hitoshura25/cvefixes huggingface dataset:
CVE-2021-33194 (Go, published 2021-05-26T15:15Z)
Description: value: golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/golang/net
Files changed:
html/parse.go
html/parse_test.go
Commit message: html: ignore templates nested within foreign content

Fixes #46288
Fixes CVE-2021-33194

Change-Id: I2fe39702de8e9aab29965c1526e377a6f9cdf056
Reviewed-on: https://go-review.googlesource.com/c/net/+/311090
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Trust: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>


Vulnerable code:
			// TODO: remove this divergence from the HTML5 spec.

Fixed code:
			// TODO: remove this divergence from the HTML5 spec.
			//
			// We don't handle all of the corner cases when mixing foreign
			// content (i.e. <math> or <svg>) with <template>. Without this
			// early return, we can get into an infinite loop, possibly because
			// of the "TODO... further divergence" a little below.
			//
			// As a workaround, if we are mixing foreign content and templates,
			// just ignore the rest of the HTML. Foreign content is rare and a
			// relatively old HTML feature. Templates are also rare and a
			// relatively new HTML feature. Their combination is very rare.
			for _, e := range p.oe {
				if e.Namespace != "" {
					p.im = ignoreTheRemainingTokens
					return true
				}
			}

			// TODO: remove this further divergence from the HTML5 spec.
func ignoreTheRemainingTokens(p *parser) bool {
	return true
}

				if parseTestBlacklist[ta.text] {
					continue
				}
// Some test inputs are simply skipped - we would otherwise fail the test. We
// blacklist such inputs from the parse test.
var parseTestBlacklist = map[string]bool{
	// See the a.Template TODO in inHeadIM.
	`<math><template><mo><template>`:                                     true,
	`<template><svg><foo><template><foreignObject><div></template><div>`: true,
}

func TestParseFragmentForeignContentTemplates(t *testing.T) {
	srcs := []string{
		"<math><html><template><mn><template></template></template>",
		"<math><math><head><mi><template>",
	}
	for _, src := range srcs {
		// The next line shouldn't infinite-loop.
		ParseFragment(strings.NewReader(src), nil)
	}
}
CVE-2022-0613 (JavaScript, published 2022-02-16T09:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/medialize/uri.js
Files changed:
src/URI.js
src/URI.min.js
test/urls.js
Commit message: fix(parse): case insensitive scheme - #412


Vulnerable code:
    string = string.replace(/^(https?|ftp|wss?)?:[/\\]*/, '$1://');
a.substring(c+1)||null,a=a.substring(0,c));a=a.replace(/^(https?|ftp|wss?)?:[/\\]*/,"$1://");"//"===a.substring(0,2)?(b.protocol=null,a=a.substring(2),a=d.parseAuthority(a,b)):(c=a.indexOf(":"),-1<c&&(b.protocol=a.substring(0,c)||null,b.protocol&&!b.protocol.match(d.protocol_expression)?b.protocol=void 0:"//"===a.substring(c+1,c+3).replace(/\\/g,"/")?(a=a.substring(c+3),a=d.parseAuthority(a,b)):(a=a.substring(c+1),b.urn=!0)));b.path=a;return b};d.parseHost=function(a,b){a||(a="");a=a.replace(/\\/g,

Fixed code:
    string = string.replace(/^(https?|ftp|wss?)?:[/\\]*/i, '$1://');
a.substring(c+1)||null,a=a.substring(0,c));a=a.replace(/^(https?|ftp|wss?)?:[/\\]*/i,"$1://");"//"===a.substring(0,2)?(b.protocol=null,a=a.substring(2),a=d.parseAuthority(a,b)):(c=a.indexOf(":"),-1<c&&(b.protocol=a.substring(0,c)||null,b.protocol&&!b.protocol.match(d.protocol_expression)?b.protocol=void 0:"//"===a.substring(c+1,c+3).replace(/\\/g,"/")?(a=a.substring(c+3),a=d.parseAuthority(a,b)):(a=a.substring(c+1),b.urn=!0)));b.path=a;return b};d.parseHost=function(a,b){a||(a="");a=a.replace(/\\/g,
    }, {
      name: 'excessive slash protocol https case-insensitive',
      url: 'hTTps://////attacker.com',
      _url: 'hTTps://attacker.com/',
      parts: {
        protocol: 'hTTps',
        username: null,
        password: null,
        hostname: 'attacker.com',
        port: null,
        path: '/',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'hTTps',
        username: '',
        password: '',
        port: '',
        path: '/',
        query: '',
        fragment: '',
        resource: '/',
        authority: 'attacker.com',
        origin: 'hTTps://attacker.com',
        userinfo: '',
        subdomain: '',
        domain: 'attacker.com',
        tld: 'com',
        directory: '/',
        filename: '',
        suffix: '',
        hash: '',
        search: '',
        host: 'attacker.com',
        hostname: 'attacker.com'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }
CVE-2022-1243 (JavaScript, published 2022-04-05T15:15Z)
Description: value: CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/medialize/uri.js
Files changed:
CHANGELOG.md
src/URI.js
test/urls.js
Commit message: fix(parse): handle CR,LF,TAB

reported by @haxatron via huntr.dev


Vulnerable code:

Fixed code:
* **SECURITY** fixing [`URI.parse()`](http://medialize.github.io/URI.js/docs.html#static-parse) remove `\r` (CR), `\n`, (LF) `\t` (TAB) - disclosed by [haxatron](https://github.com/haxatron) via https://huntr.dev/
  // https://infra.spec.whatwg.org/#ascii-tab-or-newline
  URI.ascii_tab_whitespace = /[\u0009\u000A\u000D]+/g
    // https://infra.spec.whatwg.org/#ascii-tab-or-newline
    string = string.replace(URI.ascii_tab_whitespace, '')
    }, {
      name: 'ASCII tab or newline',
      url: 'ja\r\nva\tscript:alert(1)',
      _url: 'javascript:alert(1)',
      parts: {
        protocol: 'javascript',
        username: null,
        password: null,
        hostname: null,
        port: null,
        path: 'alert(1)',
        query: null,
        fragment: null
      },
      accessors: {
        protocol: 'javascript',
        username: '',
        password: '',
        port: '',
        path: 'alert(1)',
        query: '',
        fragment: '',
        resource: 'alert(1)',
        authority: '',
        origin: '',
        userinfo: '',
        subdomain: '',
        domain: '',
        tld: '',
        directory: '',
        filename: '',
        suffix: '',
        hash: '',
        search: '',
        host: '',
        hostname: ''
      },
      is: {
        urn: true,
        url: false,
        relative: false,
        name: false,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }
CVE-2022-24723 (JavaScript, published 2022-03-03T21:15Z)
Description: value: URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/medialize/uri.js
Files changed:
src/URI.js
test/urls.js
Commit message: fix(parse): remove leading whitespace

reported by @p0cas via huntr.dev


Vulnerable code:

Fixed code:
  URI.leading_whitespace_expression = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/

    string = string.replace(URI.leading_whitespace_expression, '')

    }, {
      name: 'leading white space',
      url: '\t\bhttp://www.example.org/?hello=world',
      _url: 'http://www.example.org/?hello=world',
      parts: {
        protocol: 'http',
        username: null,
        password: null,
        hostname: 'www.example.org',
        port: null,
        path: '/',
        query: 'hello=world',
        fragment: null
      },
      accessors: {
        protocol: 'http',
        username: '',
        password: '',
        port: '',
        path: '/',
        query: 'hello=world',
        fragment: '',
        resource: '/?hello=world',
        authority: 'www.example.org',
        origin: 'http://www.example.org',
        userinfo: '',
        subdomain: 'www',
        domain: 'example.org',
        tld: 'org',
        directory: '/',
        filename: '',
        suffix: '',
        hash: '',
        search: '?hello=world',
        host: 'www.example.org',
        hostname: 'www.example.org'
      },
      is: {
        urn: false,
        url: true,
        relative: false,
        name: true,
        sld: false,
        ip: false,
        ip4: false,
        ip6: false,
        idn: false,
        punycode: false
      }
CVE-2024-34083 (Python, published 2024-05-18T19:15Z)
Description: value: aiosmptd is  a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aio-libs/aiosmtpd
Files changed:
aiosmtpd/docs/NEWS.rst
aiosmtpd/smtp.py
Commit message: starttls: Clear unencrypted commands from buffer (#380)



Vulnerable code:

Fixed code:
1.4.6 (2024-05-06)
==================

* STARTTLS is now fully enforced if used.
            # Discard any leftover unencrypted data
            # See https://tools.ietf.org/html/rfc3207#page-7
            self._reader._buffer.clear()  # type: ignore[attr-defined]
CVE-2008-7050 (PHP, published 2009-08-24T10:30Z)
Description: value: The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/Illydth/wowraidmanager
Files changed:
auth/auth_phpbb3.php
Commit message: Bug Fix: Fixes problem with phpBB3 bridge allowing login with ANY password.


Vulnerable code:
	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass);
		return 0;
		return 1;

?>

Fixed code:
	$testVal = $pwd_hasher->CheckPassword($oldpassword, $db_pass, $initString);

		return TRUE;
		return FALSE;
?>
CVE-2023-1496 (Go, published 2023-03-19T17:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/imgproxy/imgproxy
Files changed:
CHANGELOG.md
svg/svg.go
Commit message: Sanitize `use` tag in SVG


Vulnerable code:
			if strings.ToLower(string(l.Text())) == "script" {
			if _, unsafe := unsafeAttrs[strings.ToLower(string(l.Text()))]; unsafe {

Fixed code:
- Sanitize `use` tags in SVGs.
	var curTagName string

			curTagName = strings.ToLower(string(l.Text()))

			if curTagName == "script" {

			attrName := strings.ToLower(string(l.Text()))

			if _, unsafe := unsafeAttrs[attrName]; unsafe {

			if curTagName == "use" && (attrName == "href" || attrName == "xlink:href") {
				val := strings.TrimSpace(strings.Trim(string(l.AttrVal()), `"'`))
				if len(val) > 0 && val[0] != '#' {
					continue
				}
			}
CVE-2020-7729 (JavaScript, published 2020-09-03T09:15Z)
Description: value: The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-1188 \u2014 Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
Repository: https://github.com/gruntjs/grunt
Files changed:
lib/grunt/file.js
test/grunt/file_test.js
Commit message: Switch to use `safeLoad` for loading YML files via `file.readYAML`.

For previous behaviour please use the following:

```
readYAML('test/fixtures/utf8.yaml', null, {unsafeLoad: true});
```


Vulnerable code:
file.readYAML = function(filepath, options) {
    result = YAML.load(src);
    test.expect(4);
    test.deepEqual(obj, this.object, 'file should be read as utf8 by default and parsed correctly.');

Fixed code:
file.readYAML = function(filepath, options, yamlOptions) {
  if (!options) { options = {}; }
  if (!yamlOptions) { yamlOptions = {}; }

    // use the recommended way of reading YAML files
    // https://github.com/nodeca/js-yaml#safeload-string---options-
    if (yamlOptions.unsafeLoad) {
      result = YAML.load(src);
    } else {
      result = YAML.safeLoad(src);
    }
    test.expect(5);
    test.deepEqual(obj, this.object, 'file should be safely read as utf8 by default and parsed correctly.');

    obj = grunt.file.readYAML('test/fixtures/utf8.yaml', null, {unsafeLoad: true});
    test.deepEqual(obj, this.object, 'file should be unsafely read as utf8 by default and parsed correctly.');
CVE-2022-0436 (JavaScript, published 2022-04-12T21:15Z)
Description: value: Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gruntjs/grunt
Files changed:
lib/grunt/file.js
package.json
test/grunt/file_test.js
Commit message: Update dependencies, tests...


Vulnerable code:
  if (file.isDir(srcpath)) {
    "grunt-cli": "~1.4.2",
    "grunt-contrib-nodeunit": "~3.0.0",

Fixed code:
// Handles symlinks by coping them as files or directories.
  if (file._isSymbolicLink(srcpath)) {
    file._copySymbolicLink(srcpath, destpath);
  } else if (file.isDir(srcpath)) {
file._isSymbolicLink = function() {
  var filepath = path.join.apply(path, arguments);
  return fs.lstatSync(filepath).isSymbolicLink();
};

file._copySymbolicLink = function(srcpath, destpath) {
  var destdir = path.join(destpath, '..');
  var fileBase = path.basename(srcpath);
  // Use the correct relative path for the symlink
  if (!grunt.file.isPathAbsolute(srcpath)) {
    srcpath = path.relative(destdir, srcpath) || '.';
  }
  file.mkdir(destdir);
  var mode = grunt.file.isDir(srcpath) ? 'dir' : 'file';
  var destpath = path.join(destpath, fileBase);
  return fs.symlinkSync(srcpath, destpath, mode);
};

    "grunt-cli": "~1.4.3",
    "grunt-contrib-nodeunit": "~4.0.0",
    'symbolicLinkCopy': function(test) {
      test.expect(4);
      var srcfile = new Tempdir();
      fs.symlinkSync(path.resolve('test/fixtures/octocat.png'), path.join(srcfile.path, 'octocat.png'), 'file');
      // test symlink copy for files
      var destdir = new Tempdir();
      grunt.file.copy(path.join(srcfile.path, 'octocat.png'), destdir.path);
      test.ok(fs.lstatSync(path.join(srcfile.path, 'octocat.png')).isSymbolicLink());
      test.ok(fs.lstatSync(path.join(destdir.path, 'octocat.png')).isSymbolicLink());

      // test symlink copy for directories
      var srcdir = new Tempdir();
      var destdir = new Tempdir();
      var fixtures = path.resolve('test/fixtures');
      var symlinkSource = path.join(srcdir.path, path.basename(fixtures));
      console.log('symlinkSource', symlinkSource);
      fs.symlinkSync(fixtures, symlinkSource, 'dir');

      grunt.file.copy(symlinkSource, destdir.path);
      test.ok(fs.lstatSync(symlinkSource).isSymbolicLink());
      test.ok(fs.lstatSync(path.join(destdir.path, path.basename(fixtures))).isSymbolicLink());
      test.done();
    },
CVE-2022-1537 (JavaScript, published 2022-05-10T14:15Z)
Description: value: file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-367 \u2014 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Repository: https://github.com/gruntjs/grunt
Files changed:
CHANGELOG
lib/grunt/file.js
test/grunt/file_test.js
Commit message: Patch up race condition in symlink copying.


Vulnerable code:
  if (file.isLink(destpath)) {
    // in case destpath is a symlink, avoid following the symlink, instead overwrite it later
    fs.unlinkSync(destpath);
  }

  if (contents === false) {
    grunt.verbose.writeln('Write aborted.');
  }

Fixed code:
v1.5.3
  date: 2022-04-23
  changes:
    - Patch up race condition in symlink copying.
  if (contents === false || file.isLink(destpath)) {
    grunt.verbose.writeln('Write aborted. Either the process function returned false or the destination is a symlink');
  },
  'symbolicLinkDestError': function(test) {
    test.expect(1);
    var tmpfile = new Tempdir();
    fs.symlinkSync(path.resolve('test/fixtures/octocat.png'), path.join(tmpfile.path, 'octocat.png'), 'file');
    grunt.file.copy(path.resolve('test/fixtures/octocat.png'), path.join(tmpfile.path, 'octocat.png'));
    test.ok(fs.lstatSync(path.join(tmpfile.path, 'octocat.png')).isSymbolicLink());
    test.done();
  },
CVE-2023-33964 (Unknown, published 2023-05-31T18:15Z)
Description: value: mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/multiversx/mx-chain-go
Files changed:
Commit message: Merge pull request from GHSA-7xpv-4pm9-xch2

fixed issue on metachain when treating tx with invalid username

Vulnerable code:

Fixed code:
CVE-2023-34458 (Unknown, published 2023-07-13T19:15Z)
Description: value: mx-chain-go is the official implementation of the MultiversX blockchain protocol, written in golang. When executing a relayed transaction, if the inner transaction failed, it would have increased the inner transaction's sender account nonce. This could have contributed to a limited DoS attack on a targeted account. The fix is a breaking change so a new flag `RelayedNonceFixEnableEpoch` was needed. This was a strict processing issue while validating blocks on a chain. This vulnerability has been patched in version 1.4.17.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/multiversx/mx-chain-go
Files changed:
Commit message: Merge pull request from GHSA-j494-7x2v-vvvp

Fix wrong nonce in relayed failed transaction

Vulnerable code:

Fixed code:
CVE-2022-22114 (JavaScript, published 2022-01-10T16:15Z)
Description: value: In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The “search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victim’s browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker.
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sismics/docs
Files changed:
docs-web/src/main/webapp/src/app/docs/app.js
docs-web/src/main/webapp/src/app/share/app.js
Commit message: escape ngTranslate parameters


Vulnerable code:
    .useSanitizeValueStrategy(null)
      .useSanitizeValueStrategy(null)

Fixed code:
    .useSanitizeValueStrategy('escapeParameters')
      .useSanitizeValueStrategy('escapeParameters')