hitoshura25/cvefixes huggingface dataset:
CVE-2018-7749 (Other, published 2018-03-12T19:29Z)
Description: value: The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ronf/asyncssh
Files changed:
README.rst
asyncssh/version.py
docs/changes.rst
Commit message: Bump version number up to 1.12.1 and update change log and copyright


Vulnerable code:
  Copyright (c) 2013-2017 by Ron Frederick <ronf@timeheart.net>.
__version__ = '1.12.0'

Fixed code:
  Copyright (c) 2013-2018 by Ron Frederick <ronf@timeheart.net>.
__version__ = '1.12.1'
Release 1.12.1 (10 Mar 2018)
----------------------------

* Implemented a fix for CVE-2018-7749, where a modified SSH client could
  request that an AsyncSSH server perform operations before authentication
  had completed. Thanks go to Matthijs Kooijman for discovering and
  reporting this issue and helping to review the fix.

* Added a non-blocking collect_output() method to SSHClientProcess to
  allow applications to retrieve data received on an output stream
  without blocking. This call can be called multiple times and freely
  intermixed with regular read calls with a guarantee that output will
  always be returned in order and without duplication.

* Updated debug logging implementation to make it more maintainable, and
  to fix an issue where unprocessed packets were not logged in some cases.

* Extended the support below for non-ASCII characters in comments to apply
  to X.509 certificates, allowing an optional encoding to be passed in to
  get_comment() and set_comment() and a get_comment_bytes() function to
  get the raw comment bytes without performing Unicode decoding.

* Fixed an issue where a UnicodeDecodeError could be reported in some
  cases instead of a KeyEncryptionError when a private key was imported
  using the wrong passphrase.

* Fixed the reporting of the MAC algorithm selected during key exchange to
  properly report the cipher name for GCM and Chacha ciphers that don't
  use a separate MAC algorithm. The correct value was being returned in
  queries after the key exchange was complete, but the logging was being
  done before this adjustment was made.

* Fixed the documentation of connection_made() in SSHSession subclasses
  to properly reflect the type of SSHChannel objects passed to them.
CVE-2022-39270 (JSON, published 2022-10-06T18:16Z)
Description: value: DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have sufficient trust level - configured in component's settings) are able to inject arbitrary HTML on that topic's page. The issue has been fixed on the `main` branch. Admins can update the theme component through the admin UI (Customize -> Themes -> Components -> DiscoTOC -> Check for Updates). Alternatively, admins can temporarily disable the DiscoTOC theme component.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/discourse/DiscoTOC
Files changed:
about.json
javascripts/discourse/initializers/disco-toc-main.js
package.json
test/acceptance/toc-test.js
Commit message: SECURITY: Render TOC items as plain text (#44)



Vulnerable code:
    li.innerHTML = `<a href="#" data-d-toc="${clonedNode.getAttribute("id")}">${
      clonedNode.textContent
    }</a>`;
  "version": "2.0.0",

Fixed code:
  "theme_version": "2.1.0",
    const id = clonedNode.getAttribute("id");
    li.innerHTML = `<a href="#" data-d-toc="${id}"></a>`;
    li.querySelector("a").innerText = clonedNode.textContent.trim();
  "version": "2.1.0",

acceptance("DiscoTOC - non-text headings", function (needs) {
  needs.pretender((server, helper) => {
    const topicResponse = cloneJSON(topicFixtures["/t/280/1.json"]);
    topicResponse.post_stream.posts[0].cooked = `
      <h3 id="toc-h3-span" data-d-toc="toc-h3-span" class="d-toc-post-heading">
        <a name="span-4" class="anchor" href="#span-4"></a>&lt;span style="color: red"&gt;what about this&lt;/span&gt;</h3>
      </h3>
      <p>test</p>
      ${TOC_MARKUP}
    `;

    server.get("/t/280.json", () => helper.response(topicResponse));
    server.get("/t/280/:post_number.json", () =>
      helper.response(topicResponse)
    );
  });

  test("renders the TOC items as plain text", async function (assert) {
    await visit("/t/internationalization-localization/280");

    const item = query(`#d-toc [data-d-toc="toc-h3-span"]`);
    assert.strictEqual(
      item.innerHTML.trim(),
      `&lt;span style="color: red"&gt;what about this&lt;/span&gt;`
    );
  });
});
CVE-2021-4310 (PHP, published 2023-01-09T09:15Z)
Description: value: A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as ae849b347a58c2cb1be38d04bbe56fc883d5d84a. It is recommended to apply a patch to fix this issue. VDB-217662 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/01-Scripts/01-Artikelsystem
Files changed:
01article.php
Commit message: Hotfix: XSS-Vulnerability $_SERVER['PHP_SELF']
https://seancoates.com/blogs/xss-woes


Vulnerable code:
$filename	= $_SERVER['PHP_SELF'];					// Variable enthält die Adresse der Datei, auf der das Artikelsystem eingebunden wurde

Fixed code:
$filename	= $_SERVER['SCRIPT_NAME'];	            // Variable enthält die Adresse der Datei, auf der das Artikelsystem eingebunden wurde
CVE-2023-32235 (JavaScript, published 2023-05-05T05:15Z)
Description: value: Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/TryGhost/Ghost
Files changed:
ghost/core/core/frontend/web/middleware/static-theme.js
ghost/core/test/unit/frontend/web/middleware/static-theme.test.js
Commit message: 🔒 Fixed path traversal issue in theme files

refs https://github.com/TryGhost/Team/issues/2843

- Using encoded path traversal characters in URL's path allowed to fetch
  any file within active theme's folder, which is disallowed
- credits to: fuomag9 https://kiwi.fuo.fi/@fuomag9


Vulnerable code:
    const ext = path.extname(file);
    const base = path.basename(file);
    return allowedFiles.includes(base) || (file.startsWith(allowedPath) && !alwaysDeny.includes(ext));

Fixed code:
/**
 * Copy from:
 * https://github.com/pillarjs/send/blob/b69cbb3dc4c09c37917d08a4c13fcd1bac97ade5/index.js#L987-L1003
 *
 * Allows V8 to only deoptimize this fn instead of all
 * of send().
 *
 * @param {string} filePath
 * @returns {string|number} returns -1 number if decode decodeURIComponent throws
 */
function decode(filePath) {
    try {
        return decodeURIComponent(filePath);
    } catch (err) {
        return -1;
    }
}

/**
 *
 * @param {string} file path to a requested file
 * @returns {boolean}
 */
    const decodedFilePath = decode(file);
    if (decodedFilePath === -1) {
        return false;
    }

    const normalizedFilePath = path.normalize(decodedFilePath);

    const ext = path.extname(normalizedFilePath);
    const base = path.basename(normalizedFilePath);
    return allowedFiles.includes(base) || (normalizedFilePath.startsWith(allowedPath) && !alwaysDeny.includes(ext));

    it('should disallow path traversal', function (done) {
        req.path = '/assets/built%2F..%2F..%2F/package.json';
        req.method = 'GET';

        staticTheme()(req, res, function next() {
            activeThemeStub.called.should.be.false();
            expressStaticStub.called.should.be.false();

            done();
        });
    });

    it('should not crash when malformatted URL sequence is passed', function (done) {
        req.path = '/assets/built%2F..%2F..%2F%E0%A4%A/package.json';
        req.method = 'GET';

        staticTheme()(req, res, function next() {
            activeThemeStub.called.should.be.false();
            expressStaticStub.called.should.be.false();

            done();
        });
    });
CVE-2023-40028 (JSON, published 2023-08-15T18:15Z)
Description: value: Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/TryGhost/Ghost
Files changed:
ghost/core/package.json
ghost/core/test/regression/api/admin/db.test.js
yarn.lock
Commit message: 🔒 Fixed arbitrary file read via symlinks in content import

refs https://github.com/TryGhost/Product/issues/3726
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-9c9v-w225-v5rg

- credits to https://github.com/ixSly


Vulnerable code:
    "@tryghost/zip": "1.1.34",
"@tryghost/zip@1.1.34":
  version "1.1.34"
  resolved "https://registry.yarnpkg.com/@tryghost/zip/-/zip-1.1.34.tgz#c8ab1ac3bb5bc780f29c63723d3933f345f0ec65"
  integrity sha512-tfv1Lcd46/W0AkbBj/ttZLCdqI1LQppvkVQ7l5+gSx2ZOHqnZmkoKwMOB0J/LxEEC1TzhqrW0Vzx+ZYtoPACzA==
  dependencies:
    archiver "^5.0.0"
    extract-zip "^2.0.1"
    fs-extra "^10.0.0"


Fixed code:
    "@tryghost/zip": "1.1.37",

    it('Can not import a ZIP-file with symlinks', async function () {
        await request.post(localUtils.API.getApiQuery('db/'))
            .set('Origin', config.get('url'))
            .set('Accept', 'application/json')
            .expect('Content-Type', /json/)
            .attach('importfile', path.join(__dirname, '/../../../utils/fixtures/import/symlinks.zip'))
            .expect(415);
    });
"@tryghost/zip@1.1.37":
  version "1.1.37"
  resolved "https://registry.yarnpkg.com/@tryghost/zip/-/zip-1.1.37.tgz#55ca424a42615d0e53aa12b2b108e7f20ac36b42"
  integrity sha512-L+MKGsbIgHgEeoiq6lLpirNflp8CX89xDSwBRucHR/T+QLwVgnof+aiTTuaTrrF+pOWetBDTvB/gN5t94+k6hA==
  dependencies:
    "@tryghost/errors" "^1.2.26"
    archiver "^5.0.0"
    extract-zip "^2.0.1"
    fs-extra "^11.0.0"
CVE-2018-1000809 (Unknown, published 2018-10-08T15:29Z)
Description: value: privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/privacyidea/privacyidea
Files changed:
Commit message: Merge branch 'branch-2.23'


Vulnerable code:

Fixed code:
CVE-2020-12658 (C, published 2020-12-31T01:15Z)
Description: value: gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-667 \u2014 Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Repository: https://github.com/gssapi/gssproxy
Files changed:
src/gp_workers.c
Commit message: Unlock cond_mutex before pthread exit in gp_worker_main()

Signed-off-by: GuiYao <guiyao@huawei.com>
[rharwood@redhat.com: whitespace, tweak commit message]
Reviewed-by: Robbie Harwood <rharwood@redhat.com>


Vulnerable code:

Fixed code:
                pthread_mutex_unlock(&t->cond_mutex);
CVE-2018-6343 (C++, published 2018-12-31T22:29Z)
Description: value: Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/facebook/proxygen
Files changed:
proxygen/lib/http/session/HTTPSession.cpp
Commit message: Check that a secondary auth manager is set before dereferencing.

Summary: CVE-2018-6343

Reviewed By: mingtaoy

Differential Revision: D12994423

fbshipit-source-id: 9229ec11da8085f1fa153595e8e5353e19d06fb7


Vulnerable code:

Fixed code:
  if (!secondAuthManager_) {
    return;
  }

  if (!secondAuthManager_) {
    return;
  }
CVE-2018-6346 (C++, published 2018-12-31T22:29Z)
Description: value: A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-388 \u2014 7PK - Errors
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
Repository: https://github.com/facebook/proxygen
Files changed:
proxygen/lib/http/codec/HTTP2Codec.cpp
proxygen/lib/http/codec/test/HTTP2CodecTest.cpp
Commit message: Fix h2 codec state after bad priority header.

Summary:
It's possible for the http2 codec to enter an invalid state after processing a http2 header with invalid priorities.
CVE-2018-6346

Reviewed By: maxgeorg

Differential Revision: D13510025

fbshipit-source-id: 7c4e42daf1cd2b912454d13a66ab8488d1863263


Vulnerable code:
    if (curHeader_.stream == priority->streamDependency) {
      streamError(folly::to<string>("Circular dependency for txn=",
                                    curHeader_.stream),
                  ErrorCode::PROTOCOL_ERROR,
                  curHeader_.type == http2::FrameType::HEADERS);
      return ErrorCode::NO_ERROR;
    }


Fixed code:
  // Validate circular dependencies.
  if (priority && (curHeader_.stream == priority->streamDependency)) {
    streamError(
        folly::to<string>("Circular dependency for txn=", curHeader_.stream),
        ErrorCode::PROTOCOL_ERROR,
        curHeader_.type == http2::FrameType::HEADERS);
    return ErrorCode::NO_ERROR;
  }


TEST_F(HTTP2CodecTest, DuplicateBadHeaderPriority) {
  // Sent an initial header with a circular dependency
  HTTPMessage req = getGetRequest();
  req.setHTTP2Priority(HTTPMessage::HTTPPriority(0, false, 7));
  upstreamCodec_.generateHeader(output_, 1, req, true /* eom */);

  // Hack ingress with circular dependency.
  EXPECT_TRUE(parse([&](IOBuf* ingress) {
    folly::io::RWPrivateCursor c(ingress);
    c.skip(http2::kFrameHeaderSize + http2::kConnectionPreface.length());
    c.writeBE<uint32_t>(1);
  }));

  EXPECT_EQ(callbacks_.streamErrors, 1);
  EXPECT_EQ(callbacks_.sessionErrors, 0);

  // On the same stream, send another request.
  HTTPMessage nextRequest = getGetRequest();
  upstreamCodec_.generateHeader(output_, 1, nextRequest, true /* eom */);
  parse();
  EXPECT_EQ(callbacks_.streamErrors, 2);
  EXPECT_EQ(callbacks_.sessionErrors, 0);
}
CVE-2019-11921 (C++, published 2019-07-25T21:15Z)
Description: value: An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/proxygen
Files changed:
proxygen/lib/http/structuredheaders/StructuredHeadersUtilities.cpp
Commit message: Fix SEGV in StructuredHeaders::decodeBase64

Summary:
The existing code can potentially cause a SEGV due to an out of bounds write.

This fixes CVE-2019-11921.

Reviewed By: knekritz

Differential Revision: D12983120

fbshipit-source-id: 1d48063595c8d518fd8afcbc941de260af7e37fd


Vulnerable code:
#include <boost/archive/iterators/binary_from_base64.hpp>
#include <boost/archive/iterators/base64_from_binary.hpp>
#include <boost/archive/iterators/transform_width.hpp>
    return "";
  using namespace boost::archive::iterators;
  using b64it =
    transform_width<binary_from_base64<std::string::const_iterator>, 8, 6>;

  std::string decoded = std::string(b64it(std::begin(encoded)),
                                    b64it(std::end(encoded)));

  uint32_t numPadding = std::count(encoded.begin(), encoded.end(), '=');
  decoded.erase(decoded.end() - numPadding, decoded.end());
  return decoded;
  using namespace boost::archive::iterators;
  using b64it = base64_from_binary<transform_width<const char*, 6, 8>>;

  auto data = input.data();
  std::string encoded(b64it(data), b64it(data + (input.length())));
  encoded.append((3 - (input.length() % 3)) % 3, '=');

  return encoded;

Fixed code:
#include "proxygen/lib/utils/Base64.h"

    return std::string();
  int padding = 0;
  for (auto it = encoded.rbegin();
       padding < 2 && it != encoded.rend() && *it == '=';
       ++it) {
    ++padding;
  }
  return Base64::decode(encoded, padding);
  return Base64::encode(folly::ByteRange(
                            reinterpret_cast<const uint8_t*>(input.c_str()),
                            input.length()));
CVE-2022-0905 (Go, published 2022-03-10T15:15Z)
Description: value: Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/go-gitea/gitea
Files changed:
modules/auth/pam/pam.go
Commit message: fix pam authorization (#19040)

https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb/

Co-authored-by: ysf <34326+ysf@users.noreply.github.com>

Vulnerable code:

Fixed code:
	
	if err = t.AcctMgmt(0); err != nil {
	  return "", err
  }
CVE-2022-1928 (Go, published 2022-05-29T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/go-gitea/gitea
Files changed:
modules/typesniffer/typesniffer.go
routers/common/repo.go
Commit message: Fix raw endpoint PDF file headers (#19825)



Vulnerable code:
// SvgMimeType MIME type of SVG images.
const SvgMimeType = "image/svg+xml"
			if st.IsSvgImage() {
				ctx.Resp.Header().Set("Content-Type", typesniffer.SvgMimeType)

Fixed code:
const (
	// SvgMimeType MIME type of SVG images.
	SvgMimeType = "image/svg+xml"
	// ApplicationOctetStream MIME type of binary files.
	ApplicationOctetStream = "application/octet-stream"
)
			if st.IsSvgImage() || st.IsPDF() {
				if st.IsSvgImage() {
					ctx.Resp.Header().Set("Content-Type", typesniffer.SvgMimeType)
				} else {
					ctx.Resp.Header().Set("Content-Type", typesniffer.ApplicationOctetStream)
				}
CVE-2023-3515 (Go, published 2023-07-05T15:15Z)
Description: value: Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
Severity: nan (CVSS v3 base score: 4.4)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/go-gitea/gitea
Files changed:
modules/context/context_response.go
Commit message: Fix open redirect check for more cases (#25143)

If redirect_to parameter has set value starting with `\\example.com`
redirect will be created with header `Location: /\\example.com` that
will redirect to example.com domain.

Vulnerable code:
		// Unfortunately browsers consider a redirect Location with preceding "//" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
		if len(loc) > 1 && loc[0] == '/' && (loc[1] == '/' || loc[1] == '\\') {

Fixed code:
		// Unfortunately browsers consider a redirect Location with preceding "//", "\\" and "/\" as meaning redirect to "http(s)://REST_OF_PATH"
		if len(loc) > 1 && (loc[0] == '/' || loc[0] == '\\') && (loc[1] == '/' || loc[1] == '\\') {