hitoshura25/cvefixes huggingface dataset:
CVE-2008-10004 (Other, published 2023-03-06T23:15Z)
Description: value: A vulnerability was found in Email Registration 5.x-2.1 on Drupal. It has been declared as critical. This vulnerability affects the function email_registration_user of the file email_registration.module. The manipulation of the argument namenew leads to sql injection. The attack can be initiated remotely. Upgrading to version 6.x-1.0 is able to address this issue. The patch is identified as 126c141b7db038c778a2dc931d38766aad8d1112. It is recommended to upgrade the affected component. VDB-222334 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/drupalprojects/email_registration
Files changed:
email_registration.module
Commit message: fixed a protential source of SQL injection


Vulnerable code:
      $sql = "SELECT SUBSTRING_INDEX(name,'_',-1) FROM {users} WHERE name REGEXP '^%s_[0-9]+$' ORDER BY CAST(SUBSTRING_INDEX(name,'_',-1) AS UNSIGNED) DESC LIMIT 1";
      $nameidx = db_result(db_query($sql, $namenew));

Fixed code:
      $sql = "SELECT SUBSTRING_INDEX(name,'_',-1) FROM {users} WHERE name REGEXP '%s' ORDER BY CAST(SUBSTRING_INDEX(name,'_',-1) AS UNSIGNED) DESC LIMIT 1";
      $nameidx = db_result(db_query($sql, '^'. $namenew .'_[0-9]+$'));
CVE-2014-125104 (PHP, published 2023-06-01T13:15Z)
Description: value: A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patch is named e3b92b14edca6291c5f998d54c90cbe98a1fb0e3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230263.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/wp-plugins/vaultpress
Files changed:
class.vaultpress-hotfixes.php
readme.txt
vaultpress.php
Commit message: Adding a new hotfix for the MailPoet (wysija-newsletters) Remote File Upload vulnerability.


git-svn-id: https://plugins.svn.wordpress.org/vaultpress/trunk@941846 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Stable tag: 1.6
 * Version: 1.6
	var $plugin_version = '1.6';

Fixed code:

		// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
		add_action( 'admin_init', array( $this , 'protect_wysija_newsletters_verify_capability' ), 1 );

	// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
	function protect_wysija_newsletters_verify_capability() {
		if ( !class_exists( 'WYSIJA_object' ) )
			return true;
		if ( version_compare( WYSIJA::get_version(), '2.6.7', '>=' ) )
			return true;
		if ( !defined( 'DOING_AJAX' ) && !defined( 'WYSIJA_ITF' ) )
			return true;
        if( isset( $_REQUEST['page'] ) && substr( $_REQUEST['page'] ,0 ,7 ) == 'wysija_' ){

            switch( $_REQUEST['page'] ){
                case 'wysija_campaigns':
                    $role_needed = 'wysija_newsletters';
                    break;
                case 'wysija_subscribers':
                    $role_needed = 'wysija_subscribers';
                    break;
                case 'wysija_config':
                    $role_needed = 'wysija_config';
                    break;
                case 'wysija_statistics':
                    $role_needed = 'wysija_stats_dashboard';
                    break;
                default:
                    $role_needed = 'switch_themes';
            }

            if( current_user_can( $role_needed ) ){
                return true;
            } else{
                die( 'You are not allowed here.' );
            }

        }else{
            // this is not a wysija interface/action we can let it pass
            return true;
        }
    }
Stable tag: 1.6.1
= 1.6.1 =
* Security: Add a new security hotfix.

 * Version: 1.6.1
	var $plugin_version = '1.6.1';
CVE-2016-15009 (Other, published 2023-01-05T09:15Z)
Description: value: A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is aee43e5714cd8b697355ec3bf83eefee176d3fc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217440.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/openacs/bug-tracker
Files changed:
lib/nav-bar.adp
lib/one-bug.adp
www/bug.tcl
www/patch.adp
www/patch.tcl
Commit message: - protect against too large bug numbers (causes pg errors)
- don't access @patch.patch_id@ for displayed_object_id, if it does
  not exist (view mode)
- don't perform message key subsitution in user contributed bug description
- add csrf protection for search


Vulnerable code:
        <input name="search_package_id" type="hidden" value="@package_id@">
<h1>Bug @bug.bug_number_display@ - @bug.summary@ [@bug.component_name@]</h1>
@comments;noquote@
<property name="displayed_object_id">@patch.patch_id;literal@</property>
    mode:optional
if { ([info exists cancel_edit] && $cancel_edit ne "") } {
    if { ([info exists edit] && $edit ne "") } {
    } elseif { ([info exists accept] && $accept ne "") } {        
    } elseif { ([info exists refuse] && $refuse ne "") } {
    } elseif { ([info exists delete] && $delete ne "") } {
    } elseif { ([info exists reopen] && $reopen ne "") } {
    } elseif { ([info exists comment] && $comment ne "") } {
if { [form is_valid patch] } {

Fixed code:
          <input name="search_package_id" type="hidden" value="@package_id@">
          <if @::__csrf_token@ defined><input type="hidden" name="__csrf_token" value="@::__csrf_token;literal@"></if>
<h1>Bug @bug.bug_number_display@ - @bug.summary;noi18n@ [@bug.component_name@]</h1>
@comments;literal@
    check_bug_number -requires bug_number:integer {
	if {$bug_number > 2**31} {
	    ad_complain "invalid bug number"
	}
    }
<if @patch.patch_id@ defined><property name="displayed_object_id">@patch.patch_id;literal@</property></if>
    mode:word,optional
if { [info exists cancel_edit] && $cancel_edit ne "" } {
    if { [info exists edit] && $edit ne "" } {
    } elseif { [info exists accept] && $accept ne "" } {        
    } elseif { [info exists refuse] && $refuse ne "" } {
    } elseif { [info exists delete] && $delete ne "" } {
    } elseif { [info exists reopen] && $reopen ne "" } {
    } elseif { [info exists comment] && $comment ne "" } {
if { [form is_valid patch] && $mode ne "view"} {
CVE-2023-22463 (Go, published 2023-01-04T16:15Z)
Description: value: KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermore, they may use the administrator to take over the k8s cluster of the target enterprise. `session.go`, the use of hard-coded JwtSigKey, allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code. The vulnerability has been fixed in 1.6.3. In the patch, JWT key is specified in app.yml. If the user leaves it blank, a random key will be used. There are no workarounds aside from upgrading.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/KubeOperator/KubePi
Files changed:
conf/app.yml
internal/api/v1/session/session.go
internal/api/v1/v1.go
internal/config/config.go
internal/model/v1/config/config.go
internal/server/server.go
Commit message: fix: 解决 jwt 硬编码导致的 k8s 集群接管漏洞


Vulnerable code:
    expires: 24
var JwtSigKey = []byte("signature_hmac_secret_shared_key")
		jwtSigner:          jwt.NewSigner(jwt.HS256, JwtSigKey, jwtMaxAge),

	verifier := jwt.NewVerifier(jwt.HS256, session.JwtSigKey)
func ReadConfig(c *config.Config, path ...string)  error {
		return  err
		return  err
		return  nil
	return  nil

Fixed code:
    expires: 24
  jwt:
    key:
		jwtSigner:          jwt.NewSigner(jwt.HS256, server.Config().Spec.Jwt.Key, jwtMaxAge),
	verifier := jwt.NewVerifier(jwt.HS256, server.Config().Spec.Jwt.Key)
	"crypto/rand"
	"math/big"
	"strconv"
func ReadConfig(c *config.Config, path ...string) error {

		return err
		return err
		return nil
	}
	if c.Spec.Jwt.Key == "" {
		v.Set("spec.jwt.key", generate(32))
		if err := v.WriteConfig(); err != nil {
			return err
		}
	return nil
func generate(length int) string {
	const base = 36
	size := big.NewInt(base)
	n := make([]byte, length)
	for i := range n {
		c, _ := rand.Int(rand.Reader, size)
		n[i] = strconv.FormatInt(c.Int64(), base)[0]
	}
	return string(n)
}
	Jwt     JwtConfig     `json:"jwt"`

type JwtConfig struct {
	Key string `json:"key"`
}
			Jwt:    v1Config.JwtConfig{},
CVE-2023-22478 (Go, published 2023-01-14T01:15Z)
Description: value: KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/KubeOperator/KubePi
Files changed:
internal/api/v1/v1.go
Commit message: fix: 解决系统登陆日志泄漏-未授权访问


Vulnerable code:
	v1Party.Use(langHandler())
	v1Party.Use(pageHandler())
	system.Install(v1Party)

Fixed code:

	v1Party.Use(langHandler())
	v1Party.Use(pageHandler())
	system.Install(authParty)
CVE-2023-43771 (Other, published 2023-09-22T06:15Z)
Description: value: In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/mikebrady/nqptp
Files changed:
configure.ac
Commit message: Fix a bug whereby a maliciously-crafted packet received on the control port could crash the program.


Vulnerable code:
 AC_INIT([nqptp], [1.2.1], [4265913+mikebrady@users.noreply.github.com])

Fixed code:
+AC_INIT([nqptp], [1.2.3], [4265913+mikebrady@users.noreply.github.com])
CVE-2021-21283 (JavaScript, published 2021-01-26T21:15Z)
Description: value: Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted. The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension. Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flarum/sticky
Files changed:
js/src/forum/addStickyExcerpt.js
Commit message: Fix evaluation of post content by m.trust() (#24)



Vulnerable code:
        items.add('excerpt', m.trust(excerpt), -100);

Fixed code:
        // Wrapping in <div> because ItemList entries need to be vnodes
        items.add('excerpt', <div>{excerpt}</div>, -100);
CVE-2021-29469 (JavaScript, published 2021-04-23T18:15Z)
Description: value: Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/NodeRedis/node-redis
Files changed:
lib/utils.js
Commit message: fix #1569 - improve monitor_regex (#1595)

Co-authored-by: Guy Korland <gkorland@gmail.com>

Vulnerable code:
    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\]( ".+?")+$/,

Fixed code:
    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\].*"$/,
CVE-2022-41442 (PHP, published 2022-10-07T22:15Z)
Description: value: PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xiebruce/PicUploader
Files changed:
settings/SettingController.php
Commit message: fix: possible XSS vulnerability of $_POST


Vulnerable code:
        $config = json_encode($_POST, JSON_UNESCAPED_SLASHES);

Fixed code:
		$post = [];
		foreach($_POST as $key=>$val){
			$post[$key] = htmlspecialchars($val);
		}
        $config = json_encode($post, JSON_UNESCAPED_SLASHES);
CVE-2022-21699 (Unknown, published 2022-01-19T22:15Z)
Description: value: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-250 \u2014 Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Repository: https://github.com/ipython/ipython
Files changed:
Commit message: Merge pull request from GHSA-pq7m-3gw7-gq5x

FIX CVE-2022-21699

Vulnerable code:

Fixed code:
CVE-2022-21699 (Unknown, published 2022-01-19T22:15Z)
Description: value: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-279 \u2014 Incorrect Execution-Assigned Permissions
While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
Repository: https://github.com/ipython/ipython
Files changed:
Commit message: Merge pull request from GHSA-pq7m-3gw7-gq5x

FIX CVE-2022-21699

Vulnerable code:

Fixed code:
CVE-2023-24816 (Unknown, published 2023-02-10T20:15Z)
Description: value: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input.
Severity: nan (CVSS v3 base score: 7)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ipython/ipython
Files changed:
Commit message: Merge pull request from GHSA-29gw-9793-fvw7

Fix CVE-2023-24816

Vulnerable code:

Fixed code:
CVE-2016-7444 (C, published 2016-09-27T15:59Z)
Description: value: The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
lib/x509/ocsp.c
Commit message: ocsp: corrected the comparison of the serial size in OCSP response

Previously the OCSP certificate check wouldn't verify the serial length
and could succeed in cases it shouldn't.

Reported by Stefan Buehler.


Vulnerable code:

Fixed code:
	cserial.size = t;
CVE-2017-5334 (C, published 2017-03-24T15:59Z)
Description: value: Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
lib/x509/x509_ext.c
Commit message: gnutls_x509_ext_import_proxy: fix issue reading the policy language

If the language was set but the policy wasn't, that could lead to
a double free, as the value returned to the user was freed.


Vulnerable code:
	gnutls_datum_t value = { NULL, 0 };
					 &value);
		*policyLanguage = (char *)value.data;
	} else {
		gnutls_free(value.data);
		value.data = NULL;
	result = _gnutls_x509_read_value(c2, "proxyPolicy.policy", &value);
			*policy = (char *)value.data;
			value.data = NULL;
			*sizeof_policy = value.size;
	gnutls_free(value.data);

Fixed code:
	gnutls_datum_t value1 = { NULL, 0 };
	gnutls_datum_t value2 = { NULL, 0 };
					 &value1);
		*policyLanguage = (char *)value1.data;
		value1.data = NULL;
	result = _gnutls_x509_read_value(c2, "proxyPolicy.policy", &value2);
			*policy = (char *)value2.data;
			value2.data = NULL;
			*sizeof_policy = value2.size;
	gnutls_free(value1.data);
	gnutls_free(value2.data);
CVE-2017-5335 (C, published 2017-03-24T15:59Z)
Description: value: The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
lib/opencdk/read-packet.c
Commit message: opencdk: added error checking in the stream reading functions

This addresses an out of memory error. Issue found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>


Vulnerable code:
	size_t nread;
		return (u32) - 1;
	size_t nread;
	byte c, c1;
		*r_len = cdk_stream_getc(inp);

Fixed code:

	size_t nread = 0;
		return (u32) -1;
	size_t nread = 0;
	int c, c1;

		if (size == (u32)-1)
			return CDK_Inv_Packet;

		if (c1 == EOF)
			return CDK_Inv_Packet;

	int c;
		c = cdk_stream_getc(inp);
		if (c == EOF)
			goto fail;

		*r_len = c;
		if (*r_len == (u16)-1)
			goto fail;
		if (*r_len == (u32)-1) {
			goto fail;
		}

 fail:
	if (c == EOF)
		return;

		if (c1 == EOF)
			return;

		if (*r_len == (u32)-1) {
			return;
		}