hitoshura25/cvefixes huggingface dataset:
CVE-2017-16016 (JavaScript, published 2018-06-04T19:29Z)
Description: value: Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/punkave/sanitize-html
Files changed:
README.md
index.js
test/test.js
Commit message: Fixed XSS attack vector via `textarea` tags (when explicitly allowed). Decided that `script` (obviously) and `style` (due to its own XSS vectors) cannot realistically be afforded any XSS protection if allowed, unless we add a full CSS parser. Thanks again to Andrew Krasichkov.


Vulnerable code:
If a tag is not permitted, the contents of the tag are still kept, except for script and style tags.
      if (nonTextTagsArray.indexOf(tag) !== -1) {
  it('should not escape inner content from non-text tags (when allowed)', function() {

Fixed code:
If a tag is not permitted, the contents of the tag are still kept, except for `script`, `style` and `textarea` tags.
The content still gets escaped properly, with the exception of the `script` and `style` tags. *Allowing either `script` or `style` leaves you open to XSS attacks. Don't do that* unless you have good reason to trust their origin.

Fixed XSS attack vector via `textarea` tags (when explicitly allowed). Decided that `script` (obviously) and `style` (due to its own XSS vectors) cannot realistically be afforded any XSS protection if allowed, unless we add a full CSS parser. Thanks again to Andrew Krasichkov.

      if ((tag === 'script') || (tag === 'style')) {
        // htmlparser2 gives us these as-is. Escaping them ruins the content. Allowing
        // script tags is, by definition, game over for XSS protection, so if that's
        // your concern, don't allow them. The same is essentially true for style tags
        // which have their own collection of XSS vectors.
  it('should not escape inner content of script and style tags (when allowed)', function() {
  it('should not unescape escapes found inside script tags', function() {
    assert.equal(
      sanitizeHtml('<script>alert("&quot;This is cool but just ironically so I quoted it&quot;")</script>',
        {
          allowedTags: [ 'script' ]
        }
      ),
      '<script>alert("&quot;This is cool but just ironically so I quoted it&quot;")</script>'
    )
  });
  it('should correctly maintain escaping when allowing a nonTextTags tag other than script or style', function() {
    assert.equal(
      sanitizeHtml('!<textarea>&lt;/textarea&gt;&lt;svg/onload=prompt`xs`&gt;</textarea>!',
        { allowedTags: [ 'textarea' ] }
      ), '!<textarea>&lt;/textarea&gt;&lt;svg/onload=prompt`xs`&gt;</textarea>!'
    );
  });
CVE-2020-35963 (C, published 2021-01-03T19:15Z)
Description: value: flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/fluent/fluent-bit
Files changed:
src/flb_gzip.c
Commit message: gzip: fix compression size calculation (oss-fuzz 27261)

Signed-off-by: davkor <david@adalogics.com>


Vulnerable code:
    out_size = in_len + 32;

Fixed code:

    /*
     * GZIP relies on an algorithm with worst-case expansion
     * of 5 bytes per 32KB data. This means we need to create a variable
     * length output, that depends on the input length.
     * See RFC 1951 for details.
     */
    int max_input_expansion = ((int)(in_len / 32000) + 1) * 5;

    /*
     * Max compressed size is equal to sum of:
     *   10 byte header
     *   8 byte foot
     *   max input expansion
     *   size of input
     */
    out_size = 10 + 8 + max_input_expansion + in_len;
CVE-2021-36088 (C, published 2021-07-01T03:15Z)
Description: value: Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/fluent/fluent-bit
Files changed:
src/flb_parser_json.c
Commit message: parser: json: fix double-free (#3453)

Signed-off-by: davkor <david@adalogics.com>

Vulnerable code:

Fixed code:
        mp_buf = NULL;
            flb_free(tmp_out_buf);
CVE-2022-2339 (Unknown, published 2022-07-07T04:15Z)
Description: value: With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/nocodb/nocodb
Files changed:
Commit message: Merge pull request #2495 from nocodb/develop

Pre-release 0.92.0

Vulnerable code:

Fixed code:
CVE-2022-3423 (Unknown, published 2022-10-07T11:15Z)
Description: value: Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.


Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/nocodb/nocodb
Files changed:
Commit message: Merge pull request #2495 from nocodb/develop

Pre-release 0.92.0

Vulnerable code:

Fixed code:
CVE-2023-49781 (TypeScript, published 2024-05-14T14:06Z)
Description: value: NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nocodb/nocodb
Files changed:
packages/nc-gui/utils/urlUtils.ts
Commit message: fix: sanitise formula text before rendering


Vulnerable code:
  const out = rawText.replace(/URI::\((.*?)\)/g, (_, url) => {

Fixed code:

  // create a temporary element to sanitise the string
  // by encoding any html code
  const tempEl = document.createElement('div')
  tempEl.textContent = rawText
  const sanitisedText = tempEl.innerHTML

  const out = sanitisedText.replace(/URI::\((.*?)\)/g, (_, url) => {
CVE-2023-5104 (Other, published 2023-09-21T09:15Z)
Description: value: Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/nocodb/nocodb
Files changed:
packages/nc-gui-v2/components/dlg/TableRename.vue
Commit message: feat(gui-v2): add table name length validator


Vulnerable code:
const { loadTables } = useProject()
const { tables } = useProject()

Fixed code:
const { loadTables, tables, project, isMysql, isMssql, isPg } = useProject()
      {
        validator: (rule: any, value: any) => {
          return new Promise<void>((resolve, reject) => {
            let tableNameLengthLimit = 255
            if (isMysql) {
              tableNameLengthLimit = 64
            } else if (isPg) {
              tableNameLengthLimit = 63
            } else if (isMssql) {
              tableNameLengthLimit = 128
            }
            const projectPrefix = project?.value?.prefix || ''
            if ((projectPrefix + value).length > tableNameLengthLimit) {
              return reject(new Error(`Table name exceeds ${tableNameLengthLimit} characters`))
            }
            resolve()
          })
        },
      },
CVE-2019-18609 (C, published 2019-12-01T22:15Z)
Description: value: An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/alanxz/rabbitmq-c
Files changed:
librabbitmq/amqp_connection.c
Commit message: lib: check frame_size is >= INT32_MAX

When parsing a frame header, validate that the frame_size is less than
or equal to INT32_MAX. Given frame_max is limited between 0 and
INT32_MAX in amqp_login and friends, this does not change the API.

This prevents a potential buffer overflow when a malicious client sends
a frame_size that is close to UINT32_MAX, in which causes an overflow
when computing state->target_size resulting in a small value there. A
buffer is then allocated with the small amount, then memcopy copies the
frame_size writing to memory beyond the end of the buffer.


Vulnerable code:
      /* frame length is 3 bytes in */
      state->target_size =
          amqp_d32(amqp_offset(raw_frame, 3)) + HEADER_SIZE + FOOTER_SIZE;

Fixed code:
      uint32_t frame_size;

      /* frame length is 3 bytes in */
      frame_size = amqp_d32(amqp_offset(raw_frame, 3));
      /* To prevent the target_size calculation below from overflowing, check
       * that the stated frame_size is smaller than a signed 32-bit. Given
       * the library only allows configuring frame_max as an int32_t, and
       * frame_size is uint32_t, the math below is safe from overflow. */
      if (frame_size >= INT32_MAX) {
        return AMQP_STATUS_BAD_AMQP_DATA;
      }
      state->target_size = frame_size + HEADER_SIZE + FOOTER_SIZE;
CVE-2022-2871 (JavaScript, published 2022-08-17T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/notrinos/notrinoserp
Files changed:
SECURITY.md
libraries/select.js
Commit message: Prevent cross-site scripting(XSS) vulnerabilities.


Vulnerable code:
Please share privately the details of your security vulnerability by email to:
[Contact Info](support@notrinos.com)  
				// break a select option item into multi lines
					var selectionText = item.text.split('\n');

Fixed code:
Please share privately the details of your security vulnerability by email to: support@notrinos.com  
					// replace(/</g, '&lt;') : prevent the code in the option’s value from being executed by the browser.
					// split('\n') : break a select option item into multi lines
					var selectionText = item.text.replace(/</g, '&lt;').split('\n');
CVE-2022-2927 (PHP, published 2022-08-22T09:15Z)
Description: value: Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/notrinos/notrinoserp
Files changed:
admin/users.php
Commit message: added password validation for adding new user.


Vulnerable code:
	if (!$new && ($_POST['password'] != '')) {

Fixed code:
	if ($new || (!$new && ($_POST['password'] != ''))) {
CVE-2022-2965 (PHP, published 2022-08-23T16:15Z)
Description: value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository notrinos/notrinoserp prior to 0.7.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/notrinos/notrinoserp
Files changed:
access/login.php
access/password_reset.php
includes/page/header.inc
Commit message: no x-frame-options header set which allow clickjacking attack. Fixed.


Vulnerable code:
function send_css($css = '') {
	if (!headers_sent())
}

Fixed code:
if (!headers_sent())
	header("X-Frame-Options: SAMEORIGIN");

if (!headers_sent())
	header("X-Frame-Options: SAMEORIGIN");

function send_css($css='') {
	if (!headers_sent()) {
		header("X-Frame-Options: SAMEORIGIN");
	}
}
CVE-2020-10194 (Java, published 2020-03-20T21:15Z)
Description: value: cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/Zimbra/zm-mailbox
Files changed:
store/src/java/com/zimbra/cs/service/account/AutoCompleteGal.java
Commit message: ZBUG-1094:Broken GAL search filtering


Vulnerable code:
 * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014, 2016 Synacor, Inc.
        if (galAcctId != null)
            params.setGalSyncAccount(Provisioning.getInstance().getAccountById(galAcctId));

Fixed code:
 * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014, 2016, 2020 Synacor, Inc.
        if (galAcctId != null) {
            Account galAccount = Provisioning.getInstance().getAccountById(galAcctId);
            if (galAccount != null && (!account.getDomainId().equals(galAccount.getDomainId()))) {
                throw ServiceException
                    .PERM_DENIED("can not access galsync account of different domain");
            }
            params.setGalSyncAccount(galAccount);
        }
CVE-2021-31294 (C, published 2023-07-15T23:15Z)
Description: value: Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command (specifically, a SET command). NOTE: this was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have safety guarantees related to this.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/redis/redis
Files changed:
src/server.c
Commit message: Prevent replicas from sending commands that interact with keyspace (#8868)

This solves an issue reported in #8712 in which a replica would bypass
the client write pause check and cause an assertion due to executing a
write command during failover.

The fact is that we don't expect replicas to execute any command other
than maybe REPLCONF and PING, etc. but matching against the ADMIN
command flag is insufficient, so instead i just block keyspace access
for now.

Vulnerable code:
	  c->cmd->proc != resetCommand &&

Fixed code:
    int is_read_command = (c->cmd->flags & CMD_READONLY) ||
                           (c->cmd->proc == execCommand && (c->mstate.cmd_flags & CMD_READONLY));
          c->cmd->proc != resetCommand &&
    /* Prevent a replica from sending commands that access the keyspace.
     * The main objective here is to prevent abuse of client pause check
     * from which replicas are exempt. */
    if ((c->flags & CLIENT_SLAVE) && (is_may_replicate_command || is_write_command || is_read_command)) {
        rejectCommandFormat(c, "Replica can't interract with the keyspace");
        return C_OK;
    }
CVE-2021-32762 (C, published 2021-10-04T18:15Z)
Description: value: Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/redis/redis
Files changed:
deps/hiredis/hiredis.c
deps/hiredis/test.c
Commit message: Fix redis-cli / redis-sential overflow on some platforms (CVE-2021-32762) (#9587)

The redis-cli command line tool and redis-sentinel service may be vulnerable
to integer overflow when parsing specially crafted large multi-bulk network
replies. This is a result of a vulnerability in the underlying hiredis
library which does not perform an overflow check before calling the calloc()
heap allocation function.

This issue only impacts systems with heap allocators that do not perform their
own overflow checks. Most modern systems do and are therefore not likely to
be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator
which is also not vulnerable.

Co-authored-by: Yossi Gottlieb <yossigo@gmail.com>

Vulnerable code:

Fixed code:
        if (SIZE_MAX / sizeof(redisReply*) < elements) return NULL;  /* Don't overflow */
    test("Multi-bulk never overflows regardless of maxelements: ");
    size_t bad_mbulk_len = (SIZE_MAX / sizeof(void *)) + 3;
    char bad_mbulk_reply[100];
    snprintf(bad_mbulk_reply, sizeof(bad_mbulk_reply), "*%llu\r\n+asdf\r\n",
        (unsigned long long) bad_mbulk_len);

    reader = redisReaderCreate();
    reader->maxelements = 0;    /* Don't rely on default limit */
    redisReaderFeed(reader, bad_mbulk_reply, strlen(bad_mbulk_reply));
    ret = redisReaderGetReply(reader,&reply);
    test_cond(ret == REDIS_ERR && strcasecmp(reader->errstr, "Out of memory") == 0);
    freeReplyObject(reply);
    redisReaderFree(reader);
CVE-2021-32762 (C, published 2021-10-04T18:15Z)
Description: value: Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis library which does not perform an overflow check before calling the calloc() heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks. Most modern systems do and are therefore not likely to be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator which is also not vulnerable. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-680 \u2014 Integer Overflow to Buffer Overflow
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
Repository: https://github.com/redis/redis
Files changed:
deps/hiredis/hiredis.c
deps/hiredis/test.c
Commit message: Fix redis-cli / redis-sential overflow on some platforms (CVE-2021-32762) (#9587)

The redis-cli command line tool and redis-sentinel service may be vulnerable
to integer overflow when parsing specially crafted large multi-bulk network
replies. This is a result of a vulnerability in the underlying hiredis
library which does not perform an overflow check before calling the calloc()
heap allocation function.

This issue only impacts systems with heap allocators that do not perform their
own overflow checks. Most modern systems do and are therefore not likely to
be affected. Furthermore, by default redis-sentinel uses the jemalloc allocator
which is also not vulnerable.

Co-authored-by: Yossi Gottlieb <yossigo@gmail.com>

Vulnerable code:

Fixed code:
        if (SIZE_MAX / sizeof(redisReply*) < elements) return NULL;  /* Don't overflow */
    test("Multi-bulk never overflows regardless of maxelements: ");
    size_t bad_mbulk_len = (SIZE_MAX / sizeof(void *)) + 3;
    char bad_mbulk_reply[100];
    snprintf(bad_mbulk_reply, sizeof(bad_mbulk_reply), "*%llu\r\n+asdf\r\n",
        (unsigned long long) bad_mbulk_len);

    reader = redisReaderCreate();
    reader->maxelements = 0;    /* Don't rely on default limit */
    redisReaderFeed(reader, bad_mbulk_reply, strlen(bad_mbulk_reply));
    ret = redisReaderGetReply(reader,&reply);
    test_cond(ret == REDIS_ERR && strcasecmp(reader->errstr, "Out of memory") == 0);
    freeReplyObject(reply);
    redisReaderFree(reader);
CVE-2022-33105 (C, published 2022-06-23T17:15Z)
Description: value: Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/redis/redis
Files changed:
src/t_stream.c
Commit message: Fix memory leak in streamGetEdgeID (#10753)

si is initialized by streamIteratorStart(), we should call
streamIteratorStop() on it when done.

regression introduced in #9127 (redis 7.0)

Vulnerable code:

Fixed code:
    streamIteratorStop(&si);