hitoshura25/cvefixes huggingface dataset:
CVE-2022-1021 (Ruby, published 2022-08-19T13:15Z)
Description: value: Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
.rubocop.yml
app/models/campaign.rb
app/models/conversation.rb
lib/url_helper.rb
spec/helpers/url_helper_spec.rb
spec/models/conversation_spec.rb
Commit message: fix: Referer URL validation (#4309)

Fixes #354

Vulnerable code:
require 'uri'
  def url_valid?(url)
    url = begin
      URI.parse(url)
    rescue StandardError
      false
    end
    url.is_a?(URI::HTTP) || url.is_a?(URI::HTTPS)
  end


Fixed code:
    - 'app/models/conversation.rb'
  include UrlHelper
  include UrlHelper
  validate :validate_referer_url
  def validate_referer_url
    return unless additional_attributes['referer']

    self['additional_attributes']['referer'] = nil unless url_valid?(additional_attributes['referer'])
  end

require 'uri'
module UrlHelper
  def url_valid?(url)
    url = begin
      URI.parse(url)
    rescue StandardError
      false
    end
    url.is_a?(URI::HTTP) || url.is_a?(URI::HTTPS)
  end
end
require 'rails_helper'

describe UrlHelper, type: :helper do
  describe '#url_valid' do
    context 'when url valid called' do
      it 'return if valid url passed' do
        expect(helper.url_valid?('https://app.chatwoot.com/')).to eq true
      end

      it 'return false if invalid url passed' do
        expect(helper.url_valid?('javascript:alert(document.cookie)')).to eq false
      end
    end
  end
end

  describe 'validate invalid referer url' do
    let(:conversation) { create(:conversation, additional_attributes: { referer: 'javascript' }) }

    it 'returns nil' do
      expect(conversation['additional_attributes']['referer']).to eq(nil)
    end
  end

  describe 'validate valid referer url' do
    let(:conversation) { create(:conversation, additional_attributes: { referer: 'https://www.chatwoot.com/' }) }

    it 'returns nil' do
      expect(conversation['additional_attributes']['referer']).to eq('https://www.chatwoot.com/')
    end
  end
CVE-2022-2901 (Ruby, published 2022-09-06T10:15Z)
Description: value: Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/controllers/api/v1/accounts/team_members_controller.rb
spec/controllers/api/v1/accounts/team_members_controller_spec.rb
Commit message: fix: Validations for updating team members (#5384)

fixes: chatwoot/product#539

Co-authored-by: Sojan Jose <sojan@pepalo.com>

Vulnerable code:

Fixed code:
  before_action :validate_member_id_params, only: [:create, :update, :destroy]

  def validate_member_id_params
    invalid_ids = params[:user_ids].map(&:to_i) - @team.account.user_ids

    render json: { error: 'Invalid User IDs' }, status: :unauthorized and return if invalid_ids.present?
  end
  let(:account_2) { create(:account) }
      let(:agent_2) { create(:user, account: account_2, role: :agent) }

      it 'ignores the user ids when its not a valid account user id' do
        params = { user_ids: [agent_2.id] }

        patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members",
              params: params,
              headers: administrator.create_new_auth_token,
              as: :json

        expect(response).to have_http_status(:unauthorized)
        json_response = JSON.parse(response.body)
        expect(json_response['error']).to eq('Invalid User IDs')
      end
CVE-2023-2109 (JavaScript, published 2023-04-17T01:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chatwoot/chatwoot
Files changed:
app/javascript/sdk/bubbleHelpers.js
Commit message: fix: use innerText instead of innerHTML (#6431)

* refactor: use inner text instead of inner html

* refactor: use innerText instead of innerHTML

Vulnerable code:
    textNode.innerHTML = bubbleText;
    textNode.innerHTML = '';

Fixed code:
    textNode.innerText = bubbleText;
    textNode.innerText = '';
CVE-2023-2251 (JavaScript, published 2023-04-24T15:15Z)
Description: value: Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-248 \u2014 Uncaught Exception
An exception is thrown from a function, but it is not caught.
Repository: https://github.com/eemeli/yaml
Files changed:
src/errors.ts
tests/doc/errors.js
Commit message: fix: Corner case failure in error pretty-printer


Vulnerable code:
        count = Math.min(end.col - col, 80 - ci)

Fixed code:
        count = Math.max(1, Math.min(end.col - col, 80 - ci))

  test('repeated CR', () => {
    const src = '[' + '\r'.repeat(80)
    const doc = YAML.parseDocument(src, { prettyErrors: true })
    expect(doc.errors[0]).not.toHaveProperty('source')
  })
CVE-2014-4978 (C, published 2017-12-29T22:29Z)
Description: value: The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rawstudio/rawstudio
Files changed:
librawstudio/rs-filter.c
Commit message: Fixes insecure use of temporary file (CVE-2014-4978).


Vulnerable code:
	g_file_set_contents("/tmp/rs-filter-graph", str->str, str->len, NULL);
	if (0 != system("dot -Tpng >/tmp/rs-filter-graph.png </tmp/rs-filter-graph"))
	if (0 != system("gnome-open /tmp/rs-filter-graph.png"))

Fixed code:
	gchar *dot_filename;
	gchar *png_filename;
	gchar *command_line;
	/* Here we would like to use g_mkdtemp(), but due to a bug in upstream, that's impossible */
	dot_filename = g_strdup_printf("/tmp/rs-filter-graph.%u", g_random_int());
	png_filename = g_strdup_printf("%s.%u.png", dot_filename, g_random_int());

	g_file_set_contents(dot_filename, str->str, str->len, NULL);

	command_line = g_strdup_printf("dot -Tpng >%s <%s", png_filename, dot_filename);
	if (0 != system(command_line))
	g_free(command_line);

	command_line = g_strdup_printf("gnome-open %s", png_filename);
	if (0 != system(command_line))
	g_free(command_line);
	g_free(dot_filename);
	g_free(png_filename);
CVE-2015-3885 (C++, published 2015-05-19T18:59Z)
Description: value: Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/rawstudio/rawstudio
Files changed:
plugins/load-dcraw/dcraw.cc
Commit message: Avoid overflow in ljpeg_start().

Vulnerable code:
  int c, tag, len;

Fixed code:
  int c, tag;
  ushort len;
CVE-2022-45907 (Python, published 2022-11-26T02:15Z)
Description: value: In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/pytorch/pytorch
Files changed:
test/test_jit.py
torch/csrc/jit/frontend/script_type_parser.cpp
torch/jit/annotations.py
Commit message: [JIT][Security] Do not blindly eval input string (#89189)

Introduce `_eval_no_call` method, that evaluates statement only if it
does not contain any calls(done by examining the bytecode), thus preventing command injection exploit

Added simple unit test to check for that
`torch.jit.annotations.get_signature` would not result in calling random
code.

Although, this code path exists for Python-2 compatibility, and perhaps
should be simply removed.

Fixes https://github.com/pytorch/pytorch/issues/88868

Pull Request resolved: https://github.com/pytorch/pytorch/pull/89189
Approved by: https://github.com/suo


Vulnerable code:
  // machinery for graph generation, constant propgation, and constant
        arg_ann = eval(arg_ann_str, {}, EvalEnv(rcb))  # type: ignore[arg-type] # noqa: P204
        ret_ann = eval(ret_ann_str, {}, EvalEnv(rcb))  # type: ignore[arg-type] # noqa: P204

Fixed code:
    def test_calls_in_type_annotations(self):
        with self.assertRaisesRegex(RuntimeError, "Type annotation should not contain calls"):
            def spooky(a):
                # type: print("Hello") -> Tensor # noqa: F723
                return a + 2
            print(torch.__file__)
            torch.jit.annotations.get_signature(spooky, None, 1, True)

  // machinery for graph generation, constant propagation, and constant
import dis
def _eval_no_call(stmt, glob, loc):
    """Evaluate statement as long as it does not contain any method/function calls"""
    bytecode = compile(stmt, "", mode="eval")
    for insn in dis.get_instructions(bytecode):
        if "CALL" in insn.opname:
            raise RuntimeError(f"Type annotation should not contain calls, but '{stmt}' does")
    return eval(bytecode, glob, loc)  # type: ignore[arg-type] # noqa: P204


        arg_ann = _eval_no_call(arg_ann_str, {}, EvalEnv(rcb))
        ret_ann = _eval_no_call(ret_ann_str, {}, EvalEnv(rcb))
CVE-2024-31580 (C++, published 2024-04-17T19:15Z)
Description: value: PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pytorch/pytorch
Files changed:
torch/csrc/jit/runtime/vararg_functions.cpp
Commit message: [fuzzing result][fuzz_torch_jit_lite_interpreter] read-heap-buffer-overflow-far-from-bounds (size 4) in c10::IValue::IValue() (#110441)

Summary: This diff fixes a heap underflow found by fuzzing in torch/csrc/jit/runtime/vararg_functions.cpp

Test Plan:
CI and
```
arc lionhead crash reproduce 1753074381791061
```
doesn't crash anymore.

Differential Revision: D49537535

Pull Request resolved: https://github.com/pytorch/pytorch/pull/110441
Approved by: https://github.com/Skylion007


Vulnerable code:

Fixed code:
  if (num_inputs > stack.size()) {
    TORCH_CHECK(false, "Invalid number of inputs: ", num_inputs);
  }
CVE-2024-31583 (C++, published 2024-04-17T19:15Z)
Description: value: Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pytorch/pytorch
Files changed:
torch/csrc/jit/mobile/interpreter.cpp
Commit message: [fuzzing result][fuzz_torch_jit_lite_interpreter] read-heap-use-after-free (size 8) in std::_Function_base::_M_empty() (#110289)

Summary: This diff fixes a heap UAF found by fuzzing in torch/csrc/jit/mobile/interpreter.cpp

Test Plan:
CI and
```
arc lionhead crash reproduce 1009060456885023
```
doesn't crash anymore.

Reviewed By: malfet

Differential Revision: D49538326

Pull Request resolved: https://github.com/pytorch/pytorch/pull/110289
Approved by: https://github.com/malfet


Vulnerable code:

Fixed code:
          if (inst.X < 0 ||
              static_cast<size_t>(inst.X) >= code.operators_.size()) {
            throw JITException("Invalid OP Instruction");
          }
CVE-2024-31584 (C++, published 2024-04-19T21:15Z)
Description: value: Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pytorch/pytorch
Files changed:
torch/csrc/jit/mobile/flatbuffer_loader.cpp
Commit message: Fix for PyTorch mobile flatbuffer loader out of bounds reads (#110162)

Summary:
The mobile_ivalue_size field in the mobile_bytecode flatbuffer schema can be larger than the ivalues vector. This introduces potential for memory corruption when parsing the mobile_bytecode Module.

This diff fixes the issue by ensuring that  mobile_ivalue_size is less than the size of the ivalues vector.

Test Plan: contbuild & OSS CI

Differential Revision: D49687548

Pull Request resolved: https://github.com/pytorch/pytorch/pull/110162
Approved by: https://github.com/malfet


Vulnerable code:
  if (mobile_ivalue_size_ == 0) {

Fixed code:
  if (mobile_ivalue_size_ == 0 || mobile_ivalue_size_ > ivalues->size()) {
CVE-2020-11078 (Python, published 2020-05-20T16:15Z)
Description: value: In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/httplib2/httplib2
Files changed:
python2/httplib2/__init__.py
python3/httplib2/__init__.py
tests/__init__.py
tests/test_http.py
Commit message: IMPORTANT security vulnerability CWE-93 CRLF injection

Force %xx quote of space, CR, LF characters in uri.

Special thanks to Recar https://github.com/Ciyfly for discrete notification.

https://cwe.mitre.org/data/definitions/93.html


Vulnerable code:
            # print('!!! recv', chunk)

Fixed code:
            # Prevent CWE-75 space injection to manipulate request via part of uri.
            # Prevent CWE-93 CRLF injection to modify headers via part of uri.
            uri = uri.replace(" ", "%20").replace("\r", "%0D").replace("\n", "%0A")
            # Prevent CWE-75 space injection to manipulate request via part of uri.
            # Prevent CWE-93 CRLF injection to modify headers via part of uri.
            uri = uri.replace(" ", "%20").replace("\r", "%0D").replace("\n", "%0A")
            # print("!!! recv", chunk)


def test_cwe93_inject_crlf():
    # https://cwe.mitre.org/data/definitions/93.html
    # GET /?q= HTTP/1.1      <- injected "HTTP/1.1" from attacker
    # injected: attack
    # ignore-http: HTTP/1.1  <- nominal "HTTP/1.1" from library
    # Host: localhost:57285
    http = httplib2.Http()
    with tests.server_reflect() as uri:
        danger_url = urllib.parse.urljoin(
            uri, "?q= HTTP/1.1\r\ninjected: attack\r\nignore-http:"
        )
        response, content = http.request(danger_url, "GET")
        assert response.status == 200
        req = tests.HttpRequest.from_bytes(content)
        assert req.headers.get("injected") is None


def test_inject_space():
    # Injecting space into request line is precursor to CWE-93 and possibly other injections
    http = httplib2.Http()
    with tests.server_reflect() as uri:
        # "\r\nignore-http:" suffix is nuance for current server implementation
        # please only pay attention to space after "?q="
        danger_url = urllib.parse.urljoin(uri, "?q= HTTP/1.1\r\nignore-http:")
        response, content = http.request(danger_url, "GET")
        assert response.status == 200
        req = tests.HttpRequest.from_bytes(content)
        assert req.uri == "/?q=%20HTTP/1.1%0D%0Aignore-http:"
CVE-2015-10059 (JavaScript, published 2023-01-17T13:15Z)
Description: value: A vulnerability has been found in s134328 Webapplication-Veganguide and classified as problematic. This vulnerability affects unknown code of the file p05-integration/app/shared/api/apiService.js. The manipulation of the argument country/city leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 2aa760fa4e779e40a28206a32ac22ac10356f519. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218416.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/s134328/Webapplication-Veganguide
Files changed:
p05-integration/app/shared/api/apiService.js
p05-integration/cache.manifest
Commit message: Sprint 1: Frontend: API gesichert vor XSS

User-Eingaben (Parameter aus GET/URLs) werden nur genutzt wenn diese
Alpha-Numerisch + Unterstrich + Bindestrich sind.


Vulnerable code:
	 * @returns
			///get(this.url + "?apikey=" + this.apikey + "&lang=" + this.lang, 'listCountries', callback);
			//get('this.url + "?apikey=" + this.apikey + "&lang=" + this.lang + "&country=" + country', 'listCities', callback);
			//get(this.url + "?apikey=" + this.apikey + "&lang=" + this.lang + "&country=" + country + "&city=" + city',  callback);
# rev 20150511-0746

Fixed code:
	 * @returns nothing
	/**
	 * Decode the string into a safe placeholder.
	 * If it contains unsafe characters an empty string will be returned.
	 * 
	 * @private
	 * @function placeholder
	 * @memberOf app.api.apiService
	 * @param {string} placeholder - A maybe unsafe placeholder used in an $http Request
	 * @returns {string} Safe Placeholder
	 */
	var safe = function(placeholder) {
		var reg = /^[a-zA-Z0-9\-_]+$/;
		if(reg.test) {
			return placeholder;
		} else {
			return "";
		}
	};

			///get(this.url + '?apikey=' + this.apikey + '&lang=' + this.lang, 'listCountries', callback);
			//get(this.url + '?apikey=' + this.apikey + '&lang=' + this.lang + '&country=' + safe(country), 'listCities', callback);
			//get(this.url + '?apikey=' + this.apikey + '&lang=' + this.lang + '&country=' + safe(country) + '&city=' + safe(city),  callback);
# rev 20150511-0827
CVE-2015-1347 (PHP, published 2015-01-23T15:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket-1.8
Files changed:
client.inc.php
Commit message: xss: Fix possible vuln setting client lang pref


Vulnerable code:
    $_SESSION['client:lang'] = $_GET['lang'];

Fixed code:
    if (Internationalization::getLanguageInfo($_GET['lang']))
        $_SESSION['client:lang'] = $_GET['lang'];
CVE-2018-7750 (Python, published 2018-03-13T18:29Z)
Description: value: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/paramiko/paramiko
Files changed:
paramiko/common.py
paramiko/transport.py
Commit message: Fixes CVE-2018-7750 / #1175

At least, insofar as the new tests pass...!


Vulnerable code:
    DEFAULT_WINDOW_SIZE, DEFAULT_MAX_PACKET_SIZE,
                        self._handler_table[ptype](self, m)

Fixed code:
HIGHEST_USERAUTH_MESSAGE_ID = 79
    DEFAULT_WINDOW_SIZE, DEFAULT_MAX_PACKET_SIZE, HIGHEST_USERAUTH_MESSAGE_ID,
    def _ensure_authed(self, ptype, message):
        """
        Checks message type against current auth state.

        If server mode, and auth has not succeeded, and the message is of a
        post-auth type (channel open or global request) an appropriate error
        response Message is crafted and returned to caller for sending.

        Otherwise (client mode, authed, or pre-auth message) returns None.
        """
        if (
            not self.server_mode
            or ptype <= HIGHEST_USERAUTH_MESSAGE_ID
            or self.is_authenticated()
        ):
            return None
        # WELP. We must be dealing with someone trying to do non-auth things
        # without being authed. Tell them off, based on message class.
        reply = Message()
        # Global requests have no details, just failure.
        if ptype == MSG_GLOBAL_REQUEST:
            reply.add_byte(cMSG_REQUEST_FAILURE)
        # Channel opens let us reject w/ a specific type + message.
        elif ptype == MSG_CHANNEL_OPEN:
            kind = message.get_text()
            chanid = message.get_int()
            reply.add_byte(cMSG_CHANNEL_OPEN_FAILURE)
            reply.add_int(chanid)
            reply.add_int(OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED)
            reply.add_string('')
            reply.add_string('en')
        # NOTE: Post-open channel messages do not need checking; the above will
        # reject attemps to open channels, meaning that even if a malicious
        # user tries to send a MSG_CHANNEL_REQUEST, it will simply fall under
        # the logic that handles unknown channel IDs (as the channel list will
        # be empty.)
        return reply
                        error_msg = self._ensure_authed(ptype, m)
                        if error_msg:
                            self._send_message(error_msg)
                        else:
                            self._handler_table[ptype](self, m)