hitoshura25/cvefixes huggingface dataset:
CVE-2024-1109 (PHP, published 2024-02-07T11:15Z)
Description: value: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the init_download() and init() functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracking data and podcast information.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/podlove/podlove-publisher
Files changed:
lib/modules/import_export/export/podcast_exporter.php
lib/modules/import_export/export/tracking_exporter.php
lib/modules/import_export/import_export.php
readme.txt
Commit message: fix: add missing capability check and nonce validation to exporter functions


Vulnerable code:
            return;
		<a href="?podlove_export=1" class="button"><?php echo __('Export Podcast Data', 'podlove-podcasting-plugin-for-wordpress'); ?></a>
						} 
							window.location = window.location + "&podlove_export_tracking=1";
					data: {action: 'podlove-export-tracking'},
					dataType: 'json',
					success: function(result) {
					}
				window.setTimeout(podlove_check_export_status, 2000);
		</script>		
			<input type="file" name="podlove_import"/> 
		</form>		
		</form>		

Fixed code:
            if (!current_user_can('administrator')) {
                return;
            }

            if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_export')) {
                return;
            }

            if (!current_user_can('administrator')) {
                exit;
            }

            if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_export_tracking_download')) {
                exit;
            }

        if (!current_user_can('administrator')) {
            exit;
        }

        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_export_tracking')) {
            exit;
        }

            exit;
		<a href="?podlove_export=1&_podlove_nonce=<?php echo wp_create_nonce('podlove_export'); ?>" class="button"><?php echo __('Export Podcast Data', 'podlove-podcasting-plugin-for-wordpress'); ?></a>
						}
							window.location = window.location + "&podlove_export_tracking=1&_podlove_nonce=<?php echo wp_create_nonce('podlove_export_tracking_download'); ?>";
					data: {action: 'podlove-export-tracking', _podlove_nonce: '<?php echo wp_create_nonce('podlove_export_tracking'); ?>'},
					dataType: 'json'
				}).done(function(result) {
				    window.setTimeout(podlove_check_export_status, 2000);
		</script>
			<input type="file" name="podlove_import"/>
		</form>
		</form>
- add missing capability check and nonce validation to exporter functions
CVE-2024-1110 (PHP, published 2024-02-07T11:15Z)
Description: value: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/podlove/podlove-publisher
Files changed:
lib/modules/import_export/import/podcast_importer.php
lib/modules/import_export/import/tracking_importer.php
lib/modules/import_export/import_export.php
readme.txt
Commit message: fix: add missing capability check and nonce validation to importer functions


Vulnerable code:

Fixed code:
        if (!current_user_can('administrator')) {
            return;
        }

        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import')) {
            return;
        }

        if (!current_user_can('administrator')) {
            return;
        }

        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import_tracking')) {
            return;
        }

			<?php wp_nonce_field('podlove_import', '_podlove_nonce'); ?>
			<?php wp_nonce_field('podlove_import_tracking', '_podlove_nonce'); ?>
**Security**

- add missing capability check and nonce validation to importer functions
CVE-2021-4250 (Ruby, published 2022-12-18T22:15Z)
Description: value: A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.3 is able to address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/cgriego/active_attr
Files changed:
lib/active_attr/typecasting/boolean_typecaster.rb
Commit message: fix ReDoS vulnerability (#185)

resolve https://github.com/cgriego/active_attr/issues/184

Co-authored-by: wonda-tea-coffee <rikita.ishikawa@crowdworks.co.jp>

Vulnerable code:
        when Numeric, /\A[-+]?(0+\.?0*|0*\.?0+)\z/ then !value.to_f.zero?

Fixed code:
        when Numeric, /\A[-+]?(0++\.?0*|0*+\.?0+)\z/ then !value.to_f.zero?
CVE-2018-7998 (Other, published 2018-03-09T19:29Z)
Description: value: In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/jcupitt/libvips
Files changed:
ChangeLog
libvips/foreign/foreign.c
libvips/include/vips/foreign.h
Commit message: fix a crash with delayed load

If a delayed load failed, it could leave the pipeline only half-set up.
Sebsequent threads could then segv.

Set a load-has-failed flag and test before generate.

See https://github.com/jcupitt/libvips/issues/893


Vulnerable code:
		if( class->load( load ) ||
			vips_image_pio_input( load->real ) ) 
			return( NULL );

		/* ->header() read the header into @out, load has read the
		if( !vips_foreign_load_iscompat( load->real, out ) )

Fixed code:
- fix a crash if a delayed load failed [gsharpsh00ter]
 * 5/3/18
 * 	- block _start if one start fails, see #893
	/* If this start has failed before in another thread, we can fail now.
	 */
	if( load->error )
		return( NULL );

		/* Load the image and check the result.
		 *
		 * ->header() read the header into @out, load has read the
		 *
		 * If the load fails, we need to stop
		if( class->load( load ) ||
			vips_image_pio_input( load->real ) || 
			vips_foreign_load_iscompat( load->real, out ) ) {
			vips_operation_invalidate( VIPS_OPERATION( load ) ); 
			load->error = TRUE;

		}

	/* Set if a start function fails. We want to prevent the other starts
	 * from also triggering the load.
	 */
	gboolean error;
CVE-2018-7998 (Other, published 2018-03-09T19:29Z)
Description: value: In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/jcupitt/libvips
Files changed:
ChangeLog
libvips/foreign/foreign.c
libvips/include/vips/foreign.h
Commit message: fix a crash with delayed load

If a delayed load failed, it could leave the pipeline only half-set up.
Sebsequent threads could then segv.

Set a load-has-failed flag and test before generate.

See https://github.com/jcupitt/libvips/issues/893


Vulnerable code:
		if( class->load( load ) ||
			vips_image_pio_input( load->real ) ) 
			return( NULL );

		/* ->header() read the header into @out, load has read the
		if( !vips_foreign_load_iscompat( load->real, out ) )

Fixed code:
- fix a crash if a delayed load failed [gsharpsh00ter]
 * 5/3/18
 * 	- block _start if one start fails, see #893
	/* If this start has failed before in another thread, we can fail now.
	 */
	if( load->error )
		return( NULL );

		/* Load the image and check the result.
		 *
		 * ->header() read the header into @out, load has read the
		 *
		 * If the load fails, we need to stop
		if( class->load( load ) ||
			vips_image_pio_input( load->real ) || 
			vips_foreign_load_iscompat( load->real, out ) ) {
			vips_operation_invalidate( VIPS_OPERATION( load ) ); 
			load->error = TRUE;

		}

	/* Set if a start function fails. We want to prevent the other starts
	 * from also triggering the load.
	 */
	gboolean error;
CVE-2023-22457 (JavaScript, published 2023-01-04T15:15Z)
Description: value: CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki. The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1. There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/xwiki-contrib/application-ckeditor
Files changed:
application-ckeditor-plugins/src/main/resources/xwiki-source/plugin.js
application-ckeditor-ui/src/main/resources/CKEditor/HTMLConverter.xml
Commit message: CKEDITOR-475: Add form token check to HTMLConverter


Vulnerable code:
          language: $('html').attr('lang') || ''
#if ($toHTML || $fromHTML)

Fixed code:
          language: $('html').attr('lang') || '',
          formToken: document.documentElement.dataset.xwikiFormToken || ''
#if (($toHTML || $fromHTML) &amp;&amp; $services.csrf.isTokenValid($request.formToken))
CVE-2020-11073 (Unknown, published 2020-05-13T19:15Z)
Description: value: In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could run arbitrary code without any user interaction. This is fixed in version: 1.16.0
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/MichaelAquilina/zsh-autoswitch-virtualenv
Files changed:
Commit message: Merge pull request #123 from MichaelAquilina/fix/insecure_activation

fix: insecure activation of virtualenvs

Vulnerable code:

Fixed code:
CVE-2017-5207 (Other, published 2017-03-23T16:59Z)
Description: value: Firejail before 0.9.44.4, when running a bandwidth command, allows local users to gain root privileges via the --shell argument.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/netblue30/firejail
Files changed:
RELNOTES
src/firejail/bandwidth.c
Commit message: security fix


Vulnerable code:
	if (!cfg.shell)
		cfg.shell = guess_shell();
	if (!cfg.shell) {
		fprintf(stderr, "Error: no POSIX shell found, please use --shell command line option\n");
		exit(1);
	}

	arg[0] = cfg.shell;

Fixed code:
  * security: --bandwidth root shel found by Martin Carpenter
	arg[0] = "/bin/sh";
CVE-2019-12589 (C, published 2019-06-03T03:29Z)
Description: value: In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/netblue30/firejail
Files changed:
src/firejail/firejail.h
src/firejail/fs_lib.c
src/firejail/preproc.c
src/firejail/sandbox.c
Commit message: mount runtime seccomp files read-only (#2602)

avoid creating locations in the file system that are both writable and
executable (in this case for processes with euid of the user).

for the same reason also remove user owned libfiles
when it is not needed any more

Vulnerable code:
#define RUN_SECCOMP_LIST	"/run/firejail/mnt/seccomp.list"	// list of seccomp files installed
#define RUN_SECCOMP_PROTOCOL	"/run/firejail/mnt/seccomp.protocol"	// protocol filter
#define RUN_SECCOMP_CFG	"/run/firejail/mnt/seccomp"			// configured filter
#define RUN_SECCOMP_32	"/run/firejail/mnt/seccomp.32"		// 32bit arch filter installed on 64bit architectures
#define RUN_SECCOMP_MDWX	"/run/firejail/mnt/seccomp.mdwx"		// filter for memory-deny-write-execute
#define RUN_SECCOMP_BLOCK_SECONDARY	"/run/firejail/mnt/seccomp.block_secondary"	// secondary arch blocking filter
#define RUN_SECCOMP_POSTEXEC	"/run/firejail/mnt/seccomp.postexec"		// filter for post-exec library
#define RUN_RESOLVCONF_FILE	"/run/firejail/mnt/resolv.conf"
	// set capabilities
	set_caps();


Fixed code:
#define RUN_SECCOMP_DIR	"/run/firejail/mnt/seccomp"
#define RUN_SECCOMP_LIST	"/run/firejail/mnt/seccomp/seccomp.list"	// list of seccomp files installed
#define RUN_SECCOMP_PROTOCOL	"/run/firejail/mnt/seccomp/seccomp.protocol"	// protocol filter
#define RUN_SECCOMP_CFG	"/run/firejail/mnt/seccomp/seccomp"			// configured filter
#define RUN_SECCOMP_32		"/run/firejail/mnt/seccomp/seccomp.32"		// 32bit arch filter installed on 64bit architectures
#define RUN_SECCOMP_MDWX	"/run/firejail/mnt/seccomp/seccomp.mdwx"		// filter for memory-deny-write-execute
#define RUN_SECCOMP_BLOCK_SECONDARY	"/run/firejail/mnt/seccomp/seccomp.block_secondary"	// secondary arch blocking filter
#define RUN_SECCOMP_POSTEXEC	"/run/firejail/mnt/seccomp/seccomp.postexec"		// filter for post-exec library
	unlink(RUN_LIB_FILE);
		create_empty_dir_as_root(RUN_SECCOMP_DIR, 0755);

	// make seccomp filters read-only
	fs_rdonly(RUN_SECCOMP_DIR);
	// set capabilities
	set_caps();
CVE-2017-20159 (Ruby, published 2022-12-31T11:15Z)
Description: value: A vulnerability was found in rf Keynote up to 0.x on Rails. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/keynote/rumble.rb. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 05be4356b0a6ca7de48da926a9b997beb5ffeb4a. It is recommended to upgrade the affected component. VDB-217142 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rf-/keynote
Files changed:
lib/keynote/rumble.rb
spec/rumble_spec.rb
Commit message: Always escape quotes in attributes; support array attrs

The current behavior is to pass HTML-safe strings through unaltered, but
this can still cause an XSS vulnerability if the string has an unescaped
quote in it:

    https://github.com/rails/rails/commit/4394e9075189ee6031944491aecd64fb269cdf54

I also added support for array attributes, since I noticed Rails does
it when I was copying their escaping code.


Vulnerable code:
          if value
            value = (value == true) ? name : Rumble.html_escape(value)
            res << " #{name}=\"#{value}\""
          end
      <div data-modal="true" data-test="&quot;test&quot;"></div>
      div data: { modal: true, test: '"test"' }

Fixed code:
          next unless value

          value =
            if value.is_a?(Array)
              value.map { |val| Rumble.html_escape(val) }.join(" ")
            elsif value == true
              name
            else
              Rumble.html_escape(value)
            end

          res << " #{name}=\"#{value.gsub('"'.freeze, '&quot;'.freeze)}\""
      <div data-modal="true" data-safe="&quot;&quot;&quot;" data-unsafe="&quot;&amp;quot;&quot;">
      </div>
    HTML

    assert_rumble str do
      div data: { modal: true, safe: '"&quot;"'.html_safe, unsafe: '"&quot;"' }
    end
  end

  def test_array_attrs
    str = <<-HTML
      <div class="hello &quot;uns&amp;amp;fe&quot; &quot;w&amp;rld&quot;">
      </div>
      div class: ["hello", '"uns&amp;fe"', '"w&amp;rld"'.html_safe]
CVE-2019-6009 (Ruby, published 2019-09-12T17:15Z)
Description: value: Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/shirasagi/shirasagi
Files changed:
app/controllers/concerns/sns/login_filter.rb
Commit message: [fix] sns/login: close open redirect (#2061)



Vulnerable code:
    elsif params[:ref] =~ /^\//

Fixed code:
    elsif params[:ref] =~ /^\/[^\/]/
CVE-2023-52138 (C, published 2024-02-05T15:15Z)
Description: value: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.

Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/mate-desktop/engrampa
Files changed:
src/fr-command-cpio.c
src/fr-command-unarchiver.c
Commit message: Use unar instead of cpio for CPIO archives


Vulnerable code:
const char *cpio_mime_type[] = { "application/x-cpio", NULL };
	if (is_program_available (CPIO_PATH, check_command))
		capabilities |= FR_COMMAND_CAN_READ;

Fixed code:
const char *cpio_mime_type[] = { /*"application/x-cpio",*/ NULL };
/*	if (is_program_available (CPIO_PATH, check_command))
		capabilities |= FR_COMMAND_CAN_READ;*/
				       "application/x-cpio",
CVE-2023-52138 (C, published 2024-02-05T15:15Z)
Description: value: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa.

Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/mate-desktop/engrampa
Files changed:
src/fr-command-cpio.c
src/fr-command-unarchiver.c
Commit message: Use unar instead of cpio for CPIO archives


Vulnerable code:
const char *cpio_mime_type[] = { "application/x-cpio", NULL };
	if (is_program_available (CPIO_PATH, check_command))
		capabilities |= FR_COMMAND_CAN_READ;

Fixed code:
const char *cpio_mime_type[] = { /*"application/x-cpio",*/ NULL };
/*	if (is_program_available (CPIO_PATH, check_command))
		capabilities |= FR_COMMAND_CAN_READ;*/
				       "application/x-cpio",
CVE-2013-0266 (Other, published 2013-03-08T21:55Z)
Description: value: manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/puppetlabs/puppetlabs-cinder
Files changed:
manifests/base.pp
Commit message: Restrict permissions on cinder configuration

Prior to this commit, the puppetlabs-cinder module applied the mode
0644 to the File[$::cinder::params::cinder_conf] resource which
were too permissive. This commit explicitly sets the mode to 0600.


Vulnerable code:
  file { $::cinder::params::cinder_conf: }

Fixed code:
  file { $::cinder::params::cinder_conf:
    mode => '0600',
  }