hitoshura25/cvefixes huggingface dataset:
CVE-2019-1010305 (Other, published 2019-07-15T15:15Z)
Description: value: libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/kyz/libmspack
Files changed:
libmspack/ChangeLog
libmspack/mspack/chmd.c
Commit message: length checks when looking for control files


Vulnerable code:
        if (memcmp(&name[2], &content_name[2], 31L) == 0) {
          if (memcmp(&name[33], &content_name[33], 8L) == 0) {
            chm->sec1.content = fi;
          }
          else if (memcmp(&name[33], &control_name[33], 11L) == 0) {
            chm->sec1.control = fi;
          }
          else if (memcmp(&name[33], &spaninfo_name[33], 8L) == 0) {
            chm->sec1.spaninfo = fi;
          }
          else if (memcmp(&name[33], &rtable_name[33], 72L) == 0) {
            chm->sec1.rtable = fi;
          }

Fixed code:
2019-02-18  Stuart Caie <kyzer@cabextract.org.uk>

	* chmd_read_headers(): a CHM file name beginning "::" but shorter
	than 33 bytes will lead to reading past the freshly-allocated name
	buffer - checks for specific control filenames didn't take length
	into account. Thanks to ADLab of Venustech for the report and
	proof of concept.

        if (name_len == 40 && memcmp(name, content_name, 40) == 0) {
          chm->sec1.content = fi;
        }
        else if (name_len == 44 && memcmp(name, control_name, 44) == 0) {
          chm->sec1.control = fi;
        }
        else if (name_len == 41 && memcmp(name, spaninfo_name, 41) == 0) {
          chm->sec1.spaninfo = fi;
        }
        else if (name_len == 105 && memcmp(name, rtable_name, 105) == 0) {
          chm->sec1.rtable = fi;
CVE-2021-39165 (PHP, published 2021-08-26T21:15Z)
Description: value: Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/fiveai/Cachet
Files changed:
app/Models/Traits/SearchableTrait.php
Commit message: Ensure only allowed searchable columns are used in DB Query


Vulnerable code:
        if (!array_intersect(array_keys($search), $this->searchable)) {
        return $query->where($search);

Fixed code:
        $allowed_search = array_intersect_key($search, array_flip($this->searchable));
        if (! $allowed_search) {
        return $query->where($allowed_search);
CVE-2021-39165 (PHP, published 2021-08-26T21:15Z)
Description: value: Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/fiveai/Cachet
Files changed:
app/Models/Traits/SearchableTrait.php
Commit message: Ensure only allowed searchable columns are used in DB Query


Vulnerable code:
        if (!array_intersect(array_keys($search), $this->searchable)) {
        return $query->where($search);

Fixed code:
        $allowed_search = array_intersect_key($search, array_flip($this->searchable));
        if (! $allowed_search) {
        return $query->where($allowed_search);
CVE-2023-5897 (PHP, published 2023-11-01T01:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository pkp/customLocale prior to 1.2.0-1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/pkp/customLocale
Files changed:
controllers/grid/CustomLocaleGridHandler.php
templates/localeFile.tpl
Commit message: https://github.com/pkp/customLocale/issues/27 Add CSRF checking


Vulnerable code:
</form>

Fixed code:
	if (!$request->checkCSRF()) return new JSONMessage(false);

	{csrf}
</form>
CVE-2021-32640 (JavaScript, published 2021-05-25T19:15Z)
Description: value: ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/websockets/ws
Files changed:
lib/websocket-server.js
Commit message: [security] Fix ReDoS vulnerability

A specially crafted value of the `Sec-Websocket-Protocol` header could
be used to significantly slow down a ws server.

PoC and fix were sent privately by Robert McLaughlin from University of
California, Santa Barbara.


Vulnerable code:
      protocol = protocol.trim().split(/ *, */);

Fixed code:
      protocol = protocol.split(',').map(trim);

/**
 * Remove whitespace characters from both ends of a string.
 *
 * @param {String} str The string
 * @return {String} A new string representing `str` stripped of whitespace
 *     characters from both its beginning and end
 * @private
 */
function trim(str) {
  return str.trim();
}
CVE-2021-4329 (JSON, published 2023-03-05T19:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/jwadhams/json-logic-js
Files changed:
logic.js
package.json
Commit message: The operations object could be exploited to run arbitrary code (#98)

* The operations object could be exploited to run arbitrary code

* Version bump

Co-authored-by: Jeremy Wadhams <jwadhams@dealerinspire.com>

Vulnerable code:
    if (typeof operations[op] === "function") {
        // Descending into operations
        operation = operation[sub_ops[i]];
        if (operation === undefined) {
  "version": "2.0.0",

Fixed code:
    if (operations.hasOwnProperty(op) && typeof operations[op] === "function") {

        if (!operation.hasOwnProperty(sub_ops[i])) {
        // Descending into operations
        operation = operation[sub_ops[i]];
  "version": "2.0.1",
CVE-2024-32879 (Python, published 2024-04-24T20:15Z)
Description: value: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/python-social-auth/social-app-django
Files changed:
social_django/models.py
Commit message: models: make sure uid is compared case-sensitive

The database collation might vary, so use safer comparing in Python.


Vulnerable code:
    def get_social_auth(cls, provider, uid):
        try:
            return cls.objects.select_related("user").get(provider=provider, uid=uid)
        except cls.DoesNotExist:
            return None

Fixed code:
    def get_social_auth(cls, provider: str, uid: str):
        for social in cls.objects.select_related("user").filter(
            provider=provider, uid=uid
        ):
            # We need to compare to filter out case-insensitive lookups in
            # some databases (MySQL/MariaDB)
            if social.uid == uid:
                return social
        return None
CVE-2021-37794 (Go, published 2021-08-31T18:15Z)
Description: value: A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/filebrowser/filebrowser
Files changed:
http/http.go
Commit message: chore: add Content-Security-Policy header


Vulnerable code:

Fixed code:
	r.Use(func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Content-Security-Policy", `default-src 'self'`)
			next.ServeHTTP(w, r)
		})
	})
CVE-2021-46398 (Go, published 2022-02-04T16:15Z)
Description: value: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/filebrowser/filebrowser
Files changed:
http/commands.go
Commit message: fix: security issue in command runner (closes #1621)


Vulnerable code:
	if !d.server.EnableExec || !d.user.CanExecute(strings.Split(raw, " ")[0]) {
		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet

	command, err := runner.ParseCommand(d.settings, raw)
	if err != nil {
		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet

Fixed code:
	command, err := runner.ParseCommand(d.settings, raw)
	if err != nil {
		if err := conn.WriteMessage(websocket.TextMessage, []byte(err.Error())); err != nil { //nolint:govet
	if !d.server.EnableExec || !d.user.CanExecute(command[0]) {
		if err := conn.WriteMessage(websocket.TextMessage, cmdNotAllowed); err != nil { //nolint:govet
CVE-2023-39612 (Go, published 2023-09-16T01:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/filebrowser/filebrowser
Files changed:
http/raw.go
Commit message: fix: xss vulnerability in /api/raw (#2570) (#2572)



Vulnerable code:

Fixed code:
	w.Header().Add("Content-Security-Policy", `script-src 'none';`)
CVE-2018-7560 (JSON, published 2018-03-04T20:29Z)
Description: value: index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/myshenin/aws-lambda-multipart-parser
Files changed:
index.js
package.json
Commit message: security update


Vulnerable code:
        .split(new RegExp(boundary))
  "version": "0.1.1",

Fixed code:
        .split(boundary)
  "version": "0.1.2",
CVE-2020-36621 (JavaScript, published 2022-12-21T19:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the file routes/mobileconfig.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is bb33d4325fba80e7ea68b79121dba025caf6f45f. It is recommended to apply a patch to fix this issue. VDB-216470 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chedabob/whatismyudid
Files changed:
app.js
routes/mobileconfig.js
Commit message: fix: set cookie securely, and prevent XSS in the `/enrollment` route


Vulnerable code:
app.use(express.urlencoded({extended: true})); 
    if (tudid) // If it's in the query, store it and redirect (so the user doesn't see the UDID being sent in the URL)
        res.cookie('newudid', query.udid, { maxAge: 10 * 60 * 1000});     // Store for 10 minutes
        if (cookie) {
    var match = req.body.toString().match(/(0000[\d]{4}-00[A-Fa-f\d]+)|([a-fA-F\d]{40})/);
    if (match && match.length > 0) {
        res.redirect(301,'/enrollment?udid=' + match[0]);

Fixed code:
    if (tudid && extractValidUdid(tudid)) // If it's in the query, store it and redirect (so the user doesn't see the UDID being sent in the URL)
        res.cookie('newudid', query.udid, 
        { 
            maxAge: 10 * 60 * 1000,
            httpOnly: true,
            secure: process.env.NODE_ENV === 'production'? true: false
        });
        if (cookie && extractValidUdid(cookie)) {
    var udid = extractValidUdid(req.body.toString())
    if (udid) {
        res.redirect(301,'/enrollment?udid=' + udid);

function extractValidUdid (udid) {
    const match = udid.match(/(0000[\d]{4}-00[A-Fa-f\d]+)|([a-fA-F\d]{40})/);

    if (match && match.length > 0) {
        return match[0]
    }
    else {
        return null
    }
}
CVE-2015-10058 (PHP, published 2023-01-17T13:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipulation of the argument lang leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 764f4e8ce3f9242637df77530c70ae8a2ec4b6a1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218415.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wikisource/ws-cat-browser
Files changed:
index.php
Commit message: Merge branch 'xss' of https://github.com/ricordisamoa/ws-cat-browser

Conflicts:
	index.php


Vulnerable code:
 $lang = (isset($_GET['lang'])) ? $_GET['lang'] : 'en';

Fixed code:
 $lang = (isset($_GET['lang'])) ? htmlspecialchars($_GET['lang']) : 'en';
CVE-2021-29435 (Ruby, published 2021-04-13T20:15Z)
Description: value: trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials. The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/TrestleAdmin/trestle-auth
Files changed:
lib/trestle/auth/controller/authentication.rb
Commit message: Ensure CSRF protection is prepended before authentication before_actions


Vulnerable code:

Fixed code:

          # Ensure that CSRF protection happens before authentication
          protect_from_forgery prepend: true
CVE-2021-43853 (C#, published 2021-12-22T21:15Z)
Description: value: Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/michaelschwarz/Ajax.NET-Professional
Files changed:
AjaxPro/Utilities/Constant.cs
AjaxPro/core.js
Commit message: fixed another XSS issue


Vulnerable code:
        public const string AssemblyVersion = "21.12.21.2";
		else { // ISO Date 2007-12-31T23:59:59Z                                     
		}
		// not yet possible as we still return new type() JSON
		//		if (!(!(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
		//		text.replace(/"(\\.|[^"\\])*"/g, '')))  ))
		//			throw new Error("Invalid characters in JSON parse string.");                 
		var regEx = /(\"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}.*?\")|(\"\\\/Date\(.*?\)\\\/")/g;
		text = text.replace(regEx, this.regExDate);

Fixed code:
        public const string AssemblyVersion = "21.12.22.1";
		/*else { // ISO Date 2007-12-31T23:59:59Z
					console.log(s);
		}*/
		text = text.replace(/(\"\\\/Date\(\d+\)\\\/")/g, this.regExDate);
CVE-2023-49289 (C#, published 2023-12-05T00:15Z)
Description: value: Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/michaelschwarz/Ajax.NET-Professional
Files changed:
AjaxPro/Utilities/Constant.cs
AjaxPro/core.js
Commit message: fixed another XSS issue


Vulnerable code:
        public const string AssemblyVersion = "21.12.21.2";
		else { // ISO Date 2007-12-31T23:59:59Z                                     
		}
		// not yet possible as we still return new type() JSON
		//		if (!(!(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
		//		text.replace(/"(\\.|[^"\\])*"/g, '')))  ))
		//			throw new Error("Invalid characters in JSON parse string.");                 
		var regEx = /(\"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}.*?\")|(\"\\\/Date\(.*?\)\\\/")/g;
		text = text.replace(regEx, this.regExDate);

Fixed code:
        public const string AssemblyVersion = "21.12.22.1";
		/*else { // ISO Date 2007-12-31T23:59:59Z
					console.log(s);
		}*/
		text = text.replace(/(\"\\\/Date\(\d+\)\\\/")/g, this.regExDate);