hitoshura25/cvefixes huggingface dataset:
CVE-2019-12951 (C, published 2019-06-24T23:15Z)
Description: value: An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/cesanta/mongoose
Files changed:
mongoose.c
src/mg_mqtt.c
Commit message: Fix heap-based overflow in parse_mqtt

PUBLISHED_FROM=3306592896298597fff5269634df0c1a1555113b


Vulnerable code:
  const char *p, *end;
  while ((size_t)(p - io->buf) < io->len) {
  if (lc & 0x80 || len > (io->len - (p - io->buf))) {
    return MG_MQTT_ERROR_INCOMPLETE_MSG;
  }
  const char *p, *end;
  while ((size_t)(p - io->buf) < io->len) {
  if (lc & 0x80 || len > (io->len - (p - io->buf))) {
    return MG_MQTT_ERROR_INCOMPLETE_MSG;
  }

Fixed code:
  const char *p, *end, *eop = &io->buf[io->len];
  while (p < eop) {
  if (lc & 0x80 || end > eop) return MG_MQTT_ERROR_INCOMPLETE_MSG;
      if (end - p < 2) return MG_MQTT_ERROR_MALFORMED_MSG;
      p += 2;
  const char *p, *end, *eop = &io->buf[io->len];
  while (p < eop) {
  if (lc & 0x80 || end > eop) return MG_MQTT_ERROR_INCOMPLETE_MSG;
      if (end - p < 2) return MG_MQTT_ERROR_MALFORMED_MSG;
      p += 2;
CVE-2023-34188 (C, published 2023-06-23T20:15Z)
Description: value: The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/cesanta/mongoose
Files changed:
mongoose.c
src/http.c
test/unit_test.c
Commit message: Added check for negative value for HTTP Content-Length header


Vulnerable code:
    hm->body.len = (size_t) mg_to64(*cl);
    hm->body.len = (size_t) mg_to64(*cl);

Fixed code:
    int64_t content_len = mg_to64(*cl);
    if(content_len < 0) return -1;
    hm->body.len = (size_t) content_len;
    int64_t content_len = mg_to64(*cl);
    if(content_len < 0) return -1;
    hm->body.len = (size_t) content_len;
  ASSERT(fetch(&mgr, buf, url, "GET /a.txt HTTP/1.0\n"
        "Content-Length: -123\n\n") == 0);
  ASSERT(fetch(&mgr, buf, url, "POST /a.txt HTTP/1.0\n"
               "Content-Length: -123\n\n") == 0);
CVE-2021-4244 (Unknown, published 2022-12-12T14:15Z)
Description: value: A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 is able to address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender
Files changed:
Commit message: Merge pull request #889 from yikesinc/fix/audit

Fix Reflected Cross-Site Scripting issue

Vulnerable code:

Fixed code:
CVE-2014-7235 (PHP, published 2014-10-07T14:55Z)
Description: value: htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/FreePBX/fw_ari
Files changed:
htdocs_ari/includes/login.php
module.xml
Commit message: FREEPBX-8070 Turn all serialized into json


Vulnerable code:
      $buf = unserialize(stripslashes($_COOKIE['ari_auth']));
      list($data,$chksum) = $buf;
      $data = unserialize($crypt->decrypt($data,$ARI_CRYPT_PASSWORD));
        $data = $crypt->encrypt(serialize($data),$ARI_CRYPT_PASSWORD);
        $buf = serialize(array($data,$chksum));
?>
	<version>2.11.1.4</version>

Fixed code:
      $buf = json_decode($_COOKIE['ari_auth'],true);
      if(!is_array($buf)) {
        $data = false;
        $chksum = false;
      } else {
        list($data,$chksum) = $buf;
      }
      $data = json_decode($crypt->decrypt($data,$ARI_CRYPT_PASSWORD),true);
        $data = $crypt->encrypt(json_encode($data),$ARI_CRYPT_PASSWORD);
        $buf = json_encode(array($data,$chksum));
?>
	<version>2.11.1.5</version>
		*2.11.1.5* FREEPBX-8070 SECURITY ISSUE Exec shell on a host using bug in Asterisk Recording Interface index.php
CVE-2015-10115 (Other, published 2023-06-05T18:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/wp-plugins/woosidebars-sbm-converter
Files changed:
changelog.txt
classes/class-woosidebars-sbm-converter.php
readme.txt
woosidebars-sbm-converter.php
Commit message: V1.1.2 - Security Fix for _query_arg vulnerability.

git-svn-id: https://plugins.svn.wordpress.org/woosidebars-sbm-converter/trunk@1142182 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
			wp_safe_redirect( add_query_arg( 'type', urlencode( $_GET['action'] ),  add_query_arg( 'status', urlencode( $status ), add_query_arg( 'page', urlencode( $this->token ),  admin_url( 'tools.php' ) ) ) ) );
Tested up to: 3.5
Stable tag: 1.1.1
Version: 1.1.1
	$woosidebars_sbm_converter->version = '1.1.1';

Fixed code:
2015.04.22 - version 1.1.2
* classes/class-woosidebars-sbm-converter.php - Security Fix for remove_query_arg vulnerability

			wp_safe_redirect( esc_url( add_query_arg( 'type', urlencode( $_GET['action'] ),  add_query_arg( 'status', urlencode( $status ), add_query_arg( 'page', urlencode( $this->token ),  admin_url( 'tools.php' ) ) ) ) ) );
Tested up to: 4.1.1
Stable tag: 1.1.2
= 1.1.2 =
* 2015-04-22
* Security Fix for add_query_arg vulnerability

= 1.1.2 =
* 2015-04-22
* Security Fix for add_query_arg vulnerability

Version: 1.1.2
	$woosidebars_sbm_converter->version = '1.1.2';
CVE-2022-45908 (Python, published 2022-11-26T02:15Z)
Description: value: In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/PaddlePaddle/Paddle
Files changed:
python/paddle/audio/functional/window.py
Commit message: [audio]fix audio get_window security error (#47386)

* fix window security error

* format

Vulnerable code:
        window (Union[str, Tuple[str, float]]): The window function applied to the signal before the Fourier transform. Supported window functions: 'hamming', 'hann', 'kaiser', 'gaussian', 'exponential', 'triang', 'bohman', 'blackman', 'cosine', 'tukey', 'taylor'.
        winfunc = eval('_' + winstr)
    except NameError as e:

Fixed code:
class WindowFunctionRegister(object):
    def __init__(self):
        self._functions_dict = dict()

    def register(self, func=None):
        def add_subfunction(func):
            name = func.__name__
            self._functions_dict[name] = func
            return func

        return add_subfunction

    def get(self, name):
        return self._functions_dict[name]


window_function_register = WindowFunctionRegister()


@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
@window_function_register.register()
        window (Union[str, Tuple[str, float]]): The window function applied to the signal before the Fourier transform. Supported window functions: 'hamming', 'hann', 'kaiser', 'gaussian', 'general_gaussian', 'exponential', 'triang', 'bohman', 'blackman', 'cosine', 'tukey', 'taylor'.
        winfunc = window_function_register.get('_' + winstr)
    except KeyError as e:
CVE-2015-3215 (C++, published 2017-06-26T15:29Z)
Description: value: The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated by a value that does not account for the size of the IP options.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/YanVugenfirer/kvm-guest-drivers-windows
Files changed:
NetKVM/Common/ParaNdis-Common.cpp
NetKVM/Common/sw-offload.cpp
Commit message: NetKVM: BZ#1169718: More rigoruous testing of incoming packet

Signed-off-by: Joseph Hindin <yhindin@rehat.com>


Vulnerable code:
    tChecksumCheckResult res, resIp;
    resIp.value = 0;
    res.xxpStatus = ppresXxpIncomplete;
    res.xxpStatus = ppresXxpIncomplete;
    
        DPrintf(3, ("ip_version %d, ipHeaderSize %d, protocol %d, iplen %d\n",
            ip_version, ipHeaderSize, pIpHeader->v4.ip_protocol, fullLength));
        if (len < ipHeaderSize) res.ipCheckSum = ppresIPTooShort;
        if (fullLength) {}
        else
            DPrintf(2, ("ip v.%d, iplen %d\n", ip_version, fullLength));
        res.xxpFull = len >= fullLength ? 1 : 0;

Fixed code:
    tChecksumCheckResult res;
    if (ppr.ipCheckSum == ppresIPTooShort || ppr.xxpStatus == ppresXxpIncomplete)
    {
        res.flags.IpOK = FALSE;
        res.flags.IpFailed = TRUE;
        return res;
    }

        res.xxpFull = TRUE;
        res.xxpFull = FALSE;
        res.xxpStatus = ppresXxpIncomplete;
        res.xxpFull = TRUE;
    else
    {
        res.xxpFull = FALSE;
        res.xxpStatus = ppresXxpIncomplete;
    }
    res.value = 0;

    if (len < 4)
    {
        res.ipStatus = ppresNotIP;
        return res;
    }


        if (len < sizeof(IPv4Header))
        {
            res.ipStatus = ppresNotIP;
            return res;
        }
        DPrintf(3, ("ip_version %d, ipHeaderSize %d, protocol %d, iplen %d, L2 payload length %d\n",
            ip_version, ipHeaderSize, pIpHeader->v4.ip_protocol, fullLength, len));

        if (res.ipStatus == ppresNotIP)
            return res;
        }

        if (ipHeaderSize >= fullLength || len < fullLength)
        {
            DPrintf(2, ("[%s] - truncated packet - ip_version %d, ipHeaderSize %d, protocol %d, iplen %d, L2 payload length %d\n",
                ip_version, ipHeaderSize, pIpHeader->v4.ip_protocol, fullLength, len));
            res.ipCheckSum = ppresIPTooShort;
            return res;

    if (res.ipStatus == ppresNotIP || res.ipCheckSum == ppresIPTooShort)
        return res;
CVE-2024-26151 (Python, published 2024-02-22T19:15Z)
Description: value: The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of `FelixSchwarz/mjml-python` who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like `&lt;script&gt;` would be rendered as `<script>` in the final HTML output. The attacker must be able to control some data which is later injected in an mjml template which is then send out as email to other users. The attacker could control contents of email messages sent through the platform. The problem has been fixed in version 0.11.0 of this library. Versions before 0.10.0 are not affected by this security issue. As a workaround, ensure that potentially untrusted user input does not contain any sequences which could be rendered as HTML.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FelixSchwarz/mjml-python
Files changed:
CHANGELOG.md
mjml/mjml2html.py
tests/testdata/css-inlining-expected.html
tests/testdata/css-inlining.mjml
Commit message: Fix CSS child selectors; don't load remote stylesheets


Vulnerable code:
            content = _mjml.decode_contents()
        content = contentSoup.decode_contents()
                        <div style="font-family:helvetica;font-size:20px;line-height:1;text-align:left;color:#F45E43;">Hello World</div>
        <mj-text css-class="box" font-size="20px" color="#F45E43" font-family="helvetica">Hello World</mj-text>

Fixed code:
- fix CSS child selectors
- disable loading remote stylesheets
            content = _mjml.decode_contents(formatter=None)
        content = contentSoup.decode_contents(formatter=None)
            load_remote_stylesheets=False,
                        <div style="font-family:helvetica;font-size:20px;line-height:1;text-align:left;color:#F45E43;"><span style="border: 3px solid blue;"> &lt; Hello World &gt; </span></div>
      .box > div > span {
        border: 3px solid blue;
      }
        <mj-text css-class="box" font-size="20px" color="#F45E43" font-family="helvetica">
          <span>
            &lt; Hello World &gt;
          </span>
        </mj-text>
CVE-2024-24765 (Go, published 2024-03-06T18:15Z)
Description: value: CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Files changed:
route/v1/user.go
Commit message: Merge pull request from GHSA-h5gf-cmm8-cg7c



Vulnerable code:

Fixed code:
	"regexp"
	matched, err := regexp.MatchString(`^/var/lib/casaos/\d`, filePath)
	if err != nil {
		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
		return
	}
	if !matched {
		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
		return
	}
CVE-2024-24766 (Go, published 2024-03-06T19:15Z)
Description: value: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`.  If the password is incorrect application gives the error `**Invalid password**`.  Version 0.4.7 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Files changed:
route/v1/user.go
Commit message: Merge pull request from GHSA-c967-2652-gfjm

* fix: fix username enumeration

* fix typo msg type

* fix: recovery error patch

* fix: recovery error patch

---------

Signed-off-by: CorrectRoadH <a778917369@gmail.com>

Vulnerable code:
			model.Result{Success: common_err.PWD_INVALID, Message: common_err.GetMsg(common_err.PWD_INVALID)})
			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})

Fixed code:
			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
CVE-2024-24767 (Other, published 2024-03-06T18:15Z)
Description: value: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force attacks, which leads to having full access to the server. The web application lacks control over the login attempts. This vulnerability allows attackers to get super user-level access over the server. Version 0.4.7 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Files changed:
go.mod
route/v1/user.go
Commit message: Merge pull request from GHSA-c69x-5xmw-v44x

* feat: limit too many login request

* fix: fix error rate limt

---------

Signed-off-by: CorrectRoadH <a778917369@gmail.com>

Vulnerable code:
	golang.org/x/time v0.3.0 // indirect

Fixed code:
	golang.org/x/time v0.3.0
	"golang.org/x/time/rate"
var limiter = rate.NewLimiter(rate.Every(time.Minute), 5)


	if !limiter.Allow() {
		c.JSON(common_err.TOO_MANY_REQUEST,
			model.Result{
				Success: common_err.TOO_MANY_LOGIN_REQUESTS,
				Message: common_err.GetMsg(common_err.TOO_MANY_LOGIN_REQUESTS),
			})
		return
	}
CVE-2024-28232 (Go, published 2024-04-01T17:15Z)
Description: value: Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Files changed:
route/v1/user.go
Commit message: Merge pull request from GHSA-hcw2-2r9c-gc6p



Vulnerable code:
			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})

Fixed code:
			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
CVE-2018-17075 (Go, published 2018-09-16T02:29Z)
Description: value: The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/golang/net
Files changed:
html/parse.go
html/testdata/webkit/template.dat
Commit message: html: remove special procedure for <template> in frameset im

See more details: https://bugs.chromium.org/p/chromium/issues/detail?id=829668

Updates golang/go#23071

Change-Id: Ib9c963269f814c3f21d3784754729df57dcc8f90
Reviewed-on: https://go-review.googlesource.com/123776
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Nigel Tao <nigeltao@golang.org>


Vulnerable code:
		case a.Frame:
			// TODO: remove this divergence from the HTML5 spec.
			if p.oe.contains(a.Template) {
				p.addElement()
				return true
			}
		case a.Caption, a.Col, a.Colgroup, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
		case a.Template:
			// TODO: remove this divergence from the HTML5 spec.
			//
			// See https://bugs.chromium.org/p/chromium/issues/detail?id=829668
			return inTemplateIM(p)
|     <template>
|       content
|         <frame>
|         <frame>
|         <frame>
|         <frame>
|         <frame>

Fixed code:
		case a.Caption, a.Col, a.Colgroup, a.Frame, a.Head, a.Tbody, a.Td, a.Tfoot, a.Th, a.Thead, a.Tr:
|     <frame>