hitoshura25/cvefixes huggingface dataset:
CVE-2013-2022 (Other, published 2013-08-17T16:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.23 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter.  NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/happyworm/jPlayer
Files changed:
actionscript/Jplayer.as
actionscript/happyworm/jPlayer/JplayerStatus.as
jquery.jplayer/jquery.jplayer.js
Commit message: Security Fox of Flash SWF that had enabled Cross Site Scripting (XSS)


Vulnerable code:
			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
 * Version: 2.2.22
 * Date: 29th March 2013
			script: "2.2.22",
			needFlash: "2.2.20",

Fixed code:
			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
		public static const VERSION:String = "2.2.23"; // The version of the Flash jPlayer entity.
 * Version: 2.2.23
 * Date: 12th April 2013
			script: "2.2.23",
			needFlash: "2.2.23",
CVE-2013-2023 (Other, published 2013-08-15T17:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/happyworm/jPlayer
Files changed:
actionscript/Jplayer.as
actionscript/happyworm/jPlayer/JplayerStatus.as
jquery.jplayer/jquery.jplayer.js
package.json
Commit message: Security Fix completed for issue #162 ref CVE-2013-2023


Vulnerable code:
 * Version: 2.3.1
			// Check for direct access. Inspired by mediaelement.js - Also added name to object for non-IE browsers.
					if(illegalChar(s) || illegalWord(s)) {
		private function illegalWord(s:String):Boolean {
			// A blacklist of JavaScript commands that are a security concern.
			var illegals:String = "eval document alert confirm prompt console";
			if(Boolean(s)) { // Otherwise exception if parameter null.
				for each (var illegal:String in illegals.split(' ')) {
					if(s.indexOf(illegal) >= 0) {
						return true; // Illegal word found
					}
				}
			}
			return false;
		public static const VERSION:String = "2.3.1"; // The version of the Flash jPlayer entity.
 * Version: 2.3.1
			script: "2.3.1",
			needFlash: "2.3.1",
  "version": "2.3.1",

Fixed code:
 * Version: 2.3.2
			// Check for direct access. Inspired by mediaelement.js - Also added name to HTML object for non-IE browsers.
					if(illegalChar(s)) {
						securityIssue = true; // Found a security concern.
					}
				}
				if(!securityIssue) {
					if(jQueryIllegal(p.jQuery)) {
		private function jQueryIllegal(s:String):Boolean {
			// Check param contains the term jQuery.
			var validParam:RegExp = /(jQuery)/;
			return !validParam.test(s);
		public static const VERSION:String = "2.3.2"; // The version of the Flash jPlayer entity.
 * Version: 2.3.2
			script: "2.3.2",
			needFlash: "2.3.2",
  "version": "2.3.2",
CVE-2022-4871 (PHP, published 2023-01-03T12:15Z)
Description: value: A vulnerability classified as problematic was found in ummmmm nflpick-em.com up to 2.2.x. This vulnerability affects the function _Load_Users of the file html/includes/runtime/admin/JSON/LoadUsers.php. The manipulation of the argument sort leads to sql injection. The attack can be initiated remotely. The patch is identified as dd77a35942f527ea0beef5e0ec62b92e8b93211e. It is recommended to apply a patch to fix this issue. VDB-217270 is the identifier assigned to this vulnerability. NOTE: JSON entrypoint is only accessible via an admin account
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ummmmm/nflpick-em.com
Files changed:
html/includes/runtime/admin/JSON/LoadUsers.php
Commit message: Fixed SQL injection issue in _Load_Users

That was probably the only place in the software that had SQL injection since
we took the sort value and put it directly into the query.  The sort value
is now verified as a valid column.

This wasn't really an issue however since the JSON entrypoint was only accessible
via an admin account anyway.


Vulnerable code:
		
			return $this->setDBError();
		
			$loaded_user[ 'current_place' ] 	= Functions::Place( $loaded_user[ 'current_place' ] ); 
		return $this->setData( $users );		
		return $this->_db->select( $sql, $users, $current );

Fixed code:

			return false;

			$loaded_user[ 'current_place' ] 	= Functions::Place( $loaded_user[ 'current_place' ] );
		return $this->setData( $users );

		switch ( $sort )
		{
			case 'name'				:
			case 'current_place'	:
			case 'last_on'			:
			case 'paid'				:
			case 'failed_logins'	:
			case 'active_sessions'	:
			case 'remaining'		:
			{
				break;
			}
			default					:
			{
				return $this->setError( array( '#Error#', 'Invalid sort' ) );
			}
		}


		if ( !$this->_db->select( $sql, $users, $current ) )
		{
			return $this->setDBError();
		}

		return true;
CVE-2018-10756 (C, published 2020-05-15T16:15Z)
Description: value: Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/transmission/transmission
Files changed:
libtransmission/variant.c
Commit message: CVE-2018-10756: Fix heap-use-after-free in tr_variantWalk

In libtransmission/variant.c, function tr_variantWalk, when the variant
stack is reallocated, a pointer to the previously allocated memory
region is kept. This address is later accessed (heap use-after-free)
while walking back down the stack, causing the application to crash.
The application can be any application which uses libtransmission, such
as transmission-daemon, transmission-gtk, transmission-show, etc.

Reported-by: Tom Richards <tom@tomrichards.net>


Vulnerable code:
    tr_variant sorted;
        tr_variantInitDict(&node->sorted, n);
            node->sorted.val.l.vals[i] = *tmp[i].val;
        node->sorted.val.l.count = n;
        node->v = &node->sorted;
        node->v = v;
    if (node->v == &node->sorted)
        tr_free(node->sorted.val.l.vals);

Fixed code:
    tr_variant* sorted;
        node->sorted = tr_new(tr_variant, 1);
        tr_variantInitDict(node->sorted, n);
            node->sorted->val.l.vals[i] = *tmp[i].val;
        node->sorted->val.l.count = n;
        v = node->sorted;
        node->sorted = NULL;

    node->v = v;
    TR_ASSERT(node != NULL);

    if (node->sorted != NULL)
        tr_free(node->sorted->val.l.vals);
        tr_free(node->sorted);
CVE-2024-24556 (TypeScript, published 2024-01-30T18:15Z)
Description: value: urql is a GraphQL client that exposes a set of helpers for several frameworks.  The `@urql/next` package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns `html` tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/urql-graphql/urql
Files changed:
.changeset/brave-buses-thank.md
packages/next-urql/src/DataHydrationContext.ts
packages/next-urql/src/htmlescape.ts
Commit message: Merge pull request from GHSA-qhjf-hm5j-335w

* escape html characters in JSON string before injecting it into stream

* Add changeset

---------

Co-authored-by: Lenz Weber-Tronic <lorenz.weber-tronic@apollographql.com>
Co-authored-by: Phil Pluckthun <phil@kitten.sh>

Vulnerable code:
  return `(window[Symbol.for("${key}")] ??= []).push(${JSON.stringify(data)})`;

Fixed code:
---
'@urql/next': patch
---

Fix `CVE-2024-24556`, addressing an XSS vulnerability, where `@urql/next` failed to escape HTML characters in JSON payloads injected into RSC hydration bodies. When an attacker is able to manipulate strings in the JSON response in RSC payloads, this could cause HTML to be evaluated via a typical XSS vulnerability (See [`GHSA-qhjf-hm5j-335w`](https://github.com/urql-graphql/urql/security/advisories/GHSA-qhjf-hm5j-335w) for details.)
import { htmlEscapeJsonString } from './htmlescape';
  return `(window[Symbol.for("${key}")] ??= []).push(${htmlEscapeJsonString(JSON.stringify(data))})`;
// --------------------------------------------------------------------------------
//
// copied from
// https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/src/server/htmlescape.ts
// License: https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/license.md
//
// --------------------------------------------------------------------------------

// This utility is based on https://github.com/zertosh/htmlescape
// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE

const ESCAPE_LOOKUP: { [match: string]: string } = {
  "&": "\\u0026",
  ">": "\\u003e",
  "<": "\\u003c",
  "\u2028": "\\u2028",
  "\u2029": "\\u2029",
};

export const ESCAPE_REGEX = /[&><\u2028\u2029]/g;

export function htmlEscapeJsonString(str: string): string {
  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
}
CVE-2017-14061 (C, published 2017-08-31T16:29Z)
Description: value: Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://gitlab.com/libidn/libidn2
Files changed:
lib/bidi.c
Commit message: lib/bidi: Fix integer overflow (found by fuzzing)


Vulnerable code:
  while (llen-- > 0) {

Fixed code:
#include <sys/types.h>
  for (; (ssize_t) llen > 0; llen--) {
CVE-2017-14062 (C, published 2017-08-31T16:29Z)
Description: value: Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://gitlab.com/libidn/libidn2
Files changed:
lib/puny_decode.c
Commit message: lib/puny_decode: Fix integer overflow (found by fuzzing)


Vulnerable code:
static punycode_uint decode_digit(punycode_uint cp)
  return  cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
          cp - 97 < 26 ? cp - 97 :  base;

Fixed code:
static unsigned decode_digit(int cp)
  return (unsigned) (cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
         cp - 97 < 26 ? cp - 97 :  base);
CVE-2019-12290 (Other, published 2019-10-22T16:15Z)
Description: value: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://gitlab.com/libidn/libidn2
Files changed:
NEWS
Commit message: Update NEWS for CVE-2019-12290


Vulnerable code:

Fixed code:
* Version 2.x.x (unreleased)

** Mitre has assigned CVE-2019-12290 which was fixed by
   the roundtrip feature introduced in 2.2.0 (commit 241e8f48)

** Update the data tables from Unicode 6.3.0 to Unicode 11.0
CVE-2017-16015 (JavaScript, published 2018-06-04T19:29Z)
Description: value: Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/caolan/forms
Files changed:
.eslintrc
lib/render.js
lib/tag.js
lib/widgets.js
test/test-widgets.js
Commit message: [New] [Fix] ensure that all content in `tag` is properly escaped.

Vulnerable code:
		"max-params": [2, 3],
            ].join(''));
        return tag(tagName, { classes: field.classes() }, wrappedContent.join(''));
    var th = tag('th', {}, field.labelHTML(name, field.id));
    var td = tag('td', {}, tdContent);
    return tag('tr', { classes: field.classes() }, th + td);
var tag = function tag(tagName, attrsMap, content) {
    return '<' + safeTagName + attrsHTML + (isSelfClosing(safeTagName) ? ' />' : '>' + content + '</' + safeTagName + '>');
                    return tag('optgroup', { label: choice.label }, renderChoices(choice.choices, render));
            return tag('select', [attrs, userAttrs, w.attrs || {}], optionsHTML);

Fixed code:
		"max-params": [2, 4],
            ].join(''), true);
        return tag(tagName, { classes: field.classes() }, wrappedContent.join(''), true);
    var th = tag('th', {}, field.labelHTML(name, field.id), true);
    var td = tag('td', {}, tdContent, true);
    return tag('tr', { classes: field.classes() }, th + td, true);
var tag = function tag(tagName, attrsMap, content, contentIsEscaped) {
    var safeContent = contentIsEscaped ? content : htmlEscape(content);
    return '<' + safeTagName + attrsHTML + (isSelfClosing(safeTagName) ? ' />' : '>' + safeContent + '</' + safeTagName + '>');
                    return tag('optgroup', { label: choice.label }, renderChoices(choice.choices, render), true);
            return tag('select', [attrs, userAttrs, w.attrs || {}], optionsHTML, true);

    t.test('properly escapes contents', function (st) {
        st.equal(
            forms.widgets.textarea().toHTML('name', { value: 'Inside</textarea>Escaped the textarea!' }),
            '<textarea name="name" id="id_name">Inside&lt;/textarea&gt;Escaped the textarea!</textarea>'
       );

        st.end();
    });
CVE-2014-125036 (YAML, published 2023-01-02T19:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as ed4ca2cf012677973c220cdba36b5c60bfa0260b. It is recommended to apply a patch to fix this issue. VDB-217190 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/drybjed/ansible-ntp
Files changed:
meta/main.yml
Commit message: Limit connections to ntp service in firewall

This should help mitigate potential NTP amplification attacks.


Vulnerable code:
        accept_any: True

Fixed code:
        protocol: [ 'tcp', 'udp' ]
      - type: 'dport_limit'
        dport: [ 'ntp' ]
        protocol: [ 'tcp', 'udp' ]
        filename: 'ntp_dependency_limit'
        weight: '50'
        enabled: '{{ ntp_listen }}'
CVE-2021-43608 (PHP, published 2021-12-09T20:15Z)
Description: value: Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/doctrine/dbal
Files changed:
src/Platforms/AbstractPlatform.php
tests/Platforms/AbstractPlatformTestCase.php
tests/Platforms/DB2PlatformTest.php
tests/Platforms/OraclePlatformTest.php
Commit message: Cast LIMIT and OFFSET to int when building limit query


Vulnerable code:
        return $this->doModifyLimitQuery($query, $limit, $offset);

Fixed code:
        if ($limit !== null) {
            $limit = (int) $limit;
        }

        return $this->doModifyLimitQuery($query, $limit, (int) $offset);
    public function testLimitOffsetCastToInt(): void
    {
        self::assertSame(
            $this->getLimitOffsetCastToIntExpectedQuery(),
            $this->platform->modifyLimitQuery('SELECT * FROM user', '1 BANANA', '2 APPLES')
        );
    }

    protected function getLimitOffsetCastToIntExpectedQuery(): string
    {
        return 'SELECT * FROM user LIMIT 1 OFFSET 2';
    }


    protected function getLimitOffsetCastToIntExpectedQuery(): string
    {
        return 'SELECT db22.* FROM (SELECT db21.*, ROW_NUMBER() OVER() AS DC_ROWNUM'
            . ' FROM (SELECT * FROM user) db21) db22 WHERE db22.DC_ROWNUM >= 3 AND db22.DC_ROWNUM <= 3';
    }

    protected function getLimitOffsetCastToIntExpectedQuery(): string
    {
        return 'SELECT * FROM (SELECT a.*, ROWNUM AS doctrine_rownum FROM (SELECT * FROM user) a WHERE ROWNUM <= 3)'
            . ' WHERE doctrine_rownum >= 3';
    }
CVE-2023-30845 (C++, published 2023-04-26T21:15Z)
Description: value: ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to bypass JWT authentication in specific cases.

ESPv2 allows malicious requests to bypass authentication if both the conditions are true: The requested HTTP method is **not** in the API service definition (OpenAPI spec or gRPC `google.api.http` proto annotations, and the specified `X-HTTP-Method-Override` is a valid HTTP method in the API service definition. ESPv2 will forward the request to your backend without checking the JWT. Attackers can craft requests with a malicious `X-HTTP-Method-Override` value that allows them to bypass specifying JWTs. Restricting API access with API keys works as intended and is not affected by this vulnerability.

Upgrade deployments to release v2.43.0 or higher to receive a patch. This release ensures that JWT authentication occurs, even when the caller specifies `x-http-method-override`. `x-http-method-override` is still supported by v2.43.0+. API clients can continue sending this header to ESPv2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/GoogleCloudPlatform/esp-v2
Files changed:
api/README.md
src/envoy/http/service_control/filter.cc
Commit message: Add back in HTTP method override in service control filter (#802)

This is NOT used by ESPv2, but it is needed for CAG temporarily. We can remove once their rollout is complete.

Signed-off-by: Teju Nareddy <nareddyt@google.com>

Vulnerable code:
When making changes to Config Manager, make sure the new config is compatible
with older Envoy binaries under the current API version. If it's incompatible,

Fixed code:
When making changes to Config Manager, make sure that **older** config generator binaries are compatible
with **newer** Envoy binaries under the current API version. If it's incompatible,
  // TODO(b/273531500): Temporary until CAG rollout is complete.
  if (utils::handleHttpMethodOverride(headers)) {
    // Update later filters that the HTTP method has changed by clearing the
    // route cache.
    ENVOY_LOG(debug, "HTTP method override occurred, recalculating route");
    decoder_callbacks_->downstreamCallbacks()->clearRouteCache();
  }