hitoshura25/cvefixes huggingface dataset:
CVE-2023-22741 (Unknown, published 2023-01-19T22:15Z)
Description: value: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. In affected versions Sofia-SIP **lacks both message length and attributes length checks** when it handles STUN packets, leading to controllable heap-over-flow. For example, in stun_parse_attribute(), after we get the attribute's type and length value, the length will be used directly to copy from the heap, regardless of the message's left size. Since network users control the overflowed length, and the data is written to heap chunks later, attackers may achieve remote code execution by heap grooming or other exploitation methods. The bug was introduced 16 years ago in sofia-sip 1.12.4 (plus some patches through 12/21/2006) to in tree libs with git-svn-id: http://svn.freeswitch.org/svn/freeswitch/trunk@3774 d0543943-73ff-0310-b7d9-9358b9ac24b2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/freeswitch/sofia-sip
Files changed:
Commit message: Merge pull request #182 from QiuhaoLi/fix-stun-parser-oob

stun: add checks for STUN messag len and attr len

Vulnerable code:

Fixed code:
CVE-2017-20163 (PHP, published 2023-01-05T20:15Z)
Description: value: A vulnerability has been found in Red Snapper NView and classified as critical. This vulnerability affects the function mutate of the file src/Session.php. The manipulation of the argument session leads to sql injection. The name of the patch is cbd255f55d476b29e5680f66f48c73ddb3d416a8. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217516.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/RedSnapper/NView
Files changed:
src/Session.php
Commit message: sql injection

Client uncovered sql injection attack in reference to xsession.

Vulnerable code:

			Settings::$sql->query("update sio_session set id='$mutated' where id='$session'");
			Settings::$sql->query("update sio_sessiondata set sid='$mutated' where sid='$session'");

Fixed code:
			$sqlSession = Settings::$sql->escape_string($session);
			Settings::$sql->query("update sio_session set id='$mutated' where id='$sqlSession'");
			Settings::$sql->query("update sio_sessiondata set sid='$mutated' where sid='$sqlSession'");
CVE-2015-7809 (PHP, published 2015-11-06T21:59Z)
Description: value: The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/fabpot/Twig
Files changed:
lib/Twig/Template.php
test/Twig/Tests/TemplateTest.php
Commit message: fixed sandbox security issue


Vulnerable code:

Fixed code:
            // avoid RCEs when sandbox is enabled
            if (!$template instanceof Twig_Template) {
                throw new \LogicException('A block must be a method on a Twig_Template instance.');
            }

    /**
     * @expectedException LogicException
     */
    public function testDisplayBlocksAcceptTemplateOnlyAsBlocks()
    {
        $template = $this->getMockForAbstractClass('Twig_Template', array(), '', false);
        $template->displayBlock('foo', array(), array('foo' => array(new stdClass(), 'foo')));
    }
CVE-2014-1403 (HTML, published 2014-02-05T15:10Z)
Description: value: Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/oyvindkinsey/easyXDM
Files changed:
build.xml
src/Fn.js
src/changes.html
src/name.html
Commit message: Fix for CVE-2014-1403


Vulnerable code:
	<property name="project.build.version" value="2.4.18"/>

Fixed code:
	<property name="project.build.version" value="2.4.19"/>
            if (!_map.hasOwnProperty(name)) {
                return;
            }
             <li>
                2.4.19 18.01.14
                <br/>
                Removed XSS vulnerability:
                <br/>
                - XSS due to lack of validation in name.html (CVE-2014-1403) - disclosed by Krzystof Kotowicz (Cure53)
            </li>
                    if (url && !/https?:\/\//.test(url)) {
                        throw new Error('Invalid url');
                    }
CVE-2023-38504 (JavaScript, published 2023-07-27T19:15Z)
Description: value: Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remove the `sails.io.js` client.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/balderdashy/sails
Files changed:
lib/router/req.js
Commit message: Improve virtual request parsing (#7287)

* Improve virtual request parsing

Relevant for socket.io usage, and usage from tests.  (`sails.request()`)

* Update req.js

---------

Co-authored-by: Eric <eashaw@sailsjs.com>

Vulnerable code:
    // TODO: send a PR to mock-req with a fix for this
      // Strip undefined headers
      _.each(_req.headers, function (headerVal, headerKey) {
        if (_.isUndefined(headerVal)){
      });
      // Make sure all remaining headers are strings
      _req.headers = _.mapValues(_req.headers, function (headerVal /*, headerKey*/) {
        if (typeof headerVal !== 'string') {
          headerVal = ''+headerVal+'';
        return headerVal;
      });
    }

Fixed code:
      for (let headerKey of Object.keys(_req.headers)) {
        // Strip undefined headers
        if (undefined === _req.headers[headerKey]) {
        // Make sure all remaining headers are strings
        if (typeof _req.headers[headerKey] !== 'string') {
          try {
            _req.headers[headerKey] = ''+_req.headers[headerKey];
            // FUTURE: This behavior is likely being relied upon by apps, so we can't just change it.
            // But in retrospect, it would probably be better to straight-up reject this here if it's not
            // a string, since HTTP header values are always supposed to be strings; or at least primitives.
            // So maybe reject non-primitives, reject `null`, and then accept primitives, but be smart about
            // this, especially in the context of what the client is doing.
          } catch (unusedErr) {
            delete _req.headers[headerKey];
          }
      }//∞
    }//ﬁ
CVE-2021-32419 (C, published 2023-02-17T18:15Z)
Description: value: An issue in Schism Tracker v20200412 fixed in v.20200412 allows attacker to obtain sensitive information via the fmt_mtm_load_song function in fmt/mtm.c.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/schismtracker/schismtracker
Files changed:
fmt/mtm.c
Commit message: Remove unused out-of-bounds memory access from MTM loader (#249)


Vulnerable code:
		tracknote = trackdata[n];

Fixed code: