hitoshura25/cvefixes huggingface dataset:
CVE-2018-3741 (Ruby, published 2018-03-30T19:29Z)
Description: value: There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rails/rails-html-sanitizer
Files changed:
lib/rails/html/scrubbers.rb
rails-html-sanitizer.gemspec
test/sanitizer_test.rb
Commit message: Make sure we address CVE-2018-8048

Even that the issue was fixed on loofah we have our own logic to scrub
attributes so when the whitelist serializer is used the issue was still
present.

Fix CVE-2018-3741.


Vulnerable code:
  spec.add_dependency "loofah", "~> 2.0"
    expected = %(display: block; width: 100%; height: 100%; background-color: black; background-x: center; background-y: center;)
    expected = "display: block;"

Fixed code:

        Loofah::HTML5::Scrub.force_correct_attribute_escaping! node
  spec.add_dependency "loofah", "~> 2.2", ">= 2.2.2"
    expected = %(display:block;width:100%;height:100%;background-color:black;background-x:center;background-y:center;)
    expected = "display:block;"
  def test_uri_escaping_of_href_attr_in_a_tag_in_white_list_sanitizer
    html = %{<a href='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}

    text = white_list_sanitize(html)

    assert_equal %{<a href="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
  end

  def test_uri_escaping_of_src_attr_in_a_tag_in_white_list_sanitizer
    html = %{<a src='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}

    text = white_list_sanitize(html)

    assert_equal %{<a src="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
  end

  def test_uri_escaping_of_name_attr_in_a_tag_in_white_list_sanitizer
    html = %{<a name='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}

    text = white_list_sanitize(html)

    assert_equal %{<a name="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
  end

  def test_uri_escaping_of_name_action_in_a_tag_in_white_list_sanitizer
    html = %{<a action='examp<!--" unsafeattr=foo()>-->le.com'>test</a>}

    text = white_list_sanitize(html, attributes: ['action'])

    assert_equal %{<a action="examp<!--%22%20unsafeattr=foo()>-->le.com">test</a>}, text
  end
CVE-2022-23517 (Ruby, published 2022-12-14T17:15Z)
Description: value: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/rails/rails-html-sanitizer
Files changed:
lib/rails/html/scrubbers.rb
test/sanitizer_test.rb
Commit message: fix: replace slow regex attribute check with Loofah method

which uses the Crass parser


Vulnerable code:
          attr_node.value = attr_node.value.gsub(/url\s*\(\s*[^#\s][^)]+?\)/m, ' ') if attr_node.value

Fixed code:

          Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)

  def test_scrubbing_svg_attr_values_that_allow_ref
    input = %Q(<div fill="yellow url(http://bad.com/) #fff">hey</div>)
    expected = %Q(<div fill="yellow #fff">hey</div>)
    actual = scope_allowed_attributes %w(fill) do
      safe_list_sanitize(input)
    end

    assert_equal(expected, actual)
  end
CVE-2020-26280 (Python, published 2020-12-18T19:15Z)
Description: value: OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web applications users can enter rich text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Code that will be executed when other users read the respective text. An attacker could utilize this vulnerability be used to manipulate votes of other users, hijack the moderators session or simply disturb the meeting. The vulnerability was introduced with 6eae497abeab234418dfbd9d299e831eff86ed45 on 16.04.2020, which is first included in the 3.2 release. It has been patched in version 3.3 ( in commit f3809fc8a97ee305d721662a75f788f9e9d21938, merged in master on 20.11.2020).
Severity: LOW (CVSS v3 base score: 8.9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/OpenSlides/OpenSlides
Files changed:
server/openslides/utils/validate.py
Commit message: Fixed HTML attribute validation


Vulnerable code:
def allow_all(tag: str, name: str, value: str) -> bool:
    return True


allowed_attributes = allow_all

Fixed code:
allowed_attributes = [
    "align",
    "alt",
    "autoplay",
    "background",
    "bgcolor",
    "border",
    "class",
    "colspan",
    "controls",
    "dir",
    "height",
    "hidden",
    "href",
    "hreflang",
    "id",
    "lang",
    "loop",
    "muted",
    "poster",
    "preload",
    "rel",
    "rowspan",
    "scope",
    "sizes",
    "src",
    "srcset",
    "start",
    "style",
    "target",
    "title",
    "width",
]
CVE-2018-3720 (JavaScript, published 2018-06-07T02:29Z)
Description: value: assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jonschlinkert/assign-deep
Files changed:
index.js
Commit message: exclude __proto__


Vulnerable code:
    if (hasOwn(obj, key)) {

Fixed code:
    if (key !== '__proto__' && hasOwn(obj, key)) {
CVE-2020-7758 (TypeScript, published 2020-11-02T22:15Z)
Description: value: This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/browserless/chrome
Files changed:
src/routes.ts
Commit message: Ensure workspace files are _in_ the workspace DIR


Vulnerable code:

Fixed code:
      if (!filePath.includes(workspaceDir)) {
        return res.sendStatus(404);
      }

      if (!filePath.includes(workspaceDir)) {
        return res.sendStatus(404);
      }
CVE-2022-24719 (JavaScript, published 2022-03-01T21:15Z)
Description: value: Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin. A workaround has been identified by using a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/fluture-js/fluture-node
Files changed:
index.js
test/index.js
Commit message: Fix notion of cross-origin to include scheme changes


Vulnerable code:
// sameHost :: (Url, Url) -> Boolean
const sameHost = (parent, child) => {
  return p.host === c.host || c.host.endsWith ('.' + p.host);
  return sameHost (oldUrl, newUrl) ? request : overHeaders (request, xs => (

Fixed code:
// sameOrigin :: (Url, Url) -> Boolean
const sameOrigin = (parent, child) => {
  return (p.protocol === c.protocol || c.protocol === 'https:') &&
         (p.host === c.host || c.host.endsWith ('.' + p.host));
  return sameOrigin (oldUrl, newUrl) ? request : overHeaders (request, xs => (
  assertResolves (fl.map (fn.redirectAnyRequest)
                         (mockResponse ({code: 301,
                                         headers: {location: 'http://example.com/'},
                                         request: fn.Request ({headers: {cookie: 'yum'}}) ('https://example.com') (fn.emptyStream)})))
                 (fn.Request ({headers: {}}) ('http://example.com/') (fn.emptyStream)),
CVE-2022-23458 (JSON, published 2022-09-22T22:15Z)
Description: value: Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted content into editable cells. This issue was fixed in version 4.21.3. There are no known workarounds.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nhn/tui.grid
Files changed:
README.md
packages/toast-ui.grid/cypress/integration/renderer.spec.ts
packages/toast-ui.grid/package-lock.json
packages/toast-ui.grid/package.json
packages/toast-ui.grid/src/renderer/default.ts
packages/toast-ui.grid/src/view/clipboard.tsx
Commit message: fix: cross site script vulnerability (fix #1669) (#1741)

* test: add test for renderer

* fix: cross site script vulnerability

* chore: apply code reviews

Vulnerable code:
    this.el.innerHTML = `${props.formattedValue}`;
    const html = clipboardData.getData('text/html');

Fixed code:
- [Dependencies](#-dependencies)
## 🔩 Dependencies

* [DOMPurify](https://github.com/cure53/DOMPurify)


it('should render data to plain text in default renderer', () => {
  const data = [{ tag: '<img src="" onerror="alert(123)" />' }];
  const columns = [
    {
      name: 'tag',
    },
  ];

  cy.createGrid({ data, columns });

  cy.getByCls('cell-content').invoke('html').should('to.eq', '<img src="">');
});
    "@types/dompurify": {
      "version": "2.3.3",
      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-2.3.3.tgz",
      "integrity": "sha512-nnVQSgRVuZ/843oAfhA25eRSNzUFcBPk/LOiw5gm8mD9/X7CNcbRkQu/OsjCewO8+VIYfPxUnXvPEVGenw14+w==",
      "dev": true,
      "requires": {
        "@types/trusted-types": "*"
      }
    },
    "@types/trusted-types": {
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.2.tgz",
      "integrity": "sha512-F5DIZ36YVLE+PN+Zwws4kJogq47hNgX3Nx6WyDJ3kcplxyke3XIzB8uK5n/Lpm1HBsbGzd6nmGehL8cPekP+Tg==",
      "dev": true
    },
    "dompurify": {
      "version": "2.3.9",
      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-2.3.9.tgz",
      "integrity": "sha512-3zOnuTwup4lPV/GfGS6UzG4ub9nhSYagR/5tB3AvDEwqyy5dtyCM2dVjwGDCnrPerXifBKTYh/UWCGKK7ydhhw=="
    },
    "@types/dompurify": "^2.3.3",
    "dompurify": "^2.3.9",
import { sanitize } from 'dompurify';
    this.el.innerHTML = sanitize(`${props.formattedValue}`);
import { sanitize } from 'dompurify';
    const html = sanitize(clipboardData.getData('text/html'));
CVE-2017-5936 (Python, published 2017-04-12T22:59Z)
Description: value: OpenStack Nova-LXD before 13.1.1 uses the wrong name for the veth pairs when applying Neutron security group rules for instances, which allows remote attackers to bypass intended security restrictions.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openstack/nova-lxd
Files changed:
nova_lxd/nova/virt/lxd/config.py
setup.cfg
Commit message: Ensure LXD veth host device is named correctly

LXD uses a veth pair to plumb the LXD instance into the bridge
providing access to neutron networking.

In later nova-lxd versions, the host_name parameter is set based
on the neutron configured name for the host part of the pair,
ensuring that neutron iptables firewall rules are correctly
applied to instances.

Update the mitaka version of the driver to populate the LXD
network device configuration to ensure that any firewall
rules are correctly applied.

(also dropped version from setup.cfg, as pbr will automatically
generate the version based on git tags, so its really surplus
to requirements).

Change-Id: Ic5b9ad6944a1ac45cd1983d038431252ff738985
Closes-Bug: 1656847


Vulnerable code:
                network_devices[str(cfg['bridge'])] = \
                     'parent': str(cfg['bridge']),
version = 13.2.0

Fixed code:
                key = str(cfg['bridge'])
                network_devices[key] = \
                     'parent': key,
                host_device = self.vif_driver.get_vif_devname(vifaddr)
                if host_device:
                    network_devices[key]['host_name'] = host_device
CVE-2021-38593 (C++, published 2021-08-12T02:15Z)
Description: value: Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/qt/qtbase
Files changed:
src/gui/painting/qpaintengineex.cpp
Commit message: Improve fix for avoiding huge number of tiny dashes

Some pathological cases were not caught by the previous fix.

Fixes: QTBUG-95239
Pick-to: 6.2 6.1 5.15
Change-Id: I0337ee3923ff93ccb36c4d7b810a9c0667354cc5
Reviewed-by: Robert Löhning <robert.loehning@qt.io>


Vulnerable code:
        } else if (extent / patternLength > 10000) {

Fixed code:
        } else if (qFuzzyIsNull(extent) || extent / patternLength > 10000) {
CVE-2023-32762 (C++, published 2023-05-28T23:15Z)
Description: value: An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/qt/qtbase
Files changed:
src/network/access/qhsts.cpp
tests/auto/network/access/hsts/tst_qhsts.cpp
Commit message: Hsts: match header names case insensitively

Header field names are always considered to be case-insensitive.

Pick-to: 6.5 6.5.1 6.2 5.15
Fixes: QTBUG-113392
Change-Id: Ifb4def4bb7f2ac070416cdc76581a769f1e52b43
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>


Vulnerable code:
        // We use '==' since header name was already 'trimmed' for us:
        if (h.first == "Strict-Transport-Security") {

Fixed code:
        // We compare directly because header name was already 'trimmed' for us:
        if (h.first.compare("Strict-Transport-Security", Qt::CaseInsensitive) == 0) {
    list.pop_back();
    list << Header("strict-transport-security", "includeSubDomains;max-age=1000");
    QVERIFY(parser.parse(list));
    QVERIFY(parser.expirationDate() > QDateTime::currentDateTimeUtc());
    QVERIFY(parser.includeSubDomains());
CVE-2018-6596 (Python, published 2018-02-03T21:29Z)
Description: value: webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/anymail/django-anymail
Files changed:
anymail/webhooks/base.py
Commit message: Security: prevent timing attack on WEBHOOK_AUTHORIZATION secret

Anymail's webhook validation was vulnerable to a timing attack.
An attacker could have used this to recover your WEBHOOK_AUTHORIZATION
shared secret, potentially allowing them to post fabricated or malicious
email tracking events to your app.

There have not been any reports of attempted exploit in the wild. (The
vulnerability was discovered through code review.) Attempts would be
visible in http logs as a very large number of 400 responses on
Anymail's webhook urls, or in Python error monitoring as a very large
number of AnymailWebhookValidationFailure exceptions.

If you are using Anymail's webhooks, you should upgrade to this release.
In addition, you may want to rotate to a new WEBHOOK_AUTHORIZATION
secret ([docs](http://anymail.readthedocs.io/en/stable/tips/securing_webhooks/#use-a-shared-authorization-secret)),
particularly if your logs indicate attempted exploit.


Vulnerable code:
            basic_auth = get_request_basic_auth(request)
            if basic_auth is None or basic_auth not in self.basic_auth:
        # if request.POST['signature'] != expected_signature:

Fixed code:
from django.utils.crypto import constant_time_compare
            request_auth = get_request_basic_auth(request)
            # Use constant_time_compare to avoid timing attack on basic auth. (It's OK that any()
            # can terminate early: we're not trying to protect how many auth strings are allowed,
            # just the contents of each individual auth string.)
            auth_ok = any(constant_time_compare(request_auth, allowed_auth)
                          for allowed_auth in self.basic_auth)
            if not auth_ok:

        Security note: use django.utils.crypto.constant_time_compare for string
        comparisons, to avoid exposing your validation to a timing attack.
        # if not constant_time_compare(request.POST['signature'], expected_signature):
CVE-2016-8641 (Other, published 2018-08-01T14:29Z)
Description: value: A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/NagiosEnterprises/nagioscore
Files changed:
Changelog
daemon-init.in
Commit message: root privilege escalation fix


Vulnerable code:
4.2.2 - 2016-10-xx
		chown -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile

Fixed code:
SECURITY FIXES
* Fixed a root privilege escalation

4.2.2 - 2016-10-24
		chown -h -R $NagiosUser:$NagiosGroup ${RAMDISK_DIR}
	rm -f "$NagiosCfgtestFile";
	if test -e "$NagiosCfgtestFile"; then
		echo "ERROR: Could not delete '$NagiosCfgtestFile'"
		exit 8
	fi

		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown -h $NagiosUser:$NagiosGroup $NagiosCfgtestFile
		chown -h $NagiosUser:$NagiosGroup $NagiosRunFile $NagiosVarDir/nagios.log $NagiosRetentionFile
CVE-2016-9566 (Unknown, published 2016-12-15T22:59Z)
Description: value: base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/NagiosEnterprises/nagioscore
Files changed:
Commit message: Merge branch 'maint'


Vulnerable code:

Fixed code:
CVE-2016-9566 (Unknown, published 2016-12-15T22:59Z)
Description: value: base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/NagiosEnterprises/nagioscore
Files changed:
Commit message: Merge branch 'maint'


Vulnerable code:

Fixed code: