hitoshura25/cvefixes huggingface dataset:
CVE-2016-2052 (C++, published 2016-01-25T11:59Z)
Description: value: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.
Severity: MEDIUM (CVSS v3 base score: 7.6)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/behdad/harfbuzz
Files changed:
src/hb-ot-font.cc
Commit message: [ot-font] Fix hmtx wrong table length check

Discovered by libFuzzer.  Ouch!

https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957


Vulnerable code:
		  2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob)))

Fixed code:
		  2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob)))
CVE-2014-9760 (PHP, published 2017-02-13T18:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gosa-project/gosa-core
Files changed:
html/index.php
Commit message: escape html entities to fix xss at the login screen


git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@21276 594d385d-05f5-0310-b6e9-bd551577e9d8


Vulnerable code:
$smarty->assign ('username', $username);

Fixed code:
$smarty->assign ('username', set_post($username));
CVE-2015-8771 (Other, published 2017-02-13T18:59Z)
Description: value: The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/gosa-project/gosa-core
Files changed:
include/class_core.inc
include/functions.inc
Commit message: (See #1221)
udpate samba hash generation due to a possible code injection

command line parameter will be passed base64 encoded to avoid 
complex escaping sequences that may alter the initial passphrase



git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@21280 594d385d-05f5-0310-b6e9-bd551577e9d8


Vulnerable code:
                                "default"       => "perl -MCrypt::SmbHash -e \"print join(q[:], ntlmgen %password), $/;\"",
      $tmp = preg_replace("/%userPassword/", escapeshellarg($password), $tmp);
      $tmp = preg_replace("/%password/", escapeshellarg($password), $tmp);

Fixed code:
                                "default"       => "perl -MCrypt::SmbHash -e \"use MIME::Base64; print join(q[:], ntlmgen decode_base64('%password')), $/;\"",
      $tmp = preg_replace("/%userPassword/", base64_encode($password), $tmp);
      $tmp = preg_replace("/%password/", base64_encode($password), $tmp);
CVE-2018-1000528 (PHP, published 2018-06-26T16:29Z)
Description: value: GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gosa-project/gosa-core
Files changed:
html/password.php
Commit message: (see #14)
escape html entities for uid to avoid code execution


Vulnerable code:
$smarty->assign('uid', $uid);

Fixed code:
$smarty->assign('uid', set_post($uid));
CVE-2023-30614 (Ruby, published 2023-04-19T18:15Z)
Description: value: Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pay-rails/pay
Files changed:
CHANGELOG.md
app/controllers/pay/payments_controller.rb
app/views/pay/payments/show.html.erb
Commit message: Fix XSS vulnerability on Stripe payment page


Vulnerable code:
      @redirect_to = params[:back].presence || root_path
      <%= link_to t("pay.back"), @redirect_to, class: "inline-block w-full px-4 py-3 bg-gray-100 hover:bg-gray-200 text-center text-gray-600 rounded-lg" %>

Fixed code:
* [SECURITY] Fix XSS vulnerability in back parameter on Stripe payment page
  Previously, an attacker could inject Javascript or redirect the user to any URL by changing the `back` parameter in the URL.
  The `back` parameter is now sanitized and restricted to relative paths.
    before_action :set_redirect_to


    private

    # Ensure the back parameter is a valid path
    # This safely handles XSS or external redirects
    def set_redirect_to
      @redirect_to = URI.parse(params[:back].to_s).path || root_path
    end
      <%= sanitize link_to(t("pay.back"), @redirect_to, class: "inline-block w-full px-4 py-3 bg-gray-100 hover:bg-gray-200 text-center text-gray-600 rounded-lg") %>
CVE-2022-24778 (Go, published 2022-03-25T18:15Z)
Description: value: The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/containerd/imgcrypt
Files changed:
images/encryption/encryption.go
Commit message: images: Add list of Platforms to CheckAuthorization()

To be able to properly perform an authorization check on an image we need
to know the platform to perform check when in cryptManifestList(). Extend
the logic for cryptoOp == cryptoOpUnwrapOnly to skip over manifests that
do not correspond to the local platform and return an error if no manifest
was found that matches the local platform.

The following projects seem NOT to be affect due to the change in the code
path of CheckAuthorization() since they are not using it:

- cri-o
- nerdctl
- skopeo
- buildah
- podman

The impact on imgcrypt via ctr-enc is not so clear either since
CheckAuthorization() is not called on the server side but by the ctr-enc
client, thus can be modified easily.

Resolves: https://github.com/containerd/imgcrypt/issues/69
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>


Vulnerable code:

Fixed code:
// isLocalPlatform determines whether the given platform matches the local one
func isLocalPlatform(platform *ocispec.Platform) bool {
	matcher := platforms.NewMatcher(*platform)

	return matcher.Match(platforms.DefaultSpec())
}

		if cryptoOp == cryptoOpUnwrapOnly && !isLocalPlatform(manifest.Platform) {
			continue
		}
	if cryptoOp == cryptoOpUnwrapOnly {
		return ocispec.Descriptor{}, false, fmt.Errorf("No manifest found for local platform")
	}
CVE-2023-37265 (Go, published 2023-07-17T21:15Z)
Description: value: CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly. 
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/IceWhaleTech/CasaOS-Gateway
Files changed:
route/gateway_route.go
Commit message: Merge pull request from GHSA-vjh7-5r6x-xh6g

* fix:Incorrect identification of source IP addresses

* feat: support reverse proxy

* stash

* stash

* fix: the bug

* fix: the bug

* fix: the bug

* fix: the bug

* delete unused comment

* refacotr the proccess

* add comment to notice user to config correct proxy setting

* fix:some problems

* refactor the ip

* Update gateway_route.go

Vulnerable code:

Fixed code:
	"strings"
// the function is to ensure the request source IP is correct.
func rewriteRequestSourceIP(r *http.Request) {
	// we may receive two kinds of requests. a request from reverse proxy. a request from client.

	// in reverse proxy, X-Forwarded-For will like
	// `X-Forwarded-For:[192.168.6.102]`(normal)
	// `X-Forwarded-For:[::1, 192.168.6.102]`(hacked) Note: the ::1 is inject by attacker.
	// `X-Forwarded-For:[::1]`(normal or hacked) local request. But it from browser have JWT. So we can and need to verify it
	// `X-Forwarded-For:[::1,::1]`(normal or hacked) attacker can build the request to bypass the verification.
	// But in the case. the remoteAddress should be the real ip. So we can use remoteAddress to verify it.

	ipList := strings.Split(r.Header.Get("X-Forwarded-For"), ",")

	r.Header.Del("X-Forwarded-For")
	r.Header.Del("X-Real-IP")

	// Note: the X-Forwarded-For depend the correct config from reverse proxy.
	// otherwise the X-Forwarded-For may be empty.
	remoteIP := r.RemoteAddr[:strings.LastIndex(r.RemoteAddr, ":")]
	if len(ipList) > 0 && (remoteIP == "127.0.0.1" || remoteIP == "::1") {
		// to process the request from reverse proxy

		// in reverse proxy, X-Forwarded-For will container multiple IPs.
		// if the request is from reverse proxy, the r.RemoteAddr will be 127.0.0.1.
		// So we need get ip from X-Forwarded-For
		r.Header.Add("X-Forwarded-For", ipList[len(ipList)-1])
	}
	// to process the request from client.
	// the gateway will add the X-Forwarded-For to request header.
	// So we didn't need to add it.
}

		// to fix https://github.com/IceWhaleTech/CasaOS/security/advisories/GHSA-32h8-rgcj-2g3c#event-102885
		// API V1 and V2 both read ip from request header. So the fix is effective for v1 and v2.
		rewriteRequestSourceIP(r)
CVE-2024-34342 (Unknown, published 2024-05-07T15:15Z)
Description: value: react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mozilla/pdf.js
Files changed:
Commit message: Merge pull request #18015 from calixteman/rm_eval_font_loader

Simplify the way to pass the glyph drawing instructions from the worker to the main thread

Vulnerable code:

Fixed code:
CVE-2018-7485 (C, published 2018-02-26T14:29Z)
Description: value: The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/lurcher/unixODBC
Files changed:
ChangeLog
DriverManager/SQLGetDiagRecW.c
DriverManager/SQLSetDescField.c
DriverManager/SQLSetDescFieldW.c
configure.ac
exe/iusql.c
odbcinst/SQLCreateDataSource.c
odbcinst/SQLWriteFileDSN.c
Commit message: New Pre Source


Vulnerable code:
    if ( field_identifier == SQL_DESC_COUNT && (SQLINTEGER)value < 0 )
    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && value != SQL_PARAM_INPUT
        && value != SQL_PARAM_OUTPUT && value != SQL_PARAM_INPUT_OUTPUT &&
        value != SQL_PARAM_INPUT_OUTPUT_STREAM && value != SQL_PARAM_OUTPUT_STREAM )
    if ( field_identifier == SQL_DESC_COUNT && (SQLINTEGER)value < 0 )
    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && value != SQL_PARAM_INPUT
        && value != SQL_PARAM_OUTPUT && value != SQL_PARAM_INPUT_OUTPUT &&
        value != SQL_PARAM_INPUT_OUTPUT_STREAM && value != SQL_PARAM_OUTPUT_STREAM )
AC_INIT([unixODBC], [2.3.5], nick@unixodbc.org, [unixODBC])
            free(szSepLine);
        return in;
        return in;
        return in;
        return in;
		strncpy( szFileName, sizeof(szFileName) - 5, pszFileName );

Fixed code:
2.3.6pre

    * Fix order of arguments in SQLWriteFileDSN.c, fix unwanted free() in iusql.c

extern int __is_env( EHEAD * head );        /* in SQLGetDiagRec.c */

    if ( field_identifier == SQL_DESC_COUNT && (intptr_t)value < 0 )
    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && (intptr_t)value != SQL_PARAM_INPUT
        && (intptr_t)value != SQL_PARAM_OUTPUT && (intptr_t)value != SQL_PARAM_INPUT_OUTPUT &&
        (intptr_t)value != SQL_PARAM_INPUT_OUTPUT_STREAM && (intptr_t)value != SQL_PARAM_OUTPUT_STREAM )
    if ( field_identifier == SQL_DESC_COUNT && (intptr_t)value < 0 )
    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && (intptr_t)value != SQL_PARAM_INPUT
        && (intptr_t)value != SQL_PARAM_OUTPUT && (intptr_t)value != SQL_PARAM_INPUT_OUTPUT &&
        (intptr_t)value != SQL_PARAM_INPUT_OUTPUT_STREAM && (intptr_t)value != SQL_PARAM_OUTPUT_STREAM )
AC_INIT([unixODBC], [2.3.6pre], nick@unixodbc.org, [unixODBC])
        return NULL;
        return NULL;
        return NULL;
        return NULL;
		strncpy( szFileName, pszFileName, sizeof(szFileName) - 5 );
CVE-2016-10245 (PHP, published 2019-05-24T17:29Z)
Description: value: Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/doxygen/doxygen
Files changed:
templates/html/search_opensearch.php
Commit message: Bug 762934 - External search does not properly escape user supplied data, resulting in vulnerability


Vulnerable code:

Fixed code:
$query = preg_replace("/[^a-zA-Z0-9\-\_\.\x80-\xFF]/i", " ", $query );
CVE-2021-32855 (TypeScript, published 2023-02-21T15:15Z)
Description: value: Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Vanessa219/vditor
Files changed:
src/ts/util/fixBrowserBehavior.ts
types/index.d.ts
Commit message: :lock: https://github.com/Vanessa219/vditor/issues/1085


Vulnerable code:

Fixed code:
    textHTML = Lute.Sanitize(textHTML);
    public static Sanitize(html: string): string;
CVE-2015-10121 (PHP, published 2023-07-10T16:15Z)
Description: value: A vulnerability has been found in Beeliked Microsite Plugin up to 1.0.1 on WordPress and classified as problematic. Affected by this vulnerability is the function embed_handler of the file beelikedmicrosite.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is d23bafb5d05fb2636a2b78331f9d3fca152903dc. It is recommended to upgrade the affected component. The identifier VDB-233365 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/beeliked-microsite
Files changed:
beelikedmicrosite.php
Commit message: Set iframe resizer to allow cross-site scripting, allowing custom subdomains for competitions.

git-svn-id: https://plugins.svn.wordpress.org/beeliked-microsite/trunk@1122180 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 1.0.1
<script type=\"text/javascript\">jQuery(document).ready(function() { jQuery('.bee-microsite-iframe[data-autosize=1]').iFrameResize({heightCalculationMethod : 'max'}); });</script>";

Fixed code:
Version: 1.0.2
<script type=\"text/javascript\">jQuery(document).ready(function() { jQuery('.bee-microsite-iframe[data-autosize=1]').iFrameResize({heightCalculationMethod : 'max', checkOrigin: false}); });</script>";
CVE-2023-27494 (Python, published 2023-03-16T21:15Z)
Description: value: Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/streamlit/streamlit
Files changed:
lib/streamlit/components/v1/components.py
lib/streamlit/server/routes.py
lib/tests/streamlit/components_test.py
Commit message: Remove path from 404 response (#3165)

* Remove path from 404 response

* Remove exception output

Vulnerable code:
            self.write(f"{path} not found")
            self.write(f"{path} read error: {e}")
            raise tornado.web.HTTPError(404, "%s not found", absolute_path)
        self.assertEqual(b"invalid_component not found", response.body)
            b"components_test.test read error: Invalid content",
            b"components_test.test read error: 'utf-8' codec can't decode bytes in position 9-10: unexpected end of data",

Fixed code:
            self.write("not found")
            LOGGER.error(f"ComponentRequestHandler: GET {path} read error", exc_info=e)
            self.write("read error")
            raise tornado.web.HTTPError(404, "not found")
        self.assertEqual(b"not found", response.body)
            b"read error",
            b"read error",
CVE-2023-50248 (Unknown, published 2023-12-13T21:15Z)
Description: value: CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-130 \u2014 Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
Repository: https://github.com/ckan/ckan
Files changed:
Commit message: Merge pull request from GHSA-7fgc-89cx-w8j5

Sanitize indexes in tuple keys when flattening dicts

Vulnerable code:

Fixed code: