hitoshura25/cvefixes huggingface dataset:
CVE-2022-0726 (TypeScript, published 2022-02-23T14:15Z)
Description: value: Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/chocobozzz/peertube
Files changed:
server/middlewares/validators/videos/video-comments.ts
server/middlewares/validators/videos/video-rates.ts
server/tests/api/check-params/video-comments.ts
server/tests/api/check-params/videos.ts
Commit message: Check video privacy when creating comments/rates


Vulnerable code:
import { areValidationErrors, doesVideoExist, isValidVideoIdParam } from '../shared'
      const fields = {
        text: 'super comment'
      }
      const fields = {
        text: 'super comment'
      }

Fixed code:

    if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) {
      return res.fail({
        status: HttpStatusCode.FORBIDDEN_403,
        message: 'Cannot access to this ressource'
      })
    }


    if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) {
      return res.fail({
        status: HttpStatusCode.FORBIDDEN_403,
        message: 'Cannot access to this ressource'
      })
    }

import { areValidationErrors, checkCanSeeVideoIfPrivate, doesVideoExist, isValidVideoIdParam } from '../shared'
    if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) {
      return res.fail({
        status: HttpStatusCode.FORBIDDEN_403,
        message: 'Cannot access to this ressource'
      })
    }





      const fields = { text: 'super comment' }

    it('Should fail with a private video of another user', async function () {
      const fields = { text: 'super comment' }

      await makePostBodyRequest({
        url: server.url,
        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads',
        token: userAccessToken,
        fields,
        expectedStatus: HttpStatusCode.FORBIDDEN_403
      })
    })

      const fields = { text: 'super comment' }


    it('Should fail with a private video of another user', async function () {
      const fields = { text: 'super comment' }

      await makePostBodyRequest({
        url: server.url,
        path: '/api/v1/videos/' + privateVideo.uuid + '/comments/' + privateCommentId,
        token: userAccessToken,
        fields,
        expectedStatus: HttpStatusCode.FORBIDDEN_403
      })
    })

  let privateVideo: VideoCreateResult

    {
      privateVideo = await server.videos.quickUpload({ name: 'private video', privacy: VideoPrivacy.PRIVATE })
    }
    it('Should fail with a private video of another user', async function () {
      const fields = {
        rating: 'like'
      }
      await makePutBodyRequest({
        url: server.url,
        path: path + privateVideo.uuid + '/rate',
        token: userAccessToken,
        fields,
        expectedStatus: HttpStatusCode.FORBIDDEN_403
      })
    })
CVE-2022-0727 (TypeScript, published 2022-02-23T14:15Z)
Description: value: Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/chocobozzz/peertube
Files changed:
server/middlewares/validators/videos/video-comments.ts
server/middlewares/validators/videos/video-rates.ts
server/tests/api/check-params/video-comments.ts
server/tests/api/check-params/videos.ts
Commit message: Check video privacy when creating comments/rates


Vulnerable code:
import { areValidationErrors, doesVideoExist, isValidVideoIdParam } from '../shared'
      const fields = {
        text: 'super comment'
      }
      const fields = {
        text: 'super comment'
      }

Fixed code:

    if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) {
      return res.fail({
        status: HttpStatusCode.FORBIDDEN_403,
        message: 'Cannot access to this ressource'
      })
    }


    if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) {
      return res.fail({
        status: HttpStatusCode.FORBIDDEN_403,
        message: 'Cannot access to this ressource'
      })
    }

import { areValidationErrors, checkCanSeeVideoIfPrivate, doesVideoExist, isValidVideoIdParam } from '../shared'
    if (!await checkCanSeeVideoIfPrivate(req, res, res.locals.videoAll)) {
      return res.fail({
        status: HttpStatusCode.FORBIDDEN_403,
        message: 'Cannot access to this ressource'
      })
    }





      const fields = { text: 'super comment' }

    it('Should fail with a private video of another user', async function () {
      const fields = { text: 'super comment' }

      await makePostBodyRequest({
        url: server.url,
        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads',
        token: userAccessToken,
        fields,
        expectedStatus: HttpStatusCode.FORBIDDEN_403
      })
    })

      const fields = { text: 'super comment' }


    it('Should fail with a private video of another user', async function () {
      const fields = { text: 'super comment' }

      await makePostBodyRequest({
        url: server.url,
        path: '/api/v1/videos/' + privateVideo.uuid + '/comments/' + privateCommentId,
        token: userAccessToken,
        fields,
        expectedStatus: HttpStatusCode.FORBIDDEN_403
      })
    })

  let privateVideo: VideoCreateResult

    {
      privateVideo = await server.videos.quickUpload({ name: 'private video', privacy: VideoPrivacy.PRIVATE })
    }
    it('Should fail with a private video of another user', async function () {
      const fields = {
        rating: 'like'
      }
      await makePutBodyRequest({
        url: server.url,
        path: path + privateVideo.uuid + '/rate',
        token: userAccessToken,
        fields,
        expectedStatus: HttpStatusCode.FORBIDDEN_403
      })
    })
CVE-2022-39268 (Python, published 2022-09-30T21:15Z)
Description: value: ### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user's account. ### Patch Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with this commit: https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d ### References https://en.wikipedia.org/wiki/Cross-site_request_forgery https://cwe.mitre.org/data/definitions/352.html ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/orchest/orchest * Email us at rick@orchest.io
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/orchest/orchest
Files changed:
services/auth-server/app/app/views.py
Commit message: Set auth cookies to SameSite=Lax


Vulnerable code:
        resp.set_cookie("auth_token", "")
        resp.set_cookie("auth_username", "")
                    resp.set_cookie("auth_token", token.token)
                    resp.set_cookie("auth_username", username)

Fixed code:
        resp.set_cookie("auth_token", "", samesite="Lax")
        resp.set_cookie("auth_username", samesite="Lax")
                    # samesite="Lax" to avoid CSRF attacks.
                    resp.set_cookie("auth_token", token.token, samesite="Lax")
                    resp.set_cookie("auth_username", username, samesite="Lax")
CVE-2018-12713 (C, published 2018-06-24T22:29Z)
Description: value: GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was intended to be private.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/GNOME/gimp
Files changed:
app/tests/test-xcf.c
Commit message: Issue #1689: create unique temporary file with g_file_open_tmp().

Not sure this is really solving the issue reported, which is that
`g_get_tmp_dir()` uses environment variables (yet as g_file_open_tmp()
uses g_get_tmp_dir()…). But at least g_file_open_tmp() should create
unique temporary files, which prevents overriding existing files (which
is most likely the only real attack possible here, or at least the only
one I can think of unless some weird vulnerabilities exist in glib).


Vulnerable code:
  gchar               *filename;
  filename = g_build_filename (g_get_tmp_dir (), "gimp-test.xcf", NULL);

Fixed code:
  gchar               *filename = NULL;
  gint                 file_handle;
  file_handle = g_file_open_tmp ("gimp-test-XXXXXX.xcf", &filename, NULL);
  g_assert (file_handle != -1);
  close (file_handle);
CVE-2023-2479 (Markdown, published 2023-05-02T15:15Z)
Description: value: OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/appium/appium-desktop
Files changed:
README.md
Commit message: docs: update readme with security warning

Vulnerable code:
The old documentation for this project remains below.

Fixed code:
❗❗ Since this project was deprecated at least one security vulnerability was discovered that could allow remote code execution by a malicious party if Appium Desktop's open ports are exposed to the wider internet. This project is unsupported and no fixes are planned. Again, please do not use Appium Desktop anymore. Use Appium and the Appium Inspector instead.

_The old documentation for this project remains below._
CVE-2012-1909 (C++, published 2012-08-06T16:55Z)
Description: value: The Bitcoin protocol, as used in bitcoind before 0.4.4, wxBitcoin, Bitcoin-Qt, and other programs, does not properly handle multiple transactions with the same identifier, which allows remote attackers to cause a denial of service (unspendable transaction) by leveraging the ability to create a duplicate coinbase transaction.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-16 \u2014 Configuration
Weaknesses in this category are typically introduced during the configuration of the software.
Repository: https://github.com/sipa/bitcoin
Files changed:
src/main.cpp
Commit message: Do not allow overwriting unspent transactions (BIP 30)

Introduce the following network rule:
 * a block is not valid if it contains a transaction whose hash
   already exists in the block chain, unless all that transaction's
   outputs were already spent before said block.

Warning: this is effectively a network rule change, with potential
risk for forking the block chain. Leaving this unfixed carries the
same risk however, for attackers that can cause a reorganisation
in part of the network.

Thanks to Russell O'Connor and Ben Reeves.


Vulnerable code:
    if (!txdb.EraseTxIndex(*this))
        return error("DisconnectInputs() : EraseTxPos failed");

Fixed code:
    // This can fail if a duplicate of this transaction was in a chain that got
    // reorganized away. This is only possible if this transaction was completely
    // spent, so erasing it would be a no-op anway.
    txdb.EraseTxIndex(*this);
    // Do not allow blocks that contain transactions which 'overwrite' older transactions,
    // unless those are already completely spent.
    // If such overwrites are allowed, coinbases and transactions depending upon those
    // can be duplicated to remove the ability to spend the first instance -- even after
    // being sent to another address.
    // See BIP30 and http://r6.ca/blog/20120206T005236Z.html for more information.
    // This logic is not necessary for memory pool transactions, as AcceptToMemoryPool
    // already refuses previously-known transaction id's entirely.
    // This rule applies to all blocks whose timestamp is after March 15, 2012, 0:00 UTC.
    // On testnet it is enabled as of februari 20, 2012, 0:00 UTC.
    if (pindex->nTime > 1331769600 || (fTestNet && pindex->nTime > 1329696000))
        BOOST_FOREACH(CTransaction& tx, vtx)
        {
            CTxIndex txindexOld;
            if (txdb.ReadTxIndex(tx.GetHash(), txindexOld))
                BOOST_FOREACH(CDiskTxPos &pos, txindexOld.vSpent)
                    if (pos.IsNull())
                        return false;
        }
CVE-2017-12868 (PHP, published 2017-09-01T13:29Z)
Description: value: The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/simplesamlphp/simplesamlphp
Files changed:
lib/SimpleSAML/Utils/Crypto.php
Commit message: bugfix: SimpleSAML\Utils\Crypto returns true for different strings using PHP < 5.6.

The reason was the lack of conversion to integer for each character of the strings before applying the XOR operator to them. The operator returns always an empty string when applied to two characters, and applying a binary-wise OR between 0 and an empty string, yields 0. Therefore, $diff is always 0, and the function returns true for every two strings with same length, regardless of their contents.


Vulnerable code:
        for ($i = 0; $i < $len; ++$i) {
            $diff |= $known[$i] ^ $user[$i];

Fixed code:
        for ($i = 0; $i < $len; $i++) {
            $diff |= ord($known[$i]) ^ ord($user[$i]);
CVE-2017-12871 (PHP, published 2017-09-01T21:29Z)
Description: value: The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/simplesamlphp/simplesamlphp
Files changed:
lib/SimpleSAML/Utils/Crypto.php
Commit message: Fix an issue with IV generation in SimpleSAML\Utils\Crypto::aesEncrypt().

IVs must be random and one-time (never reused). Additionally, by deriving it from the key, the key length was effectively reduced to 128 bits.


Vulnerable code:
        $iv     = substr($key, 0, $ivSize);

Fixed code:
        $iv     = openssl_random_pseudo_bytes($ivSize);
CVE-2020-5301 (PHP, published 2020-04-21T20:15Z)
Description: value: SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6.
Severity: LOW (CVSS v3 base score: 3.1)
Weakness: CWE-178 \u2014 Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
Repository: https://github.com/simplesamlphp/simplesamlphp
Files changed:
lib/SimpleSAML/Module.php
Commit message: Fix source code disclosure on case-insensitive file systems

If the file system containing the PHP code is case-insensitive, a
request containing an uppercase file extension will return the
contents of the PHP file to the browser instead of executing it.

E.g. a request for this URL will return the source code:

  https:/sp.example.org/simplesaml/module.php/core/frontpage_welcome.PHP

Fix that by converting the path to lowercase before checking the file
extension.

See the following page for details:

  https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq


Vulnerable code:
        if (substr($path, -4) === '.php') {

Fixed code:
        if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {
CVE-2014-9709 (C, published 2015-03-30T10:59Z)
Description: value: The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://bitbucket.org/libgd/gd-libgd
Files changed:
src/gd_gif_in.c
Commit message: Fix possible buffer read overflow
detected by -fsanitize=address, thanks to Jan Bee


Vulnerable code:
	unsigned char buf[280];
		ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;

Fixed code:
#define CSD_BUF_SIZE 280

	unsigned char buf[CSD_BUF_SIZE];
		if (i < CSD_BUF_SIZE * 8) {
			ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
		} else {
			ret = -1;
			break;
		}
CVE-2017-11667 (Unknown, published 2017-07-26T20:29Z)
Description: value: OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/opf/openproject
Files changed:
Commit message: Merge remote-tracking branch 'origin/release/7.1' into dev


Vulnerable code:

Fixed code:
CVE-2022-35213 (PHP, published 2022-08-18T20:15Z)
Description: value: Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/blogpublish.php.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap
Files changed:
application/config/config.php
application/modules/admin/views/blog/blogpublish.php
Commit message: hot fixes


Vulnerable code:
$config['encryption_key'] = '';
$config['sess_save_path'] = NULL;
                    <div><img class="img-responsive" src="<?= base_url('attachments/blog_images/' . $_POST['image']) ?>"></div>

Fixed code:
$config['encryption_key'] = 'asd';
$config['sess_save_path'] = sys_get_temp_dir();
                    <div><img class="img-responsive" src="<?= base_url('attachments/blog_images/' . htmlspecialchars($_POST['image'])) ?>"></div>
CVE-2020-36561 (Unknown, published 2022-12-27T22:15Z)
Description: value: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/yi-ge/unzip
Files changed:
Commit message: Merge pull request #1 from snoopysecurity/fix/santize-filename-paths

fix: sanitize filepath names

Vulnerable code:

Fixed code: