hitoshura25/cvefixes huggingface dataset:
CVE-2020-35236 (Unknown, published 2020-12-14T05:15Z)
Description: value: The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/amazeeio/lagoon
Files changed:
Commit message: Merge pull request #6 from amazeeio/AIOSEC-85-insecure-gitlab-project-delete

Aiosec 85 insecure gitlab project delete


Vulnerable code:

Fixed code:
CVE-2020-36632 (JavaScript, published 2022-12-25T20:15Z)
Description: value: A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/hughsk/flat
Files changed:
index.js
Commit message: Fix prototype pollution on unflatten

Fixes #105.


Vulnerable code:

Fixed code:
      if (key1 === '__proto__') {
        return
      }
CVE-2014-125110 (PHP, published 2024-04-01T00:15Z)
Description: value: A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/wp-file-upload
Files changed:
lib/wfu_ajaxactions.php
lib/wfu_functions.php
readme.txt
wordpress_file_upload.php
Commit message: new version 2.4.4 - fix XSS issues

git-svn-id: https://plugins.svn.wordpress.org/wp-file-upload/trunk@968920 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
		print_r($_SESSION);
		print_r($_POST);
		print_r($user);
		print_r($_POST);
		print_r($arr);
= 2.4.2 =
Version: 2.4.3

Fixed code:
		print_r(wfu_sanitize($_SESSION));
		print_r(wfu_sanitize($_POST));
		print_r(wfu_sanitize($user));
		print_r(wfu_sanitize($_POST));
		print_r(wfu_sanitize($arr));
function wfu_safe_array($arr) {
	return array_map("htmlspecialchars", $arr);
}

function wfu_sanitize($var) {
	$typ = gettype($var);
	if ( $typ == "boolean" || $typ == "integer" || $typ == "double" || $typ == "resource" || $typ == "NULL" )
		return $var;
	elseif ( $typ == "string" )
		return htmlspecialchars($var);
	elseif ( $typ == "array" || $typ == "object" ) {
		foreach ( $var as &$item ) $item = wfu_sanitize($item);
		return $var;
	}
	else
		return $typ;
}

= 2.4.4 =
* intermediate update to make the plugin more immune to hackers

= 2.4.4 =
Important upgrade to address some vulnerability issues.

= 2.4.3 =
Version: 2.4.4
CVE-2023-46254 (Go, published 2023-11-06T19:15Z)
Description: value: capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name. For example consider two tenants `solar` and `wind`. Tenant `solar`, owned by a ServiceAccount named `tenant-owner` in the Namespace `solar`. Tenant `wind`, owned by a ServiceAccount named `tenant-owner` in the Namespace `wind`. The Tenant owner `solar` would be able to list the namespaces of the Tenant `wind` and vice-versa, although this is not correct. The bug introduces an exfiltration vulnerability since allows the listing of Namespace resources of other Tenants, although just in some specific conditions: 1. `capsule-proxy` runs with the `--disable-caching=false` (default value: `false`) and 2. Tenant owners are ServiceAccount, with the same resource name, but in different Namespaces. This vulnerability doesn't allow any privilege escalation on the outer tenant Namespace-scoped resources, since the Kubernetes RBAC is enforcing this. This issue has been addressed in version 0.4.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/projectcapsule/capsule-proxy
Files changed:
internal/controllers/role_bindings.go
Commit message: fix(rolebinding-reflector): namespaced name for serviceaccount users


Vulnerable code:
		_, username, err = serviceaccount.SplitUsername(username)
		if err != nil {
			return nil, errors.Wrap(err, "Unable to parse serviceAccount name")
		result = append(result, fmt.Sprintf("%s-%s", subject.Kind, subject.Name))

Fixed code:
		namespace, name, splitErr := serviceaccount.SplitUsername(username)
		if splitErr != nil {
			return nil, errors.Wrap(splitErr, "Unable to parse serviceAccount name")

		username = fmt.Sprintf("%s-%s", namespace, name)
		parts := []string{subject.Kind}

		if len(subject.Namespace) > 0 {
			parts = append(parts, subject.Namespace)
		}

		parts = append(parts, subject.Name)

		result = append(result, strings.Join(parts, "-"))
CVE-2023-48312 (Go, published 2023-11-24T18:15Z)
Description: value: capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running with the `anonymous-auth` Kubernetes API Server setting disable (set to `false`) are affected since it would be possible to bypass the token review mechanism, interacting with the upper Kubernetes API Server. This privilege escalation cannot be exploited if you're relying only on client certificates (SSL/TLS). This vulnerability has been addressed in version 0.4.6. Users are advised to upgrade.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/projectcapsule/capsule-proxy
Files changed:
internal/request/http.go
Commit message: fix: fix authentication bypass for capsule-proxy

- fix authentication bypass for capsule-proxy with leading token

Signed-off-by: slimm609 <dbrian@vmware.com>


Vulnerable code:

Fixed code:
	if !tr.Status.Authenticated {
		return "", nil, fmt.Errorf("cannot verify the token due to error")
	}
CVE-2013-10021 (PHP, published 2023-03-11T21:15Z)
Description: value: A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dd32/debug-bar
Files changed:
panels/class-debug-bar-queries.php
Commit message: debug-bar: Security: prevent reflective xss in older browsers by escaping output generated by URL-less add_query_arg call props batmoo.
Imported from https://plugins.trac.wordpress.org/changeset/713401/debug-bar

Vulnerable code:
				$out .= "<p>" . sprintf( __('There are too many queries to show easily! <a href="%s">Show them anyway</a>', 'debug-bar'), add_query_arg( 'debug_queries', 'true' ) ) . "</p>";

Fixed code:
				$out .= "<p>" . sprintf( __('There are too many queries to show easily! <a href="%s">Show them anyway</a>', 'debug-bar'), esc_url( add_query_arg( 'debug_queries', 'true' ) ) ) . "</p>";
CVE-2021-4309 (PHP, published 2023-01-08T17:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $_SERVER['SCRIPT_NAME'] leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is a16eb7da46ed22bc61067c212635394f2571d3c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217649 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/01-Scripts/01ACP
Files changed:
01acp/_dev.php
01acp/_loader.php
01acp/acp.php
01acp/comments.php
01acp/filemanager.php
01acp/index.php
01acp/module.php
01acp/rights.php
01acp/settings.php
01acp/system/uploader.php
01acp/update.php
01acp/users.php
Commit message: Hotfix: XSS-Vulnerability $_SERVER['PHP_SELF']
https://seancoates.com/blogs/xss-woes


Vulnerable code:
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF']."?modul=".$modul."&amp;loadpage=".$_REQUEST['loadpage'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF']."?modul=".$modul."";
		create_ModulForm($_SERVER['PHP_SELF']."?","input",TRUE)."</div>";
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
if(!isset($filename)) $filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];

Fixed code:
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME']."?modul=".$modul."&amp;loadpage=".$_REQUEST['loadpage'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME']."?modul=".$modul."";
		create_ModulForm($_SERVER['SCRIPT_NAME']."?","input",TRUE)."</div>";
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
if(!isset($filename)) $filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
CVE-2019-11340 (Python, published 2019-04-19T14:29Z)
Description: value: util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/matrix-org/sydent
Files changed:
sydent/util/emailutils.py
Commit message: Require that parsed mail addresses match raw input

Python's email parser turns malformed addresses into valid ones
by removing anything after and including the second '@'. This
meant that sydent sent emails to the validated address but stored
the raw address as validated.

This rejects any requests where the parsed email address does not
match the raw input.


Vulnerable code:
        mailString = open(mailTemplateFile).read() % allSubstitutions
        rawFrom = email.utils.parseaddr(mailFrom)[1]
        rawTo = email.utils.parseaddr(mailTo)[1]
        if rawFrom == '' or rawTo == '':
            smtp.sendmail(rawFrom, rawTo, mailString.encode('utf-8'))

Fixed code:
        mailString = open(mailTemplateFile).read().decode('utf8') % allSubstitutions
        parsedFrom = email.utils.parseaddr(mailFrom)[1]
        parsedTo = email.utils.parseaddr(mailTo)[1]
        if parsedFrom == '' or parsedTo == '':


            # We're using the parsing above to do basic validation, but instead of
            # failing it may munge the address it returns. So we should *not* use
            # that parsed address, as it may not match any validation done
            # elsewhere.
            smtp.sendmail(mailFrom, mailTo, mailString.encode('utf-8'))
CVE-2021-29430 (Python, published 2021-04-15T21:15Z)
Description: value: Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/matrix-org/sydent
Files changed:
sydent/http/httpcommon.py
sydent/http/httpserver.py
Commit message: Limit maximum request size.

Request size shouldn't be unbounded because there is no need for it and
it can lead to DoS in some cases.


Vulnerable code:
            except:

    def connectionLost(self, reason = connectionDone) -> None:

Fixed code:
from twisted.web import server

# Arbitrarily limited to 512 KiB.
MAX_REQUEST_SIZE = 512 * 1024


            except Exception:
    def connectionLost(self, reason=connectionDone) -> None:


class SizeLimitingRequest(server.Request):
    def handleContentChunk(self, data):
        if self.content.tell() + len(data) > MAX_REQUEST_SIZE:
            logger.info(
                "Aborting connection from %s because the request exceeds maximum size",
                self.client.host)
            self.transport.abortConnection()
            return

        return super().handleContentChunk(data)
from sydent.http.httpcommon import SizeLimitingRequest
        self.factory.requestFactory = SizeLimitingRequest
CVE-2021-29430 (Python, published 2021-04-15T21:15Z)
Description: value: Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/matrix-org/sydent
Files changed:
sydent/hs_federation/verifier.py
sydent/http/httpclient.py
sydent/http/servlets/registerservlet.py
Commit message: Add max size for other HTTP calls.


Vulnerable code:
        result = yield client.get_json("matrix://%s/_matrix/key/v2/server/" % server_name)
    def get_json(self, uri):
        body = yield readBody(response)
        yield readBody(response)

Fixed code:
        result = yield client.get_json("matrix://%s/_matrix/key/v2/server/" % server_name, 1024 * 50)
from sydent.http.httpcommon import BodyExceededMaxSize, read_body_with_max_size
    def get_json(self, uri, max_size = None):
        :param max_size: The maximum size (in bytes) to allow as a response.
        :type max_size: int

        body = yield read_body_with_max_size(response, max_size)
        try:
            # TODO Will this cause the server to think the request was a failure?
            yield read_body_with_max_size(response, 0)
        except BodyExceededMaxSize:
            pass
            1024 * 5,
CVE-2021-29431 (Python, published 2021-04-15T21:15Z)
Description: value: Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/matrix-org/sydent
Files changed:
sydent/hs_federation/verifier.py
sydent/http/servlets/threepidunbindservlet.py
sydent/threepid/bind.py
Commit message: Validate hostname in more places


Vulnerable code:
from sydent.hs_federation.verifier import NoAuthenticationError
            # 
                
                except:
            mxid_parts[1],

Fixed code:
from sydent.util.stringutils import is_valid_hostname
class InvalidServerName(Exception):
    """
    Raised when the provided origin parameter is not a valid hostname (plus optional port).
    """
    pass


        if not is_valid_hostname(json_request["origin"]):
            raise InvalidServerName("X-Matrix header's origin parameter must be a valid hostname")

from sydent.hs_federation.verifier import NoAuthenticationError, InvalidServerName
            #

                except InvalidServerName as ex:
                    request.setResponseCode(400)
                    request.write(dict_to_json_bytes({'errcode': 'M_INVALID_PARAM', 'error': str(ex)}))
                    request.finish()
                    return
                except Exception:
from sydent.util.stringutils import is_valid_hostname


        matrix_server = mxid_parts[1]

        if not is_valid_hostname(matrix_server):
            logger.error(
                "MXID server part '%s' not a valid hostname. Not retrying.",
                matrix_server,
            )
            return

            matrix_server,
CVE-2021-29431 (Python, published 2021-04-15T21:15Z)
Description: value: Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/matrix-org/sydent
Files changed:
sydent/hs_federation/verifier.py
sydent/http/servlets/threepidunbindservlet.py
sydent/threepid/bind.py
Commit message: Validate hostname in more places


Vulnerable code:
from sydent.hs_federation.verifier import NoAuthenticationError
            # 
                
                except:
            mxid_parts[1],

Fixed code:
from sydent.util.stringutils import is_valid_hostname
class InvalidServerName(Exception):
    """
    Raised when the provided origin parameter is not a valid hostname (plus optional port).
    """
    pass


        if not is_valid_hostname(json_request["origin"]):
            raise InvalidServerName("X-Matrix header's origin parameter must be a valid hostname")

from sydent.hs_federation.verifier import NoAuthenticationError, InvalidServerName
            #

                except InvalidServerName as ex:
                    request.setResponseCode(400)
                    request.write(dict_to_json_bytes({'errcode': 'M_INVALID_PARAM', 'error': str(ex)}))
                    request.finish()
                    return
                except Exception:
from sydent.util.stringutils import is_valid_hostname


        matrix_server = mxid_parts[1]

        if not is_valid_hostname(matrix_server):
            logger.error(
                "MXID server part '%s' not a valid hostname. Not retrying.",
                matrix_server,
            )
            return

            matrix_server,