hitoshura25/cvefixes huggingface dataset:
CVE-2024-23341 (Unknown, published 2024-01-23T18:15Z)
Description: value: TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/i3thuan5/TuiTse-TsuSin
Files changed:
Commit message: Merge pull request #22 from i3thuan5/siu-tua-kuaho

處理大括號錯誤

Vulnerable code:

Fixed code:
CVE-2022-25897 (Java, published 2022-09-08T05:15Z)
Description: value: The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/eclipse/milo
Files changed:
opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/api/config/OpcUaServerConfigLimits.java
opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/subscriptions/SubscriptionManager.java
Commit message: Allow max MonitoredItems per session to be configured via OpcUaServerConfigLimits


Vulnerable code:
                    long maxMonitoredItems = server.getConfig().getLimits().getMaxMonitoredItems().longValue();
                    if (server.getMonitoredItemCount().incrementAndGet() <= maxMonitoredItems) {

Fixed code:
    /**
     * Get the maximum number of MonitoredItems, per Session, that can be created.
     *
     * @return the maximum number of MonitoredItems, per Session, that can be created.
     */
    default UInteger getMaxMonitoredItemsPerSession() {
        return uint(Integer.MAX_VALUE);
    }

    private final AtomicLong monitoredItemCount = new AtomicLong(0L);

                monitoredItemCount.getAndUpdate(count -> count - monitoredItems.size());
                monitoredItemCount.getAndUpdate(count -> count - deletedItems.size());
            long globalMax = server.getConfig()
                .getLimits().getMaxMonitoredItems().longValue();

            long sessionMax = server.getConfig()
                .getLimits().getMaxMonitoredItemsPerSession().longValue();

                    long globalCount = server.getMonitoredItemCount().incrementAndGet();
                    long sessionCount = monitoredItemCount.incrementAndGet();
                    if (globalCount <= globalMax && sessionCount <= sessionMax) {
                    monitoredItemCount.decrementAndGet();
                    monitoredItemCount.decrementAndGet();
                monitoredItemCount.getAndUpdate(count -> count - deletedItems.size());
                monitoredItemCount.getAndUpdate(count -> count - monitoredItems.size());

            monitoredItemCount.getAndUpdate(count -> count - subscription.getMonitoredItems().size());
CVE-2020-7780 (Scala, published 2020-11-27T17:15Z)
Description: value: This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/softwaremill/akka-http-session
Files changed:
core/src/main/scala/com/softwaremill/session/CsrfDirectives.scala
core/src/test/scala/com/softwaremill/session/CsrfDirectivesTest.scala
javaTests/src/test/java/com/softwaremill/session/javadsl/CsrfDirectivesTest.java
Commit message: Fix CSRF protection bypass #74


Vulnerable code:
            if (submitted == cookie) {

Fixed code:
            if (submitted == cookie && !cookie.isEmpty) {
  it should "reject requests if the csrf cookie and the header are empty" in {
    Get("/site") ~> routes ~> check {
      responseAs[String] should be("ok")

      Post("/transfer_money") ~>
        addHeader(Cookie(cookieName, "")) ~>
        addHeader(sessionConfig.csrfSubmittedName, "") ~>
        routes ~>
        check {
          rejections should be(List(AuthorizationFailedRejection))
        }
    }
  }

    @Test
    public void shouldRejectRequestsIfTheCsrfCookieAndTheHeaderAreEmpty() {
        // given
        final Route route = createCsrfRouteWithCheckHeaderMode();

        // when
        TestRouteResult testRouteResult = testRoute(route)
          .run(HttpRequest.GET("/site"));

        // then
        testRouteResult
          .assertStatusCode(StatusCodes.OK);

        /* second request */
        // when
        TestRouteResult testRouteResult2 = testRoute(route)
          .run(HttpRequest.POST("/transfer_money")
            .addHeader(Cookie.create(csrfCookieName, ""))
            .addHeader(RawHeader.create(csrfSubmittedName, ""))
          );

        // then
        testRouteResult2
          .assertStatusCode(StatusCodes.FORBIDDEN);

    }
CVE-2015-10049 (Python, published 2023-01-15T18:15Z)
Description: value: A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is e39645fd714adb7e549908780235911ae282b21b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218372.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/overdrive-diy/course-builder
Files changed:
coursebuilder/modules/oeditor/oeditor.html
coursebuilder/modules/oeditor/oeditor.py
coursebuilder/tests/functional/admin_settings.py
Commit message: Fix XSS vulnerability in which unescaped template values were being pasted into OEditor fields.
	Change on 2015/03/24 by jorr <jorr@google.com>
-------------
Created by MOE: http://code.google.com/p/moe-java
MOE_MIGRATED_REVID=89464922


Vulnerable code:
    cb_global.get_url = '{{ get_url }}';
    cb_global.save_url = '{{ save_url }}';
    cb_global.exit_button_caption = '{{ exit_button_caption }}';
    cb_global.exit_url = '{{ exit_url }}';
    cb_global.save_method = '{{ save_method }}';
    cb_global.delete_url = '{{ delete_url }}';
    cb_global.delete_method = '{{ delete_method }}';
    cb_global.delete_button_caption = '{{ delete_button_caption }}'
    cb_global.save_button_caption = '{{ save_button_caption }}'
        '{{ module }}'{% if not loop.last %},{% endif %}{% endfor %}];
    cb_global.delete_message = '{{ delete_message }}';
        schema.root{% for element in annotation[0] %}['{{element}}']{% endfor %}
            'exit_url': jinja2.Markup(exit_url),  # suppress & -> &amp; in url
            'cb_global.exit_url = \'dashboard?action=analytics&tab=data_pump\'',

Fixed code:
    cb_global.get_url = '{{ get_url|js_string }}';
    cb_global.save_url = '{{ save_url|js_string }}';
    cb_global.exit_button_caption = '{{ exit_button_caption|js_string }}';
    cb_global.exit_url = '{{ exit_url|js_string }}';
    cb_global.save_method = '{{ save_method|js_string }}';
    cb_global.delete_url = '{{ delete_url|js_string }}';
    cb_global.delete_method = '{{ delete_method|js_string }}';
    cb_global.delete_button_caption = '{{ delete_button_caption|js_string }}'
    cb_global.save_button_caption = '{{ save_button_caption|js_string }}'
        '{{ module|js_string }}'{% if not loop.last %},{% endif %}{% endfor %}];
    cb_global.delete_message = '{{ delete_message|js_string }}';
        schema.root{% for element in annotation[0] %}['{{element|js_string}}']{% endfor %}
            'exit_url': exit_url,
            'cb_global.exit_url = \'dashboard?action=analytics'
            '\\u0026tab=data_pump\'',
CVE-2022-24772 (Markdown, published 2022-03-18T14:15Z)
Description: value: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/digitalbazaar/forge
Files changed:
CHANGELOG.md
Commit message: Add advisory links.


Vulnerable code:

Fixed code:
  - CVE ID: [CVE-2022-24771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771)
  - GHSA ID: [GHSA-cfm4-qjh2-4765](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)
  - CVE ID: [CVE-2022-24772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772)
  - GHSA ID: [GHSA-x4jg-mjrx-434g](https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g)
  - CVE ID: [CVE-2022-24773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773)
  - GHSA ID: [GHSA-2r2c-g63r-vccr](https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr)
CVE-2022-24773 (Markdown, published 2022-03-18T14:15Z)
Description: value: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/digitalbazaar/forge
Files changed:
CHANGELOG.md
Commit message: Add advisory links.


Vulnerable code:

Fixed code:
  - CVE ID: [CVE-2022-24771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771)
  - GHSA ID: [GHSA-cfm4-qjh2-4765](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)
  - CVE ID: [CVE-2022-24772](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772)
  - GHSA ID: [GHSA-x4jg-mjrx-434g](https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g)
  - CVE ID: [CVE-2022-24773](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773)
  - GHSA ID: [GHSA-2r2c-g63r-vccr](https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr)
CVE-2020-7707 (JavaScript, published 2020-08-18T14:15Z)
Description: value: The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/jquense/expr
Files changed:
compiler.js
index.js
test.js
Commit message: fix: prototype polution vector


Vulnerable code:
  forEach(parts, function(part, isBracket, isArray, idx, parts) {
  setter: function(path) {
  getter: function(path, safe) {
  }
Cache.prototype.clear = function() {
Cache.prototype.get = function(key) {
Cache.prototype.set = function(key, value) {
  setter: function(path) {
      setCache.set(path, function setter(data, value) {
        var index = 0,
          len = parts.length
  getter: function(path, safe) {
  join: function(segments) {
    return segments.reduce(function(path, part) {
  forEach: function(path, cb, thisArg) {
  }
      split(path).map(function(part) {
      'FE43-D880-21AE': 3
    }
expr.forEach('foo.baz["bar"][1]', function(part, isBracket, isArray, idx) {

Fixed code:
  forEach(parts, function (part, isBracket, isArray, idx, parts) {
  setter: function (path) {
    if (
      path.indexOf('__proto__') !== -1 ||
      path.indexOf('constructor') !== -1 ||
      path.indexOf('prototype') !== -1
    ) {
      return (obj) => obj
    }

  getter: function (path, safe) {
  },
Cache.prototype.clear = function () {
Cache.prototype.get = function (key) {
Cache.prototype.set = function (key, value) {
  setter: function (path) {
      setCache.set(path, function setter(obj, value) {
        var index = 0
        var len = parts.length
        var data = obj

          let part = parts[index]
          if (
            part === '__proto__' ||
            part === 'constructor' ||
            part === 'prototype'
          ) {
            return obj
          }

  getter: function (path, safe) {
  join: function (segments) {
    return segments.reduce(function (path, part) {
  forEach: function (path, cb, thisArg) {
  },
      split(path).map(function (part) {
const root = (typeof global == 'object' && global) || this

      'FE43-D880-21AE': 3,
    },

  //
  ;['__proto__', 'constructor', 'prototype'].forEach((keyToTest) => {
    setter(`${keyToTest}.a`)({}, 'newValue')

    a.notEqual(root['a'], 'newValue')

    const b = 'oldValue'

    a.equal(b, 'oldValue')
    a.notEqual(root['b'], 'newValue')

    setter(`${keyToTest}.b`)({}, 'newValue')
    a.equal(b, 'oldValue')
    a.notEqual(root['b'], 'newValue')
    a.equal(root['b'], undefined)
  })
expr.forEach('foo.baz["bar"][1]', function (part, isBracket, isArray, idx) {
CVE-2018-15601 (PHP, published 2018-08-21T02:29Z)
Description: value: apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/jbroadway/elefant
Files changed:
apps/filemanager/handlers/upload/drop.php
Commit message: Decode file names before restricting extensions


Vulnerable code:
// some browsers may urlencode the file name
$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);


Fixed code:
// some browsers may urlencode the file name
$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
CVE-2018-16975 (PHP, published 2018-09-12T21:29Z)
Description: value: An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input validation in apps/designer/handlers/csspreview.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/jbroadway/elefant
Files changed:
apps/designer/handlers/csspreview.php
Commit message: Fixed CSS preview including PHP tags, re: #286


Vulnerable code:
		$page->layout = str_replace ('</head>', '<style>' . file_get_contents ($_GET['css']) . '</style></head>', $page->layout);
		$page->layout = str_replace ('</head>', '<style>' . $_POST['css'] . '</style></head>', $page->layout);

Fixed code:
		$page->layout = str_replace ('</head>', '<style>' . strip_tags (file_get_contents ($_GET['css'])) . '</style></head>', $page->layout);
		$page->layout = str_replace ('</head>', '<style>' . strip_tags ($_POST['css']) . '</style></head>', $page->layout);
CVE-2017-8342 (Python, published 2017-04-30T15:59Z)
Description: value: Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/Kozea/Radicale
Files changed:
radicale/auth.py
Commit message: Random timer to avoid timing oracles and simple bruteforce attacks

Important note: this is a security fix.


Vulnerable code:
                    if login == user:
                        return self.verify(hash_value, password)

Fixed code:
import random
import time
                    if login == user and self.verify(hash_value, password):
                        return True
        # Random timer to avoid timing oracles and simple bruteforce attacks
        time.sleep(1 + random.random())
CVE-2024-36043 (TypeScript, published 2024-05-18T20:15Z)
Description: value: question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/surveyjs/survey-library
Files changed:
src/question_image.ts
tests/question_imagetests.ts
Commit message: Image with contentMode: "youtube" allows external script execution
fixed https://github.com/surveyjs/service/issues/2174


Vulnerable code:
const youtubeTags = ["youtube.com", "youtu.be"];
  for (let i = 0; i < youtubeTags.length; i++) {
    if (url.indexOf(youtubeTags[i]) !== -1) return true;
      return getCorrectImageLink(text);
function getCorrectImageLink(val: string): string {
  if(!val || !isUrlYoutubeVideo(val)) return val;

Fixed code:
const youtubeDomains = ["www.youtube.com", "m.youtube.com", "youtube.com", "youtu.be"];
  url = url.replace(/^https?:\/\//, "");
  for (let i = 0; i < youtubeDomains.length; i++) {
    if (url.indexOf(youtubeDomains[i] + "/") === 0) return true;
      return getCorrectImageLink(text, this.contentMode == "youtube");
function getCorrectImageLink(val: string, isYouTube: boolean): string {
  if (!val || !isUrlYoutubeVideo(val)) return isYouTube ? "" : val;
  //if(!val || !isUrlYoutubeVideo(val)) return val;
  question.imageLink = "https://youtube.com/embed/tgbNymZ7vqY";
  assert.equal(question.renderedMode, "youtube");
  question.imageLink = "m.youtube.com/embed/tgbNymZ7vqY";
  assert.equal(question.renderedMode, "youtube");
  question.imageLink = "youtube.com/embed/tgbNymZ7vqY";
  assert.equal(question.renderedMode, "youtube");
  question.imageLink = "youtu.be/tgbNymZ7vqY";
  assert.equal(question.renderedMode, "youtube");
  question.imageLink = "youtu.bee/tgbNymZ7vqY";
  assert.equal(question.renderedMode, "image");
  question.imageLink = "javascript:(alert('youtu.be'))";
  assert.equal(question.renderedMode, "image");
QUnit.test("Check youtube video imagelink", function (assert) {
  const question = new QuestionImageModel("q1");
  question.contentMode = "youtube";
  question.imageLink = "https://www.youtube.com/embed/tgbNymZ7vqY";
  assert.equal(question.locImageLink.renderedHtml, "https://www.youtube.com/embed/tgbNymZ7vqY");
  question.imageLink = "javascript:alert('a')";
  assert.equal(question.locImageLink.renderedHtml, "");
  question.imageLink = "https://youtu.be/tgbNymZ7vqY";
  assert.equal(question.locImageLink.renderedHtml, "https://www.youtube.com/embed/tgbNymZ7vqY");
  question.imageLink = "javascript:alert('youtube.com')";
  assert.equal(question.locImageLink.renderedHtml, "");
  question.imageLink = "youtube.com.org";
  assert.equal(question.locImageLink.renderedHtml, "");

  question.contentMode = "image";
  question.imageLink = "videoUrl.mov";
  assert.equal(question.locImageLink.renderedHtml, "videoUrl.mov");
});
CVE-2014-2552 (PHP, published 2018-04-27T16:29Z)
Description: value: Brookins Consulting (BC) Collected Information Export extension for eZ Publish 1.1.0 does not properly restrict access, which allows remote attackers to gain access to sensitive data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/brookinsconsulting/bccie
Files changed:
settings/site.ini.append.php
Commit message: Updated: Commented out role policy override settings for greater default security of cie information


Vulnerable code:
[RoleSettings]
PolicyOmitList[]=bccie/overview
PolicyOmitList[]=bccie/export
PolicyOmitList[]=bccie/doexport

Fixed code:
#
# Uncomment the following to enable module views regardless of missing role policy configuration
#
# [RoleSettings]
# PolicyOmitList[]=bccie/overview
# PolicyOmitList[]=bccie/export
# PolicyOmitList[]=bccie/doexport