hitoshura25/cvefixes huggingface dataset:
CVE-2023-35931 (JavaScript, published 2023-06-23T20:15Z)
Description: value: Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug has been patched in version 1.7.1.



Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-526 \u2014 Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.
Repository: https://github.com/ericcornelissen/shescape
Files changed:
CHANGELOG.md
src/win/cmd.js
test/fixtures/win.js
test/fuzz/_common.cjs
testing.js
Commit message: Test coverage for environment variables (#982)

Add e2e test coverage for environment variables and add escaping of `%`
for CMD. ALso include `%` in test fixtures for all shells on Windows.

The new test cases for environment variables are also included in the
`shescape/testing` injectionStrings.

Vulnerable code:
    .replace(/(["&<>|])/gu, "^$1");
function getExpectedOutput({ arg, shell }, normalizeWhitespace) {
export const injectionStrings = ["\x00world", "&& ls", "'; ls #", '"; ls #'];

Fixed code:
- Add `%` escaping for CMD. ([#982])
- Expand injection strings to cover environment variables. ([#982])
[#982]: https://github.com/ericcornelissen/shescape/pull/982
    .replace(/(["%&<>|])/gu, "^$1");
    .replace(/%/gu, "^%")
    "percentage signs ('%')": [
      {
        input: "a%b",
        expected: { interpolation: "a^%b", noInterpolation: "a%b" },
      },
      {
        input: "a%b%c",
        expected: { interpolation: "a^%b^%c", noInterpolation: "a%b%c" },
      },
    ],
    "percentage signs ('%')": [
      {
        input: "a%b",
        expected: { interpolation: "a%b", noInterpolation: "a%b" },
      },
      {
        input: "a%b%c",
        expected: { interpolation: "a%b%c", noInterpolation: "a%b%c" },
      },
    ],
    "percentage signs ('%')": [
      {
        input: "a%b",
        expected: '"a^%b"',
      },
      {
        input: "a%b%c",
        expected: '"a^%b^%c"',
      },
    ],
    "percentage signs ('%')": [
      {
        input: "a%b",
        expected: '"a%b"',
      },
      {
        input: "a%b%c",
        expected: '"a%b%c"',
      },
    ],
 * @param {boolean} args.quoted Was `arg` quoted prior to echoing.
function getExpectedOutput({ arg, quoted, shell }, normalizeWhitespace) {
  // Adjust % for shell when quoted
  if (isShellCmd(shell) && quoted) {
    arg = arg.replace(/%/gu, "^%");
  }

export const injectionStrings = [
  "\x00world",
  "&& ls",
  "'; ls #",
  '"; ls #',
  "$PATH",
  "$Env:PATH",
  "%PATH%",
];
CVE-2024-29901 (TypeScript, published 2024-03-29T16:15Z)
Description: value: The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/workos/authkit-nextjs
Files changed:
src/session.ts
Commit message: always control the x-workos-session header (#17)



Vulnerable code:
    const response = NextResponse.next();

Fixed code:
  newRequestHeaders.delete(sessionHeaderName);

    const response = NextResponse.next({
      request: { headers: newRequestHeaders },
    });
CVE-2013-2061 (C, published 2013-11-18T02:55Z)
Description: value: The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/OpenVPN/openvpn
Files changed:
src/openvpn/buffer.h
src/openvpn/crypto.c
Commit message: Use constant time memcmp when comparing HMACs in openvpn_decrypt.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Signed-off-by: Gert Doering <gert@greenie.muc.de>


Vulnerable code:
	  if (memcmp (local_hmac, BPTR (buf), hmac_len))

Fixed code:
/**
 * Compare src buffer contents with match.
 * *NOT* constant time. Do not use when comparing HMACs.
 */
/**
 * Compare first size bytes of src buffer contents with match.
 * *NOT* constant time. Do not use when comparing HMACs.
 */
/**
 * As memcmp(), but constant-time.
 * Returns 0 when data is equal, non-zero otherwise.
 */
static int
memcmp_constant_time (const void *a, const void *b, size_t size) {
  const uint8_t * a1 = a;
  const uint8_t * b1 = b;
  int ret = 0;
  size_t i;

  for (i = 0; i < size; i++) {
      ret |= *a1++ ^ *b1++;
  }

  return ret;
}

	  if (memcmp_constant_time (local_hmac, BPTR (buf), hmac_len))
CVE-2018-9336 (C, published 2018-05-01T18:29Z)
Description: value: openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/OpenVPN/openvpn
Files changed:
src/openvpnserv/interactive.c
Commit message: Fix potential double-free() in Interactive Service (CVE-2018-9336)

Malformed input data on the service pipe towards the OpenVPN interactive
service (normally used by the OpenVPN GUI to request openvpn instances
from the service) can result in a double free() in the error handling code.

This usually only leads to a process crash (DoS by an unprivileged local
account) but since it could possibly lead to memory corruption if
happening while multiple other threads are active at the same time,
CVE-2018-9336 has been assigned to acknowledge this risk.

Fix by ensuring that sud->directory is set to NULL in GetStartUpData()
for all error cases (thus not being free()ed in FreeStartupData()).

Rewrite control flow to use explicit error label for error exit.

Discovered and reported by Jacob Baines <jbaines@tenable.com>.

CVE: 2018-9336

Signed-off-by: Gert Doering <gert@greenie.muc.de>
Acked-by: Selva Nair <selva.nair@gmail.com>
Message-Id: <20180414072617.25075-1-gert@greenie.muc.de>
URL: https://www.mail-archive.com/search?l=mid&q=20180414072617.25075-1-gert@greenie.muc.de

Signed-off-by: Gert Doering <gert@greenie.muc.de>


Vulnerable code:
    BOOL ret = FALSE;
        goto out;
        goto out;
        goto out;
        goto out;
        goto out;
        goto out;
        goto out;
    data = NULL; /* don't free data */
    ret = TRUE;
out:
    return ret;

Fixed code:
        goto err;
        goto err;
        goto err;
        goto err;
        goto err;
        goto err;
        goto err;
    return TRUE;
err:
    sud->directory = NULL;		/* caller must not free() */
    return FALSE;
CVE-2024-39905 (Python, published 2024-07-11T16:15Z)
Description: value: Red is a fully modular Discord bot. Due to a bug in Red's Core API, 3rd-party cogs using the `@commands.can_manage_channel()` command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory. The problem was patched and released in version 3.5.10.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cog-Creators/Red-DiscordBot
Files changed:
redbot/core/commands/requires.py
Commit message: Fix `@commands.can_manage_channel` always passing (#6398)



Vulnerable code:
    privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
    return _can_manage_channel_deco(allow_thread_owner)
    return _can_manage_channel_deco(PrivilegeLevel.GUILD_OWNER, allow_thread_owner)
    return _can_manage_channel_deco(PrivilegeLevel.ADMIN, allow_thread_owner)
    return _can_manage_channel_deco(PrivilegeLevel.MOD, allow_thread_owner)

Fixed code:
    *, privilege_level: Optional[PrivilegeLevel] = None, allow_thread_owner: bool = False
    return _can_manage_channel_deco(allow_thread_owner=allow_thread_owner)
    return _can_manage_channel_deco(
        privilege_level=PrivilegeLevel.GUILD_OWNER, allow_thread_owner=allow_thread_owner
    )
    return _can_manage_channel_deco(
        privilege_level=PrivilegeLevel.ADMIN, allow_thread_owner=allow_thread_owner
    )
    return _can_manage_channel_deco(
        privilege_level=PrivilegeLevel.MOD, allow_thread_owner=allow_thread_owner
    )
CVE-2022-4397 (PHP, published 2022-12-10T19:15Z)
Description: value: A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/Comment.php of the component Comment Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 36b2d4abe20a6245e4f8df7a4b14e130b24d429d. It is recommended to apply a patch to fix this issue. VDB-215250 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/morontt/zend-blog-number-2
Files changed:
application/controllers/IndexController.php
application/forms/Comment.php
application/views/scripts/index/formcomment.phtml
Commit message: Add CSRF-token for comments


Vulnerable code:
                $this->saveComment($topicId, $url, $formData);

Fixed code:
        $form->getElement('csrfToken')->setValue($this->generateCommentToken());
                if ($this->validCommentToken($formData['csrfToken'])) {
                    $this->saveComment($topicId, $url, $formData);
                }


    private function generateCommentToken($time = null): string
    {
        $time = $time ?? time();
        $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';

        return base64_encode($time . ':' . hash('md5', 'MD5_' . $userAgent . $time, true));
    }

    private function validCommentToken($token): bool
    {
        $raw = base64_decode($token, true);
        if ($raw === false) {
            return false;
        }

        $position = strpos($raw, ':');
        if ($position === false) {
            return false;
        }

        $time = substr($raw, 0, $position);

        return hash_equals($this->generateCommentToken($time), $token);
    }
        $csrfToken = new Zend_Form_Element_Hidden('csrfToken');
        $csrfToken->addValidator('NotEmpty');
        $this->addElement($csrfToken);

        <?php echo $this->form->csrfToken; ?>
CVE-2022-24899 (PHP, published 2022-05-06T00:15Z)
Description: value: Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/contao/contao
Files changed:
core-bundle/src/Resources/contao/pages/PageRegular.php
Commit message: Merge pull request from GHSA-m8x6-6r63-qvj2



Vulnerable code:
		$this->Template->robots = $headBag->getMetaRobots();
			$this->Template->canonical = $headBag->getCanonicalUriForRequest($request);

Fixed code:
		$this->Template->robots = htmlspecialchars($headBag->getMetaRobots());
			$this->Template->canonical = htmlspecialchars($headBag->getCanonicalUriForRequest($request));
CVE-2023-29200 (PHP, published 2023-04-25T18:15Z)
Description: value: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/contao/contao
Files changed:
core-bundle/src/Resources/contao/drivers/DC_Folder.php
Commit message: Merge pull request from GHSA-fp7q-xhhw-6rj3



Vulnerable code:
		if (empty($this->arrFilemounts))

Fixed code:
		$this->isValid($strFolder);

		if (!is_dir($this->strRootDir . '/' . $strFolder) || !$this->isMounted($strFolder))
		{
			throw new AccessDeniedException('Folder "' . $strFolder . '" is not mounted or cannot be found.');
		}

		if (empty($this->arrFilemounts) && !\is_array($GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root']) && $GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root'] !== false)
CVE-2023-36806 (PHP, published 2023-07-25T19:15Z)
Description: value: Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/contao/contao
Files changed:
core-bundle/src/Resources/contao/widgets/InputUnit.php
core-bundle/src/Resources/contao/widgets/TimePeriod.php
core-bundle/src/Resources/contao/widgets/TrblField.php
Commit message: Merge pull request from GHSA-4gpr-p634-922x



Vulnerable code:
	/**
	 * Units
	 * @var array
	 */
	protected $arrUnits = array();

				$this->arrUnits = StringUtil::deserialize($varValue);
	 * Do not validate unit fields
	 *
			if ($k != 'unit')
		foreach ($this->arrUnits as $arrUnit)
	/**
	 * Units
	 * @var array
	 */
	protected $arrUnits = array();

				$this->arrUnits = StringUtil::deserialize($varValue);
	 * Do not validate unit fields
	 *
			if ($k != 'unit')
		if (empty($this->arrUnits))
			$this->arrUnits = array(array('value'=>'', 'label'=>'-'));
		foreach ($this->arrUnits as $arrUnit)
	/**
	 * Units
	 * @var array
	 */
	protected $arrUnits = array();

				$this->arrUnits = StringUtil::deserialize($varValue);
	 * Do not validate unit fields
	 *
			if ($k != 'unit')
		foreach ($this->arrUnits as $arrUnit)

Fixed code:
				$this->arrOptions = StringUtil::deserialize($varValue);
			if ($k == 'unit')
			{
				if (!$this->isValidOption($v))
				{
					$varInput[$k] = '';
					$this->addError($GLOBALS['TL_LANG']['ERR']['invalid']);
				}
			}
			else
		foreach ($this->arrOptions as $arrUnit)
				$this->arrOptions = StringUtil::deserialize($varValue);
			if ($k == 'unit')
			{
				if (!$this->isValidOption($v))
				{
					$varInput[$k] = '';
					$this->addError($GLOBALS['TL_LANG']['ERR']['invalid']);
				}
			}
			else
		if (empty($this->arrOptions))
			$this->arrOptions = array(array('value'=>'', 'label'=>'-'));
		foreach ($this->arrOptions as $arrUnit)
				$this->arrOptions = StringUtil::deserialize($varValue);
			if ($k == 'unit')
			{
				if (!$this->isValidOption($v))
				{
					$varInput[$k] = '';
					$this->addError($GLOBALS['TL_LANG']['ERR']['invalid']);
				}
			}
			else
		foreach ($this->arrOptions as $arrUnit)
CVE-2023-36806 (PHP, published 2023-07-25T19:15Z)
Description: value: Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/contao/contao
Files changed:
core-bundle/contao/widgets/InputUnit.php
core-bundle/contao/widgets/TimePeriod.php
core-bundle/contao/widgets/TrblField.php
Commit message: Merge pull request from GHSA-4gpr-p634-922x



Vulnerable code:
	/**
	 * Units
	 * @var array
	 */
	protected $arrUnits = array();

				$this->arrUnits = StringUtil::deserialize($varValue);
	 * Do not validate unit fields
	 *
			if ($k != 'unit')
		foreach ($this->arrUnits as $arrUnit)
	/**
	 * Units
	 * @var array
	 */
	protected $arrUnits = array();

				$this->arrUnits = StringUtil::deserialize($varValue);
	 * Do not validate unit fields
	 *
			if ($k != 'unit')
		if (empty($this->arrUnits))
			$this->arrUnits = array(array('value'=>'', 'label'=>'-'));
		foreach ($this->arrUnits as $arrUnit)
	/**
	 * Units
	 * @var array
	 */
	protected $arrUnits = array();

				$this->arrUnits = StringUtil::deserialize($varValue);
	 * Do not validate unit fields
	 *
			if ($k != 'unit')
		foreach ($this->arrUnits as $arrUnit)

Fixed code:
				$this->arrOptions = StringUtil::deserialize($varValue);
			if ($k == 'unit')
			{
				if (!$this->isValidOption($v))
				{
					$varInput[$k] = '';
					$this->addError($GLOBALS['TL_LANG']['ERR']['invalid']);
				}
			}
			else
		foreach ($this->arrOptions as $arrUnit)
				$this->arrOptions = StringUtil::deserialize($varValue);
			if ($k == 'unit')
			{
				if (!$this->isValidOption($v))
				{
					$varInput[$k] = '';
					$this->addError($GLOBALS['TL_LANG']['ERR']['invalid']);
				}
			}
			else
		if (empty($this->arrOptions))
			$this->arrOptions = array(array('value'=>'', 'label'=>'-'));
		foreach ($this->arrOptions as $arrUnit)
				$this->arrOptions = StringUtil::deserialize($varValue);
			if ($k == 'unit')
			{
				if (!$this->isValidOption($v))
				{
					$varInput[$k] = '';
					$this->addError($GLOBALS['TL_LANG']['ERR']['invalid']);
				}
			}
			else
		foreach ($this->arrOptions as $arrUnit)
CVE-2024-28191 (PHP, published 2024-04-09T14:15Z)
Description: value: Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/contao/contao
Files changed:
core-bundle/src/Resources/contao/library/Contao/Input.php
core-bundle/src/String/SimpleTokenParser.php
core-bundle/tests/String/SimpleTokenParserTest.php
Commit message: Merge pull request from GHSA-747v-52c4-8vj8

# Conflicts:
#	core-bundle/src/String/SimpleTokenParser.php
#	core-bundle/tests/Contao/InputTest.php

Co-authored-by: Leo Feyer <1192057+leofeyer@users.noreply.github.com>

Vulnerable code:
		return str_replace(array('{{', '}}'), array('&#123;&#123;', '&#125;&#125;'), (string) $varValue);
                return $data[$matches[1]];
            '{if token=="foo"}',
            '{if token=="foo"}',

Fixed code:
		$varValue = str_replace(array('{{', '}}'), array('&#123;&#123;', '&#125;&#125;'), (string) $varValue);

		// Encode single curly braces at the beginning and end of the string
		return preg_replace(array('/^(\s*)\{|\{(\s*)$/', '/^(\s*)\}|\}(\s*)$/'), array('$1&#123;$2', '$1&#125;$2'), $varValue);
use Contao\Input;
                return Input::encodeInsertTags($data[$matches[1]]);
        yield 'Test regular curly braces do not get encoded' => [
            '##token##',
            ['token' => 'foo { bar } baz'],
            'foo { bar } baz',
        ];

            '&#123;if token=="foo"&#125;',
        ];

        yield 'Test insert tags insertion not possible' => [
            '##token##',
            ['token' => '{{date}}'],
            '&#123;&#123;date&#125;&#125;',
            '&#123;if token=="foo"&#125;',
        ];

        yield 'Test insert tags insertion not possible with multiple tokens' => [
            '##token1####token2####token3##',
            ['token1' => '{', 'token2' => '{date}', 'token3' => '}'],
            '&#123;&#123;date&#125;&#125;',