hitoshura25/cvefixes huggingface dataset:
CVE-2014-3544 (PHP, published 2014-07-29T11:10Z)
Description: value: Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/moodle/moodle
Files changed:
user/profile.php
Commit message: MDL-45683 user: Escaping Skype ID used in profile


Vulnerable code:
    $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.$user->skype);

Fixed code:
    $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.urlencode($user->skype));
CVE-2024-38522 (Markdown, published 2024-06-28T17:15Z)
Description: value: Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/scidsg/hushline
Files changed:
SECURITY.md
Commit message: Remove unpkg.com from the CSP header


Vulnerable code:
- `script-src 'self' https://js.stripe.com https://unpkg.com;` Allow scripts to be loaded from the site's own origin, Stripe (for payment processing), and unpkg (a content delivery network for npm packages).

Fixed code:
- `script-src 'self' https://js.stripe.com;` Allow scripts to be loaded from the site's own origin and Stripe (for payment processing).
CVE-2019-19960 (Unknown, published 2019-12-25T00:15Z)
Description: value: In wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/wolfSSL/wolfssl
Files changed:
Commit message: Merge pull request #2637 from SparkiDev/ecc_cache_resist

Improve wc_ecc_mulmod_ex cache attack resistance

Vulnerable code:

Fixed code:
CVE-2019-19962 (C, published 2019-12-25T00:15Z)
Description: value: wolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in RSA cryptography.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/wolfSSL/wolfssl
Files changed:
wolfcrypt/src/signature.c
wolfssl/wolfcrypt/signature.h
Commit message: Change signature generation to verify by default


Vulnerable code:

Fixed code:
{
    return wc_SignatureGenerateHash_ex(hash_type, sig_type, hash_data, hash_len,
        sig, sig_len, key, key_len, rng, 1);
}

int wc_SignatureGenerateHash_ex(
    enum wc_HashType hash_type, enum wc_SignatureType sig_type,
    const byte* hash_data, word32 hash_len,
    byte* sig, word32 *sig_len,
    const void* key, word32 key_len, WC_RNG* rng, int verify)
    if (ret == 0 && verify) {
        ret = wc_SignatureVerifyHash(hash_type, sig_type, hash_data, hash_len,
            sig, *sig_len, key, key_len);
    }

{
    return wc_SignatureGenerate_ex(hash_type, sig_type, data, data_len, sig,
        sig_len, key, key_len, rng, 1);
}

int wc_SignatureGenerate_ex(
    enum wc_HashType hash_type, enum wc_SignatureType sig_type,
    const byte* data, word32 data_len,
    byte* sig, word32 *sig_len,
    const void* key, word32 key_len, WC_RNG* rng, int verify)
    if (ret == 0 && verify) {
        ret = wc_SignatureVerifyHash(hash_type, sig_type, hash_data,
            hash_enc_len, sig, *sig_len, key, key_len);
    }

WOLFSSL_API int wc_SignatureGenerateHash_ex(
    enum wc_HashType hash_type, enum wc_SignatureType sig_type,
    const byte* hash_data, word32 hash_len,
    byte* sig, word32 *sig_len,
    const void* key, word32 key_len, WC_RNG* rng, int verify);
WOLFSSL_API int wc_SignatureGenerate_ex(
    enum wc_HashType hash_type, enum wc_SignatureType sig_type,
    const byte* data, word32 data_len,
    byte* sig, word32 *sig_len,
    const void* key, word32 key_len,
    WC_RNG* rng, int verify);
CVE-2019-19963 (Unknown, published 2019-12-25T00:15Z)
Description: value: An issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is enabled. DSA signing uses the BEEA algorithm during modular inversion of the nonce, leading to a side-channel attack against the nonce.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/wolfSSL/wolfssl
Files changed:
Commit message: Merge pull request #2629 from SparkiDev/dsa_blinding

Blinding for DSA sign

Vulnerable code:

Fixed code:
CVE-2020-36177 (C, published 2021-01-06T16:15Z)
Description: value: RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfssl
Files changed:
wolfcrypt/src/rsa.c
Commit message: RSA-PSS: Handle edge case with encoding message to hash

When the key is small relative to the digest (1024-bit key, 64-byte
hash, 61-byte salt length), the internal message to hash is larger than
the output size.
Allocate a buffer for the message when this happens.


Vulnerable code:
    #if defined(WOLFSSL_NO_MALLOC) && !defined(WOLFSSL_STATIC_MEMORY)
        byte salt[RSA_MAX_SIZE/8 + RSA_PSS_PAD_SZ];
    #else
        byte* salt = NULL;
    #endif
        salt = (byte*)XMALLOC(RSA_PSS_PAD_SZ + inputLen + saltLen, heap,
        if (salt == NULL) {
    s = m = salt;
    s = m = pkcsBlock;
#if defined(WOLFSSL_PSS_LONG_SALT) || defined(WOLFSSL_PSS_SALT_LEN_DISCOVER)
        if (salt != NULL) {
            XFREE(salt, heap, DYNAMIC_TYPE_RSA_BUFFER);
#endif

Fixed code:
#if defined(WOLFSSL_NO_MALLOC) && !defined(WOLFSSL_STATIC_MEMORY)
    byte msg[RSA_MAX_SIZE/8 + RSA_PSS_PAD_SZ];
#else
    byte* msg = NULL;
#endif
    byte* salt;
        msg = (byte*)XMALLOC(RSA_PSS_PAD_SZ + inputLen + saltLen, heap,
        if (msg == NULL) {
    salt = s = m = msg;
    if (pkcsBlockLen < RSA_PSS_PAD_SZ + inputLen + saltLen) {
    #if !defined(WOLFSSL_NO_MALLOC) || defined(WOLFSSL_STATIC_MEMORY)
        msg = (byte*)XMALLOC(RSA_PSS_PAD_SZ + inputLen + saltLen, heap,
                                                       DYNAMIC_TYPE_RSA_BUFFER);
        if (msg == NULL) {
            return MEMORY_E;
        }
    #endif
        m = msg;
    }
    else {
        m = pkcsBlock;
    }
    s = m;
        if (msg != NULL) {
            XFREE(msg, heap, DYNAMIC_TYPE_RSA_BUFFER);
CVE-2020-36177 (Unknown, published 2021-01-06T16:15Z)
Description: value: RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest size.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/wolfSSL/wolfssl
Files changed:
Commit message: Merge pull request #3426 from SparkiDev/rsa_pss_fix

RSA-PSS: Handle edge case with encoding message to hash

Vulnerable code:

Fixed code:
CVE-2021-38597 (C, published 2021-08-12T15:15Z)
Description: value: wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extension.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/wolfSSL/wolfssl
Files changed:
wolfcrypt/src/asn.c
wolfssl/wolfcrypt/asn.h
Commit message: OCSP: improve handling of OCSP no check extension


Vulnerable code:
            /* trust for the lifetime of the responder's cert*/
            if (cert->ocspNoCheckSet && verify == VERIFY_OCSP)
                verify = NO_VERIFY;
                                noVerify ? NO_VERIFY : VERIFY_OCSP, cm);

Fixed code:
            if (verify == VERIFY_OCSP_CERT) {
                /* trust for the lifetime of the responder's cert*/
                if (cert->ocspNoCheckSet)
                    verify = VERIFY;
                else
                    verify = VERIFY_OCSP;
            }
                                noVerify ? NO_VERIFY : VERIFY_OCSP_CERT, cm);
    VERIFY_OCSP_CERT = 6,
CVE-2020-26226 (JavaScript, published 2020-11-18T22:15Z)
Description: value: In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/semantic-release/semantic-release
Files changed:
lib/hide-sensitive.js
test/hide-sensitive.test.js
Commit message: fix: mask secrets when characters get uri encoded


Vulnerable code:
  const regexp = new RegExp(toReplace.map((envVar) => escapeRegExp(env[envVar])).join('|'), 'g');

Fixed code:
  const regexp = new RegExp(
    toReplace
      .map((envVar) => `${escapeRegExp(env[envVar])}|${encodeURI(escapeRegExp(env[envVar]))}`)
      .join('|'),
    'g'
  );
test('Replace url-encoded environment variable', (t) => {
  const env = {privateKey: 'secret '};
  t.is(
    hideSensitive(env)(`https://host.com?token=${encodeURI(env.privateKey)}`),
    `https://host.com?token=${SECRET_REPLACEMENT}`
  );
});
CVE-2022-31051 (JavaScript, published 2022-06-09T20:15Z)
Description: value: semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by `encodeURI`. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL are already masked properly.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/semantic-release/semantic-release
Files changed:
index.js
test/index.test.js
Commit message: fix(log-repo): use the original form of the repo url to remove the need to mask credentials (#2459)

fixes #2449

Vulnerable code:
    `Run automated release from branch ${ciBranch} on repository ${options.repositoryUrl}${
  const config = {branches: [{name: 'master'}], repositoryUrl, tagFormat: `v\${version}`};

Fixed code:
    `Run automated release from branch ${ciBranch} on repository ${options.originalRepositoryURL}${
    options.originalRepositoryURL = options.repositoryUrl;
    originalRepositoryURL: repositoryUrl,
  const config = {
    branches: [{name: 'master'}],
    repositoryUrl,
    originalRepositoryURL: repositoryUrl,
    tagFormat: `v\${version}`,
  };
CVE-2023-5498 (Python, published 2023-10-10T10:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/chiefonboarding/chiefonboarding
Files changed:
back/admin/admin_tasks/templates/admin_tasks_detail.html
back/admin/admin_tasks/tests.py
back/admin/admin_tasks/views.py
Commit message: Fix missing csrf token on admin task done view (#367)



Vulnerable code:
<a type="submit" href="{% url 'admin_tasks:completed' object.id %}" class="btn btn-primary">
  {% if object.completed %}
    {% translate "Reopen" %}
  {% else %}
    {% translate "Complete" %}
  {% endif %}
</a>
    response = client.get(complete_url, follow=True)
from django.shortcuts import get_object_or_404
from django.views.generic.base import RedirectView
class AdminTaskToggleDoneView(LoginRequiredMixin, ManagerPermMixin, RedirectView):
    permanent = False
    pattern_name = "admin_tasks:detail"
    def get(self, request, *args, **kwargs):
        task_id = self.kwargs.get("pk", -1)
        admin_task = get_object_or_404(AdminTask, id=task_id)
        return super().get(request, *args, **kwargs)

Fixed code:
<form method="post" action="{% url 'admin_tasks:completed' object.id %}">
  {% csrf_token %}
  <button type="submit" class="btn btn-primary">
    {% if object.completed %}
      {% translate "Reopen" %}
    {% else %}
      {% translate "Complete" %}
    {% endif %}
  </button>
</form>
    response = client.post(complete_url, follow=True)
from django.shortcuts import get_object_or_404, redirect

from django.views.generic.detail import BaseDetailView
class AdminTaskToggleDoneView(LoginRequiredMixin, ManagerPermMixin, BaseDetailView):
    model = AdminTask
    def post(self, request, *args, **kwargs):
        admin_task = self.get_object()
        return redirect("admin_tasks:detail", pk=admin_task.id)
CVE-2019-10664 (C++, published 2019-03-31T14:29Z)
Description: value: Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/domoticz/domoticz
Files changed:
main/WebServer.cpp
Commit message: Fixed possible SQL Injection Vulnerability (Thanks to Fabio Carretto!)


Vulnerable code:
			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%s", idx.c_str());

Fixed code:
			result = m_sql.safe_queryBlob("SELECT Image FROM Floorplans WHERE ID=%d", atol(idx.c_str()));
CVE-2019-10678 (C++, published 2019-03-31T21:29Z)
Description: value: Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/domoticz/domoticz
Files changed:
main/Helper.cpp
Commit message: Do not allow enters/returns in arguments (thanks to Fabio Carretto)


Vulnerable code:

Fixed code:
	"\n",
	"\r",
CVE-2022-32173 (C#, published 2022-10-03T13:15Z)
Description: value: In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/OrchardCMS/OrchardCore
Files changed:
src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs
src/docs/reference/core/Sanitizer/README.md
Commit message: Remove form tag from allowed tags during sanitization (#11729)



Vulnerable code:
By default it allows css classes, but can be configured to accept other attributes.


Fixed code:
                    sanitizer.AllowedTags.Remove("form");

## Defaults configuration

The elements sanitized by default are listed on this page: https://github.com/mganss/HtmlSanitizer#tags-allowed-by-default

Orchard Core changes these defaults by:

- allowing the attribute `class`
- removing the tag `form`
CVE-2014-3589 (Python, published 2014-08-25T14:55Z)
Description: value: PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/python-pillow/Pillow
Files changed:
PIL/IcnsImagePlugin.py
Tests/check_icns_dos.py
Commit message: Icns DOS fix --  CVE-2014-3589

Found and reported by Andrew Drake of dropbox.com


Vulnerable code:

Fixed code:
            if blocksize <= 0:
                raise SyntaxError('invalid block header')
# Tests potential DOS of IcnsImagePlugin with 0 length block.
# Run from anywhere that PIL is importable. 

from PIL import Image
from io import BytesIO

if bytes is str:
    Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00')))
else:
    Image.open(BytesIO(bytes('icns\x00\x00\x00\x10hang\x00\x00\x00\x00', 'latin-1')))
CVE-2016-0775 (C, published 2016-04-13T16:59Z)
Description: value: Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Tests/check_fli_overflow.py
libImaging/FliDecode.c
Commit message: FLI overflow error fix and testcase CVE-2016-0775


Vulnerable code:
		memcpy(buf+x, data, state->xsize);

Fixed code:
from helper import unittest, PillowTestCase
from PIL import Image

TEST_FILE = "Tests/images/fli_overflow.fli"


class TestFliOverflow(PillowTestCase):
    def test_fli_overflow(self):

        # this should not crash with a malloc error or access violation
        im = Image.open(TEST_FILE)
        im.load()
        

if __name__ == '__main__':
    unittest.main()
		memcpy(buf, data, state->xsize);
CVE-2016-2533 (C, published 2016-04-13T16:59Z)
Description: value: Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/python-pillow/Pillow
Files changed:
Tests/test_file_pcd.py
libImaging/PcdDecode.c
Commit message: PCD decoder overruns the shuffle buffer, Fixes #568


Vulnerable code:
	    out += 4;
	    out += 4;

Fixed code:
from helper import unittest, PillowTestCase, hopper
from PIL import Image

class TestFilePcd(PillowTestCase):

    def test_load_raw(self):
        im = Image.open('Tests/images/hopper.pcd')
        im.load() # should not segfault.

        # Note that this image was created with a resized hopper
        # image, which was then converted to pcd with imagemagick
        # and the colors are wonky in Pillow.  It's unclear if this
        # is a pillow or a convert issue, as other images not generated
        # from convert look find on pillow and not imagemagick.
        
        #target = hopper().resize((768,512))
        #self.assert_image_similar(im, target, 10)

	    out += 3;
	    out += 3;
CVE-2016-4009 (C, published 2016-04-13T16:59Z)
Description: value: Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/python-pillow/Pillow
Files changed:
libImaging/Resample.c
Commit message: fix integer overflow in Resample.c


Vulnerable code:

Fixed code:
    // check for overflow
    if (kmax > 0 && xsize > SIZE_MAX / kmax)
        return (Imaging) ImagingError_MemoryError();

    // sizeof(float) should be greater than 0
    if (xsize * kmax > SIZE_MAX / sizeof(float))
        return (Imaging) ImagingError_MemoryError();

    // sizeof(int) should be greater than 0 as well
    if (xsize > SIZE_MAX / (2 * sizeof(int)))
        return (Imaging) ImagingError_MemoryError();