hitoshura25/cvefixes huggingface dataset:
CVE-2019-25157 (Other, published 2023-12-19T03:15Z)
Description: value: A vulnerability was found in Ethex Contracts. It has been classified as critical. This affects an unknown part of the file EthexJackpot.sol of the component Monthly Jackpot Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 6b8664b698d3d953e16c284fadc6caeb9e58e3db. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248271.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/ethex-bet/ethex-contracts
Files changed:
EthexJackpot.sol
Commit message: Security vulnerability issue fixed

Issue described here https://bitcointalk.org/index.php?topic=5120151.msg50827730#msg50827730

Vulnerable code:
    
    function loadTickets(address payable[] calldata addresses, uint256[] calldata numbers) external {
        for (uint i = 0; i < addresses.length; i++)
            tickets[numbers[i]] = addresses[i];
    }
    
        firstNumber = numberEnd;

Fixed code:

        dailyAmount = 0;
        weeklyAmount = 0;
        monthlyAmount = 0;
        seasonalAmount = 0;
        firstNumber = weeklyNumberStart;
        for (uint256 i = firstNumber; i <= numberEnd; i++)
            tickets[i] = previousContract.getAddress(i);
CVE-2023-3302 (PHP, published 2023-06-23T13:15Z)
Description: value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/admidio/admidio
Files changed:
adm_program/system/classes/ListConfiguration.php
Commit message: Excel export could lead to execute apps #1433


Vulnerable code:
            $outputContent = $content;

Fixed code:
            $content = preg_replace("/\t/", "\\t", $content);
            $content = preg_replace("/\r?\n/", "\\n", $content);
            $outputContent = preg_replace("/^[@=+-]/", "#", $content);
CVE-2024-27918 (Go, published 2024-03-21T02:52Z)
Description: value: Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider.

Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is remedied in versions 2.8.4, 2.7.3, and 2.6.1 All versions prior to these patches are affected by the vulnerability.*It is recommended that customers upgrade their deployments as soon as possible if they are utilizing OIDC authentication with the `CODER_OIDC_EMAIL_DOMAIN` setting.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/coder/coder
Files changed:
coderd/userauth.go
coderd/userauth_test.go
Commit message: Merge pull request from GHSA-7cc2-r658-7xpf

This fixes a vulnerability with the `CODER_OIDC_EMAIL_DOMAIN` option,
where users with a superset of the allowed email domain would be allowed
to login. For example, given `CODER_OIDC_EMAIL_DOMAIN=google.com`, a
user would be permitted entry if their email domain was
`colin-google.com`.

Vulnerable code:
			if strings.HasSuffix(strings.ToLower(email), strings.ToLower(domain)) {
				Message: fmt.Sprintf("Your email %q is not in domains %q !", email, api.OIDCConfig.EmailDomain),

Fixed code:
		emailSp := strings.Split(email, "@")
		if len(emailSp) == 1 {
			httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
				Message: fmt.Sprintf("Your email %q is not in domains %q!", email, api.OIDCConfig.EmailDomain),
			})
			return
		}
		userEmailDomain := emailSp[len(emailSp)-1]
			if strings.EqualFold(userEmailDomain, domain) {
				Message: fmt.Sprintf("Your email %q is not in domains %q!", email, api.OIDCConfig.EmailDomain),
	}, {
		Name: "EmailDomainSubset",
		IDTokenClaims: jwt.MapClaims{
			"email":          "colin@gmail.com",
			"email_verified": true,
		},
		AllowSignups: true,
		EmailDomain: []string{
			"mail.com",
		},
		StatusCode: http.StatusForbidden,
CVE-2014-125111 (PHP, published 2024-04-08T13:15Z)
Description: value: A vulnerability was found in namithjawahar Wp-Insert up to 2.0.8 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.9 is able to address this issue. The name of the patch is a07b7b08084b9b85859f3968ce7fde0fd1fcbba3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-259628.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/wp-insert
Files changed:
includes/common/popups/categories.php
includes/common/popups/chitika.php
includes/common/popups/countries.php
includes/common/popups/instances.php
includes/common/popups/pages.php
includes/common/popups/posts.php
readme.txt
wp-insert.php
Commit message: XSS Exploit Fix.

git-svn-id: https://plugins.svn.wordpress.org/wp-insert/trunk@831372 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(adCode);
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo (string)$_GET['target']; ?>').val(selectedItems.join(','));
Stable tag: 2.0.8
Version: 2.0.8

Fixed code:
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(adCode);
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
				parent.jQuery('#<?php echo wp_kses((string)$_GET['target'], ''); ?>').val(selectedItems.join(','));
Stable tag: 2.0.9
Version: 2.0.9
CVE-2022-1187 (PHP, published 2022-04-19T21:15Z)
Description: value: The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/macbookandrew/wp-youtube-live
Files changed:
inc/admin.php
Commit message: Fix a reflected cross-site scripting vulnerability

CVE-2022-1187

Vulnerable code:
        die( 'Invalid nonce.' . var_export( $_POST, true ) );

Fixed code:
        die( 'Invalid nonce.');
CVE-2020-11014 (Python, published 2020-04-28T20:15Z)
Description: value: Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the ability to issue new tokens or permanently destroy future minting capability. This is fixed version 3.6.2.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/simpleledger/Electron-Cash-SLP
Files changed:
gui/qt/slp_create_token_mint_dialog.py
Commit message: patch for critical vulnerability in mint tool
related to #126

This commit fixes an issue where the order of SLP outputs could be reordered because the "mandatory_coins" parameter was not being used as it should be with all SLP transactions.  Reordering the output addresses could sometimes cause the token mint baton receiver and token receiver addresses to be switched.


Vulnerable code:
            tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None)
        # Find & Add baton to tx inputs
        try:
            baton_utxo = self.main_window.wallet.get_slp_token_baton(self.token_id_e.text())
        except SlpNoMintingBatonFound:
            self.show_message(_("There is no minting baton found for this token."))
            return

        tx.add_inputs([baton_utxo])
        for txin in tx._inputs:
            self.main_window.wallet.add_input_info(txin)

Fixed code:
            tx = self.main_window.wallet.make_unsigned_transaction(coins, outputs, self.main_window.config, fee, None, mandatory_coins=[baton_input])
CVE-2017-1000492 (JavaScript, published 2018-01-03T01:29Z)
Description: value: Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/leanote/desktop-app
Files changed:
public/js/app/note.js
Commit message: Starred notes XXS


Vulnerable code:
    $("#noteTitle").val(note.Title);
        var t = tt(me.starItemT, note.NoteId, note.Title || getMsg('Untitled'));

Fixed code:
    var title = note.Title || '';
    title = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>');
    $("#noteTitle").val(title);
        var t = tt(me.starItemT, note.NoteId, trimTitle(note.Title) || getMsg('Untitled'));
CVE-2012-1107 (C++, published 2012-09-06T18:55Z)
Description: value: The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted sampleRate in an ape file, which triggers a divide-by-zero error.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/taglib/taglib
Files changed:
taglib/ape/apeproperties.cpp
Commit message: Make sure to not try dividing by zero


Vulnerable code:
  d->length = totalBlocks / d->sampleRate;

Fixed code:
  d->length = d->sampleRate > 0 ? totalBlocks / d->sampleRate : 0;
CVE-2012-1108 (C++, published 2012-09-06T18:55Z)
Description: value: The parse function in ogg/xiphcomment.cpp in TagLib 1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted vendorLength field in an ogg file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/taglib/taglib
Files changed:
taglib/ogg/xiphcomment.cpp
Commit message: Be more careful when parsing Vorbis Comments


Vulnerable code:
  int commentFields = data.mid(pos, 4).toUInt(false);
  for(int i = 0; i < commentFields; i++) {
    int commentLength = data.mid(pos, 4).toUInt(false);

Fixed code:
  uint commentFields = data.mid(pos, 4).toUInt(false);
  if(commentFields > (data.size() - 8) / 4) {
    return;
  }

  for(uint i = 0; i < commentFields; i++) {
    uint commentLength = data.mid(pos, 4).toUInt(false);
    if(pos > data.size()) {
      break;
    }
    if(commentSeparatorPosition == -1) {
      break;
    }
CVE-2012-1584 (C++, published 2012-09-06T18:55Z)
Description: value: Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/taglib/taglib
Files changed:
taglib/toolkit/tbytevector.cpp
Commit message: Avoid uint overflow in case the length + index is over UINT_MAX


Vulnerable code:
  if(length < 0xffffffff && length + index < size())

Fixed code:
  if(length < size() - index)
CVE-2017-12678 (C++, published 2017-08-08T01:34Z)
Description: value: In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/taglib/taglib
Files changed:
taglib/mpeg/id3v2/id3v2framefactory.cpp
Commit message: Don't assume TDRC is an instance of TextIdentificationFrame (#831)

If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame
which causes problems in rebuildAggregateFrames() when it is assumed
that TDRC is a TextIdentificationFrame

Vulnerable code:
      static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
    if(tdrc->fieldList().size() == 1 &&

Fixed code:
      dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
    if(tdrc &&
       tdrc->fieldList().size() == 1 &&
CVE-2017-7501 (C, published 2017-11-22T22:29Z)
Description: value: It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rpm-software-management/rpm
Files changed:
lib/fsm.c
Commit message: Don't follow symlinks on file creation (CVE-2017-7501)

Open newly created files with O_EXCL to prevent symlink tricks.
When reopening hardlinks for writing the actual content, use append
mode instead. This is compatible with the write-only permissions but
is not destructive in case we got redirected to somebody elses file,
verify the target before actually writing anything.

As these are files with the temporary suffix, errors mean a local
user with sufficient privileges to break the installation of the package
anyway is trying to goof us on purpose, don't bother trying to mend it
(we couldn't fix the hardlink case anyhow) but just bail out.

Based on a patch by Florian Festi.


Vulnerable code:
static int expandRegular(rpmfi fi, const char *dest, rpmpsm psm, int nodigest, int nocontent)
	wfd = Fopen(dest, "w.ufdio");
	    rc = expandRegular(fi, dest, psm, nodigest, 1);
	    rc = expandRegular(fi, dest, psm, nodigest, 0);
	    rc = expandRegular(fi, dest, psm, nodigest, 0);
	    rc = expandRegular(fi, fn, psm, nodigest, 0);

Fixed code:
/* Check dest is the same, empty and regular file with writeonly permissions */
static int linkSane(FD_t wfd, const char *dest)
{
    struct stat sb, lsb;

    return (fstat(Fileno(wfd), &sb) == 0 && sb.st_size == 0 &&
	    (sb.st_mode & ~S_IFMT) == S_IWUSR &&
	    lstat(dest, &lsb) == 0 && S_ISREG(lsb.st_mode) &&
	    sb.st_dev == lsb.st_dev && sb.st_ino == lsb.st_ino);
}

static int expandRegular(rpmfi fi, const char *dest, rpmpsm psm, int exclusive, int nodigest, int nocontent)
	wfd = Fopen(dest, exclusive ? "wx.ufdio" : "a.ufdio");

	/* If reopening, make sure the file is what we expect */
	if (!exclusive && wfd != NULL && !linkSane(wfd, dest)) {
	    rc = RPMERR_OPEN_FAILED;
	    goto exit;
	}
	    rc = expandRegular(fi, dest, psm, 1, nodigest, 1);
	    rc = expandRegular(fi, dest, psm, 1, nodigest, 0);
	    rc = expandRegular(fi, dest, psm, 0, nodigest, 0);
	    rc = expandRegular(fi, fn, psm, 0, nodigest, 0);
CVE-2021-35938 (C, published 2022-08-25T20:15Z)
Description: value: A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Severity: nan (CVSS v3 base score: 6.7)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rpm-software-management/rpm
Files changed:
lib/fsm.c
Commit message: Set file metadata via fd-based ops for everything but symlinks

Regular file ops are fd-based already, for the rest we need to open them
manually. Files with temporary suffix must never be followed, for
directories (and pre-existing FA_TOUCHed files) use the rpm symlink
"root or target owner allowed" rule wrt following.

This mostly fixes CVE-2021-35938, but as we're not yet using dirfd-based
operatiosn for everything there are corner cases left undone. And then
there's the plugin API which needs updating for all this.


Vulnerable code:

Fixed code:
	    if (!rc && fd == -1 && !S_ISLNK(fp->sb.st_mode)) {
		/* Only follow safe symlinks, and never on temporary files */
		fd = fsmOpenat(di.dirfd, fp->fpath,
				fp->suffix ? AT_SYMLINK_NOFOLLOW : 0);
		if (fd < 0)
		    rc = RPMERR_OPEN_FAILED;
	    }
CVE-2023-49292 (Go, published 2023-12-05T00:15Z)
Description: value: ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ecies/go
Files changed:
privatekey.go
publickey.go
Commit message: fix: additional security checks added


Vulnerable code:
		return nil, fmt.Errorf("public key is empty")

Fixed code:
	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
		return nil, fmt.Errorf("invalid public key")
	}

	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
		return nil, fmt.Errorf("invalid public key")
	}

	if !k.Curve.IsOnCurve(k.X, k.Y) {
		return nil, fmt.Errorf("invalid public key")
	}

		return nil, fmt.Errorf("private key is empty")
CVE-2021-4213 (Java, published 2022-08-24T16:15Z)
Description: value: A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/dogtagpki/jss
Files changed:
src/main/java/org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java
Commit message: Additional fix for TLS connection I missed from original patch

Vulnerable code:
	    event.setEngine(this);
            event.setEngine(this);

Fixed code:
CVE-2022-24300 (C++, published 2022-02-02T06:15Z)
Description: value: Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/minetest/minetest
Files changed:
src/itemstackmetadata.cpp
Commit message: Sanitize ItemStack meta text


Vulnerable code:
	bool result = Metadata::setString(name, var);
	if (name == TOOLCAP_KEY)

Fixed code:
#include <algorithm>
static void sanitize_string(std::string &str)
{
	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_START), str.end());
	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_KV_DELIM), str.end());
	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_PAIR_DELIM), str.end());
}

	std::string clean_name = name;
	std::string clean_var = var;
	sanitize_string(clean_name);
	sanitize_string(clean_var);

	bool result = Metadata::setString(clean_name, clean_var);
	if (clean_name == TOOLCAP_KEY)