hitoshura25/cvefixes huggingface dataset:
CVE-2022-4929 (JavaScript, published 2023-03-06T03:15Z)
Description: value: A vulnerability was found in icplayer up to 0.818. It has been rated as problematic. Affected by this issue is some unknown functionality of the file addons/Commons/src/tts-utils.js. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.819 is able to address this issue. The patch is identified as fa785969f213c76384f1fe67d47b17d57fcc60c8. It is recommended to upgrade the affected component. VDB-222290 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/icplayer/icplayer
Files changed:
addons/Commons/src/tts-utils.js
addons/Table/src/presenter.js
changelog.txt
Commit message: fix(addons): Fix XSS vulnerabilities in Table and tts-utils (#885)

* sanitize Wiris response against XSS in the Wiris addon

* added tests

* fix(addons): Fix XSS vulnerabilities in Table addon and tts-utils

Co-authored-by: Maciej Zawłocki <mzawlocki@solwit.com>
Co-authored-by: maciej-zawlocki-solwit <34648176+maciej-zawlocki-solwit@users.noreply.github.com>

Vulnerable code:
                var altText = $(this).attr('alt');
                        $(this).attr('id'),

Fixed code:
                var altText = window.xssUtils.sanitize($(this).attr('alt'));
                        window.xssUtils.sanitize($(this).attr('id')),
2022-12-09 Fixed XSS vulnerabilities in Table and tts-utils
CVE-2015-3634 (PHP, published 2017-06-08T21:29Z)
Description: value: The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Boonstra/Slideshow
Files changed:
classes/SlideshowPluginSlideshowStylesheet.php
readme.txt
Commit message: Fixed security vulnerability with custom stylesheets


Vulnerable code:
		// Get custom stylesheet, of the default stylesheet if the custom stylesheet does not exist
		$stylesheet = get_option($styleName, '');
		if (strlen($stylesheet) <= 0)
			$stylesheet .= ob_get_clean();
*   Compatible with WordPress 4.0.

Fixed code:
		// Get custom style keys
		$customStyleKeys = array_keys(get_option(SlideshowPluginGeneralSettings::$customStyles, array()));
		// Match $styleName against custom style keys
		if (in_array($styleName, $customStyleKeys))
		{
			// Get custom stylesheet
			$stylesheet = get_option($styleName, '');
		}
		else
			$stylesheet = ob_get_clean();
*   Compatible with WordPress 4.2.
*	Fixed: Security vulnerability in the SlideshowPluginSlideshowStylesheet class.
CVE-2020-28472 (TypeScript, published 2021-01-19T11:15Z)
Description: value: This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aws/aws-sdk-js-v3
Files changed:
packages/shared-ini-file-loader/src/index.spec.ts
packages/shared-ini-file-loader/src/index.ts
Commit message: fix(shared-ini-file-loader): ignore prohibited profile name (#1764)

* fix(shared-ini-file-loader): ignore prohibited profile name

* fix: address feedbacks

Vulnerable code:
export function loadSharedConfigFiles(init: SharedConfigInit = {}): Promise<SharedConfigFiles> {
}
function normalizeConfigFile(data: ParsedIniData): ParsedIniData {
}
function parseIni(iniData: string): ParsedIniData {
}
function slurpFile(path: string): Promise<string> {
  return new Promise((resolve, reject) => {
}
function getHomeDir(): string {
}

Fixed code:

    it("should ignore profile name in block list", async () => {
      __addMatcher(
        DEFAULT_PATH,
        `
[__proto__]
foo = not_exist`.trim()
      );

      expect(await loadSharedConfigFiles()).toEqual({
        configFile: {},
        credentialsFile: {},
      });
    });

    it("should ignore profile name in block list", async () => {
      __addMatcher(
        DEFAULT_PATH,
        `
[profile __proto__]
foo = not_exist`.trim()
      );

      expect(await loadSharedConfigFiles()).toEqual({
        configFile: {},
        credentialsFile: {},
      });
    });
export const loadSharedConfigFiles = (init: SharedConfigInit = {}): Promise<SharedConfigFiles> => {
};
const normalizeConfigFile = (data: ParsedIniData): ParsedIniData => {
};
const profileNameBlockList = ["__proto__", "profile __proto__"];
const parseIni = (iniData: string): ParsedIniData => {
      if (profileNameBlockList.includes(currentSection)) {
        throw new Error(`Found invalid profile name "${currentSection}"`);
      }
};
const slurpFile = (path: string): Promise<string> =>
  new Promise((resolve, reject) => {
const getHomeDir = (): string => {
};
CVE-2024-31995 (JSON, published 2024-04-10T22:15Z)
Description: value: `@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param.  This can allow invocations outside of the original intended time period.  A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/digitalbazaar/zcap
Files changed:
package.json
Commit message: Express expectation of node >= 18.


Vulnerable code:
    "node": ">=14"

Fixed code:
    "node": ">=18"
CVE-2021-4216 (C, published 2022-08-26T16:15Z)
Description: value: A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ArtifexSoftware/mupdf
Files changed:
source/tools/muraster.c
Commit message: Bug 704834: Fix division by zero for zero width pages in muraster.


Vulnerable code:
	reps = (int)(max_band_memory / min_band_mem);
	if (reps < 1)

Fixed code:
	if (min_band_mem > 0)
		reps = (int)(max_band_memory / min_band_mem);
	if (min_band_mem == 0 || reps < 1)
CVE-2023-30857 (TypeScript, published 2023-04-28T21:15Z)
Description: value: @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.

Severity: nan (CVSS v3 base score: 3.7)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/aedart/ion
Files changed:
packages/support/src/meta/meta.ts
Commit message: Fix possible prototype pollution

Not entirely sure how likely this will ever be for metadata, but just in case that the entire metadata record's prototype is attempted polluted, then this will prevent it.

Vulnerable code:
    let metadata: MetadataRecord = registry.get(owner) ?? {};

Fixed code:
    let metadata: MetadataRecord = registry.get(owner) ?? Object.create(null);
CVE-2019-18397 (C, published 2019-11-13T14:15Z)
Description: value: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/fribidi/fribidi
Files changed:
lib/fribidi-bidi.c
Commit message: Truncate isolate_level to FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL


Vulnerable code:
          RL_ISOLATE_LEVEL (pp) = isolate_level++;

Fixed code:
          RL_ISOLATE_LEVEL (pp) = isolate_level;
          if (isolate_level < FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL-1)
              isolate_level++;
CVE-2022-25309 (C, published 2022-09-06T18:15Z)
Description: value: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-122 \u2014 Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Repository: https://github.com/fribidi/fribidi
Files changed:
lib/fribidi-char-sets-cap-rtl.c
Commit message: Protected against garbage in the CapRTL encoder


Vulnerable code:
	us[j++] = caprtl_to_unicode[(int) s[i]];

Fixed code:
      {
        if ((int)s[i] < 0)
          us[j++] = '?';
        else
          us[j++] = caprtl_to_unicode[(int) s[i]];
      }
CVE-2020-4045 (Unknown, published 2020-06-11T22:15Z)
Description: value: SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1. Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/ssbc/ssb-db
Files changed:
Commit message: Merge pull request from GHSA-mpgr-2cx9-327h

Fix get() returning decrypted messages

Vulnerable code:

Fixed code:
CVE-2022-25929 (JavaScript, published 2022-12-21T05:15Z)
Description: value: The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/joewalnes/smoothie
Files changed:
smoothie.js
Commit message: fix: potential XSS when `tooltipLabel` or `strokeStyle` are controlled by users

This doesn't completely get rid of `innerHTML` usage, but at least
now the developer is responsible for `tooltipFormatter` not returning
dangerous HTML if they decide to override it.


Vulnerable code:
          lines = [timestampFormatter(new Date(timestamp))],
        lines.push('<span style="color:' + data[i].series.options.strokeStyle + '">' +
        label +
        this.options.yMaxFormatter(data[i].value, this.options.labels.precision) + '</span>');
      return lines.join('<br>');

Fixed code:
 * v1.36.1: Fix a potential XSS when `tooltipLabel` or `strokeStyle` are controlled by users, by @WofWca
          // A dummy element to hold children. Maybe there's a better way.
          elements = document.createElement('div'),
      elements.appendChild(document.createTextNode(
        timestampFormatter(new Date(timestamp))
      ));
        var dataEl = document.createElement('span');
        dataEl.style.color = data[i].series.options.strokeStyle;
        dataEl.appendChild(document.createTextNode(
          label + this.options.yMaxFormatter(data[i].value, this.options.labels.precision)
        ));
        elements.appendChild(document.createElement('br'));
        elements.appendChild(dataEl);
      return elements.innerHTML;
      // TODO make `tooltipFormatter` return element(s) instead of an HTML string so it's harder for users
      // to introduce an XSS. This would be a breaking change.
CVE-2021-25964 (Python, published 2021-10-04T15:15Z)
Description: value: In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/janeczku/calibre-web
Files changed:
cps/editbooks.py
cps/jinjia.py
cps/templates/detail.html
cps/templates/index.html
cps/ub.py
optional-requirements.txt
requirements.txt
Commit message: Added lxml to needed requirements
Improved displaying of series title, book of series, comments and custom comments


Vulnerable code:
have_scholar = True
    pass

            book.comments[0].text = comments


        <p>{{_("Book %(index)s of %(range)s", index=entry.series_index|formatfloat(2), range=("<a href='" + url_for('web.books_list', data='series', sort_param='stored', book_id=entry.series[0].id) + "'>" + entry.series[0].name + "</a>")|safe) }}</p>
  <h2 class="{{title}}">{{_(title)}}</h2>
                log.info("Login and store session : " + flask_session.get('_id', ""))
                log.info("Found stored session : " + flask_session.get('_id', ""))
        log.info("Deleted session_key : " + session_key)
lxml>=3.8.0,<4.7.0

Fixed code:
from lxml.html.clean import clean_html
    have_scholar = True


    if comments:
        comments = clean_html(comments)
            book.comments[0].text = clean_html(comments)
        if to_save[cc_string]:
            to_save[cc_string] = clean_html(to_save[cc_string])
from flask_babel import gettext as _
from markupsafe import escape
@jinjia.app_template_filter('escapedlink')
def escapedlink_filter(url, text):
    return "<a href='{}'>{}</a>".format(url, escape(text))

          <p>{{_("Book %(index)s of %(range)s", index=entry.series_index | formatfloat(2), range=(url_for('web.books_list', data='series', sort_param='stored', book_id=entry.series[0].id)|escapedlink(entry.series[0].name))|safe)}}</p>
  <h2 class="{{title}}">{{title}}</h2>
                log.debug("Login and store session : " + flask_session.get('_id', ""))
                log.debug("Found stored session: " + flask_session.get('_id', ""))
        log.debug("Deleted session_key: " + session_key)
lxml>=3.8.0,<4.7.0
CVE-2021-4170 (JavaScript, published 2022-01-16T21:15Z)
Description: value: calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/janeczku/calibre-web
Files changed:
cps/static/js/edit_books.js
Commit message: Fix upload of cover and book formats containing html characters


Vulnerable code:
    $("#upload-format").html(filename);
    $("#upload-cover").html(filename);

Fixed code:
    $("#upload-format").text(filename);
    $("#upload-cover").text(filename);
CVE-2021-4171 (Python, published 2022-01-17T10:15Z)
Description: value: calibre-web is vulnerable to Business Logic Errors
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/janeczku/calibre-web
Files changed:
cps/shelf.py
Commit message: Prevent 2 public shelfs with same names due to changing public property


Vulnerable code:
        shelf.is_public = 1 if to_save.get("is_public") else 0
        if check_shelf_is_unique(shelf, shelf_title, shelf_id):
def check_shelf_is_unique(shelf, title, shelf_id=False):
    if shelf.is_public == 1:

Fixed code:
        is_public = 1 if to_save.get("is_public") else 0
        if check_shelf_is_unique(shelf, shelf_title, is_public, shelf_id):
            shelf.is_public = is_public
def check_shelf_is_unique(shelf, title, is_public, shelf_id=False):
    if is_public == 1:
CVE-2022-0273 (Python, published 2022-01-30T14:15Z)
Description: value: Improper Access Control in Pypi calibreweb prior to 0.6.16.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/janeczku/calibre-web
Files changed:
cps/shelf.py
Commit message: Prevent creating a public shelf without permission


Vulnerable code:
        is_public = 1 if to_save.get("is_public") else 0

Fixed code:
        is_public = 1 if to_save.get("is_public") == "on" else 0
CVE-2022-0406 (Python, published 2022-04-03T19:15Z)
Description: value: Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/janeczku/calibre-web
Files changed:
SECURITY.md
cps/constants.py
Commit message: Upates for new release


Vulnerable code:
STABLE_VERSION = {'version': '0.6.16 Beta'}

Fixed code:
| V 0.6.16      | JavaScript could get executed on authors page. Thanks to @alicaz                                                   ||
| V 0.6.16      | Localhost can no longer be used to upload covers. Thanks to @scara31                                               ||
| V 0.6.16      | Another case where public shelfs could be created without permission is prevented. Thanks to @ibarrionuevo         ||
STABLE_VERSION = {'version': '0.6.16'}
CVE-2022-0766 (Python, published 2022-03-07T07:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/janeczku/calibre-web
Files changed:
cps/helper.py
Commit message: Don't allow redirects on cover uploads, catch more addresses which resolve to localhost


Vulnerable code:
            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling

Fixed code:
            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling
CVE-2022-0767 (Python, published 2022-03-07T07:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
Severity: HIGH (CVSS v3 base score: 9.9)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/janeczku/calibre-web
Files changed:
cps/helper.py
Commit message: Don't allow redirects on cover uploads, catch more addresses which resolve to localhost


Vulnerable code:
            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling

Fixed code:
            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling