hitoshura25/cvefixes huggingface dataset:
CVE-2021-39196 (Java, published 2021-09-07T19:15Z)
Description: value: pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is important because the capture filters can effectively limit the scope of information that a user can see in the data captures. If no filter is present, then all data on the local network segment where the program is running can be captured and downloaded. v3.12 fixes this problem. There is no workaround, you must upgrade to v3.12 or greater.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/jdhwpgmbca/pcapture
Files changed:
src/main/java/com/rtds/svc/CaptureTypeService.java
Commit message: Fixed major security bug.

A user could effectively specify an undefined url and the program would return a null filter rather than throwing an exception and returning an error to the user. This was a really bad bug. I found it when I was adding code to validate the path parameters. That will be coming in the next commit.


Vulnerable code:
        if( type != null )
            return type.getCaptureFilter();
        return null;

Fixed code:
        if( type == null )
            throw new IllegalArgumentException( "The url_suffix must exist in the database." );
        // It is okay for the capture filter itself to be null, but the CaptureType
        // must be in the database, otherwise the user could effectively forge
        // a capture filter for "all" just by requesting a non-existent filter.
        
        return type.getCaptureFilter();
CVE-2014-125050 (Unknown, published 2023-01-06T17:15Z)
Description: value: A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ScottTZhang/voter-js
Files changed:
Commit message: Merge pull request #15 from ScottTZhang/injection

avoid sql injection

Vulnerable code:

Fixed code:
CVE-2013-1812 (Unknown, published 2013-12-12T18:55Z)
Description: value: The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/openid/ruby-openid
Files changed:
Commit message: Merge pull request #43 from nov/against_dos

limit fetching file size & disable XML entity expansion

Vulnerable code:

Fixed code:
CVE-2023-51390 (Unknown, published 2023-12-21T00:15Z)
Description: value: journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-319 \u2014 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Repository: https://github.com/Aiven-Open/journalpump
Files changed:
Commit message: Merge pull request #162 from Aiven-Open/version-250

Updating version and NEWS with last updates since version 2.4.3

Vulnerable code:

Fixed code:
CVE-2016-15012 (C#, published 2023-01-07T13:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs. The manipulation leads to sql injection. Upgrading to version 5.0.0 is able to address this issue. The patch is named 83b3e91e0c1e84873a6d3ca3c5887eb5b4f5a3d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217619. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/forcedotcom/SalesforceMobileSDK-Windows
Files changed:
SalesforceSDK/SmartStore/Store/QuerySpec.cs
Commit message: use statement to build sql query to avoid the possibility for SQLi security risk


Vulnerable code:
        private const string SelectCount = "SELECT count(*) ";
            int fromLocation = smartSql.ToLower().IndexOf(" from ", StringComparison.CurrentCultureIgnoreCase);
            return SelectCount + smartSql.Substring(fromLocation);

Fixed code:
        private const string SelectCount = "SELECT count(*) ";
        private const string SelectCountFrom = SelectCount + "FROM ({0})";


            return string.Format(SelectCountFrom, smartSql);
CVE-2022-24750 (C++, published 2022-03-10T21:15Z)
Description: value: UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.0 in which the DSM plugin module, which allows a local authenticated user to achieve local privilege escalation (LPE) on a vulnerable system. The vulnerability has been fixed to allow loading of plugins from the installed directory. Affected users should upgrade their UltraVNC to 1.3.8.1. Users unable to upgrade should not install and run UltraVNC server as a service. It is advisable to create a scheduled task on a low privilege account to launch WinVNC.exe instead. There are no known workarounds if winvnc needs to be started as a service.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/ultravnc/UltraVNC
Files changed:
winvnc/winvnc/vncproperties.cpp
Commit message: security fix


Vulnerable code:
			EnableWindow(GetDlgItem(hwnd, IDC_PLUGIN_BUTTON), _this->m_server->IsDSMPluginEnabled());
				EnableWindow(GetDlgItem(hwnd, IDC_PLUGIN_BUTTON),
					SendMessage(GetDlgItem(hwnd, IDC_PLUGIN_CHECK), BM_GETCHECK, 0, 0) == BST_CHECKED);

Fixed code:
#include "shlwapi.h"
			EnableWindow(GetDlgItem(hwnd, IDC_PLUGIN_BUTTON),  (_this->m_server->AuthClientCount() == 0 ? _this->m_server->IsDSMPluginEnabled(): false));
				EnableWindow(GetDlgItem(hwnd, IDC_PLUGIN_BUTTON), _this->m_server->AuthClientCount() == 0 
						? SendMessage(GetDlgItem(hwnd, IDC_PLUGIN_CHECK), BM_GETCHECK, 0, 0) == BST_CHECKED 
						: BST_UNCHECKED);
					PathStripPathA(szPlugin);
CVE-2023-29008 (JavaScript, published 2023-04-06T17:15Z)
Description: value: The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for different HTTP methods.

SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at `kit/src/runtime/server/respond.js`. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed in versions prior to 1.15.2 by simply specifying an upper-cased `Content-Type` header value. The browser will not send uppercase characters, but this check does not block all expected CORS requests.

If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. This may lead to all POST operations requiring authentication being allowed in the following cases: If the target site sets `SameSite=None` on its auth cookie and the user visits a malicious site in a Chromium-based browser; if the target site doesn't set the `SameSite` attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off; and/or if the user is visiting a malicious site with a very outdated browser.

SvelteKit 1.15.2 contains a patch for this issue. It is also recommended to explicitly set `SameSite` to a value other than `None` on authentication cookies especially if the upgrade cannot be done in a timely manner.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/sveltejs/kit
Files changed:
.changeset/happy-pots-move.md
packages/kit/src/utils/http.js
packages/kit/test/apps/basics/test/server.test.js
Commit message: Merge pull request from GHSA-gv7g-x59x-wf8f

* fix: do a case-insensitive comparison when checking header value

* changeset

* remove export

* Update .changeset/happy-pots-move.md

Vulnerable code:
export function is_content_type(request, ...types) {
	return types.includes(type);
			'text/plain'

Fixed code:
---
'@sveltejs/kit': patch
---

fix: address security advisory CVE-2023-29008 by doing a case-insensitive comparison when checking header value
function is_content_type(request, ...types) {
	return types.includes(type.toLowerCase());
			'text/plain',
			'text/plaiN'
CVE-2024-23641 (JavaScript, published 2024-01-24T17:15Z)
Description: value: SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sveltejs/kit
Files changed:
.changeset/smooth-kids-cover.md
packages/kit/src/exports/node/index.js
Commit message: fix: ignore bodies sent with non-PUT/PATCH/POST requests  (#11708)

* fix: ignore bodies sent with non-PUT/PATCH/POST requests

* use ||

---------

Co-authored-by: Rich Harris <rich.harris@vercel.com>

Vulnerable code:
		body: get_raw_body(request, bodySizeLimit)

Fixed code:
---
'@sveltejs/kit': patch
---

fix: ignore bodies sent with non-PUT/PATCH/POST requests
		body:
			request.method === 'POST' || request.method === 'PUT' || request.method === 'PATCH'
				? get_raw_body(request, bodySizeLimit)
				: undefined
CVE-2022-22107 (PHP, published 2022-01-05T15:15Z)
Description: value: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/Bottelet/DaybydayCRM
Files changed:
app/Http/Controllers/AppointmentsController.php
app/Http/Requests/User/StoreUserRequest.php
app/Http/Requests/User/UpdateUserRequest.php
Commit message: password change requires 6 on update, and only allowed users can see calendar


Vulnerable code:
 
        if (!auth()->user()->can("appointment-create")) {
            'password' => 'required|min:5|confirmed',
            'password_confirmation' => 'required|min:5',
            'password' => 'sometimes',
            'password_confirmation' => 'sometimes',

Fixed code:
        if (!auth()->user()->can("calendar-view")) {
            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
            return redirect()->back();
        }
        if (!auth()->user()->can("appointment-delete")) {
            'password' => 'required|min:6|confirmed',
            'password_confirmation' => 'required|min:6',
            'password' => 'sometimes|min:6|confirmed',
            'password_confirmation' => 'sometimes|min:6',
CVE-2022-22108 (PHP, published 2022-01-05T15:15Z)
Description: value: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/Bottelet/DaybydayCRM
Files changed:
app/Http/Controllers/UsersController.php
app/Models/User.php
resources/views/users/form.blade.php
Commit message: ensure only admin and owner can change role, and password, unless it is yourself


Vulnerable code:
            $user->roles()->sync([$request->roles]);


Fixed code:
        if (!auth()->user()->can('absence-view')) {
            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
            return redirect()->back();
        }

        if( !auth()->user()->canChangePasswordOn($user) ) {
            unset($request['password']);
        }


            if(auth()->user()->canChangeRole() ) {
                $user->roles()->sync([$request->roles]);
            }
    public function canChangePasswordOn(User $user)
    {
        if($this->id === $user->id || ( $this->roles->first()->name == Role::OWNER_ROLE || $this->roles->first()->name == Role::ADMIN_ROLE)) {
            return true;
        }

        return false;
    }

    public function canChangeRole()
    {
        return $this->roles->first()->name == Role::OWNER_ROLE || $this->roles->first()->name == Role::ADMIN_ROLE;
    }
@if(isset($user) && auth()->user()->canChangePasswordOn($user))

@endif
@if(isset($user) && auth()->user()->canChangeRole())
@endif
CVE-2022-22109 (PHP, published 2022-01-05T15:15Z)
Description: value: In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Bottelet/DaybydayCRM
Files changed:
app/Http/Controllers/TasksController.php
Commit message: fix xss for tasks index


Vulnerable code:
                . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-title="'. $tasks->title . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'

Fixed code:
                . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'
CVE-2022-22110 (PHP, published 2022-01-05T15:15Z)
Description: value: In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/Bottelet/DaybydayCRM
Files changed:
app/Http/Controllers/AppointmentsController.php
app/Http/Requests/User/StoreUserRequest.php
app/Http/Requests/User/UpdateUserRequest.php
Commit message: password change requires 6 on update, and only allowed users can see calendar


Vulnerable code:
 
        if (!auth()->user()->can("appointment-create")) {
            'password' => 'required|min:5|confirmed',
            'password_confirmation' => 'required|min:5',
            'password' => 'sometimes',
            'password_confirmation' => 'sometimes',

Fixed code:
        if (!auth()->user()->can("calendar-view")) {
            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
            return redirect()->back();
        }
        if (!auth()->user()->can("appointment-delete")) {
            'password' => 'required|min:6|confirmed',
            'password_confirmation' => 'required|min:6',
            'password' => 'sometimes|min:6|confirmed',
            'password_confirmation' => 'sometimes|min:6',
CVE-2022-22111 (PHP, published 2022-01-05T15:15Z)
Description: value: In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/Bottelet/DaybydayCRM
Files changed:
app/Http/Controllers/UsersController.php
app/Models/User.php
resources/views/users/form.blade.php
Commit message: ensure only admin and owner can change role, and password, unless it is yourself


Vulnerable code:
            $user->roles()->sync([$request->roles]);


Fixed code:
        if (!auth()->user()->can('absence-view')) {
            session()->flash('flash_message_warning', __('You do not have permission to view this page'));
            return redirect()->back();
        }

        if( !auth()->user()->canChangePasswordOn($user) ) {
            unset($request['password']);
        }


            if(auth()->user()->canChangeRole() ) {
                $user->roles()->sync([$request->roles]);
            }
    public function canChangePasswordOn(User $user)
    {
        if($this->id === $user->id || ( $this->roles->first()->name == Role::OWNER_ROLE || $this->roles->first()->name == Role::ADMIN_ROLE)) {
            return true;
        }

        return false;
    }

    public function canChangeRole()
    {
        return $this->roles->first()->name == Role::OWNER_ROLE || $this->roles->first()->name == Role::ADMIN_ROLE;
    }
@if(isset($user) && auth()->user()->canChangePasswordOn($user))

@endif
@if(isset($user) && auth()->user()->canChangeRole())
@endif
CVE-2020-15229 (Unknown, published 2020-10-14T19:15Z)
Description: value: Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host filesystem during the extraction with a crafted squashfs filesystem. The extraction occurs automatically for unprivileged (either installation or with `allow setuid = no`) run of Singularity when a user attempt to run an image which is a local SIF image or a single file containing a squashfs filesystem and is coming from remote sources `library://` or `shub://`. Image build is also impacted in a more serious way as it can be used by a root user, allowing an attacker to overwrite/create files leading to a system compromise, so far bootstrap methods `library`, `shub` and `localimage` are triggering the squashfs extraction. This issue is addressed in Singularity 3.6.4. All users are advised to upgrade to 3.6.4 especially if they use Singularity mainly for building image as root user. There is no solid workaround except to temporary avoid to use unprivileged mode with single file images in favor of sandbox images instead. Regarding image build, temporary avoid to build from `library` and `shub` sources and as much as possible use `--fakeroot` or a VM for that.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/hpcng/singularity
Files changed:
Commit message: Merge pull request #5611 from dctrud/36-sec

Merge GHSA-7gcp-w6ww-2xv9 fixes for release 3.6.4

Vulnerable code:

Fixed code: