metadata(req.context, id)
        api = context.UnauthenticatedContextMiddleware(rserver.API(mapper))

Fixed code:
        if image['location'] and CONF.delayed_delete:
            status = 'pending_delete'
        else:
            status = 'deleted'

            # Delete the image from the registry first, since we rely on it
            # for authorization checks.
            # See https://bugs.launchpad.net/glance/+bug/1065187
            registry.update_image_metadata(req.context, id, {'status': status})
            registry.delete_image_metadata(req.context, id)

        server = rserver.API(mapper)
        # NOTE(markwash): we need to pass through context auth information if
        # we have it.
        if 'X-Auth-Token' in self.req.headers:
            api = utils.FakeAuthMiddleware(server)
        else:
            api = context.UnauthenticatedContextMiddleware(server)
    def test_delete_not_allowed(self):
        # Verify we can get the image data
        req = webob.Request.blank("/images/%s" % UUID2)
        req.method = 'GET'
        req.headers['X-Auth-Token'] = 'user:tenant:'
        res = req.get_response(self.api)
        self.assertEqual(res.status_int, 200)
        self.assertEqual(len(res.body), 19)

        # Verify we cannot delete the image
        req.method = 'DELETE'
        res = req.get_response(self.api)
        self.assertEqual(res.status_int, 403)

        # Verify the image data is still there
        req.method = 'GET'
        res = req.get_response(self.api)
        self.assertEqual(res.status_int, 200)
        self.assertEqual(len(res.body), 19)

            'auth_tok': auth_tok,
CVE-2012-5482 (Python, published 2012-11-11T13:00Z)
Description: value: The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/openstack/glance
Files changed:
glance/api/v2/images.py
glance/tests/functional/v2/test_images.py
Commit message: Ensure authorization before deleting from store

This fixes bug 1076506.

Change-Id: I3794c14fe523a9a27e943d73dd0248489d2b91f6


Vulnerable code:
        status = 'deleted'
        if image['location']:
            if CONF.delayed_delete:
                status = 'pending_delete'
                self.store_api.schedule_delayed_delete_from_backend(
                                image['location'], id)
            else:
                self.store_api.safe_delete_from_backend(image['location'],
                                                        req.context, id)

Fixed code:
        if image['location'] and CONF.delayed_delete:
            status = 'pending_delete'
        else:
            status = 'deleted'

            if image['location']:
                if CONF.delayed_delete:
                    self.store_api.schedule_delayed_delete_from_backend(
                                    image['location'], id)
                else:
                    self.store_api.safe_delete_from_backend(image['location'],
                                                            req.context, id)
        # Upload some image data
        path = self._url('/v2/images/%s/file' % image_id)
        headers = self._headers({'Content-Type': 'application/octet-stream'})
        response = requests.put(path, headers=headers, data='ZZZZZ')
        self.assertEqual(201, response.status_code)

        # Image data should still be present after the failed delete
        path = self._url('/v2/images/%s/file' % image_id)
        response = requests.get(path, headers=self._headers())
        self.assertEqual(200, response.status_code)
        self.assertEqual(response.text, 'ZZZZZ')