hitoshura25/cvefixes huggingface dataset:
CVE-2022-27649 (Go, published 2022-04-04T20:15Z)
Description: value: A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/containers/podman
Files changed:
libpod/oci_conmon_exec_linux.go
pkg/specgen/generate/security.go
test/e2e/run_test.go
Commit message: do not set the inheritable capabilities

The kernel never sets the inheritable capabilities for a process, they
are only set by userspace.  Emulate the same behavior.

Closes: CVE-2022-27649

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>


Vulnerable code:
		pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding
		pspec.Capabilities.Ambient = pspec.Capabilities.Bounding
		configSpec.Process.Capabilities.Inheritable = caplist
		configSpec.Process.Capabilities.Inheritable = userCaps
		Expect(session.OutputToString()).To(ContainSubstring("00000000a80425fb"))
		Expect(session.OutputToString()).To(ContainSubstring("00000000a80425fb"))
			Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))

Fixed code:

	// Always unset the inheritable capabilities similarly to what the Linux kernel does
	// They are used only when using capabilities with uid != 0.
	pspec.Capabilities.Inheritable = []string{}


	// Always unset the inheritable capabilities similarly to what the Linux kernel does
	// They are used only when using capabilities with uid != 0.
	configSpec.Process.Capabilities.Inheritable = []string{}
			configSpec.Process.Capabilities.Inheritable = userCaps
		Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))
		Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))
			Expect(session.OutputToString()).To(ContainSubstring("0000000000000002"))
CVE-2014-125037 (Ruby, published 2023-01-02T18:15Z)
Description: value: A vulnerability, which was classified as critical, was found in License to Kill. This affects an unknown part of the file models/injury.rb. The manipulation of the argument name leads to sql injection. The patch is named cd11cf174f361c98e9b1b4c281aa7b77f46b5078. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217191.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/elizabrock/license-to-kill
Files changed:
lib/database.rb
models/injury.rb
spec/injury_integration_spec.rb
Commit message: Fix the SQL injection! STRING INTERPOLATION - NEVER AGAIN. NEVER!


Vulnerable code:
  def execute(statement)
    super(statement)
    statement = "Select * from injuries where name = \"#{name}\";"
    execute_and_instantiate(statement)[0]
      statement = "Insert into injuries (name) values ('#{name}');"
      Environment.database_connection.execute(statement)
  def self.execute_and_instantiate(statement)
    rows = Environment.database_connection.execute(statement)

Fixed code:
  def execute(statement, bind_vars = [])
    super(statement, bind_vars)
    statement = "Select * from injuries where name = ?;"
    execute_and_instantiate(statement, name)[0]
      statement = "Insert into injuries (name) values (?);"
      Environment.database_connection.execute(statement, name)
  def self.execute_and_instantiate(statement, bind_vars = [])
    rows = Environment.database_connection.execute(statement, bind_vars)
        pending
        pending
        pending
CVE-2022-4881 (Lua, published 2023-01-08T13:15Z)
Description: value: A vulnerability was found in CapsAdmin PAC3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lua/pac3/core/shared/http.lua. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. The patch is identified as 8fc9e12dfa21d757be6eb4194c763e848b299ac0. It is recommended to apply a patch to fix this issue. VDB-217646 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/CapsAdmin/pac3
Files changed:
lua/pac3/core/shared/http.lua
lua/pac3/libraries/urltex.lua
Commit message: Fix an HTML injection exploit (#1210)

* Improve FixURL

* Ensure number

* Simplify

Vulnerable code:
	local size = data.size or urltex.TextureSize
return urltex

Fixed code:
	url = url:gsub("[\"'<>\n\\]+", "")
	local size = tonumber(data.size or urltex.TextureSize)
return urltex
CVE-2023-41318 (Go, published 2023-09-08T20:15Z)
Description: value: matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/turt2live/matrix-media-repo
Files changed:
api/_routers/98-use-rcontext.go
Commit message: Sniff content type during download for disposition


Vulnerable code:
		contentType = downloadRes.ContentType
			disposition = "inline"

Fixed code:
	"github.com/gabriel-vasile/mimetype"
	"github.com/turt2live/matrix-media-repo/util/readers"
		contentType = "application/octet-stream"
		// Don't rely on user-supplied values for content-type
		br := readers.NewBufferReadsReader(downloadRes.Data)
		if mimeType, err := mimetype.DetectReader(br); err != nil {
			rctx.Log.Warn("Non-fatal error sniffing mime type of download: ", err)
			sentry.CaptureException(err)
		} else if mimeType != nil {
			contentType = mimeType.String()
		}
		ogReader := downloadRes.Data
		downloadRes.Data = readers.NewCancelCloser(io.NopCloser(br.GetRewoundReader()), func() {
			_ = ogReader.Close()
		})

		if contentType != downloadRes.ContentType {
			rctx.Log.Debugf("Expected '%s' content type but ended up with '%s'", downloadRes.ContentType, contentType)
		}

			disposition = "attachment"
CVE-2023-41318 (Go, published 2023-09-08T20:15Z)
Description: value: matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` upon download. This vulnerability could be leveraged to execute scripts embedded in SVG content. Commits `77ec235` and `bf8abdd` fix the issue and are included in the 1.3.0 release. Operators should upgrade to v1.3.0 as soon as possible. Operators unable to upgrade should override the `Content-Disposition` header returned by matrix-media-repo as a workaround.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/turt2live/matrix-media-repo
Files changed:
api/_routers/98-use-rcontext.go
util/mime.go
Commit message: Fix Content-Disposition handling


Vulnerable code:
				if util.HasAnyPrefix(contentType, []string{"image/", "audio/", "video/", "text/plain"}) {

Fixed code:
				if util.CanInline(contentType) {

func CanInline(ct string) bool {
	ct = FixContentType(ct)
	return ArrayContains(InlineContentTypes, ct)
}

var InlineContentTypes = []string{
	// Types are inherited from https://github.com/matrix-org/synapse/pull/15988

	"text/css",
	"text/plain",
	"text/csv",
	"application/json",
	"application/ld+json",
	"image/jpeg",
	"image/gif",
	"image/png",
	"image/apng",
	"image/webp",
	"image/avif",
	"video/mp4",
	"video/webm",
	"video/ogg",
	"video/quicktime",
	"audio/mp4",
	"audio/webm",
	"audio/aac",
	"audio/mpeg",
	"audio/ogg",
	"audio/wave",
	"audio/wav",
	"audio/x-wav",
	"audio/x-pn-wav",
	"audio/flac",
	"audio/x-flac",
}
CVE-2017-20171 (JavaScript, published 2023-01-17T23:15Z)
Description: value: A vulnerability classified as critical has been found in PrivateSky apersistence. This affects an unknown part of the file db/sql/mysqlUtils.js. The manipulation leads to sql injection. The identifier of the patch is 954425f61634b556fe644837a592a5b8fcfca068. It is recommended to apply a patch to fix this issue. The identifier VDB-218457 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/PrivateSky/apersistence
Files changed:
db/sql/MySqlPersistence.js
db/sql/mysqlUtils.js
lib/BasicStrategy.js
lib/ModelDescription.js
lib/basicSQLTypes.js
test/fillLazyTest.js
Commit message: fixed SQL injection bug and changed type boolean from bit to tinyint


Vulnerable code:

                column['Type'] = column['Type'].split('(')[0];   //ignore size specifications such as INT(10)

                
                var deserialized_id = modelUtil.deserialiseField(typeName,model.getPKField(),serialized_id,self)

        
        if(model.getFieldDescription(field).type === 'boolean') {
            query+=' b\''+serializedData[field]+'\',';
        }else{
            query+=' \''+serializedData[field]+'\',';
        }


                dbType = dbType.slice(dbType.indexOf('('));

        if(from[p] || from[p]===false) {
            
            if(value[0] != '0') {
            if(value){
                return "1"
                return "0"
        "bit"
            if(arrayOfStuff.length>0&&arrayOfStuff[0].__meta){
                //the array is of lazy objects and was filled
                arrayOfStuff = arrayOfStuff.map(function(lazyLoadedObject){
                    return lazyLoadedObject.__meta.getPK()
                })
            }
    }]);

Fixed code:
            
                column['Type'] = column['Type'].split('(')[0];   //ignore size specifications such as INT(10) ... not neccesarily reccomender
                var deserialized_id = modelUtil.deserialiseField(typeName,model.getPKField(),serialized_id,self);
var mysql = require('mysql');
        query+= mysql.escape(serializedData[field])+',';
                dbType = dbType.slice(0,dbType.indexOf('('));
        if(from.hasOwnProperty(p)) {
            if(value == 1) {
            if(value == true){
                return 1
                return 0
        "tinyint(1)"
    }],1000);
CVE-2022-4563 (Other, published 2022-12-16T17:15Z)
Description: value: A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is b0526a06f8ca713cce74b63e00d3730618d89691. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215972.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/freedomofpress/securedrop
Files changed:
securedrop/debian/securedrop-app-code.postinst
Commit message: Manipulate gpg config file as www-data

An attacker with access to www-data could have gpg-agent.conf be a
symlink to a root-owned file (e.g. /etc/passwd) and trick the postinst
into clobbering that file as root. Because the content is fixed, it's
pretty low risk but straightforward to fix.


Vulnerable code:
            echo allow-loopback-pinentry >> /var/lib/securedrop/keys/gpg-agent.conf
            echo 'default-cache-ttl 0' >> /var/lib/securedrop/keys/gpg-agent.conf
        echo allow-loopback-pinentry > /var/lib/securedrop/keys/gpg-agent.conf
        echo 'default-cache-ttl 0' >> /var/lib/securedrop/keys/gpg-agent.conf
        gpg2 --homedir=/var/lib/securedrop/keys --batch --import < /var/lib/securedrop/keys/secring.gpg
    chown -R www-data:www-data /var/lib/securedrop


Fixed code:
    chown -R www-data:www-data /var/lib/securedrop

            echo allow-loopback-pinentry | sudo -u www-data tee -a /var/lib/securedrop/keys/gpg-agent.conf
            echo 'default-cache-ttl 0' | sudo -u www-data tee -a /var/lib/securedrop/keys/gpg-agent.conf
        echo allow-loopback-pinentry | sudo -u www-data tee /var/lib/securedrop/keys/gpg-agent.conf
        echo 'default-cache-ttl 0' | sudo -u www-data tee -a /var/lib/securedrop/keys/gpg-agent.conf
        # shellcheck disable=SC2024
        sudo -u www-data gpg2 --homedir=/var/lib/securedrop/keys --batch --import < /var/lib/securedrop/keys/secring.gpg
CVE-2021-36357 (C, published 2021-10-22T12:15Z)
Description: value: An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uint16_t "year" value, resulting in a type mismatch that can truncate a higher integer value to a smaller one, and bypass a timestamp check. The fix is to use the right endian conversion function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/open-power/skiboot
Files changed:
libstb/secvar/backend/edk2-compat-process.c
Commit message: secvar: fix endian conversion

unpack_timestamp() calls le32_to_cpu() for endian conversion of
uint16_t "year" value. This patch fixes the code to use le16_to_cpu().

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>


Vulnerable code:
	uint16_t year = le32_to_cpu(timestamp->year);

Fixed code:
	uint16_t year = le16_to_cpu(timestamp->year);
CVE-2022-24798 (Python, published 2022-03-31T23:15Z)
Description: value: Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/irrdnet/irrd
Files changed:
irrd/server/graphql/resolvers.py
irrd/utils/text.py
Commit message: Correct missing password hash removal

Auth has removal was broken in a number of cases for all 4.2 versions:
- All queries that returned the object text for a mntner when
  all hash names (MD5-PW etc.) in the text were lower or mixed case
- Queries for the auth attribute in GraphQL queries
- Queries for the objectText for journal entries in GraphQL queries

Further details in 4.2.3 release notes.

Note that this commit only has the fix and tests or coverage may
fail without the subsequent update to the tests.


Vulnerable code:
                value = remove_auth_hashes(value)
    if not any([pw_hash in input for pw_hash in PASSWORD_HASHERS_ALL.keys()]):

Fixed code:
        if response['objectText']:
            response['objectText'] = remove_auth_hashes(response['objectText'])
                value = [remove_auth_hashes(v) for v in value]
    input_lower = input.lower()
    if not any([pw_hash.lower() in input_lower for pw_hash in PASSWORD_HASHERS_ALL.keys()]):
CVE-2017-14498 (Other, published 2017-09-15T18:29Z)
Description: value: SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/silverstripe/silverstripe-installer
Files changed:
assets/.htaccess
Commit message: [SS-2017-017] FIX SVG uploads disabled by default


Vulnerable code:
<FilesMatch "\.(?i:html|htm|xhtml|js|css|bmp|png|gif|jpg|jpeg|ico|pcx|tif|tiff|au|mid|midi|mpa|mp3|ogg|m4a|ra|wma|wav|cda|avi|mpg|mpeg|asf|wmv|m4v|mov|mkv|mp4|ogv|webm|swf|flv|ram|rm|doc|docx|dotx|dotm|txt|rtf|xls|xlsx|xltx|xltm|pages|ppt|pptx|potx|potm|pps|csv|cab|arj|tar|zip|zipx|sit|sitx|svg|gz|tgz|bz2|ace|arc|pkg|dmg|hqx|jar|xml|pdf|gpx|kml)$">

Fixed code:
<FilesMatch "\.(?i:html|htm|xhtml|js|css|bmp|png|gif|jpg|jpeg|ico|pcx|tif|tiff|au|mid|midi|mpa|mp3|ogg|m4a|ra|wma|wav|cda|avi|mpg|mpeg|asf|wmv|m4v|mov|mkv|mp4|ogv|webm|swf|flv|ram|rm|doc|docx|dotx|dotm|txt|rtf|xls|xlsx|xltx|xltm|pages|ppt|pptx|potx|potm|pps|csv|cab|arj|tar|zip|zipx|sit|sitx|gz|tgz|bz2|ace|arc|pkg|dmg|hqx|jar|xml|pdf|gpx|kml)$">
CVE-2020-36635 (Java, published 2022-12-27T23:15Z)
Description: value: A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.13.0 is able to address this issue. The name of the patch is 34213c3f6ea22df427573076fb62744694f601d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216915.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-appointmentscheduling
Files changed:
api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java
api/src/main/resources/messages.properties
api/src/test/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidatorTest.java
Commit message: RA-1772: Fix stored xss is appointment scheduling (#32)



Vulnerable code:

Fixed code:
import org.openmrs.web.WebUtil;
		if(verifyIfNameHasHtmlEncodableChars(appointmentType.getName())){
			errors.rejectValue("name", "appointmentscheduling.AppointmentType.unsafeName.errorMessage");
		}

	private boolean verifyIfNameHasHtmlEncodableChars(String appointmentName) {
		if(appointmentName != null){
			return !WebUtil.escapeHTML(appointmentName).equals(appointmentName);
		}
		return false;
	}
${project.parent.artifactId}.AppointmentType.unsafeName.errorMessage= Name must not have HTML characters

	@Test
	public void mustRejectAppointmentTypeNameWithXSS() throws Exception {
		String evilName = "<script>alert(1)</script>";
		AppointmentType appointmentTypeEvilName = new AppointmentType(evilName, "", 10);

		appointmentTypeValidator.validate(appointmentTypeEvilName, errors);

		Mockito.verify(errors).rejectValue("name", "appointmentscheduling.AppointmentType.unsafeName.errorMessage");
	}