hitoshura25/cvefixes huggingface dataset:
CVE-2023-49281 (Python, published 2023-12-01T22:15Z)
Description: value: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Cainor/Calendarinho
Files changed:
CalendarinhoApp/authentication.py
Commit message: Full Fix for Open Redirect Issue #1


Vulnerable code:
                if next_url and next_url.startswith('/'):

Fixed code:
from django.utils.http import url_has_allowed_host_and_scheme
                if (next_url and url_has_allowed_host_and_scheme(next_url, settings.ALLOWED_HOSTS)):
                    print("Good People")
                    print("fucking bad shit")
CVE-2018-13785 (C, published 2018-07-09T13:29Z)
Description: value: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/glennrp/libpng
Files changed:
pngrutil.c
Commit message: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)


Vulnerable code:
         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
          + 1 + (png_ptr->interlaced? 6: 0));
         idat_limit=PNG_UINT_31_MAX;

Fixed code:
         (size_t)png_ptr->width
         * (size_t)png_ptr->channels
         * (png_ptr->bit_depth > 8? 2: 1)
         + 1
         + (png_ptr->interlaced? 6: 0);
         idat_limit = PNG_UINT_31_MAX;
CVE-2018-13785 (C, published 2018-07-09T13:29Z)
Description: value: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/glennrp/libpng
Files changed:
pngrutil.c
Commit message: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)


Vulnerable code:
         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
          + 1 + (png_ptr->interlaced? 6: 0));
         idat_limit=PNG_UINT_31_MAX;

Fixed code:
         (size_t)png_ptr->width
         * (size_t)png_ptr->channels
         * (png_ptr->bit_depth > 8? 2: 1)
         + 1
         + (png_ptr->interlaced? 6: 0);
         idat_limit = PNG_UINT_31_MAX;
CVE-2020-36660 (Python, published 2023-02-06T17:15Z)
Description: value: A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/paxswill/evesrp
Files changed:
src/evesrp/views/api.py
Commit message: Security Vuln: Check API access to entity details

Access through the /api/user/<id> and /api/group/<id> routes were not
properly being checked. This meant that anyone could easily enumerate
users and groups.

User information disclosed would include which SRP groups a user is
in, whether they are an admin, which permissions a user has been
granted, as well as the details for every SRP request that user has
submitted, including the character name for the loss. The authentication
source (Test Auth, EVE SSO, etc) for the user would also be disclosed
through the requests, along with the ID associated with that
authentication method.

Group information disclosed would include the group name, permissions
granted within that group, as well as all members of the group.

v0.12.2 is going to be released shortly addressing this vulnerability.
A large thank you to the individual who brought this to my attention.


Vulnerable code:

Fixed code:
@login_required
    if not current_user.admin and not \
            current_user.has_permission(PermissionType.admin):
        abort(403)
@login_required
    if not current_user.admin and not \
            current_user.has_permission(PermissionType.admin):
        abort(403)
CVE-2023-49006 (PHP, published 2023-12-19T10:15Z)
Description: value: Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/phpsysinfo/phpsysinfo
Files changed:
phpsysinfo.ini.new
read_config.php
Commit message: Disable JSONP data mode by default for security reasons


Vulnerable code:

Fixed code:
; Enable JSONP data mode (e.g. /phpsysinfo/xml.php?plugin=complete&jsonp&callback=getData)
; Disabled by default for security reasons.
; - false : JSONP data mode disabled
; - true : JSONP data mode enabled
;
;JSONP=false

    if (isset($_GET['jsonp']) && (!defined('PSI_JSONP') || !PSI_JSONP)) {
        echo "JSONP data mode not enabled in phpsysinfo.ini.";
        die();
    }
CVE-2022-0839 (Other, published 2022-03-04T15:15Z)
Description: value: Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/liquibase/liquibase
Files changed:
liquibase-core/src/test/groovy/liquibase/parser/core/xml/XMLChangeLogSAXParserTest.groovy
Commit message: Added liquibase.secureParsing test


Vulnerable code:
        <!ENTITY insecure SYSTEM "https://localhost/insecure">
        e.message.contains("Failed to read external document 'insecure'")
        e.message.contains("Connection refused")

Fixed code:
        <!ENTITY insecure SYSTEM "file://invalid.txt">
        e.message.contains("access is not allowed due to restriction set by the accessExternalDTD property")
        e.message.contains("Error Reading Changelog File: invalid.txt")
CVE-2015-0228 (Other, published 2015-03-08T02:59Z)
Description: value: The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/apache/httpd
Files changed:
CHANGES
modules/lua/lua_request.c
Commit message: *) SECURITY: CVE-2015-0228 (cve.mitre.org)
     mod_lua: A maliciously crafted websockets PING after a script
     calls r:wsupgrade() can cause a child process crash.
     [Edward Lu <Chaosed0 gmail.com>]

Discovered by Guido Vranken <guidovranken gmail.com>

Submitted by: Edward Lu
Committed by: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1657261 13f79535-47bb-0310-9956-ffa450edef68


Vulnerable code:
                lua_websocket_read(L); /* read the next frame instead */

Fixed code:
  *) SECURITY: CVE-2015-0228 (cve.mitre.org)
     mod_lua: A maliciously crafted websockets PING after a script
     calls r:wsupgrade() can cause a child process crash. 
     [Edward Lu <Chaosed0 gmail.com>]

    int do_read = 1;
    while (do_read) { 
    do_read = 0;
                do_read = 1;
    }
CVE-2015-0253 (Other, published 2015-07-20T23:59Z)
Description: value: The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/apache/httpd
Files changed:
CHANGES
server/protocol.c
Commit message: *) SECURITY: CVE-2015-0253 (cve.mitre.org)
     core: Fix a crash introduced in with ErrorDocument 400 pointing
     to a local URL-path with the INCLUDES filter active, introduced
     in 2.4.11. PR 57531. [Yann Ylavic]


Submitted By: ylavic
Committed By: covener





git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1664205 13f79535-47bb-0310-9956-ffa450edef68


Vulnerable code:
                r->proto_num = HTTP_VERSION(1,0);
                r->protocol  = apr_pstrdup(r->pool, "HTTP/1.0");

Fixed code:
  *) SECURITY: CVE-2015-0253 (cve.mitre.org)
     core: Fix a crash introduced in with ErrorDocument 400 pointing
     to a local URL-path with the INCLUDES filter active, introduced
     in 2.4.11. PR 57531. [Yann Ylavic]

            r->proto_num = HTTP_VERSION(1,0);
            r->protocol  = apr_pstrdup(r->pool, "HTTP/1.0");
CVE-2017-9798 (Other, published 2017-09-18T15:29Z)
Description: value: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/apache/httpd
Files changed:
CHANGES
server/core.c
Commit message: core: Disallow Methods' registration at run time (.htaccess), they may be
used only if registered at init time (httpd.conf).

Calling ap_method_register() in children processes is not the right scope
since it won't be shared for all requests.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1807655 13f79535-47bb-0310-9956-ffa450edef68


Vulnerable code:

Fixed code:
  *) core: Disallow Methods' registration at runtime (.htaccess), they may be
     used only if registered at init time (httpd.conf).  [Yann Ylavic]

            if (cmd->pool == cmd->temp_pool) {
                /* In .htaccess, we can't globally register new methods. */
                return apr_psprintf(cmd->pool, "Could not register method '%s' "
                                   "for %s from .htaccess configuration",
                                    method, cmd->cmd->name);
            }
CVE-2020-14001 (Ruby, published 2020-07-17T16:15Z)
Description: value: The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/gettalong/kramdown
Files changed:
lib/kramdown/options.rb
lib/kramdown/parser/kramdown/extensions.rb
test/testcases/block/12_extension/options.text
Commit message: Add option forbidden_inline_options

It is sometimes necessary to restrict the options that can be set
inline, ie. using the {::options ...} extensions.

By default, the template option is now forbidden to avoid possible
security problems. This addresses CVE-2020-14001.


Vulnerable code:

Fixed code:
    define(:forbidden_inline_options, Object, %w[template], <<~EOF) do |val|
      Defines the options that may not be set using the {::options} extension

      Default: template
      Used by: HTML converter
    EOF
      val.map! {|item| item.kind_of?(String) ? str_to_sym(item) : item }
      simple_array_validator(val, :forbidden_inline_options)
    end

              if @options[:forbidden_inline_options].include?(k) ||
                  k == :forbidden_inline_options
                warning("Option #{k} may not be set inline")
                next false
              end


{::options template="/etc/passwd" /}
CVE-2022-39379 (Ruby, published 2022-11-02T13:15Z)
Description: value: Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/fluent/fluentd
Files changed:
lib/fluent/oj_options.rb
Commit message: Remove `object` from the available list of `FLUENT_OJ_OPTION_MODE`

There is less benefit by this option in actual, and it will instroduce
serious security risk since it can execute arbitrary Ruby code.
We remove it since keeping it secure is difficult.

ref: GHSL-2022-067

Signed-off-by: Takuro Ashie <ashie@clear-code.com>


Vulnerable code:
      'mode': %i[strict null compat json rails object custom]

Fixed code:
      'mode': %i[strict null compat json rails custom]
CVE-2020-24391 (JSON, published 2021-03-30T21:15Z)
Description: value: mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mongo-express/mongo-express
Files changed:
HISTORY.md
package.json
Commit message: Bump 1.0.0-alpha.1


Vulnerable code:
  "version": "0.54.0",

Fixed code:
# 1.0-alpha.1 - Mon Jun 22, 2020
Brekaing:
- Change mongo-query-parser to 2.0. This changes how parsing works altogether and drop support for some advanced syntax but is safer [(#528)](https://github.com/mongo-express/mongo-express/pull/#528)
- Rewrite the connection module to use mongo as much as possible and update mongodb to 3.5 [(#528)](https://github.com/mongo-express/mongo-express/pull/#528)

New:
- Add csv extension in file export [(#578)](https://github.com/mongo-express/mongo-express/pull/#578)
- Don't drop the collection on Delete docs action when no query is provided. [(#502)](https://github.com/mongo-express/mongo-express/pull/#502)
- Fix broken delete document for UUID (BinData 3 & 4) [(#538)](https://github.com/mongo-express/mongo-express/pull/#538)

Deps:
- Bump lodash to 4.6.2 [(#525)](https://github.com/mongo-express/mongo-express/pull/#525)


  "version": "1.0.0-alpha.1",
CVE-2021-21422 (Unknown, published 2021-06-21T19:15Z)
Description: value: mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mongo-express/mongo-express
Files changed:
Commit message: Merge pull request from GHSA-7p8h-86p5-wv3p

- Fix several XSS vulnerabilities

Vulnerable code:

Fixed code:
CVE-2013-2130 (C++, published 2014-06-05T20:55Z)
Description: value: ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/znc/znc
Files changed:
modules/webadmin.cpp
Commit message: Fix NULL pointer dereference in webadmin.

Triggerable by any non-admin, if webadmin is loaded.

The only affected version is 1.0

Thanks to ChauffeR (Simone Esposito) for reporting this.


Vulnerable code:
			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {

Fixed code:
			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
CVE-2018-14055 (C++, published 2018-07-15T01:29Z)
Description: value: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/znc/znc
Files changed:
src/Client.cpp
src/IRCSock.cpp
Commit message: Better cleanup lines coming from network.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.


Vulnerable code:
    sLine.TrimRight("\n\r");
    sLine.TrimRight("\n\r");

Fixed code:
    sLine.Replace("\n", "");
    sLine.Replace("\r", "");
    sLine.Replace("\n", "");
    sLine.Replace("\r", "");
CVE-2018-14055 (C++, published 2018-07-15T01:29Z)
Description: value: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/znc/znc
Files changed:
src/Config.cpp
Commit message: Don't let attackers inject rogue values into znc.conf

Because of this vulnerability, existing ZNC users could get Admin
permissions.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.


Vulnerable code:
            File.Write(sIndentation + it.first + " = " + sValue + "\n");
            File.Write(sIndentation + "<" + it.first + " " + it2.first + ">\n");
            File.Write(sIndentation + "</" + it.first + ">\n");

Fixed code:
    auto SingleLine = [](const CString& s) {
        return s.Replace_n("\r", "").Replace_n("\n", "");
    };

            File.Write(SingleLine(sIndentation + it.first + " = " + sValue) +
                       "\n");
            File.Write(SingleLine(sIndentation + "<" + it.first + " " +
                                  it2.first + ">") +
                       "\n");
            File.Write(SingleLine(sIndentation + "</" + it.first + ">") + "\n");