hitoshura25/cvefixes huggingface dataset:
CVE-2022-24301 (C++, published 2022-02-02T06:15Z)
Description: value: In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/minetest/minetest
Files changed:
src/network/serverpackethandler.cpp
Commit message: Prevent players accessing inventories of other players (#10341)



Vulnerable code:
		bool from_inv_is_current_player =
			(ma->from_inv.type == InventoryLocation::PLAYER) &&
			(ma->from_inv.name == player->getName());

		bool to_inv_is_current_player =
			(ma->to_inv.type == InventoryLocation::PLAYER) &&
			(ma->to_inv.name == player->getName());

Fixed code:
		bool from_inv_is_current_player = false;
		if (ma->from_inv.type == InventoryLocation::PLAYER) {
			if (ma->from_inv.name != player->getName())
				return;
			from_inv_is_current_player = true;
		}
		
		bool to_inv_is_current_player = false;
		if (ma->to_inv.type == InventoryLocation::PLAYER) {
			if (ma->to_inv.name != player->getName())
				return;
			to_inv_is_current_player = true;
		}
CVE-2022-35978 (C++, published 2022-08-15T19:15Z)
Description: value: Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
Severity: nan (CVSS v3 base score: 10)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/minetest/minetest
Files changed:
src/script/lua_api/l_settings.cpp
Commit message: Protect a few more settings from being set from mods

Of those settings main_menu_script has concrete security impact, the rest are added out of abundance of caution.


Vulnerable code:
/* This protects:
 * 'secure.*' settings from being set
 * some mapgen settings from being set
		throw LuaError("Attempt to set secure setting.");

Fixed code:
/* This protects the following from being set:
 * 'secure.*' settings
 * some security-relevant settings
 *   (better solution pending)
 * some mapgen settings
		throw LuaError("Attempted to set secure setting.");
	const char *disallowed[] = {
		"main_menu_script", "shader_path", "texture_path", "screenshot_path",
		"serverlist_file", "serverlist_url", "map-dir", "contentdb_url",
	};
	if (!is_mainmenu) {
		for (const char *name2 : disallowed) {
			if (name == name2)
				throw LuaError("Attempted to set disallowed setting.");
		}
	}
CVE-2022-22143 (JavaScript, published 2022-05-01T16:15Z)
Description: value: The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/mozilla/node-convict
Files changed:
packages/convict/src/main.js
packages/convict/test/prototype_pollution.test.js
Commit message: More complete fix against prototype pollution

first addressed in https://github.com/mozilla/node-convict/pull/384


Vulnerable code:
const ALLOWED_OPTION_STRICT = 'strict'
const ALLOWED_OPTION_WARN = 'warn'

      if (!(parentKey == '__proto__' || parentKey == 'constructor' || parentKey == 'prototype')) {
        const parent = walk(this._instance, parentKey, true)
        parent[childKey] = v
      }

Fixed code:
// Forbidden key paths, for protection against prototype pollution
const FORBIDDEN_KEY_PATHS = [
  '__proto__',
  'this.constructor.prototype',
]

const ALLOWED_OPTION_STRICT = 'strict'
const ALLOWED_OPTION_WARN = 'warn'

      for (const path of FORBIDDEN_KEY_PATHS) {
        if (k.startsWith(`${path}.`)) {
          return this
        }
      }

      const parent = walk(this._instance, parentKey, true)
      parent[childKey] = v
'use strict'

const convict = require('../')

describe('Convict prototype pollution resistance', function() {

  test('against __proto__', function() {
    const obj = {}
    const config = convict(obj)

    config.set('__proto__.polluted_proto_root', 'Polluted!')
    expect({}).not.toHaveProperty('polluted_proto_root')

    config.set('__proto__.nested.polluted_proto_nested', 'Polluted!')
    expect({}).not.toHaveProperty('nested')
    expect({}).not.toHaveProperty('nested.polluted_proto_nested')
  })

  test('against this.constructor.prototype', function() {
    const obj = {}
    const config = convict(obj)

    config.set('this.constructor.prototype.polluted_constructor_prototype_root', 'Polluted!')
    expect({}).not.toHaveProperty('polluted_constructor_prototype_root')

    config.set('this.constructor.prototype.nested.polluted_constructor_prototype_nested', 'Polluted!')
    expect({}).not.toHaveProperty('nested')
    expect({}).not.toHaveProperty('nested.polluted_constructor_prototype_nested')
  })

})
CVE-2015-0278 (C, published 2015-05-18T15:59Z)
Description: value: libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-273 \u2014 Improper Check for Dropped Privileges
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
Repository: https://github.com/libuv/libuv
Files changed:
src/unix/process.c
Commit message: unix: call setgoups before calling setuid/setgid

Partial fix for #1093


Vulnerable code:

Fixed code:
  if (options->flags & (UV_PROCESS_SETUID | UV_PROCESS_SETGID)) {
    /* When dropping privileges from root, the `setgroups` call will
     * remove any extraneous groups. If we don't call this, then
     * even though our uid has dropped, we may still have groups
     * that enable us to do super-user things. This will fail if we
     * aren't root, so don't bother checking the return value, this
     * is just done as an optimistic privilege dropping function.
     */
    SAVE_ERRNO(setgroups(0, NULL));
  }
CVE-2024-24806 (C, published 2024-02-07T22:15Z)
Description: value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/libuv/libuv
Files changed:
src/idna.c
test/test-idna.c
Commit message: fix: always zero-terminate idna output

Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6


Vulnerable code:
  if (d < de)
    *d++ = '\0';

Fixed code:
  if (d >= de)
    return UV_EINVAL;
  *d++ = '\0';
  char c[1];
  b[0] = 0x7F;
  ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 1, c, c + 1));
CVE-2024-24806 (C, published 2024-02-07T22:15Z)
Description: value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/libuv/libuv
Files changed:
src/idna.c
test/test-idna.c
Commit message: fix: reject zero-length idna inputs

Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6


Vulnerable code:

Fixed code:
  if (s == se)
    return UV_EINVAL;

  ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 0, c, c + 1));
CVE-2024-24806 (Unknown, published 2024-02-07T22:15Z)
Description: value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/libuv/libuv
Files changed:
Commit message: Merge pull request from GHSA-f74f-cvh7-c6q6

* fix: always zero-terminate idna output

* fix: reject zero-length idna inputs

* test: empty strings are not valid IDNA

---------

Co-authored-by: Santiago Gimeno <santiago.gimeno@gmail.com>

Vulnerable code:

Fixed code:
CVE-2024-24806 (C, published 2024-02-07T22:15Z)
Description: value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/libuv/libuv
Files changed:
test/test-idna.c
Commit message: test: empty strings are not valid IDNA

Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6


Vulnerable code:
  T("", "");

Fixed code:
  F("", UV_EINVAL);
CVE-2021-29060 (JavaScript, published 2021-06-21T16:15Z)
Description: value: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/Qix-/color-string
Files changed:
index.js
Commit message: fix ReDos in hwb() parser (low-severity)

Discovered by Yeting Li, c/o Colin Ife via Snyk.io.

A ReDos (Regular Expression Denial of Service) vulnerability
was responsibly disclosed to me via email by Colin on
Mar 5 2021 regarding an exponential time complexity for
linearly increasing input lengths for `hwb()` color strings.

Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.

Thank you Yeting Li and Colin Ife for bringing this to my
attention in a secure, responsible and professional manner.

A CVE will not be assigned for this vulnerability.


Vulnerable code:
	var hsl = /^hsla?\(\s*([+-]?(?:\d*\.)?\d+)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
	var hwb = /^hwb\(\s*([+-]?\d*[\.]?\d+)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;

Fixed code:
	var hsl = /^hsla?\(\s*([+-]?(?:\d{0,3}\.)?\d+)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
	var hwb = /^hwb\(\s*([+-]?\d{0,3}(?:\.\d+)?)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?[\d\.]+)\s*)?\)$/;
CVE-2014-1401 (PHP, published 2014-02-11T17:55Z)
Description: value: Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/auracms/AuraCMS
Files changed:
mod/statistik/vcounter.php
Commit message: Update VCounter

Update VCounter


Vulnerable code:
				$ip = getenv('HTTP_CLIENT_IP');
				$ip = getenv('HTTP_X_FORWARDED_FOR');
				$ip = getenv('HTTP_X_FORWARDED');
				$ip = getenv('HTTP_FORWARDED_FOR');
				$ip = getenv('HTTP_FORWARDED');
				$ip = $_SERVER['REMOTE_ADDR'];
			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('mysql_real_escape_string($this->timestamp)', 'mysql_real_escape_string($this->ip)')");
	$ip				 =	getIP();
	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='mysql_real_escape_string($ip)' AND (tm+'$locktime')>'$now'"));
		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', 'mysql_real_escape_string($ip)')");

Fixed code:
				$ip = mysql_real_escape_string(getenv('HTTP_CLIENT_IP'));
				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED_FOR'));
				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED'));
				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED_FOR'));
				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED'));
				$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('$this->timestamp', '$this->ip')");
	$ip				 =	mysql_real_escape_string(getIP());
	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='$ip' AND (tm+'$locktime')>'$now'"));
		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', '$ip')");
CVE-2014-1401 (PHP, published 2014-02-11T17:55Z)
Description: value: Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/auracms/AuraCMS
Files changed:
mod/content/content.php
Commit message: AuraCMS

Update Vulnerability SQL Injection in content.php


Vulnerable code:
		$search	= !isset($_GET['search']) ? cleanText($_POST['search']) : cleanText($_GET['search']);

Fixed code:
		$search	= !isset($_GET['search']) ? mysqli_real_escape_string(cleanText($_POST['search'])) : mysqli_real_escape_string(cleanText($_GET['search']));
CVE-2023-42444 (Unknown, published 2023-09-19T15:15Z)
Description: value: phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/whisperfish/rust-phonenumber
Files changed:
Commit message: Merge branch 'advisory-fix-1'

Fixes a panic vulnerability CVE-2023-42444

See advisory https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2


Vulnerable code:

Fixed code:
CVE-2024-39697 (Unknown, published 2024-07-09T15:15Z)
Description: value: phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/whisperfish/rust-phonenumber
Files changed:
Commit message: Merge branch 'proptest' for CVE-2024-39697


Vulnerable code:

Fixed code: