hitoshura25/cvefixes huggingface dataset:
CVE-2024-22211 (C, published 2024-01-19T20:15Z)
Description: value: FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/planar.c
Commit message: [codec,planar] check resolution for overflow

If the codec resolution is too large return an error as the internal
buffers would otherwise overflow.


Vulnerable code:
	context->maxPlaneSize = context->maxWidth * context->maxHeight;

Fixed code:
	const UINT64 tmp = (UINT64)context->maxWidth * context->maxHeight;
	if (tmp > UINT32_MAX)
		return FALSE;
	context->maxPlaneSize = tmp;

	if (context->maxWidth > UINT32_MAX / 4)
		return FALSE;
CVE-2024-32658 (C, published 2024-04-23T18:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/interleaved.c
Commit message: [codec,interleaved] fix offset error


Vulnerable code:
		if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
	if (!buffer_within_range(pbOrderHdr, 2, pbEnd))

Fixed code:
		if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
	if (!buffer_within_range(pbOrderHdr, 3, pbEnd))
CVE-2024-32659 (C, published 2024-04-23T20:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/color.c
Commit message: [codec,color] fix out of bound read


Vulnerable code:

Fixed code:
	if ((nWidth == 0) || (nHeight == 0))
		return TRUE;
CVE-2024-32660 (C, published 2024-04-23T20:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/codec/zgfx.c
Commit message: [codec,zgfx] allocate in segment steps

do not trust the uncompressedSize of a ZGFX_SEGMENTED_MULTIPART and
allocate the output buffer in steps after decoding a segment.


Vulnerable code:
		*ppDstData = NULL;

			*ppDstData = aligned_zgfx_malloc(zgfx->OutputCount);

		if (!*ppDstData)
			goto fail;

		*pDstSize = zgfx->OutputCount;
		CopyMemory(*ppDstData, zgfx->OutputBuffer, zgfx->OutputCount);
		BYTE* pConcatenated = NULL;
		size_t used = 0;
		if (!Stream_CheckAndLogRequiredLengthOfSize(TAG, stream, segmentCount, sizeof(UINT32)))
			goto fail;

		pConcatenated = aligned_zgfx_malloc(uncompressedSize);

		if (!pConcatenated)
			goto fail;

		*ppDstData = pConcatenated;
		*pDstSize = uncompressedSize;

			if (zgfx->OutputCount > UINT32_MAX - used)
			if (used + zgfx->OutputCount > uncompressedSize)
				goto fail;
			CopyMemory(pConcatenated, zgfx->OutputBuffer, zgfx->OutputCount);
			pConcatenated += zgfx->OutputCount;
			used += zgfx->OutputCount;
		}

Fixed code:
static BOOL zgfx_append(ZGFX_CONTEXT* zgfx, BYTE** ppConcatenated, size_t uncompressedSize,
                        size_t* pUsed)
{
	WINPR_ASSERT(zgfx);
	WINPR_ASSERT(ppConcatenated);
	WINPR_ASSERT(pUsed);

	const size_t used = *pUsed;
	if (zgfx->OutputCount > UINT32_MAX - used)
		return FALSE;

	if (used + zgfx->OutputCount > uncompressedSize)
		return FALSE;

	BYTE* tmp = realloc(*ppConcatenated, used + zgfx->OutputCount + 64ull);
	if (!tmp)
		return FALSE;
	*ppConcatenated = tmp;
	CopyMemory(&tmp[used], zgfx->OutputBuffer, zgfx->OutputCount);
	*pUsed = used + zgfx->OutputCount;
	return TRUE;
}

	size_t used = 0;
	BYTE* pConcatenated = NULL;
	WINPR_ASSERT(ppDstData);
	WINPR_ASSERT(pDstSize);

	*ppDstData = NULL;
	*pDstSize = 0;
		{
			if (!zgfx_append(zgfx, &pConcatenated, zgfx->OutputCount, &used))
				goto fail;
			if (used != zgfx->OutputCount)
				goto fail;
			*ppDstData = pConcatenated;
			*pDstSize = zgfx->OutputCount;
		}
			if (!zgfx_append(zgfx, &pConcatenated, uncompressedSize, &used))
		}
		if (used != uncompressedSize)
			goto fail;
		*ppDstData = pConcatenated;
		*pDstSize = uncompressedSize;
	if (status < 0)
		free(pConcatenated);
CVE-2024-32661 (C, published 2024-04-23T20:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/info.c
Commit message: [core,info] fix missing check in rdp_write_logon_info_v1


Vulnerable code:

Fixed code:
	WINPR_ASSERT(info);
	if (!info->domain || !info->username)
		return FALSE;
CVE-2024-32662 (C, published 2024-04-23T21:15Z)
Description: value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/FreeRDP/FreeRDP
Files changed:
libfreerdp/core/redirection.c
Commit message: [core,redirection] fix length of redirection strings

length field is in bytes, when converting from UCS-2 use size in WCHAR


Vulnerable code:
	char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength, &utf8_len);

Fixed code:
	char* utf8 = ConvertWCharNToUtf8Alloc(wchar, *pLength / sizeof(WCHAR), &utf8_len);
CVE-2023-42439 (Python, published 2023-09-15T21:15Z)
Description: value: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/GeoNode/geonode
Files changed:
geonode/proxy/tests.py
geonode/utils.py
Commit message: Merge pull request from GHSA-pxg5-h34r-7q8p

* fixes advisory

* - fix tests

Vulnerable code:
    match = ip_regex.findall(url)
    match = domain_regex.findall(url)

Fixed code:
        url = f"{settings.SITEURL.rstrip('/')}@geoserver:8080/web/index.html"

        response = self.client.get(f"{self.proxy_url}?url={url}")
        self.assertEqual(response.status_code, 403)

        url = f"{settings.SITEURL.rstrip('/')}%40geoserver:8080/web/index.html"

        response = self.client.get(f"{self.proxy_url}?url={url}")
        self.assertEqual(response.status_code, 403)

    urlunparse,
def remove_credentials_from_url(url):
    # Parse the URL
    parsed_url = urlparse(url)

    # Remove the username and password from the parsed URL
    parsed_url = parsed_url._replace(netloc=parsed_url.netloc.split("@")[-1])

    # Reconstruct the URL without credentials
    cleaned_url = urlunparse(parsed_url)

    return cleaned_url


    # Decode the URL to handle percent-encoded characters
    _url = remove_credentials_from_url(unquote(url))

    match = ip_regex.findall(_url)
    match = domain_regex.findall(_url)
CVE-2010-10007 (PHP, published 2023-01-18T06:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in lierdakil click-reminder. It has been rated as critical. This issue affects the function db_query of the file src/backend/include/BaseAction.php. The manipulation leads to sql injection. The identifier of the patch is 41213b660e8eb01b22c8074f06208f59a73ca8dc. It is recommended to apply a patch to fix this issue. The identifier VDB-218465 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/lierdakil/click-reminder
Files changed:
src/backend/include/BaseAction.php
Commit message: Some SQL injection safeguards

Vulnerable code:

Fixed code:
        if(strpos($query, ';') !== false)
            throw new Exception("Query '$query' contains ';'!", ERR_DB);
        #iid MUST be numeric. If not, it's not an IID!
        if(!is_numeric($this->iid)) 
            throw new Exception("Malformed IID '$this->iid'!", ERR_NO_IID);
CVE-2022-39217 (Python, published 2022-09-17T00:15Z)
Description: value: some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affected versions this GitHub Action creates a CSV file without sanitizing the output of the APIs. If an alert is dismissed or any other custom field contains executable code / formulas, it might be run when an endpoint opens that CSV file in a spreadsheet program. This issue has been addressed in version `v1`. Users are advised to use `v1` or later. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/some-natalie/ghas-to-csv
Files changed:
requirements.txt
src/code_scanning.py
src/enterprise.py
src/secret_scanning.py
Commit message: move from `csv` to `defusedcsv` (#20)



Vulnerable code:
import csv
import csv
import csv

Fixed code:
defusedcsv==2.0.0
from defusedcsv import csv
from defusedcsv import csv
from defusedcsv import csv
CVE-2023-32317 (Ruby, published 2023-05-26T23:15Z)
Description: value: Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both "Base File Tar" and "Additional file archive" can be fed with Tar files that contain paths outside their target directories (e.g.,  `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process.  This issue has been addressed in version 2.11.0. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/autolab/Autolab
Files changed:
app/controllers/courses_controller.rb
lib/archive.rb
Commit message: Merge pull request from GHSA-h8g5-vhm4-wx6g



Vulnerable code:
        destination = if archive
                        File.join(extFilesDir,
                                  pathname)
                        File.join(baseFilesDir, pathname)
        pathname.gsub!(%r{/}, "-")
        File.open(destination, "wb") do |out|

Fixed code:
require "pathname"
        output_dir = if archive
                       extFilesDir
                        baseFilesDir
        output_file = File.join(output_dir, pathname)

        # skip if the file lies outside the archive
        next unless Archive.in_dir?(Pathname(output_file), Pathname(output_dir))

        File.open(output_file, "wb") do |out|

  # Check if a path lies (strictly) within a directory
  # Takes two Pathname objects
  # https://gist.github.com/henrik/48e8bb74de9d887770dfb3cc6efaa9b2
  def self.in_dir?(path, dir)
    path_parts = path.expand_path.each_filename.to_a
    dir_parts = dir.expand_path.each_filename.to_a
    return false if path_parts == dir_parts

    dir_parts.zip(path_parts).all? { |x, y| x == y }
  end
CVE-2023-32676 (Ruby, published 2023-05-26T23:15Z)
Description: value: Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Using the install assessment functionality an attacker can feed a Tar file that contain files with paths pointing outside of the target directory (e.g.,  `../../../../tmp/tarslipped1.sh`). When the Install assessment form is submitted the files inside of the archives are expanded to the attacker-chosen locations. This issue has been addressed in version 2.11.0. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/autolab/Autolab
Files changed:
app/controllers/assessments_controller.rb
app/controllers/courses_controller.rb
Commit message: Merge pull request from GHSA-x9hj-r9q4-832c

* use Archive.in_dir? to check entry files in archive stay within archive

* run rubocop

* check that file is specifically within assessment directory

* address PR comment

Vulnerable code:
          FileUtils.mkdir_p(File.join(course_root, relative_pathname),
          File.open(File.join(course_root, relative_pathname), "wb") do |f|
          FileUtils.chmod entry.header.mode, File.join(course_root, relative_pathname),
          File.symlink entry.header.linkname, File.join(course_root, relative_pathname)
                      else
                        baseFilesDir
                      end

Fixed code:
      assessment_path = Rails.root.join("courses", @course.name, asmt_name)
        entry_file = File.join(course_root, relative_pathname)
        # Ensure file will lie within course, otherwise skip
        next unless Archive.in_dir?(Pathname(entry_file), Pathname(assessment_path))

          FileUtils.mkdir_p(entry_file,
          File.open(entry_file, "wb") do |f|
          FileUtils.chmod entry.header.mode, entry_file,
          File.symlink entry.header.linkname, entry_file
                     else
                       baseFilesDir
                     end
CVE-2022-0848 (PHP, published 2022-03-04T09:15Z)
Description: value: OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/part-db/part-db
Files changed:
inc/lib.php
Commit message: Disallow uploading of potentially unsafe file extensions.



Vulnerable code:
    //Dont allow to upload a PHP file.
    if(strpos($file_array['name'], ".php") != false
        || strpos($destination_filename, ".php") != false)

Fixed code:
/**
 * Gets the file extension from a filename
 *
 * @param string    $filename The filename
 * @return string The extension of the file
 */
function getExtensionFromFileName($filename)
{
    $tmp = explode('.', $filename);
    return end($tmp);
}

    $unsafe_extensions = ['php', 'phtml', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'phtm', 'sh', 'asp', 'cgi', 'py', 'pl', 'exe', 'aspx'];

    //Dont allow upload of files with potentially dangerous extension
    if (in_array(getExtensionFromFileName($file_array['name']), $unsafe_extensions)
        || in_array(getExtensionFromFileName($destination_filename), $unsafe_extensions))
CVE-2023-0609 (Unknown, published 2023-02-01T12:15Z)
Description: value: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request from GHSA-qwx8-mxxx-mg96

ExportController: fix improper authorization vulnerability

Vulnerable code:

Fixed code:
CVE-2023-0610 (Unknown, published 2023-02-01T12:15Z)
Description: value: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request from GHSA-mrqx-mjc4-vfh3

AnnotationController: fix improper authorization vulnerability

Vulnerable code:

Fixed code:
CVE-2023-0734 (Unknown, published 2023-03-05T21:15Z)
Description: value: Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request #6290 from wallabag/2.5/fix-add-tag-other-entries

Fix adding tag to entries from other people

Vulnerable code:

Fixed code:
CVE-2023-0735 (Unknown, published 2023-02-07T23:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request #6289 from wallabag/2.5/fix-csrf-user-deletion

Fix CSRF on user deletion

Vulnerable code:

Fixed code:
CVE-2023-0736 (Unknown, published 2023-02-07T23:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request #6288 from wallabag/2.5/xss-username-share-page

Fix XSS on username on share page

Vulnerable code:

Fixed code:
CVE-2023-4454 (Unknown, published 2023-08-21T10:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request from GHSA-p8gp-899c-jvq9

Replace GET way to POST way to reset data user

Vulnerable code:

Fixed code:
CVE-2023-4455 (Unknown, published 2023-08-21T10:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wallabag/wallabag
Files changed:
Commit message: Merge pull request from GHSA-gjvc-55fw-v6vq

Replace GET way to POST way to delete API client

Vulnerable code:

Fixed code: