hitoshura25/cvefixes huggingface dataset:
CVE-2024-6345 (Unknown, published 2024-07-15T01:15Z)
Description: value: A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/pypa/setuptools
Files changed:
Commit message: Merge pull request #4332 from pypa/debt/package-index-vcs

Modernize package_index VCS handling

Vulnerable code:

Fixed code:
CVE-2024-39943 (TypeScript, published 2024-07-04T23:15Z)
Description: value: rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/rejetto/hfs
Files changed:
src/util-os.ts
Commit message: fix: remote-execution with upload permissions on mac+linux. Thanks to @charmindoge for reporting (CVE requested)


Vulnerable code:
import { exec, execSync } from 'child_process'
    const out = try_(() => execSync(`df -k "${path}"`).toString(),

Fixed code:
import { exec, execSync, spawnSync } from 'child_process'
    const out = try_(() => spawnSync('df', ['-k', path]).stdout.toString(),
CVE-2020-28975 (Python, published 2020-11-21T21:15Z)
Description: value: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/scikit-learn/scikit-learn
Files changed:
doc/whats_new/v1.0.rst
sklearn/svm/_base.py
sklearn/svm/tests/test_svm.py
Commit message: FIX Prevents segfault in SVC when internals are altered (#21336)

Co-authored-by: Guillaume Lemaitre <g.lemaitre58@gmail.com>
Co-authored-by: Jérémie du Boisberranger <34657725+jeremiedbb@users.noreply.github.com>
Co-authored-by: Olivier Grisel <olivier.grisel@gmail.com>

Vulnerable code:

Fixed code:
:mod:`sklearn.svm`
..................

- |Fix| :class:`svm.SVC` and :class:`svm.SVR` check for an inconsistency
  in its internal representation and raise an error instead of segfaulting.
  This fix also resolves
  `CVE-2020-28975 <https://nvd.nist.gov/vuln/detail/CVE-2020-28975>`__.
  :pr:`21336` by `Thomas Fan`_.

        # Fixes https://nvd.nist.gov/vuln/detail/CVE-2020-28975
        # Check that _n_support is consistent with support_vectors
        sv = self.support_vectors_
        if not self._sparse and sv.size > 0 and self.n_support_.sum() != sv.shape[0]:
            raise ValueError(
                f"The internal representation of {self.__class__.__name__} was altered"
            )


def test_svc_raises_error_internal_representation():
    """Check that SVC raises error when internal representation is altered.

    Non-regression test for #18891 and https://nvd.nist.gov/vuln/detail/CVE-2020-28975
    """
    clf = svm.SVC(kernel="linear").fit(X, Y)
    clf._n_support[0] = 1000000

    msg = "The internal representation of SVC was altered"
    with pytest.raises(ValueError, match=msg):
        clf.predict(X)
CVE-2019-11932 (C, published 2019-10-03T22:15Z)
Description: value: A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/koral--/android-gif-drawable
Files changed:
android-gif-drawable/src/main/c/decoding.c
Commit message: Do not realloc array if new raster size is 0.

if realloc() is called with 0 size it may return NULL and this will be incorrectly handled
as not enough memory and (also) rasterBits will be freed by realloc but we will not update
it.


Vulnerable code:
					int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
					int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;

Fixed code:
					if (newRasterSize == 0) {
						free(info->rasterBits);
						info->rasterBits = NULL;
						info->rasterSize = newRasterSize;
						return;
					}
					const int_fast32_t widthOverflow = gifFilePtr->Image.Width - info->originalWidth;
					const int_fast32_t heightOverflow = gifFilePtr->Image.Height - info->originalHeight;
CVE-2020-26134 (PHP, published 2020-10-02T09:15Z)
Description: value: Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LiveHelperChat/livehelperchat
Files changed:
lhc_web/lib/core/lhbbcode/lhbbcode.php
lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php
Commit message: Cleanup BB Code


Vulnerable code:
    					 '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
    					 '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
    					 '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
            '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
            '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
            '/\[color\=(.*?)\](.*?)\[\/color\]/ms'

Fixed code:
    					 '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
    					 '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
    					 '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
            '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
            '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
            '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
CVE-2020-26135 (PHP, published 2020-10-02T09:15Z)
Description: value: Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LiveHelperChat/livehelperchat
Files changed:
lhc_web/lib/core/lhbbcode/lhbbcode.php
lhc_web/lib/core/lhbbcode/lhbbcode_cleanup.php
Commit message: Cleanup BB Code


Vulnerable code:
    					 '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
    					 '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
    					 '/\[color\=(.*?)\](.*?)\[\/color\]/ms'
            '/\[list\=(.*?)\](.*?)\[\/list\]/ms',
            '/\[fs(.*?)\](.*?)\[\/fs(.*?)\]/ms',
            '/\[color\=(.*?)\](.*?)\[\/color\]/ms'

Fixed code:
    					 '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
    					 '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
    					 '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
            '/\[list\=([0-9]+)\](.*?)\[\/list\]/ms',
            '/\[fs([0-9]+)\](.*?)\[\/fs\]/ms',
            '/\[color\=([A-Za-z0-9]{2,6})\](.*?)\[\/color\]/ms'
CVE-2024-27516 (PHP, published 2024-02-29T01:44Z)
Description: value: Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/LiveHelperChat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhchat/onlineusers/section_online_users.tpl.php
lhc_web/modules/lhfaq/faqwidget.php
Commit message: fix #2054

In next two weeks svelte version will be released. So all these never ending angular issues will be over for the most of the part.


Vulnerable code:
		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(strip_tags($_GET['search']),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
$tpl->set('keyword',$keywordSearch);

Fixed code:
		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(str_replace(array('}}','{{'),'',strip_tags($_GET['search'])),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
$tpl->set('keyword', str_replace(array('}}','{{'),'',$keywordSearch));
CVE-2023-32305 (SQL, published 2023-05-12T19:15Z)
Description: value: aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/aiven/aiven-extras
Files changed:
sql/aiven_extras.sql
Commit message: Qualify function calls with pg_catalog schema

The security definer functions `aiven_extras.pg_create_publication` and
`aiven_extras.set_pgaudit_parameter` are missing explicit `pg_catalog`
schema qualifications for array and string function calls such as
`array_length`, `format`, and `left`.

Co-authored-by: Etienne Stalmans <etienne.stalmans@aiven.io>
Co-authored-by: Kevin Michel <kevin.michel@aiven.io>
Co-authored-by: Thomas Krennwallner <teakay@aiven.io>


Vulnerable code:
    l_table_count = array_length(arg_tables, 1);
            ASSERT array_length(l_parsed_ident, 1) <= 2, 'Only simple table names or tables qualified with schema names allowed';
            IF array_length(l_parsed_ident, 1) = 2
        l_tables_command = left(l_tables_command, -2) || ' WITH (publish = %I)';
        EXECUTE format(l_tables_command, VARIADIC array[arg_publication_name] || l_parsed_arg_tables || arg_publish);
        EXECUTE format('CREATE PUBLICATION %I WITH (publish = %I)', arg_publication_name, arg_publish);
    EXECUTE format('ALTER PUBLICATION %I OWNER TO %I', arg_publication_name, session_user);
    EXECUTE format('ALTER DATABASE %I SET pgaudit.%I = %L',

Fixed code:
    l_table_count = pg_catalog.array_length(arg_tables, 1);
            ASSERT pg_catalog.array_length(l_parsed_ident, 1) <= 2, 'Only simple table names or tables qualified with schema names allowed';
            IF pg_catalog.array_length(l_parsed_ident, 1) = 2
        l_tables_command = pg_catalog.left(l_tables_command, -2) || ' WITH (publish = %I)';
        EXECUTE pg_catalog.format(l_tables_command, VARIADIC array[arg_publication_name] || l_parsed_arg_tables || arg_publish);
        EXECUTE pg_catalog.format('CREATE PUBLICATION %I WITH (publish = %I)', arg_publication_name, arg_publish);
    EXECUTE pg_catalog.format('ALTER PUBLICATION %I OWNER TO %I', arg_publication_name, session_user);
    EXECUTE pg_catalog.format('ALTER DATABASE %I SET pgaudit.%I = %L',
CVE-2024-23644 (Rust, published 2024-01-24T20:15Z)
Description: value: Trillium is a composable toolkit for building internet applications with async rust. In `trillium-http` prior to 0.3.12 and `trillium-client` prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have sufficient control over headers. This only affects use cases where attackers have control of request headers, and can insert "\r\n" sequences. Specifically, if untrusted and unvalidated input is inserted into header names or values.

Outbound `trillium_http::HeaderValue` and `trillium_http::HeaderName` can be constructed infallibly and were not checked for illegal bytes when sending requests from the client or responses from the server. Thus, if an attacker has sufficient control over header values (or names) in a request or response that they could inject `\r\n` sequences, they could get the client and server out of sync, and then pivot to gain control over other parts of requests or responses. (i.e. exfiltrating data from other requests, SSRF, etc.)

In `trillium-http` versions 0.3.12 and later, if a header name is invalid in server response headers, the specific header and any associated values are omitted from network transmission. Additionally, if a header value is invalid in server response headers, the individual header value is omitted from network transmission. Other headers values with the same header name will still be sent. In `trillium-client` versions 0.5.4 and later, if any header name or header value is invalid in the client request headers, awaiting the client Conn returns an `Error::MalformedHeader` prior to any network access. As a workaround, Trillium services and client applications should sanitize or validate untrusted input that is included in header values and header names. Carriage return, newline, and null characters are not allowed.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Repository: https://github.com/trillium-rs/trillium
Files changed:
http/src/headers/unknown_header_name.rs
Commit message: fix(security): allow all tchar in header names


Vulnerable code:
        self.0
            .chars()
            .all(|c| matches!(c, 'a'..='z'|'A'..='Z'|'0'..='9'|'-'|'_'))

Fixed code:
fn is_tchar(c: char) -> bool {
    matches!(
        c,
        'a'..='z'
        | 'A'..='Z'
        | '0'..='9'
        | '!'
        | '#'
        | '$'
        | '%'
        | '&'
        | '\''
        | '*'
        | '+'
        | '-'
        | '.'
        | '^'
        | '_'
        | '`'
        | '|'
        | '~'
    )
}

        // token per https://www.rfc-editor.org/rfc/rfc9110#section-5.1
        // tchar per https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2
        !self.is_empty() && self.0.chars().all(is_tchar)
CVE-2012-3408 (Ruby, published 2012-08-06T16:55Z)
Description: value: lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/puppetlabs/puppet
Files changed:
lib/puppet/network/authstore.rb
spec/integration/network/rest_authconfig_spec.rb
Commit message: Deprecate IP-based authentication

This will need to be made explicit in a future version, so it's good to
get people to stop using it if possible.


Vulnerable code:
        ip? ? pattern.include?(IPAddr.new(ip)) : matchname?(name)
        # LAK:NOTE http://snurl.com/21zf8  [groups_google_com]
    { :ip => '10.1.1.1', :node => 'host.domain.com', :key => 'key', :authenticated => true }.each do |k,v|
      args[k] ||= v
    end

Fixed code:
        if ip?
          if pattern.include?(IPAddr.new(ip))
            Puppet.deprecation_warning "Authentication based on IP address is deprecated; please use certname-based rules instead"
            true
          else
            false
          end
        else
          matchname?(name)
        end
    args = {
      :key => 'key',
      :node => 'host.domain.com',
      :ip => '10.1.1.1',
      :authenticated => true
    }.merge(args)
  it "should warn when matching against IP addresses" do
    add_rule("allow 10.1.1.1")

    @auth.should allow(request)

    @logs.should be_any {|log| log.level == :warning and log.message =~ /Authentication based on IP address is deprecated/}
  end

  it "should not warn when matches against IP addresses fail" do
    add_rule("allow 10.1.1.2")

    @auth.should_not allow(request)

    @logs.should_not be_any {|log| log.level == :warning and log.message =~ /Authentication based on IP address is deprecated/}
  end
CVE-2012-3865 (Ruby, published 2012-08-06T16:55Z)
Description: value: Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/puppetlabs/puppet
Files changed:
lib/puppet/reports/store.rb
spec/unit/reports/store_spec.rb
Commit message: Reject directory traversal in store report processor


Vulnerable code:
    client = self.host.gsub("..",".")
    dir = File.join(Puppet[:reportdir], client)
      Puppet.warning "Could not write report for #{client} at #{file}: #{detail}"
  # removes all reports for a given host
    client = host.gsub("..",".")
    dir = File.join(Puppet[:reportdir], client)

Fixed code:
SEPARATOR = [Regexp.escape(File::SEPARATOR.to_s), Regexp.escape(File::ALT_SEPARATOR.to_s)].join

    if host =~ Regexp.union(/[#{SEPARATOR}]/, /\A\.\.?\Z/)
      raise ArgumentError, "Invalid node name #{host.inspect}"
    end
    dir = File.join(Puppet[:reportdir], host)
      Puppet.warning "Could not write report for #{host} at #{file}: #{detail}"
  # removes all reports for a given host?
    if host =~ Regexp.union(/[#{SEPARATOR}]/, /\A\.\.?\Z/)
      raise ArgumentError, "Invalid node name #{host.inspect}"
    end

    dir = File.join(Puppet[:reportdir], host)

    ['..', 'hello/', '/hello', 'he/llo', 'hello/..', '.'].each do |node|
      it "rejects #{node.inspect}" do
        @report.host = node
        expect { @report.process }.to raise_error(ArgumentError, /Invalid node/)
      end
    end

    ['.hello', 'hello.', '..hi', 'hi..'].each do |node|
      it "accepts #{node.inspect}" do
        @report.host = node
        @report.process
      end
    end
  end

  describe "::destroy" do
    ['..', 'hello/', '/hello', 'he/llo', 'hello/..', '.'].each do |node|
      it "rejects #{node.inspect}" do
        expect { processor.destroy(node) }.to raise_error(ArgumentError, /Invalid node/)
      end
    end

    ['.hello', 'hello.', '..hi', 'hi..'].each do |node|
      it "accepts #{node.inspect}" do
        processor.destroy(node)
      end
    end
CVE-2012-3866 (Ruby, published 2012-08-06T16:55Z)
Description: value: lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/puppetlabs/puppet
Files changed:
lib/puppet/defaults.rb
Commit message: Tighten permissions on classfile, resourcefile, lastrunfile, and lastrunreport.


Vulnerable code:
      :mode => 0644,
      :mode => 0644,
      :mode => 0644,
      :mode => 0644,

Fixed code:
      :mode => 0640,
      :mode => 0640,
      :mode => 0640,
      :mode => 0640,
CVE-2024-22404 (Unknown, published 2024-01-18T21:15Z)
Description: value: Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Repository: https://github.com/nextcloud/files_zip
Files changed:
Commit message: Merge pull request #192 from nextcloud/bugfix/share-attributes



Vulnerable code:

Fixed code: