hitoshura25/cvefixes huggingface dataset:
CVE-2022-22845 (Go, published 2022-01-10T14:12Z)
Description: value: QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/sipcapture/homer-app
Files changed:
auth/claims.go
auth/constants.go
config/config.go
etc/webapp_config.json
main.go
version.go
Commit message: added jwt generator.

Many thanks to Omri Baso and Fabien Aunay for the report! Great job guys!


Vulnerable code:
	t, err := token.SignedString([]byte(JwtSecret))
const JwtSecret = "167f0db2-f83e-4baa-9736-d56064a5b415"

		SigningKey: []byte(auth.JwtSecret),
var VERSION_APPLICATION = "1.4.27"

Fixed code:
	"github.com/sipcapture/homer-app/config"
	t, err := token.SignedString([]byte(config.Setting.AUTH_SETTINGS.JwtSecret))
	AUTH_SETTINGS struct {
		JwtSecret string `default:""`
	}

    "jwt_secret": "167f0db2-f83e-4baa-9736-d56064a5b415",
	GenerateJwtSecret         *bool      `json:"generate_jwt_secret"`
	//Jwt
	appFlags.GenerateJwtSecret = flag.Bool("generate-jwt-secret", false, "generate jwt secret")

	if *appFlags.GenerateJwtSecret {
		logger.Info("Generating jwt secret...")
		config.Setting.AUTH_SETTINGS.JwtSecret = uuid.NewV4().String()
		viper.Set("auth_settings.jwt_secret", config.Setting.AUTH_SETTINGS.JwtSecret)
		err := viper.WriteConfig()
		if err != nil {
			fmt.Println("No configuration file loaded: ", err)
			logger.Error("No configuration file loaded - using defaults")
		}

		os.Exit(0)
	}

		SigningKey: []byte(config.Setting.AUTH_SETTINGS.JwtSecret),
	//generate JWT
	config.Setting.AUTH_SETTINGS.JwtSecret = viper.GetString("auth_settings.jwt_secret")
	if config.Setting.AUTH_SETTINGS.JwtSecret == "" {
		config.Setting.AUTH_SETTINGS.JwtSecret = uuid.NewV4().String()
		viper.Set("auth_settings.jwt_secret", config.Setting.AUTH_SETTINGS.JwtSecret)
		saveConfig = true
	}

var VERSION_APPLICATION = "1.4.28"
CVE-2020-36637 (Unknown, published 2022-12-30T12:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been declared as problematic. This vulnerability affects unknown code of the file resources/core/adminserv.php. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Chris92de/AdminServ
Files changed:
Commit message: Merge pull request #7 from lacaulac/patch-2

Fixed an XSS vulnerability

Vulnerable code:

Fixed code:
CVE-2021-23433 (JavaScript, published 2021-11-19T20:15Z)
Description: value: The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/algolia/algoliasearch-helper-js
Files changed:
src/functions/merge.js
test/spec/functions/defaultsPure.js
test/spec/functions/intersection.js
test/spec/functions/merge.js
Commit message: fix(SearchParameters): ignore invalid parameters (#880)

* fix(SearchParameters): ignore invalid parameters

These parameters could be used maliciously, so are explicilty not allowed in merge

* clearer test

Vulnerable code:
    if (!Object.prototype.hasOwnProperty.call(source, key)) {
    if (isObjectOrArrayOrFunction(targetVal) && isObjectOrArrayOrFunction(sourceVal)) {


Fixed code:
    if (
      !Object.prototype.hasOwnProperty.call(source, key) ||
      key === '__proto__'
    ) {
    if (
      isObjectOrArrayOrFunction(targetVal) &&
      isObjectOrArrayOrFunction(sourceVal)
    ) {

it('does not pollute the prototype', () => {
  var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable to PP"}}');
  var subject = {};

  expect(subject.polluted).toBe(undefined);

  const out = defaults({}, payload);

  expect(out).toEqual({});

  expect({}.polluted).toBe(undefined);
});

it('does not pollute the prototype', () => {
  var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable to PP"}}');
  var subject = {};

  expect(subject.polluted).toBe(undefined);

  const out = merge({}, payload);

  expect(out).toEqual({});

  expect({}.polluted).toBe(undefined);
});
CVE-2021-46461 (C, published 2022-02-14T22:15Z)
Description: value: njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/njs_vmcode.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_vmcode.c
src/test/njs_unit_test.c
Commit message: Added missing element in typeof table for DataView() type.

Previously, typeof operation for DataView object resulted
in out of bounds array accessing.

This fixes #450 issue on Github.


Vulnerable code:

Fixed code:
        &njs_string_object,
    { njs_str("var x = new ArrayBuffer(3); [typeof x, typeof new DataView(x)]"),
      njs_str("object,object") },
CVE-2021-46462 (C, published 2022-02-14T22:15Z)
Description: value: njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /src/njs_object.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_function.c
src/test/njs_unit_test.c
Commit message: Fixed Function.prototype.apply() with slow arrays.

Previously, the function had two issues:
   * array->start was referenced without checking for fast array flag
   * the created arguments list was not sanity-checked for its length,
     which can be very large.

The fix is to remove micro-optimization for arrays and introduce limit
size for arguments list.

This closes #449 issue in Github.


Vulnerable code:

        goto activate;

    } else if (njs_is_array(arr_like)) {
        arr = arr_like->data.u.array;

        args = arr->start;
        length = arr->length;

    } else if (njs_slow_path(!njs_is_object(arr_like))) {

Fixed code:
    }
    if (njs_slow_path(!njs_is_object(arr_like))) {
    if (njs_slow_path(length > 1024)) {
        njs_internal_error(vm, "argument list is too long");
        return NJS_ERROR;
    }

    { njs_str("(function(index, ...rest){ return rest[index];})"
              ".apply({}, [1022].concat(Array(1023).fill(1).map((v,i)=>i.toString(16))))"),
      njs_str("3fe") },
CVE-2021-46463 (JavaScript, published 2022-02-14T22:15Z)
Description: value: njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerability in njs_promise_perform_then().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_promise.c
src/njs_vmcode.c
test/js/promise_prototype_reject_type_confusion.t.js
test/js/promise_prototype_then_type_confusion.t.js
Commit message: Fixed type confusion bug while resolving promises.

Previously, the internal function njs_promise_perform_then() which
implements PerformPromiseThen() expects its first argument to always be
a promise instance.  This assertion might be invalid because the
functions corresponding to Promise.prototype.then() and
Promise.resolve() incorrectly verified their arguments.

Specifically, the functions recognized their first argument as promise
if it was an object which was an Promise or had Promise object in its
prototype chain.  The later condition is not correct because internal
slots are not inherited according to the spec.

This closes #447 issue in Github.


Vulnerable code:
    njs_object_t              *object;
    if (njs_is_object(x)) {
        object = njs_object_proto_lookup(njs_object(x), NJS_PROMISE,
                                         njs_object_t);

        if (object != NULL) {
            ret = njs_value_property(vm, x, njs_value_arg(&string_constructor),
                                     &value);
            if (njs_slow_path(ret == NJS_ERROR)) {
                return NULL;
            }
            if (njs_values_same(&value, constructor)) {
                return njs_promise(x);
            }
    njs_object_t              *object;
    if (njs_slow_path(!njs_is_object(promise))) {
        goto failed;
    }

    object = njs_object_proto_lookup(njs_object(promise), NJS_PROMISE,
                                     njs_object_t);
    if (njs_slow_path(object == NULL)) {
    njs_set_object(&val, &promise->object);

Fixed code:
    if (njs_is_promise(x)) {
        ret = njs_value_property(vm, x, njs_value_arg(&string_constructor),
                                 &value);
        if (njs_slow_path(ret == NJS_ERROR)) {
            return NULL;
        }
        if (njs_values_same(&value, constructor)) {
            return njs_promise(x);
    if (njs_slow_path(!njs_is_promise(promise))) {
    njs_assert(njs_is_promise(value));

    njs_set_promise(&val, promise);
/*---
includes: []
flags: [async]
---*/

Symbol.__proto__ = new Promise(()=>{});

Promise.reject(Symbol)
.then(v => $DONOTEVALUATE())
.catch(err => assert.sameValue(err.name, 'Symbol'))
.then($DONE, $DONE);
/*---
includes: []
flags: [async]
---*/

Symbol.__proto__ = new Promise(()=>{});

Promise.resolve(Symbol)
.then(v => $DONOTEVALUATE())
.catch(err => assert.sameValue(err.name, 'TypeError'))
.then($DONE, $DONE);
CVE-2022-27007 (JavaScript, published 2022-04-14T15:15Z)
Description: value: nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with njs_function_frame_save().
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_function.c
test/js/async_recursive_large.t.js
test/js/async_recursive_mid.t.js
Commit message: Fixed frame allocation from an awaited frame.

njs_function_frame_save() is used to save the awaited frame when "await"
instruction is encountered. The saving was done as a memcpy() of
existing runtime frame.

njs_function_frame_alloc() is used to alloc a new function frame, this
function tries to use a spare preallocated memory from the previous
frame first.  Previously, this function might result in "use-after-free"
when invoked from a restored frame saved with njs_function_frame_save().
Because njs_function_frame_save() left pointers to the spare memory of
the original frame which may be already free when saved frame is
restored.

The fix is to erase fields for the spare memory from the saved frame.

This closes #469 issue on Github.


Vulnerable code:
    if (v == 3) {

Fixed code:

    native->size = 0;
    native->free = NULL;
    native->free_size = 0;
/*---
includes: [compareArray.js]
flags: [async]
---*/

let stages = [];

async function f(v) {
    if (v == 1000) {
        return;
    }

    stages.push(`f>${v}`);

    await "X";

    await f(v + 1);

    stages.push(`f<${v}`);
}

f(0)
.then(v => {
    assert.sameValue(stages.length, 2000);
})
.then($DONE, $DONE);
    if (v == 1000) {
CVE-2022-27008 (C, published 2022-04-14T15:15Z)
Description: value: nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_array.c
src/test/njs_unit_test.c
Commit message: Fixed Array.prototype.concat() when "this" is a slow array.

Previously, when the current appended element is fast array the "this"
array was expected to always be a fast array also.  This may not be the
case when the previous appended element was not fast thus converting
the "this" array to a slow form.

Previous fix introduced in 2c1382bab643 (0.7.2) was not complete, the
correct fix is to never assume "this" is fast, whereas njs_array_add()
may only be called with fast arrays.

This closes #471 issue in Github.


Vulnerable code:
                    ret = njs_array_add(vm, array, &retval);
                    if (njs_slow_path(ret != NJS_OK)) {
                        return NJS_ERROR;

Fixed code:
    njs_assert(array->object.fast_array);

                    ret = njs_value_property_i64_set(vm, &this, length,
                                                     &retval);
                    if (njs_slow_path(ret == NJS_ERROR)) {
                        return ret;
    { njs_str("var a = [1]; a[1111111] = 2;"
              "var a2 = [3].concat(a, [4]);"
              "njs.dump(a2)"),
      njs_str("[3,1,<1111110 empty items>,2,4]") },
CVE-2022-28049 (C, published 2022-04-15T14:15Z)
Description: value: NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmcode.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_vmcode.c
src/test/njs_unit_test.c
Commit message: Fixed allocation of large array literals.

Previously, allocation of large array literals may result in
null-pointer dereference. The reason is that njs_array_alloc() may
return a slow array when size is large enough, but the instruction
code assumes that array is always flat.

The fix is to check fast_array flag before accessing array->start.

This closes #473 issue on Github.


Vulnerable code:
            value = array->start;
            length = array->length;

            do {
                njs_set_invalid(value);
                value++;
                length--;
            } while (length != 0);

Fixed code:
            if (array->object.fast_array) {
                value = array->start;
                length = array->length;

                do {
                    njs_set_invalid(value);
                    value++;
                    length--;
                } while (length != 0);
            }
    { njs_str("var a = (new Function('return [' + ','.repeat(2**16) + ']'))();"
			  "njs.dump(a)"),
      njs_str("[<65536 empty items>]") },
CVE-2022-29369 (C, published 2022-05-12T19:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation via njs_lvlhsh_bucket_find at njs_lvlhsh.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_vmcode.c
src/test/njs_unit_test.c
Commit message: Fixed njs_vmcode_interpreter() when "toString" conversion fails.

Previously, while interpreting a user function, njs_vmcode_interpreter()
might return prematurely when an error happens.  This is not correct
because the current frame has to be unwound (or exception caught)
first.

The fix is exit through only 5 appropriate exit points to ensure
proper unwinding.

This closes #467 issue on Github.


Vulnerable code:
                    return NJS_ERROR;
                    ret = njs_value_to_key(vm, value2, value2);
                        return NJS_ERROR;
                    njs_key_string_get(vm, value2, &string);
                        return NJS_ERROR;
                    return NJS_ERROR;

Fixed code:
                    goto error;
                    ret = njs_value_to_key(vm, &dst, value2);
                        goto error;
                    njs_key_string_get(vm, &dst, &string);
                        njs_memory_error(vm);
                        goto error;
                    njs_memory_error(vm);
                    goto error;
    { njs_str("function f() { Object.prototype.toString = 1; };"
              "Object.prototype.toString = f;"
              "(function () { try { 's'[{}](); } catch (e) { throw e; } })()"),
      njs_str("TypeError: Cannot convert object to primitive value") },
CVE-2022-29779 (C, published 2022-06-02T14:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_array.c
src/test/njs_unit_test.c
Commit message: Fixed Array.prototype.slice() with slow "this" argument.

Previously, when "this" argument was not a fast array, but the "deleted" array
was a fast array, the "deleted" array may be left in uninitialized state if
"this" argument had gaps.

This fix is to ensure that "deleted" is properly initialized.

This fixes #485 issue on Github.


Vulnerable code:

Fixed code:

            } else {
                if (deleted->object.fast_array) {
                    njs_set_invalid(&deleted->start[i]);
                }
    { njs_str("var a = {1: 'B', length: 2};"
              "Array.prototype.splice.call(a, 0)"),
      njs_str(",B") },

    { njs_str("var a = new Uint8Array();"
              "a.__proto__ = [1,2,3];"
              "a.splice(0)"),
      njs_str(",,") },
CVE-2022-29780 (C, published 2022-06-02T14:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_array.c
src/test/njs_unit_test.c
Commit message: Fixed Array.prototype.sort() when arr size is changed in a comparator.

This fixed #468 issue on Github.


Vulnerable code:
    if (njs_fast_path(fast_path)) {

Fixed code:
    if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
      njs_str("65535") },
CVE-2022-30503 (C, published 2022-06-02T14:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_typed_array.c
src/test/njs_unit_test.c
Commit message: Fixed Array.prototype.fill() for typed-arrays.

This closes #478 issue on Github.


Vulnerable code:
    njs_set_number(setval, num);


Fixed code:
    { njs_str("Array.prototype.fill.call(new Int32Array(1))"),
      njs_str("0") },
CVE-2022-31306 (C, published 2022-06-21T13:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_array.c
src/test/njs_unit_test.c
Commit message: Fixed Object.defineProperty() when a recursive descriptor is provided.

This closes #481 issue on Github.


Vulnerable code:

Fixed code:
    if (njs_slow_path(!array->object.fast_array)) {
        return NJS_OK;
    }

    { njs_str("const arr = [1,2];"
              "function f(arg) {"
              "        const desc = {get: arg};"
              "        Object.defineProperty(desc, 'set', desc);"
              "        Object.defineProperty(arr, 1, desc);"
              "}"
              "f(f);"
              "njs.dump(arr)"),
      njs_str("[1,'[Getter]']") },