hitoshura25/cvefixes huggingface dataset:
CVE-2020-28371 (Java, published 2020-11-09T22:15Z)
Description: value: An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ReadyTalk/avian
Files changed:
classpath/java/io/FileOutputStream.java
Commit message: Fix integer overflow leading to out-of-bounds read/write


Vulnerable code:
    if (offset < 0 || offset + length > b.length) {

Fixed code:
    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
CVE-2020-28371 (Java, published 2020-11-09T22:15Z)
Description: value: An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ReadyTalk/avian
Files changed:
classpath/java/io/FileOutputStream.java
Commit message: Fix integer overflow leading to out-of-bounds read/write


Vulnerable code:
    if (offset < 0 || offset + length > b.length) {

Fixed code:
    if (offset < 0 || length < 0 || length > b.length || offset > b.length - length) {
CVE-2020-36400 (C++, published 2021-07-01T03:15Z)
Description: value: ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/zeromq/libzmq
Files changed:
src/decoder_allocators.hpp
Commit message: Problem: ZMTP v1 static allocator is needlessly resized

Solution: don't do it, resizing the shared allocator makes sense
as it can take the message buff for zero copy, but the static allocator
is fixed


Vulnerable code:
    void resize (std::size_t new_size_) { _buf_size = new_size_; }

Fixed code:
    //  This buffer is fixed, size must not be changed
    void resize (std::size_t new_size_) { LIBZMQ_UNUSED (new_size_); }
CVE-2018-25065 (JSON, published 2023-01-05T10:15Z)
Description: value: A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is b4bc3cbbb099eab50cf2b544cf577116f1867b94. It is recommended to apply a patch to fix this issue. The identifier VDB-217445 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wikimedia/mediawiki-extensions-I18nTags
Files changed:
I18nTags_body.php
extension.json
Commit message: SECURITY: Parse tag function input as wikitext to prevent XSS

Unlike parser functions, tag functions' output is unescaped by
default.

Bug: T200973
Change-Id: I63ea5b7b1edd96a4b9fe8837eb7979faa80b5f78


Vulnerable code:
	public static function formatNumber( $data, $params, $parser ) {
		return $lang->formatNum( $data );
	public static function grammar( $data, $params, $parser ) {
		return $lang->convertGrammar( $data, $case );
	public static function plural( $data, $params, $parser ) {
		return $s;
	public static function linktrail( $data, $params, $parser ) {
		return "<strong>$predata$inside</strong>$data";
	"version": "2016-02-20",

Fixed code:
	public static function formatNumber( $data, $params, $parser, $frame ) {
		$text = $lang->formatNum( $data );
		return $parser->recursiveTagParse( $text, $frame );
	public static function grammar( $data, $params, $parser, $frame ) {
		$text = $lang->convertGrammar( $data, $case );
		return $parser->recursiveTagParse( $text, $frame );
	public static function plural( $data, $params, $parser, $frame ) {
		return $parser->recursiveTagParse( $s, $frame );
	public static function linktrail( $data, $params, $parser, $frame ) {
		$text = "<strong>$predata$inside</strong>$data";
		return $parser->recursiveTagParse( $text, $frame );
	"version": "2018-08-06",
CVE-2012-6112 (PHP, published 2013-01-27T22:55Z)
Description: value: classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/tinymce/tinymce_spellchecker_php
Files changed:
changelog.txt
classes/GoogleSpell.php
Commit message: Fixed security issue with google spellchecker


Vulnerable code:

Fixed code:
Version 2.0.6.1 (2012-11-16)
	Fixed security issue with google spellchecker.
		$lang = preg_replace('/[^a-z\-]/i', '', $lang); // Sanitize, remove everything but a-z or -
		$str = preg_replace('/[\x00-\x1F\x7F]/', '', $str); // Sanitize, remove all control characters
CVE-2022-23640 (Markdown, published 2022-03-02T20:15Z)
Description: value: Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-776 \u2014 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Repository: https://github.com/monitorjbl/excel-streaming-reader
Files changed:
README.md
Commit message: Updating readme for security release


Vulnerable code:
    <version>2.0.0</version>
    <version>2.0.0</version>

Fixed code:
# !!! Security Alert !!!

Update to the latest version (2.1.0) **as soon as possible** to fix a critical vulnerability. The Xerxes XML parsing library that Excel Streaming Reader uses defaulted to allowing [entity expansion](https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet), which could be exploited by an attacker to read arbitrary data from your system. The latest versions of Excel Streaming Reader do not allow this and will throw a `ParsingException` if a workbook contains an XML document with an entity declaration.

    <version>2.1.0</version>
    <version>2.1.0</version>
CVE-2020-11021 (Unknown, published 2020-04-29T18:15Z)
Description: value: Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/actions/http-client
Files changed:
Commit message: Merge pull request #27 from actions/redirect-auth-issue

Redirects should not pass authorization to different domain

Vulnerable code:

Fixed code:
CVE-2022-4559 (PHP, published 2022-12-16T17:15Z)
Description: value: A vulnerability was found in INEX IPX-Manager up to 6.2.0. It has been declared as problematic. This vulnerability affects unknown code of the file resources/views/customer/list.foil.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.3.0 is able to address this issue. The name of the patch is bc9b14c6f70cccdb89b559e8bc3a7318bfe9c243. It is recommended to upgrade the affected component. VDB-215962 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/inex/IXP-Manager
Files changed:
resources/views/customer/list.foil.php
Commit message: [BF] Escape HTML content to prevent XSS [ref: 055-9-4]


Vulnerable code:
                <?= $t->tag ? 'Tag: ' . $t->tags[ $t->tag ][ 'display_as' ] : "Limit to tag..." ?>
                        <?= $tag[ 'display_as' ] ?>

Fixed code:
                <?= $t->tag ? 'Tag: ' . $t->ee( $t->tags[ $t->tag ][ 'display_as' ] ) : "Limit to tag..." ?>
                        <?= $t->ee( $tag[ 'display_as' ] ) ?>
CVE-2023-41878 (YAML, published 2023-09-27T15:19Z)
Description: value: MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/metersphere/installer
Files changed:
metersphere/docker-compose-seleniarm.yml
Commit message: fix: 修复selenium弱密码的问题

默认禁用vnc，默认vnc为只读模式，缺省弱密码改为强密码。
用户可以手动开启vnc，开启后可以指定是否只读，并修改vnc密码。
参考：
https://github.com/SeleniumHQ/docker-selenium#debugging
https://github.com/SeleniumHQ/docker-selenium#disabling-vnc


Vulnerable code:
      - "5900:5900" # password: secret
      - "5901:5900" # password: secret

Fixed code:
      - "5900:5900"
      - SE_START_VNC=false
      - SE_VNC_VIEW_ONLY=1
      - SE_VNC_PASSWORD=Password123@selenium
      - "5901:5900"
      - SE_START_VNC=false
      - SE_VNC_VIEW_ONLY=1
      - SE_VNC_PASSWORD=Password123@selenium
CVE-2023-30549 (Unknown, published 2023-04-25T21:15Z)
Description: value: Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not been patched. That includes Red Hat Enterprise Linux 7, Debian 10 buster (unless the linux-5.10 package is installed), Ubuntu 18.04 bionic and Ubuntu 20.04 focal. Use-after-free flaws in the kernel can be used to attack the kernel for denial of service and potentially for privilege escalation.

Apptainer 1.1.8 includes a patch that by default disables mounting of extfs filesystem types in setuid-root mode, while continuing to allow mounting of extfs filesystems in non-setuid "rootless" mode using fuse2fs.

Some workarounds are possible. Either do not install apptainer-suid (for versions 1.1.0 through 1.1.7) or set `allow setuid = no` in apptainer.conf.  This requires having unprivileged user namespaces enabled and except for apptainer 1.1.x versions will disallow mounting of sif files, extfs files, and squashfs files in addition to other, less significant impacts.  (Encrypted sif files are also not supported unprivileged in apptainer 1.1.x.). Alternatively, use the `limit containers` options in apptainer.conf/singularity.conf to limit sif files to trusted users, groups, and/or paths, and set `allow container extfs = no` to disallow mounting of extfs overlay files.  The latter option by itself does not disallow mounting of extfs overlay partitions inside SIF files, so that's why the former options are also needed.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/apptainer/apptainer
Files changed:
Commit message: Merge pull request from GHSA-j4rf-7357-f4cg

add "allow setuid-mount" options

Vulnerable code:

Fixed code:
CVE-2018-16790 (C, published 2018-09-10T05:29Z)
Description: value: _bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/mongodb/mongo-c-driver
Files changed:
src/libbson/src/bson/bson-iter.c
src/libbson/tests/test-bson.c
Commit message: Fix for CVE-2018-16790 -- Verify bounds before binary length read.

As reported here: https://jira.mongodb.org/browse/CDRIVER-2819,
a heap overread occurs due a failure to correctly verify data
bounds.

In the original check, len - o returns the data left including the
sizeof(l) we just read. Instead, the comparison should check
against the data left NOT including the binary int32, i.e. just
subtype (byte*) instead of int32 subtype (byte*).

Added in test for corrupted BSON example.


Vulnerable code:
      if (l >= (len - o)) {

Fixed code:
      if (l >= (len - o - 4)) {
   VALIDATE_TEST ("test59.bson",
                  BSON_VALIDATE_NONE,
                  9,
                  BSON_VALIDATE_NONE,
                  "corrupt BSON");
CVE-2024-30212 (Other, published 2024-05-28T16:15Z)
Description: value: If a SCSI READ(10) command is initiated via USB using the largest LBA 
(0xFFFFFFFF) with it's default block size of 512 and a count of 1,

the first 512 byte of the 0x80000000 memory area is returned to the 
user. If the block count is increased, the full RAM can be exposed.

The same method works to write to this memory area. If RAM contains 
pointers, those can be - depending on the application - overwritten to

return data from any other offset including Progam and Boot Flash.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Microchip-MPLAB-Harmony/core
Files changed:
driver/memory/async/src/drv_memory.c.ftl
driver/memory/sync/src/drv_memory.c.ftl
Commit message: [DRV_MEM] Fixed parameter validation for variable overflow issue

MH3-90524


Vulnerable code:
    if ((nBlock == 0U) || ((blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
    if ((nBlock == 0U) || ((blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))

Fixed code:
    if ((nBlock == 0U) || (((uint64_t)blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
    if ((nBlock == 0U) || (((uint64_t)blockStart + nBlock) > dObj->mediaGeometryTable[geometry_type].numBlocks))
CVE-2017-20177 (PHP, published 2023-02-06T20:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the function wangguard_users_info of the file wangguard-user-info.php of the component WGG User List Handler. The manipulation of the argument userIP leads to cross site scripting. The attack may be launched remotely. The patch is identified as 88414951e30773c8d2ec13b99642688284bf3189. It is recommended to apply a patch to fix this issue. VDB-220214 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/joseconti/WangGuard
Files changed:
wangguard-class-wp-users.php
wangguard-user-info.php
Commit message: Fixed XSS Vulneraibility

When showing user info from WGG users list, user IP was passed through URL without sanitization. After this commit the user IP is no longer needed in the URL as the screen will get the IP from WGG tables instead.
Also $_GET['userID'] is now sanitized and casted to an integer to apply some more defensive programming, you know, just in case.


Vulnerable code:
					$arrayUrl = array ('userID' => $user_id, 'userIP' => $row_data->user_ip, '?TB_iframe' => 'true', 'width' => '900', 'height' => '550' );
		$userID = $_GET["userID"];
		$userIP = $_GET["userIP"];

Fixed code:
					$arrayUrl = array ('userID' => $user_id, '?TB_iframe' => 'true', 'width' => '900', 'height' => '550' );
		$userID = absint( $_GET["userID"] );

		$table = $wpdb->base_prefix . 'wangguarduserstatus';
		$userIP = $wpdb->get_var( $wpdb->prepare( "SELECT user_ip FROM $table WHERE ID = %d", $userID ) );
		$userIP = $userIP ? $userIP : '';
CVE-2021-30218 (C, published 2021-04-29T15:15Z)
Description: value: samurai 1.2 has a NULL pointer dereference in writefile() in util.c via a crafted build file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/michaelforney/samurai
Files changed:
util.c
Commit message: util: Check for NULL string in writefile

This check was there previously, but was removed in f549b757 with
the addition of a check during parse that every rule has rspfile
if and only if it has rspfile_content. However, this fails to
consider the possibility of those variables coming from the edge
or global environment. So, re-add the check.

Fixes #67.


Vulnerable code:
	if (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0) {

Fixed code:
	if (s && (fwrite(s->s, 1, s->n, f) != s->n || fflush(f) != 0)) {
CVE-2021-30219 (C, published 2021-04-29T15:15Z)
Description: value: samurai 1.2 has a NULL pointer dereference in printstatus() function in build.c via a crafted build file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/michaelforney/samurai
Files changed:
parse.c
Commit message: parse: Check for non-empty command/rspfile/rspfile_content

This matches ninja behavior and prevents the possibility of a rule
with an empty (NULL) command string.

Fixes #68.


Vulnerable code:

Fixed code:
		if (!val)
			continue;
CVE-2013-4136 (Other, published 2013-09-30T21:55Z)
Description: value: ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/phusion/passenger
Files changed:
NEWS
ext/common/ServerInstanceDir.h
test/cxx/ServerInstanceDirTest.cpp
Commit message: If the server instance directory already exists, it is now removed first in order get correct directory permissions.
If the directory still exists after removal, Phusion Passenger aborts to avoid writing to a directory with unexpected permissions.
Fixes issue #910.


Vulnerable code:
		makeDirTree(path, "u=rwx,g=rx,o=rx");
		// The destructor doesnn't remove the server instance directory if it

Fixed code:
 * If the server instance directory already exists, it will now be removed
   first in order get correct directory permissions. If the directory still
   exists after removal, Phusion Passenger aborts to avoid writing to a
   directory with unexpected permissions. Fixes issue #910.
#include <sys/stat.h>
		if (owner) {
			switch (getFileType(path)) {
			case FT_NONEXISTANT:
				createDirectory(path);
				break;
			case FT_DIRECTORY:
				removeDirTree(path);
				createDirectory(path);
				break;
			default:
				throw RuntimeException("'" + path + "' already exists, and is not a directory");
			}
		} else if (getFileType(path) != FT_DIRECTORY) {
			throw RuntimeException("Server instance directory '" + path +
				"' does not exist");
		}
	}

	void createDirectory(const string &path) const {
		// We do not use makeDirTree() here. If an attacker creates a directory
		// just before we do, then we want to abort because we want the directory
		// to have specific permissions.
		if (mkdir(path.c_str(), parseModeString("u=rwx,g=rx,o=rx")) == -1) {
			int e = errno;
			throw FileSystemException("Cannot create server instance directory '" +
				path + "'", e, path);
		}
		// The destructor doesn't remove the server instance directory if it
		makeDirTree(parentDir + "/passenger-test.1234");
		makeDirTree(parentDir + "/passenger-test.5678");