hitoshura25/cvefixes huggingface dataset:
CVE-2005-10002 (PHP, published 2023-10-29T15:15Z)
Description: value: A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/wp-plugins/secure-files
Files changed:
secure-files.php
Commit message: Fixed potential security exploit.

git-svn-id: https://plugins.svn.wordpress.org/secure-files/trunk@3641 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 1.1
			$downloadfile = $sf_directory . $downloadfile;

Fixed code:
Version: 1.2
			$downloadfile = $sf_directory . basename($downloadfile);
CVE-2023-45957 (PHP, published 2023-12-22T16:15Z)
Description: value: A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thirtybees/thirtybees
Files changed:
controllers/admin/AdminRequestSqlController.php
Commit message: Fix Stored XSS vulnerability

Special thanks to Ulaş Deniz İlhan from Zigrin Security for discovering
and reporting this vulnerability.


Vulnerable code:
            $this->errors[] = $e->getMessage();

Fixed code:
            $this->errors[] = Tools::safeOutput($e->getMessage());
CVE-2021-3822 (JavaScript, published 2021-09-27T13:15Z)
Description: value: jsoneditor is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/josdejong/jsoneditor
Files changed:
HISTORY.md
src/js/util.js
Commit message: Fix inefficient regex to replace return characters


Vulnerable code:
    // remove return characters and the whitespace surrounding return characters
    const trimmedValue = element.nodeValue.replace(/\s*\n\s*/g, '')

Fixed code:
## not yet published, version 9.5.6

- Fix inefficient regex to replace return characters. 


    // remove return characters and the whitespaces surrounding those return characters
    const trimmedValue = element.nodeValue.replace(/(\b|^)\s*\n\s*(\b|$)/g, '')
CVE-2012-3458 (Python, published 2012-09-15T17:55Z)
Description: value: Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/bbangert/beaker
Files changed:
beaker/crypto/pycrypto.py
Commit message: Apply patch from Redhat to secure pycrypto that otherwise could allow an attacker to determine contents of the encrypted payload (but is unable to modify).


Vulnerable code:
        cipher = AES.new(key)
        data = data + (" " * (16 - (len(data) % 16)))
        cipher = AES.new(key)

        return cipher.decrypt(data).rstrip()

Fixed code:
    from Crypto.Util import Counter
        cipher = AES.new(key, AES.MODE_CTR,
                         counter=Counter.new(128, initial_value=0))
        cipher = AES.new(key, AES.MODE_CTR,
                         counter=Counter.new(128, initial_value=0))
        return cipher.decrypt(data)
CVE-2019-18857 (Unknown, published 2019-11-11T15:15Z)
Description: value: darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/darylldoyle/svg-sanitizer
Files changed:
Commit message: Merge branch 'hotfix/31-xss-bypass'


Vulnerable code:

Fixed code:
CVE-2022-23638 (Unknown, published 2022-02-14T21:15Z)
Description: value: svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-sanitizer` library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/darylldoyle/svg-sanitizer
Files changed:
Commit message: Merge pull request from GHSA-fqx8-v33p-4qcc

Advisory fix 1

Vulnerable code:

Fixed code:
CVE-2019-8903 (JSON, published 2019-02-18T16:29Z)
Description: value: index.js in Total.js Platform before 3.2.3 allows path traversal.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/totaljs/framework
Files changed:
index.js
package.json
Commit message: Fixed again a critical bug with path travel...


Vulnerable code:
		if (req.uri.pathname.indexOf('./') !== -1) {
			req.$total_status(404);
			return;
    "version": "3.2.2",

Fixed code:
		for (var i = 0; i < req.uri.pathname.length; i++) {
			var c = req.uri.pathname[i];
			var n = req.uri.pathname[i + 1];
			if ((c === '.' && n === '/') || (c === '%' && n === '2' && req.uri.pathname[i + 2] === 'e')) {
				req.$total_status(404);
				return;
			}
    "version": "3.2.3",
CVE-2019-8903 (JSON, published 2019-02-18T16:29Z)
Description: value: index.js in Total.js Platform before 3.2.3 allows path traversal.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/totaljs/framework
Files changed:
index.js
package.json
Commit message: Improved security.


Vulnerable code:
const REG_TRAVEL = /(\/)?\.\.\//g;
	req.url = req.url.replace(REG_TRAVEL, '');
    "version": "3.2.0",

Fixed code:
	var beg = 0;

	// Removes directory browsing
	for (var i = 0; i < req.url.length; i++) {
		if (req.url[i] === '.' && req.url[i + 1] === '/')
			beg = i + 1;
		else if (req.url[i] === '?')
			break;
	}

	if (beg)
		req.url = req.url.substring(beg);

    "version": "3.2.1",
CVE-2020-28494 (JavaScript, published 2021-02-02T11:15Z)
Description: value: This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/totaljs/framework
Files changed:
image.js
Commit message: Fixed "Command Injection" in `image.stream()` - thank to Sam Sanoop.


Vulnerable code:
	if (!type)

Fixed code:
const SUPPORTEDIMAGES = { jpg: 1, png: 1, gif: 1, apng: 1, jpeg: 1, heif: 1, heic: 1, webp: 1, ico: 1 };
	if (!type || !SUPPORTEDIMAGES[type])
CVE-2020-28495 (JavaScript, published 2021-02-02T11:15Z)
Description: value: This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/totaljs/framework
Files changed:
utils.js
Commit message: Fixed `U.set()` by adding check for `Prototype pollution`.


Vulnerable code:

Fixed code:

	if ((/__proto__|constructor|prototype/).test(a))
		throw new Error('Prototype pollution');
CVE-2021-23344 (JavaScript, published 2021-03-04T17:15Z)
Description: value: The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/totaljs/framework
Files changed:
changes.txt
utils.js
Commit message: Fixed potential vulnerability in `U.set()` method.


Vulnerable code:
	if ((/__proto__|constructor|prototype/).test(a))
		throw new Error('Prototype pollution');

Fixed code:
- fixed potential remote code execution in `U.set()` founded by [Snyk](https://snyk.io/vuln)
	if ((/__proto__|constructor|prototype|eval/).test(a))
		throw new Error('Potential vulnerability');
CVE-2021-23389 (JavaScript, published 2021-07-12T16:15Z)
Description: value: The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/totaljs/framework
Files changed:
changes.txt
utils.js
Commit message: Fixed security issue in `U.set()` and `U.get()`.


Vulnerable code:
	if ((/__proto__|constructor|prototype|eval/).test(a))
		throw new Error('Potential vulnerability');

	fn(obj, value, path);

Fixed code:
- fixed security in `U.get()` and `U.set()` (reported by Agustin Gianni)

	if ((/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/).test(path))
		return value;

	return fn(obj, value, path);
	if ((/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/).test(path))
		return;
CVE-2021-32831 (JavaScript, published 2021-08-30T21:15Z)
Description: value: Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/totaljs/framework
Files changed:
changes.txt
utils.js
Commit message: Fixed security issue in `U.set()` and `U.get()`.


Vulnerable code:
	if ((/__proto__|constructor|prototype|eval/).test(a))
		throw new Error('Potential vulnerability');

	fn(obj, value, path);

Fixed code:
- fixed security in `U.get()` and `U.set()` (reported by Agustin Gianni)

	if ((/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/).test(path))
		return value;

	return fn(obj, value, path);
	if ((/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/).test(path))
		return;
CVE-2017-15367 (PHP, published 2018-03-07T20:29Z)
Description: value: Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/bacula-web/bacula-web
Files changed:
client-report.php
Commit message: Ensure provided period is a valid integer and a known value

  - if provided period is not an integer or a known value, we
    raise an exception


Vulnerable code:

Fixed code:
       // Check if period is an integer and listed in known periods
       if(!array_key_exists( $period, $periods_list)) {
          throw new Exception('Critical: provided value for (period) is unknown or not valid');
       }

       if(!filter_var($period, FILTER_VALIDATE_INT)) {
          throw new Exception('Critical: provided value for (period) is unknown or not valid');
       }
CVE-2018-14632 (Go, published 2018-09-06T14:29Z)
Description: value: An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.
Severity: MEDIUM (CVSS v3 base score: 7.7)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/evanphx/json-patch
Files changed:
patch.go
patch_test.go
Commit message: fix check idx index


Vulnerable code:

Fixed code:
	if idx < 0 || idx >= len(ary) || idx > len(cur) {
		return fmt.Errorf("Unable to access invalid index: %d", idx)
	}
	{
		`{ "foo": ["bar"]}`,
		`[ {"op": "add", "path": "/foo/2", "value": "bum"}]`,
	},
CVE-2024-24753 (PHP, published 2024-02-01T16:17Z)
Description: value: Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple `Content-Security-Policy` headers, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Repository: https://github.com/brefphp/bref
Files changed:
src/Event/Http/HttpResponse.php
tests/Event/Http/HttpResponseTest.php
Commit message: Add support for multi-value response headers with API Gateway v2


Vulnerable code:
                $headers[$name] = is_array($values) ? end($values) : $values;
    public function test nested arrays in headers are flattened()
            // The last value is kept (when multiheaders are not enabled)
            'headers' => ['Foo' => 'baz'],

Fixed code:
                $headers[$name] = is_array($values) ? implode(', ', $values) : $values;
    public function test multi value headers()
            // Headers are joined with a comma
            // See https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.2
            // API Gateway v2 does not support multi-value headers
            'headers' => ['Foo' => 'bar, baz'],
CVE-2024-24754 (PHP, published 2024-02-01T16:17Z)
Description: value: Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the `$files` or `$parsedBody` arrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Repository: https://github.com/brefphp/bref
Files changed:
src/Event/Http/Psr15Handler.php
src/Event/Http/Psr7Bridge.php
Commit message: Cleanup uploaded files for PSR-15 handlers


Vulnerable code:
                            $tmpPath = tempnam(sys_get_temp_dir(), 'bref_upload_');

Fixed code:
        Psr7Bridge::cleanupUploadedFiles();

    private const UPLOADED_FILES_PREFIX = 'bref_upload_';

                            $tmpPath = tempnam(sys_get_temp_dir(), self::UPLOADED_FILES_PREFIX);

    /**
     * Cleanup previously uploaded files.
     */
    public static function cleanupUploadedFiles(): void
    {
        $tmpFiles = glob(sys_get_temp_dir() . '/' . self::UPLOADED_FILES_PREFIX . '*');
        if ($tmpFiles !== false) {
            foreach ($tmpFiles as $file) {
                if(is_file($file)) {
                    unlink($file);
                }
            }
        }
    }
CVE-2024-29186 (JSON, published 2024-03-22T17:15Z)
Description: value: Bref is an open-source project that helps users go serverless on Amazon Web Services with PHP. When Bref prior to version 2.1.17 is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed. In the parsing process, the `Content-Type` header of each part is read using the `Riverline/multipart-parser` library.

The library, in the `StreamedPart::parseHeaderContent` function, performs slow multi-byte string operations on the header value.
Precisely, the `mb_convert_encoding` function is used with the first (`$string`) and third (`$from_encoding`) parameters read from the header value.

An attacker could send specifically crafted requests which would force the server into performing long operations with a consequent long billed duration.

The attack has the following requirements and limitations: The Lambda should use the Event-Driven Function runtime and the `RequestHandlerInterface` handler and should implement at least an endpoint accepting POST requests; the attacker can send requests up to 6MB long (this is enough to cause a billed duration between 400ms and 500ms with the default 1024MB RAM Lambda image of Bref); and if the Lambda uses a PHP runtime <= php-82, the impact is higher as the billed duration in the default 1024MB RAM Lambda image of Bref could be brought to more than 900ms for each request. Notice that the vulnerability applies only to headers read from the request body as the request header has a limitation which allows a total maximum size of ~10KB.

Version 2.1.17 contains a fix for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/brefphp/bref
Files changed:
composer.json
Commit message: Require `riverline/multipart-parser` 2.1.2 to fix security issue


Vulnerable code:
        "riverline/multipart-parser": "^2.0.6",

Fixed code:
        "riverline/multipart-parser": "^2.1.2",
CVE-2022-40897 (Python, published 2022-12-23T00:15Z)
Description: value: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/pypa/setuptools
Files changed:
setuptools/package_index.py
setuptools/tests/test_packageindex.py
Commit message: Limit the amount of whitespace to search/backtrack. Fixes #3659.


Vulnerable code:
REL = re.compile(r"""<([^>]*\srel\s*=\s*['"]?([^'">]+)[^>]*)>""", re.I)
@pytest.mark.xfail(reason="#3659")

Fixed code:
REL = re.compile(r"""<([^>]*\srel\s{0,10}=\s{0,10}['"]?([^'" >]+)[^>]*)>""", re.I)