hitoshura25/cvefixes huggingface dataset:
CVE-2022-35930 (Unknown, published 2022-08-04T22:15Z)
Description: value: PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/sigstore/policy-controller
Files changed:
Commit message: Merge pull request from GHSA-739f-hw6h-7wq8

Compute the filtered attestation list.

Vulnerable code:

Fixed code:
CVE-2022-39395 (Go, published 2022-11-10T18:15Z)
Description: value: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to Server 0.16.0, Worker 0.16.0, and UI 0.17.0 to fix the issue. After upgrading, Vela administrators will need to explicitly change the default settings to configure Vela as desired. Some of the fixes will interrupt existing workflows and will require Vela administrators to modify default settings. However, not applying the patch (or workarounds) will continue existing risk exposure. Some workarounds are available. Vela administrators can adjust the worker's `VELA_RUNTIME_PRIVILEGED_IMAGES` setting to be explicitly empty, leverage the `VELA_REPO_ALLOWLIST` setting on the server component to restrict access to a list of repositories that are allowed to be enabled, and/or audit enabled repositories and disable pull_requests if they are not needed.
Severity: nan (CVSS v3 base score: 9.9)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/go-vela/server
Files changed:
api/repo.go
Commit message: Merge pull request from GHSA-5m7g-pj8w-7593

* fix(allowlist)!: modify repo allowlist behavior

* setting allow pull to false on create repo endpoint by default

Co-authored-by: ecrupper <easton.crupper12@gmail.com>

Vulnerable code:
		// default events to push and pull_request
		r.SetAllowPull(true)
// allowlist are allowed to enable repos. If the allowlist is
// empty then any repo can be enabled.
	// if the allowlist is not set or empty allow any repo to be enabled
	if len(allowlist) == 0 {

Fixed code:
		// default event to push
// allowlist are allowed to enable repos.
//
// a single entry of '*' allows any repo to be enabled.
	// check if all repos are allowed to be enabled
	if len(allowlist) == 1 && allowlist[0] == "*" {
CVE-2020-5208 (C, published 2020-02-05T14:15Z)
Description: value: It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/ipmitool/ipmitool
Files changed:
lib/ipmi_fru.c
Commit message: fru: Fix buffer overflow vulnerabilities

Partial fix for CVE-2020-5208, see
https://github.com/ipmitool/ipmitool/security/advisories/GHSA-g659-9qxw-p7cp

The `read_fru_area_section` function only performs size validation of
requested read size, and falsely assumes that the IPMI message will not
respond with more than the requested amount of data; it uses the
unvalidated response size to copy into `frubuf`. If the response is
larger than the request, this can result in overflowing the buffer.

The same issue affects the `read_fru_area` function.


Vulnerable code:
	uint32_t off = offset, tmp, finish;
	uint32_t off = offset, tmp, finish;

Fixed code:
	uint32_t off = offset;
	uint32_t tmp;
	uint32_t finish;
	uint32_t size_left_in_buffer;
		memset(frubuf + fru->size, 0, length - fru->size);
		length = finish - offset;
	size_left_in_buffer = length;
		if(rsp->data_len < 1
		   || tmp > rsp->data_len - 1
		   || tmp > size_left_in_buffer)
		{
			printf(" Not enough buffer size");
			return -1;
		}

		size_left_in_buffer -= tmp;
	uint32_t off = offset;
	uint32_t tmp, finish;
	uint32_t size_left_in_buffer;
		memset(frubuf + fru->size, 0, length - fru->size);
		length = finish - offset;

	size_left_in_buffer = length;
		if(rsp->data_len < 1
		   || tmp > rsp->data_len - 1
		   || tmp > size_left_in_buffer)
		{
			printf(" Not enough buffer size");
			return -1;
		}
		size_left_in_buffer -= tmp;
CVE-2018-25063 (JavaScript, published 2023-01-01T09:15Z)
Description: value: A vulnerability classified as problematic was found in Zenoss Dashboard up to 1.3.4. Affected by this vulnerability is an unknown functionality of the file ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js. The manipulation of the argument HTMLString leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The identifier of the patch is f462285a0a2d7e1a9255b0820240b94a43b00a44. It is recommended to upgrade the affected component. The identifier VDB-217153 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zenoss/ZenPacks.zenoss.Dashboard
Files changed:
ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js
Commit message: ZEN-31099: sanitize html before inserting it

According to owasp there are some vulnerabilities if we insert raw html
without sanitizing it.
Create a blacklist of tags that are forbidden to use and whitelist
of attributes that can be used and then filter the html code.


Vulnerable code:
                width: 200
            tempDiv.innerHTML = HTMLString;

Fixed code:
                width: 200,
                listeners: {
                    afterrender: function(me) {
                        Ext.tip.QuickTipManager.register({
                            target: me.getId(),
                            title : 'Warning',
                            text  : 'Your HTML will be processed according to security rules'
                        });
                    }
                }
            tempDiv.innerHTML = Zenoss.util.sanitizeHtml(HTMLString);
CVE-2022-24913 (Java, published 2023-01-12T05:15Z)
Description: value: Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/cowtowncoder/java-merge-sort
Files changed:
src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java
Commit message: vuln-fix: Temporary File Information Disclosure



This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>

Vulnerable code:
        File f = File.createTempFile(_prefix, _suffix);

Fixed code:
import java.nio.file.Files;
        File f = Files.createTempFile(_prefix, _suffix).toFile();
CVE-2014-125055 (Go, published 2023-01-07T09:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-208 \u2014 Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/agnivade/easy-scrypt
Files changed:
scrypt.go
Commit message: Preventing timing attacks

- By using ConstantTimeCompare

Reviewed by:
Testing:
Tickets:
Backport:


Vulnerable code:
	result = bytes.Equal(source_master_key, target_master_key) &&
		bytes.Equal(target_hash, source_hash)

Fixed code:
	"crypto/subtle"
	// ConstantTimeCompare returns ints. Converting it to bool
	key_comp := subtle.ConstantTimeCompare(source_master_key,
		target_master_key) != 0
	hash_comp := subtle.ConstantTimeCompare(target_hash,
		source_hash) != 0
	result = key_comp && hash_comp
CVE-2021-4270 (C#, published 2022-12-21T19:15Z)
Description: value: A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers.cs. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6140b140ccd02b5e4e7d6ba013ac1225724487f4. It is recommended to apply a patch to fix this issue. VDB-216474 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/peders/Imprint-CMS
Files changed:
ImprintCMS/Models/ViewHelpers.cs
Commit message: Encode search query to prevent XSS attacks.


Vulnerable code:
</form>", action, query, SitePhrases.LabelSearchPlaceholder, SitePhrases.LabelSearch));

Fixed code:
</form>", action, helper.AttributeEncode(query), SitePhrases.LabelSearchPlaceholder, SitePhrases.LabelSearch));
CVE-2022-35923 (JavaScript, published 2022-08-02T20:15Z)
Description: value: v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/imbrn/v8n
Files changed:
src/v8n.js
Commit message: fix inefficient regular expressions on lowercase and uppercase rules


Vulnerable code:
  lowercase: () => value => /^([a-z]+\s*)+$/.test(value),
  uppercase: () => value => /^([A-Z]+\s*)+$/.test(value),

Fixed code:
  lowercase: () => value => {
    return (
      typeof value === 'boolean' ||
      (value === value.toLowerCase() && value.trim() !== '')
    );
  },
  uppercase: () => value =>
    value === value.toUpperCase() && value.trim() !== '',
CVE-2020-7206 (Unknown, published 2020-07-17T22:15Z)
Description: value: HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/HewlettPackard/nagios-plugins-hpilo
Files changed:
Commit message: Merge pull request #8 from dchangtw/1.5.0

CVE-2020-7206: Fix php code injection problem

Vulnerable code:

Fixed code:
CVE-2015-10077 (PHP, published 2023-02-10T15:15Z)
Description: value: A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The patch is named 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/webbuilders-group/silverstripe-kapost-bridge
Files changed:
code/control/KapostService.php
Commit message: Fixed potential sql injection points

Vulnerable code:
        $token=KapostPreviewToken::get()->filter('Code', Convert::raw2xml($auth))->first();
            $kapostObj=KapostObject::get()->filter('KapostRefID', Convert::raw2xml($this->urlParams['ID']))->sort('"Created" DESC')->first();
        $existing=KapostObject::get()->filter('KapostRefID', Convert::raw2xml($content_id))->first();
            $existing=KapostObject::get()->filter('KapostRefID', Convert::raw2xml($resultID))->first();

Fixed code:
        $token=KapostPreviewToken::get()->filter('Code', Convert::raw2sql($auth))->first();
            $kapostObj=KapostObject::get()->filter('KapostRefID', Convert::raw2sql($this->urlParams['ID']))->sort('"Created" DESC')->first();
        $existing=KapostObject::get()->filter('KapostRefID', Convert::raw2sql($content_id))->first();
            $existing=KapostObject::get()->filter('KapostRefID', Convert::raw2sql($resultID))->first();
CVE-2018-20962 (PHP, published 2019-08-08T20:15Z)
Description: value: The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Laravel-Backpack/CRUD
Files changed:
CHANGELOG.md
src/resources/views/columns/select.blade.php
Commit message: fixes #1297 - possible xss vulnerability in select field type


Vulnerable code:
            echo implode(', ', $attributes);

Fixed code:
- #1297 - possible XSS vulnerability in ```select``` field type; now using ```e()``` to escape the attribute;
            echo e(implode(', ', $attributes));
CVE-2015-2784 (Ruby, published 2020-01-21T18:15Z)
Description: value: The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/rsantamaria/papercrop
Files changed:
lib/paperclip_processors/cropper.rb
Commit message: Sanitized crop input, logs with Paperclip log function if anything weird happens


Vulnerable code:
        w = target.send :"#{@attachment.name}_crop_w"
        h = target.send :"#{@attachment.name}_crop_h"
        x = target.send :"#{@attachment.name}_crop_x"
        y = target.send :"#{@attachment.name}_crop_y"
        ["-crop", "#{w}x#{h}+#{x}+#{y}"]

Fixed code:
        begin
          w = Integer(target.send :"#{@attachment.name}_crop_w")
          h = Integer(target.send :"#{@attachment.name}_crop_h")
          x = Integer(target.send :"#{@attachment.name}_crop_x")
          y = Integer(target.send :"#{@attachment.name}_crop_y")
          ["-crop", "#{w}x#{h}+#{x}+#{y}"]
        rescue
          Paperclip.log("[papercrop] #{@attachment.name} crop w/h/x/y were non-integer")
          return
        end
CVE-2017-20164 (PHP, published 2023-01-07T20:15Z)
Description: value: A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/symbiote/silverstripe-seed
Files changed:
code/extensions/SecurityLoginExtension.php
Commit message: SECURITY, fixing a possible phishing exploit.


Vulnerable code:
		if(Member::currentUserID() && $URL) {

Fixed code:
		if(Member::currentUserID() && $URL && Director::is_site_url($URL)) {
CVE-2016-1222 (PHP, published 2016-06-05T01:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kobebeauty/php-contact-form
Files changed:
contact/confirm.php
contact/index.php
Commit message: クロスサイトスクリプティングの脆弱性発覚に伴うコード一部修正


Vulnerable code:
	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo $_SERVER["PHP_SELF"]; ?>" novalidate>

Fixed code:
	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo htmlspchar($_SERVER['PHP_SELF']); ?>">
	<form class="form-horizontal" name="contactform" role="form" method="post" action="<?php echo htmlspchar($_SERVER['PHP_SELF']); ?>" novalidate>
CVE-2022-42975 (Other, published 2022-10-17T06:15Z)
Description: value: socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/phoenixframework/phoenix
Files changed:
lib/phoenix/socket/transport.ex
test/phoenix/socket/transport_test.exs
Commit message: Fix wildcard check_origin vulnerability.

Previously, our documentation points to a wilcard example of:

    check_origin: [
      "//*.other.com"
    ]

Which should allow any subdomain of "other.com", but our comparison
for `"//*.other.com"` would allow `api.any-other.com`, which would
allow an attacker to register a domain with a custom prefix of a target
domain and pass origin checks. This patch ensures the `String.ends_with?`
check includes the subdomain dot prefix.

Who is affected?

Only those using a wildcard check origin are affected, and potential
exploits are limited to allowing unauthenticated channel connections
from a bad host. Because LiveView adds its own csrf token to the
connection by default, LiveView applications with wildcard check origin
would refuse connection under this scenario. Additionally, channel
applications utilizing token based authentication would require the
attacker to also have a valid token to connection from a bad host.
Phoenix channels does not allow access to cookies, so an attacker would
also not be able to pass their own cookies from a bad host.


Vulnerable code:
    do: String.ends_with?(request_host, allowed_host)

Fixed code:
    do: request_host == allowed_host or String.ends_with?(request_host, "." <> allowed_host)

      conn = check_origin("https://ex.com", check_origin: origins)
      refute conn.halted

      conn = check_origin("https://org1.prefix-ex.com", check_origin: origins)
      assert conn.halted
      conn = check_origin("http://foo.example.com", check_origin: origins)
      refute conn.halted

      conn = check_origin("http://bad.example.com", check_origin: origins)
      assert conn.halted

      conn = check_origin("http://org1.prefix-foo.example.com", check_origin: origins)
      assert conn.halted