hitoshura25/cvefixes huggingface dataset:
CVE-2021-29506 (Java, published 2021-05-13T19:15Z)
Description: value: GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a regular expression injection vulnerability that may lead to Denial of Service. This has been patched in 2.4 and 3.0 See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/graphhopper/graphhopper
Files changed:
navigation/src/main/java/com/graphhopper/navigation/NavigateResource.java
Commit message: avoid regex in navigate module (#2304)

* replace two regexs with one indexOf

* make check stricter

* use @easbar's suggestion

Vulnerable code:

        url = url.replaceFirst("/navigate/directions/v5/gh/" + profile + "/", "");
        url = url.replaceAll("\\?[*]", "");



Fixed code:
        String urlStart = "/navigate/directions/v5/gh/" + profile + "/";
        if (!url.startsWith(urlStart)) throw new IllegalArgumentException("Incorrect URL " + url);
        url = url.substring(urlStart.length());
CVE-2020-15085 (Unknown, published 2020-06-30T17:15Z)
Description: value: In Saleor Storefront before version 2.10.3, request data used to authenticate customers was inadvertently cached in the browser's local storage mechanism, including credentials. A malicious user with direct access to the browser could extract the email and password. In versions prior to 2.10.0 persisted the cache even after the user logged out. This is fixed in version 2.10.3. A workaround is to manually clear application data (browser's local storage) after logging into Saleor Storefront.
Severity: LOW (CVSS v3 base score: 6.1)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/mirumee/saleor-storefront
Files changed:
Commit message: Merge pull request from GHSA-4279-h39w-2jqm

Do not store passwords in localStorage

Vulnerable code:

Fixed code:
CVE-2015-8747 (Python, published 2016-02-03T18:59Z)
Description: value: The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/Unrud/Radicale
Files changed:
radicale/storage/multifilesystem.py
Commit message: Convert component names safely to filenames
Component names are controlled by the user and
without this checks access to arbitrary files is
possible if the multifilesystem backend is used.


Vulnerable code:

Fixed code:
            if not pathutils.is_safe_filesystem_path_component(name):
                log.LOGGER.debug(
                    "Can't tranlate name safely to filesystem, "
                    "skipping component: %s", name)
                continue
        if not pathutils.is_safe_filesystem_path_component(name):
            log.LOGGER.debug(
                "Can't tranlate name safely to filesystem, "
                "skipping component: %s", name)
            return
CVE-2015-8748 (Python, published 2016-02-03T18:59Z)
Description: value: Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/Unrud/Radicale
Files changed:
radicale/rights/regex.py
Commit message: Prevent "regex injection"

If an attacker is able to authenticate with a user name like .* he can bypass limitations imposed by "owner_write" and "owner_only".

Vulnerable code:
    regex = ConfigParser({"login": user, "path": collection_url})

Fixed code:
    # Prevent "regex injection"
    user_escaped = re.escape(user)
    collection_url_escaped = re.escape(collection_url)
    regex = ConfigParser({"login": user_escaped, "path": collection_url_escaped})
CVE-2022-26874 (PHP, published 2022-03-11T07:15Z)
Description: value: lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/Mime_Viewer
Files changed:
doc/Horde/Mime/Viewer/changelog.yml
lib/Horde/Mime/Viewer/Ooo.php
Commit message: [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).


Vulnerable code:
  notes: |+
    
                            'data' => str_replace(array_keys($tags), array_values($tags), $content),

Fixed code:
  notes: |
    [jan] Fix XSS vulnerability in Open Document mime viewer with different code path (Reported by: Mahdi Pasche <pasche@b1-systems.de>).
    |+
                            'data' => Horde_Text_Filter::filter(
                                str_replace(array_keys($tags), array_values($tags), $content),
                                'xss'
                            ),
CVE-2013-1800 (Ruby, published 2013-04-09T20:55Z)
Description: value: The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/jnunemaker/crack
Files changed:
lib/crack/xml.rb
test/xml_test.rb
Commit message: Remove support for symbol and yaml.


Vulnerable code:
  self.typecasts["symbol"]        = lambda{|v| v.nil? ? nil : v.to_sym}
  self.typecasts["yaml"]          = lambda{|v| v.nil? ? nil : YAML.load(v)}
    
  
    
    
    
    
  
        <content type="yaml"></content>
      'content'    => nil,
        <content type="yaml">--- \n1: should be an integer\n:message: Have a nice day\narray: \n- should-have-dashes: true\n  should_have_underscores: true\n</content>
      # Changed this line where the key is :message.  The yaml specifies this as a symbol, and who am I to change what you specify
      # The line in ActiveSupport is
      # 'content' => { 'message' => "Have a nice day", 1 => "should be an integer", "array" => [{ "should-have-dashes" => true, "should_have_underscores" => true }] },
      'content' => { :message => "Have a nice day", 1 => "should be an integer", "array" => [{ "should-have-dashes" => true, "should_have_underscores" => true }] },
      'resident' => :yes
  
  
end

Fixed code:







      'resident' => 'yes',


end
CVE-2020-13432 (Other, published 2020-06-08T18:15Z)
Description: value: rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/rejetto/hfs2
Files changed:
main.dfm
main.pas
scriptLib.pas
Commit message: limit URL parameters to 1000 characters


Vulnerable code:
  ClientHeight = 391
  ClientWidth = 913
    Width = 913
    Width = 913
    Width = 913
    Width = 913
    Width = 913
    Height = 308
      Height = 197
      Top = 197
      Width = 913
      Width = 597
      Height = 197
        Width = 597
        Height = 174
        Width = 597
          Width = 337
          Left = 337
      Height = 197
        Height = 174
      Top = 202
      Width = 913
        Width = 913
        Width = 913
    Left = 248
    Top = 320
        Checked = True
    data.urlvars[i]:=decodeURL(ansistring(data.urlvars[i]));
      begin
      result:=fullMacro;
      exit;
      end;

Fixed code:
  ClientHeight = 483
  ClientWidth = 879
    Width = 879
    Width = 879
    Width = 879
    ExplicitWidth = 976
    Width = 879
    ExplicitWidth = 976
    Width = 879
    Height = 400
    ExplicitWidth = 976
      Height = 289
      Top = 289
      Width = 879
      Width = 563
      Height = 289
      ExplicitWidth = 660
        Width = 563
        Height = 266
        ExplicitWidth = 660
        Width = 563
        ExplicitWidth = 660
          Width = 303
          ExplicitWidth = 400
          Left = 303
          ExplicitLeft = 400
      Height = 289
        Height = 266
      Top = 294
      Width = 879
      ExplicitWidth = 976
        Width = 879
        ExplicitWidth = 976
        Width = 879
            Width = 100
        ExplicitWidth = 976
    Left = 264
    Top = 408
  const
    MAX = 1000;
    begin
    s:=decodeURL(ansistring(data.urlvars[i]));
    if length(s) > MAX then
      setLength(s, MAX);
    data.urlvars[i]:=s;
    end;
      exit(fullMacro);
CVE-2023-28753 (C, published 2023-05-18T22:15Z)
Description: value: netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap memory corruption with attacker controlled data.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/netconsd
Files changed:
ncrx/libncrx.c
Commit message: ensure fragment offset is less than total length

Summary:
when messages are received in fragments, we need to make sure the offset value is less than the length of all fragments to be received.

CVE-2023-28753

Reviewed By: kernelslacker

Differential Revision: D44277643

fbshipit-source-id: 8b4b163503a5574b05c0a185b615de61442a0309


Vulnerable code:

Fixed code:
			    nf_off >= nf_len ||
CVE-2021-3845 (TypeScript, published 2022-01-04T17:15Z)
Description: value: ws-scrcpy is vulnerable to External Control of File Name or Path
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-73 \u2014 External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Repository: https://github.com/netristv/ws-scrcpy
Files changed:
src/server/services/HttpServer.ts
Commit message: fix: file access outside the public dir


Vulnerable code:

Fixed code:
            if (pathname.indexOf(publicDir) !== 0) {
                res.statusCode = 403;
                res.end();
                return;
            }
CVE-2023-0901 (Unknown, published 2023-02-18T01:15Z)
Description: value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pixelfed/pixelfed
Files changed:
Commit message: Merge pull request #4102 from pixelfed/staging

Update email form

Vulnerable code:

Fixed code:
CVE-2023-0914 (PHP, published 2023-02-19T01:15Z)
Description: value: Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pixelfed/pixelfed
Files changed:
app/Http/Controllers/BookmarkController.php
Commit message: Update BookmarkController


Vulnerable code:

Fixed code:
use App\Services\FollowerService;
        abort_if(!in_array($status->scope, ['public', 'unlisted', 'private']), 404);

        if($status->scope == 'private') {
            abort_if(
                $profile->id !== $status->profile_id && !FollowerService::follows($profile->id, $status->profile_id),
                404,
                'Error: Cannot bookmark private posts from accounts you do not follow.'
            );
        }
CVE-2024-25108 (Unknown, published 2024-02-12T20:15Z)
Description: value: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-280 \u2014 Improper Handling of Insufficient Permissions or Privileges 
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Repository: https://github.com/pixelfed/pixelfed
Files changed:
Commit message: Merge pull request from GHSA-gccq-h3xj-jgvf

[staging] Implement proper OAuth authorization on API endpoints

Vulnerable code:

Fixed code:
CVE-2024-25108 (Unknown, published 2024-02-12T20:15Z)
Description: value: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/pixelfed/pixelfed
Files changed:
Commit message: Merge pull request from GHSA-gccq-h3xj-jgvf

[staging] Implement proper OAuth authorization on API endpoints

Vulnerable code:

Fixed code:
CVE-2024-25108 (Unknown, published 2024-02-12T20:15Z)
Description: value: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/pixelfed/pixelfed
Files changed:
Commit message: Merge pull request from GHSA-gccq-h3xj-jgvf

[staging] Implement proper OAuth authorization on API endpoints

Vulnerable code:

Fixed code:
CVE-2017-0375 (Other, published 2017-06-09T17:29Z)
Description: value: The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/torproject/tor
Files changed:
changes/trove-2017-004
src/or/connection_edge.c
Commit message: TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_

This fixes an assertion failure in relay_send_end_cell_from_edge_() when an
origin circuit and a cpath_layer = NULL were passed.

A service rendezvous circuit could do such a thing when a malformed BEGIN cell
is received but shouldn't in the first place because the service needs to send
an END cell on the circuit for which it can not do without a cpath_layer.

Fixes #22493

Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>


Vulnerable code:
  if (!CIRCUIT_IS_ORIGIN(circ))
    relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, NULL);
                                    END_STREAM_REASON_NOTDIRECTORY, NULL);
                                  END_STREAM_REASON_INTERNAL, NULL);
                                    END_STREAM_REASON_EXITPOLICY, NULL);
    origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ);
                                    origin_circ->cpath->prev);

Fixed code:
  o Major bugfixes (hidden service, relay):
    - Fix an assertion failure when an hidden service handles a malformed
      BEGIN cell. This bug resulted in the service crashing triggered by a
      tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on
      tor-0.3.0.1-alpha. Found by armadev.
  origin_circuit_t *origin_circ = NULL;
  crypt_path_t *layer_hint = NULL;
  if (!CIRCUIT_IS_ORIGIN(circ)) {
  } else {
    tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED);
    origin_circ = TO_ORIGIN_CIRCUIT(circ);
    layer_hint = origin_circ->cpath->prev;
  }
    relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, layer_hint);
                                  END_STREAM_REASON_NOTDIRECTORY, layer_hint);
                                  END_STREAM_REASON_INTERNAL, layer_hint);
                                    END_STREAM_REASON_EXITPOLICY, layer_hint);
    tor_assert(origin_circ);
                                    layer_hint);
CVE-2017-0376 (Other, published 2017-06-09T17:29Z)
Description: value: The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/torproject/tor
Files changed:
changes/trove-2017-005
src/or/relay.c
Commit message: TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell

On an hidden service rendezvous circuit, a BEGIN_DIR could be sent
(maliciously) which would trigger a tor_assert() because
connection_edge_process_relay_cell() thought that the circuit is an
or_circuit_t but is an origin circuit in reality.

Fixes #22494

Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>


Vulnerable code:
      if (rh.command == RELAY_COMMAND_BEGIN_DIR) {

Fixed code:
  o Major bugfixes (hidden service, relay, security):
    - Fix an assertion failure caused by receiving a BEGIN_DIR cell on
      a hidden service rendezvous circuit. Fixes bug 22494, tracked as
      TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found
      by armadev.


      if (rh.command == RELAY_COMMAND_BEGIN_DIR &&
          circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
CVE-2017-0380 (Other, published 2017-09-18T16:29Z)
Description: value: The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/torproject/tor
Files changed:
changes/trove-2017-008
src/or/rendservice.c
Commit message: Fix log-uninitialized-stack bug in rend_service_intro_established.

Fixes bug 23490; bugfix on 0.2.7.2-alpha.

TROVE-2017-008
CVE-2017-0380


Vulnerable code:
  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
                rend_pk_digest, REND_SERVICE_ID_LEN);

Fixed code:
  o Major bugfixes (security, hidden services, loggging):
    - Fix a bug where we could log uninitialized stack when a certain
      hidden service error occurred while SafeLogging was disabled.
      Fixes bug #23490; bugfix on 0.2.7.2-alpha.
      This is also tracked as TROVE-2017-008 and CVE-2017-0380.
  base32_encode(serviceid, REND_SERVICE_ID_LEN_BASE32 + 1,
                rend_pk_digest, REND_SERVICE_ID_LEN);