hitoshura25/cvefixes huggingface dataset:
CVE-2022-23634 (Ruby, published 2022-02-11T22:15Z)
Description: value: Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/puma/puma
Files changed:
lib/puma/request.rb
Commit message: Ensure `close` is called on the response body no matter what

Another fallout from https://github.com/puma/puma/pull/2809 is that
in some cases the `res_body.close` wasn't called because some previous code
raised.

For Rails apps it means CurrentAttributes and a few other important
states aren't reset properly.

This is being improved on the Rails side too, but I believe it would
be good to harden this on the puma side as well.


Vulnerable code:
        uncork_socket io

        body.close
        client.tempfile.unlink if client.tempfile
        res_body.close if res_body.respond_to? :close

Fixed code:
        begin
          uncork_socket io

          body.close
          client.tempfile.unlink if client.tempfile
        ensure
          # Whatever happens, we MUST call `close` on the response body.
          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
          res_body.close if res_body.respond_to? :close
        end
CVE-2018-20226 (Scala, published 2018-12-21T23:29Z)
Description: value: An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TheHive-Project/Cortex
Files changed:
app/org/thp/cortex/controllers/UserCtrl.scala
Commit message: #158 Fix checks in user creation


Vulnerable code:
            !request.body.getStrings("roles").getOrElse(Nil).contains(Roles.superAdmin.toString)))

Fixed code:
            !request.body.getStrings("roles").getOrElse(Nil).contains(Roles.superAdmin.name)))
CVE-2016-6903 (Python, published 2017-04-24T19:59Z)
Description: value: lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
Severity: HIGH (CVSS v3 base score: 9.9)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/ghantoos/lshell
Files changed:
lshell/sec.py
test/test_functional.py
Commit message: [security] MAJOR issue: catch ctrl escapes (Closes #149)

The was a major security issue with lshell that allows any user to
escape from lshell into bash (or any other available shell. This
was done by typing <CTRL-V><CTRL-J>bash after any allowed command.
For example:
~$ echo<CTRL-V><CTRL-J>bash

Thanks Vladislav Yarmak (@Snawoot) for reporting this major issue!


Vulnerable code:
    line = " ".join(line.split())

Fixed code:
    line = line.strip()
    def test_28_catch_lnext_terminal_ctrl(self):
        """ F25 | test ctrl-v ctrl-j then command, forbidden/security """
        self.child = pexpect.spawn('%s/bin/lshell '
                                   '--config %s/etc/lshell.conf '
                                   % (TOPDIR, TOPDIR))
        self.child.expect('%s:~\$' % self.user)

        expected = u'*** forbidden syntax: echo\r'
        self.child.send('echo')
        self.child.sendcontrol('v')
        self.child.sendcontrol('j')
        self.child.sendline('bash')
        self.child.expect('%s:~\$' % self.user)

        result = self.child.before.decode('utf8').split('\n')

        self.assertIn(expected, result)
CVE-2022-41922 (Unknown, published 2022-11-23T18:15Z)
Description: value: `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/yiisoft/yii
Files changed:
Commit message: Merge pull request from GHSA-442f-wcwq-fpcf

Fix for CVE-2022-41922

Vulnerable code:

Fixed code:
CVE-2023-47130 (Unknown, published 2023-11-14T21:15Z)
Description: value: Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/yiisoft/yii
Files changed:
Commit message: Merge pull request from GHSA-mw2w-2hj2-fg8q

Advisory fix

Vulnerable code:

Fixed code:
CVE-2023-1527 (PHP, published 2023-03-21T00:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tsolucio/corebos
Files changed:
include/utils/VtlibUtils.php
Commit message: sec(VTLIB) purify clean javascript in href


Vulnerable code:

Fixed code:
				if (strpos($value, '<a') !== false && strpos($value, 'javascript') !== false) {
					$dom = new DOMDocument;
					$dom->loadHTML($value, LIBXML_HTML_NODEFDTD | LIBXML_HTML_NOIMPLIED);
					foreach ($dom->getElementsByTagName('a') as $node) {
						if ($node->hasAttribute('href') && !filter_var($node->getAttribute('href'), FILTER_VALIDATE_URL) !== false) {
							$node->removeAttribute('href');
							$value = trim($dom->saveHTML(), "\n");
						}
					}
				}
CVE-2023-3069 (PHP, published 2023-06-02T17:15Z)
Description: value: Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/tsolucio/corebos
Files changed:
modules/Vtiger/ExecuteFunctions.php
Commit message: sec(Users) repeat password checks in backend before update


Vulnerable code:
		if (is_admin($current_user) || $current_user->id==$userid) {
			$focus = new Users();
			$focus->mode='edit';
			$focus->id = $userid;
			$focus->retrieve_entity_info($userid, 'Users');
			$ret = $focus->change_password('old_password', vtlib_purify(substr($_REQUEST['new_password'], 0, 1024)));
			if ($ret) {
				$ret = array('password'=>$ret);
			} else {
				$ret = array('password'=>false, 'msg' => $focus->error_string);
			}
		} else {
			$ret = array('password'=>false, 'msg' => $focus->error_string);

Fixed code:
		require_once 'include/Webservices/ChangePassword.php';
		try {
			$npass = vtlib_purify($_REQUEST['new_password']);
			vtws_changePassword(vtlib_purify($_REQUEST['record']), 'nocheck_old_password', $npass, $npass, $current_user);
			$ret = array('password'=>true);
		} catch (\Throwable $th) {
			$ret = array('password'=>false, 'msg' => $th->getMessage());
CVE-2023-3070 (PHP, published 2023-06-02T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tsolucio/corebos
Files changed:
data/CRMEntity.php
modules/Users/Save.php
Commit message: sec(Emails) sanitize email fields


Vulnerable code:

Fixed code:
				} elseif ($uitype == 13) {
					$fldvalue = filter_var($this->column_fields[$fieldname], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['email1'] = filter_var($focus->column_fields['email1'], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['email2'] = filter_var($focus->column_fields['email2'], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['secondaryemail'] = filter_var($focus->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
CVE-2023-3071 (PHP, published 2023-06-02T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tsolucio/corebos
Files changed:
modules/PickList/PickListAction.php
Commit message: sec(Picklist) sanitize picklist values


Vulnerable code:
			$adb->pquery($sql, array($id, $val, 1, $picklist_valueid));

Fixed code:
			$adb->pquery($sql, array($id, vtlib_purify($val), 1, $picklist_valueid));
CVE-2023-3073 (PHP, published 2023-06-02T19:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tsolucio/corebos
Files changed:
modules/Documents/SaveFolder.php
Commit message: sec(Documents) sanitize and limit folder name and description


Vulnerable code:
$foldername = utf8RawUrlDecode($_REQUEST['foldername']);
$folderdesc = utf8RawUrlDecode($_REQUEST['folderdesc']);

Fixed code:
$foldername = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['foldername']))), 0, 20);
$folderdesc = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['folderdesc']))), 0, 50);
CVE-2023-3074 (PHP, published 2023-06-02T18:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tsolucio/corebos
Files changed:
modules/Users/DetailViewAjax.php
modules/Users/Save.php
Commit message: sec(Users) sanitize email and name


Vulnerable code:

Fixed code:
		$userObj->column_fields['first_name'] = vtlib_purify($userObj->column_fields['first_name']);
		$userObj->column_fields['last_name'] = vtlib_purify($userObj->column_fields['last_name']);
		$userObj->column_fields['email1'] = filter_var($userObj->column_fields['email1'], FILTER_SANITIZE_EMAIL);
		$userObj->column_fields['email2'] = filter_var($userObj->column_fields['email2'], FILTER_SANITIZE_EMAIL);
		$userObj->column_fields['secondaryemail'] = filter_var($userObj->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['first_name'] = vtlib_purify($focus->column_fields['first_name']);
	$focus->column_fields['last_name'] = vtlib_purify($focus->column_fields['last_name']);
CVE-2023-3075 (PHP, published 2023-06-02T18:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/tsolucio/corebos
Files changed:
Smarty/templates/modules/Utilities/2fa.tpl
include/integrations/2fa/settings.php
Commit message: sec(2FA) apply CSRF check


Vulnerable code:
		<form role="form" style="margin:0 100px;" name="faform">

Fixed code:
		<form role="form" style="margin:0 100px;" name="faform" method="post">
	Vtiger_Request::validateRequest();
CVE-2018-20684 (Other, published 2019-01-10T21:29Z)
Description: value: In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/winscp/winscp
Files changed:
source/core/ScpFileSystem.cpp
source/resource/TextsCore.h
source/resource/TextsCore1.rc
Commit message: Bug 1675: Prevent SCP server sending files that were not requested

https://winscp.net/tracker/1675

Source commit: 4aa587620973bf793fb6e783052277c0f7be4b55


Vulnerable code:

Fixed code:
          if ((Level == 0) && (OnlyFileName != UnixExtractFileName(FileName)))
          {
            SCPError(LoadStr(UNREQUESTED_FILE), False);
          }
#define UNREQUESTED_FILE        749
  UNREQUESTED_FILE, "Server sent a file that was not requested."
CVE-2024-26484 (PHP, published 2024-02-22T05:15Z)
Description: value: A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CMS. The only effect was on the trykirby.com demo site, which is not customer-controlled.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getkirby/demokit
Files changed:
site/snippets/blocks/image.php
Commit message: Update image block to core snippet


Vulnerable code:
  'href'          => $link->or($src),

Fixed code:
  'href'          => $link->or($src)->toUrl(),
CVE-2020-35774 (Other, published 2020-12-29T18:15Z)
Description: value: server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/twitter/twitter-server
Files changed:
CHANGELOG.rst
server/src/main/scala/com/twitter/server/handler/HistogramQueryHandler.scala
Commit message: twitter-server: Plug XSS vulnerability in /histograms endpoint

Problem

Right now we allow script injection in /histograms by telling people about the
query that they just ran.

Solution

Stop telling people about the query they ran.

JIRA Issues: OSS-5328

Differential Revision: https://phabricator.twitter.biz/D574844


Vulnerable code:
          case None => s"Key: $query is not a valid histogram."
          s"Key: $query is not a valid histogram."

Fixed code:
* Escape user-provided string from the returned text.  This removes a potential vector for an XSS
  attack. ``PHAB_ID=D574844``

          case None => s"Key: ${escapeHtml(query)} is not a valid histogram."
          s"Key: ${escapeHtml(query)} is not a valid histogram."
CVE-2021-3765 (JavaScript, published 2021-11-02T07:15Z)
Description: value: validator.js is vulnerable to Inefficient Regular Expression Complexity
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/validatorjs/validator.js
Files changed:
src/lib/rtrim.js
Commit message: fix(rtrim): remove regex to prevent ReDOS attack (#1738)



Vulnerable code:
  // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /(\s)+$/g;
  return str.replace(pattern, '');

Fixed code:
  if (chars) {
    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
    const pattern = new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g');
    return str.replace(pattern, '');
  }
  // Use a faster and more safe than regex trim method https://blog.stevenlevithan.com/archives/faster-trim-javascript
  let strIndex = str.length - 1;
  while (/\s/.test(str.charAt(strIndex))) {
    strIndex -= 1;
  }

  return str.slice(0, strIndex + 1);
CVE-2022-29256 (JavaScript, published 2022-05-25T22:15Z)
Description: value: sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` environment variable in a build environment then they might be able to use this to inject an arbitrary command at `npm install` time. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. This problem is fixed in version 0.30.5.
Severity: MEDIUM (CVSS v3 base score: 6.7)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/lovell/sharp
Files changed:
docs/changelog.md
lib/libvips.js
Commit message: Install: pass `PKG_CONFIG_PATH` via env rather than substitution


Vulnerable code:
    const globalLibvipsVersion = spawnSync(`PKG_CONFIG_PATH="${pkgConfigPath()}" pkg-config --modversion vips-cpp`, spawnSyncOptions).stdout;
    const brewPkgConfigPath = spawnSync('which brew >/dev/null 2>&1 && eval $(brew --env) && echo $PKG_CONFIG_LIBDIR', spawnSyncOptions).stdout || '';

Fixed code:
* Install: pass `PKG_CONFIG_PATH` via env rather than substitution.
  [@dwisiswant0](https://github.com/dwisiswant0)

    const globalLibvipsVersion = spawnSync('pkg-config --modversion vips-cpp', {
      ...spawnSyncOptions,
      env: {
        PKG_CONFIG_PATH: pkgConfigPath()
      }
    }).stdout;
    const brewPkgConfigPath = spawnSync(
      'which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',
      spawnSyncOptions
    ).stdout || '';
CVE-2021-38383 (C, published 2021-08-10T18:15Z)
Description: value: OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/owntone/owntone-server
Files changed:
src/misc.c
Commit message: [misc] Fix use-after-free in net_bind()

Thanks to Ba Jinsheng for reporting this bug


Vulnerable code:
  // Get the port that was assigned
  ret = getsockname(fd, ptr->ai_addr, &ptr->ai_addrlen);
      DPRINTF(E_LOG, L_MISC, "Could not find address of service '%s': %s\n", log_service_name, strerror(errno));
  net_port_get(port, (union net_sockaddr *)ptr->ai_addr);
  net_address_get(addr, sizeof(addr), (union net_sockaddr *)ptr->ai_addr);

Fixed code:
  union net_sockaddr naddr = { 0 };
  socklen_t naddr_len = sizeof(naddr);
  // Get our address (as string) and the port that was assigned (necessary when
  // caller didn't specify a port)
  ret = getsockname(fd, &naddr.sa, &naddr_len);
      DPRINTF(E_LOG, L_MISC, "Error finding address of service '%s': %s\n", log_service_name, strerror(errno));
      goto error;
    }
  else if (naddr_len > sizeof(naddr))
    {
      DPRINTF(E_LOG, L_MISC, "Unexpected address length of service '%s'\n", log_service_name);
  net_port_get(port, &naddr);
  net_address_get(addr, sizeof(addr), &naddr);