hitoshura25/cvefixes huggingface dataset:
CVE-2021-33910 (Unknown, published 2021-07-20T19:15Z)
Description: value: basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/systemd/systemd
Files changed:
Commit message: Merge pull request #20256 from keszybz/one-alloca-too-many

 basic/unit-name: do not use strdupa() on a path

Vulnerable code:

Fixed code:
CVE-2022-2526 (C, published 2022-09-09T15:15Z)
Description: value: A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/systemd/systemd
Files changed:
src/resolve/resolved-dns-stream.c
Commit message: resolved: pin stream while calling callbacks for it

These callbacks might unref the stream, but we still have to access it,
let's hence ref it explicitly.

Maybe fixes: #10725


Vulnerable code:
        DnsStream *s = userdata;

Fixed code:
        _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */

        _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */
CVE-2022-3821 (C, published 2022-11-08T22:15Z)
Description: value: An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/systemd/systemd
Files changed:
src/basic/time-util.c
src/test/test-time-util.c
Commit message: time-util: fix buffer-over-run

Fixes #23928.


Vulnerable code:
                n = MIN((size_t) k, l);

Fixed code:
                n = MIN((size_t) k, l-1);

        /* See issue #23928. */
        _cleanup_free_ char *buf;
        assert_se(buf = new(char, 5));
        assert_se(buf == format_timespan(buf, 5, 100005, 1000));
CVE-2022-4415 (Unknown, published 2023-01-11T15:15Z)
Description: value: A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/systemd/systemd
Files changed:
Commit message: Merge branch 'systemd-security/coredump-capabilities'

CVE-2022-4415: systemd: coredump not respecting fs.suid_dumpable kernel setting
Affects systemd >= 247 with libacl support enabled.

This is a merge of https://github.com/systemd/systemd-security/pull/12/.
I'm doing the merge locally because github doesn't support merging directly
from systemd/systemd-security to systemd/systemd.


Vulnerable code:

Fixed code:
CVE-2024-24042 (Java, published 2024-03-19T07:15Z)
Description: value: Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Devan-Kerman/ARRP
Files changed:
gradle.properties
src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java
src/test/java/test/RRPPreTest.java
Commit message: oops v0.8.2


Vulnerable code:
mod_version=0.8.0
				if(path.startsWith(output)) {
			if(file.startsWith(dir)) {

Fixed code:
mod_version=0.8.1
				if(path.toAbsolutePath().startsWith(output.toAbsolutePath())) {
			if(file.toAbsolutePath().startsWith(dir.toAbsolutePath())) {
import net.devtech.arrp.api.RuntimeResourcePack;
import java.nio.file.Path;
		RuntimeResourcePack pack = RuntimeResourcePack.create("test:test");
		pack.addLang(new Identifier("aaaa:aaaa"), new JLang().entry("aaaa", "bbbbb"));
		pack.dumpDirect(Path.of("aaaa"));
CVE-2019-12741 (XML, published 2019-06-05T15:29Z)
Description: value: XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jamesagnew/hapi-fhir
Files changed:
hapi-fhir-testpage-overlay/src/main/java/ca/uhn/fhir/to/BaseController.java
src/changes/changes.xml
Commit message: Fix a potential security vulneability in the testpage overlay


Vulnerable code:
import org.thymeleaf.TemplateEngine;
		theModel.put("serverId", serverId);
		theModel.put("base", serverBase);
		theModel.put("baseName", serverName);
		theModel.put("apiKey", apiKey);
		theModel.put("resourceName", defaultString(theRequest.getResource()));
		theModel.put("encoding", theRequest.getEncoding());
		theModel.put("pretty", theRequest.getPretty());
		theModel.put("_summary", theRequest.get_summary());


Fixed code:
		theModel.put("serverId", sanitizeInput(serverId));
		theModel.put("base", sanitizeInput(serverBase));
		theModel.put("baseName", sanitizeInput(serverName));
		theModel.put("apiKey", sanitizeInput(apiKey));
		theModel.put("resourceName", sanitizeInput(defaultString(theRequest.getResource())));
		theModel.put("encoding", sanitizeInput(theRequest.getEncoding()));
		theModel.put("pretty", sanitizeInput(theRequest.getPretty()));
		theModel.put("_summary", sanitizeInput(theRequest.get_summary()));
	private static String sanitizeInput(String theString) {
		String retVal = theString;
		if (retVal != null) {
			for (int i = 0; i < retVal.length(); i++) {
				char nextChar = retVal.charAt(i);
				switch (nextChar) {
					case '\'':
					case '"':
					case '<':
					case '>':
						retVal = retVal.replace(nextChar, '_');
				}
			}
		}
		return retVal;
	}

			<action type="fix">
				A potential security vulnerability in the hapi-fhir-testpage-overlay project was corrected: A URL
				parameter was not being correctly escaped, leading to a potential XSS vulnerabnility. A big thanks to
				Mudit Punia and Dushyant Garg for reporting this.
			</action>
CVE-2017-20005 (C, published 2021-06-06T22:15Z)
Description: value: NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/nginx/nginx
Files changed:
src/core/ngx_times.c
Commit message: Introduced time truncation to December 31, 9999 (ticket #1368).

Various buffers are allocated in an assumption that there would be
no more than 4 year digits.  This might not be true on platforms
with 64-bit time_t, as 64-bit time_t is able to represent more than that.
Such dates with more than 4 year digits hardly make sense though, as
various date formats in use do not allow them anyway.

As such, all dates are now truncated by ngx_gmtime() to December 31, 9999.
This should have no effect on valid dates, though will prevent potential
buffer overflows on invalid ones.


Vulnerable code:

Fixed code:
    /*
     * no more than 4 year digits supported,
     * truncate to December 31, 9999, 23:59:59
     */

    if (days > 2932896) {
        days = 2932896;
        sec = 86399;
    }
CVE-2017-20005 (C, published 2021-06-06T22:15Z)
Description: value: NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/nginx/nginx
Files changed:
src/core/ngx_times.c
Commit message: Fixed ngx_gmtime() on 32-bit platforms with 64-bit time_t.

In ngx_gmtime(), instead of casting to ngx_uint_t we now work with
time_t directly.  This allows using dates after 2038 on 32-bit platforms
which use 64-bit time_t, notably NetBSD and OpenBSD.

As the code is not able to work with negative time_t values, argument
is now set to 0 for negative values.  As a positive side effect, this
results in Epoch being used for such values instead of a date in distant
future.


Vulnerable code:
    ngx_uint_t  n, sec, min, hour, mday, mon, year, wday, days, leap;
    n = (ngx_uint_t) t;
    days = n / 86400;
    n %= 86400;
    hour = n / 3600;
    n %= 3600;
    min = n / 60;
    sec = n % 60;

Fixed code:
    ngx_uint_t  sec, min, hour, mday, mon, year, wday, days, leap;
    if (t < 0) {
        t = 0;
    }
    days = t / 86400;
    sec = t % 86400;
    hour = sec / 3600;
    sec %= 3600;
    min = sec / 60;
    sec %= 60;
CVE-2019-20372 (C, published 2020-01-09T21:15Z)
Description: value: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/nginx/nginx
Files changed:
src/http/ngx_http_special_response.c
Commit message: Discard request body when redirecting to a URL via error_page.

Reported by Bert JW Regeer and Francisco Oca Gonzalez.


Vulnerable code:

Fixed code:
    r->expect_tested = 1;

    if (ngx_http_discard_request_body(r) != NGX_OK) {
        r->keepalive = 0;
    }
CVE-2020-21809 (PHP, published 2021-07-30T14:15Z)
Description: value: SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/nukeviet/module-shops
Files changed:
modules/shops/funcs/detail.php
modules/shops/funcs/search_result.php
Commit message: Security fixes


Vulnerable code:
    $listid = explode(',', $listid);
    
        
        
        
            
    
    
    
    
    
    
    
    
    
    
    
    
        
    
                
    
    
        
    
}
            $group_price_i = explode('-', $group_price_i);

Fixed code:
    $listid = array_map('intval', explode(',', $listid));
























}
            $group_price_i = array_map('intval', explode('-', $group_price_i));
CVE-2024-22200 (Unknown, published 2024-01-30T16:15Z)
Description: value: vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application.  This vulnerability was patched in 4.2.0.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vantage6/vantage6-UI
Files changed:
Commit message: Merge pull request from GHSA-8wxq-346h-xmr8

Hide nginx version from the dockerfile headers

Vulnerable code:

Fixed code:
CVE-2024-24562 (Unknown, published 2024-03-14T19:15Z)
Description: value: vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vantage6/vantage6-UI
Files changed:
Commit message: Merge pull request from GHSA-gwq3-pvwq-4c9w

Added security headers to UI requests

Vulnerable code:

Fixed code:
CVE-2022-21189 (TypeScript, published 2022-05-01T16:15Z)
Description: value: The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/dexie/Dexie.js
Files changed:
src/functions/utils.ts
Commit message: Prohibit prototype pollution


Vulnerable code:
                if (!innerObj) innerObj = (obj[currentKeyPath] = {});

Fixed code:
                if (!innerObj || !hasOwn(obj, currentKeyPath)) innerObj = (obj[currentKeyPath] = {});
CVE-2017-12424 (C, published 2017-08-04T09:29Z)
Description: value: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/shadow-maint/shadow
Files changed:
lib/commonio.c
Commit message: Fix buffer overflow if NULL line is present in db.

If ptr->line == NULL for an entry, the first cycle will exit,
but the second one will happily write past entries buffer.
We actually do not want to exit the first cycle prematurely
on ptr->line == NULL.
Signed-off-by: Tomas Mraz <tmraz@fedoraproject.org>


Vulnerable code:
	     && (NULL != ptr->line)
	     && (   ('+' != ptr->line[0])
	         && ('-' != ptr->line[0]))
	if ((NULL != ptr) && (NULL != ptr->line)) {

Fixed code:
	     && ((NULL == ptr->line)
	         || (('+' != ptr->line[0])
	             && ('-' != ptr->line[0])))
	if (NULL != ptr) {
CVE-2019-19882 (Other, published 2019-12-18T16:15Z)
Description: value: shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/shadow-maint/shadow
Files changed:
src/Makefile.am
Commit message: Fix failing chmod calls on installation for suidubins

suidubins should be suidusbins, since these binaries are installed
${prefix}/sbin. This historically hasn't broken the build because
chmod of newgidmap/newuidmap succeeds, causing make to think the command
succeeded. Configuring shadow with --with-fcaps removes these final two
entries and exposes the chmod failure to make.


Vulnerable code:
suidubins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod

Fixed code:
suidusbins     =
suidusbins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
	for i in $(suidusbins); do \
		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
	done
CVE-2023-29383 (C, published 2023-04-14T22:15Z)
Description: value: In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/shadow-maint/shadow
Files changed:
lib/fields.c
Commit message: Added control character check

Added control character check, returning -1 (to "err") if control characters are present.


Vulnerable code:
 *  + -1 is returned if an illegal character is present.
 *  +  1 is returned if no illegal characters are present, but the field
 *       contains a non-printable character.
		/* Search if there are some non-printable characters */

Fixed code:
 *  + -1 is returned if an illegal or control character is present.
 *  +  1 is returned if no illegal or control characters are present,
 *       but the field contains a non-printable character.
		/* Search if there are non-printable or control characters */
			}
			if (!iscntrl (*cp)) {
				err = -1;