hitoshura25/cvefixes huggingface dataset:
CVE-2023-37299 (HTML, published 2023-06-30T15:15Z)
Description: value: Joplin before 2.11.5 allows XSS via an AREA element of an image map.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laurent22/joplin
Files changed:
packages/app-cli/tests/md_to_html/sanitize_15.html
packages/app-cli/tests/md_to_html/sanitize_16.html
packages/app-cli/tests/md_to_html/sanitize_16.md
packages/renderer/htmlUtils.ts
Commit message: All: Security: Prevent XSS by sanitizing certain HTML attributes


Vulnerable code:
<use href="data:image/svg+xml,&lt;svg id=&apos;x&apos; xmlns=&apos;http://www.w3.org/2000/svg&apos;&gt;&lt;image href=&apos;asdf&apos; onerror=&apos;top.require(`child_process`).execSync(`calc.exe`)&apos; /&gt;&lt;/svg&gt;#x" class="jop-noMdConv">
				if (name === 'a') {
					// Make sure that only non-acceptable URLs are filtered out.
					// In particular we want to exclude `javascript:` URLs.
					if ('href' in attrs && !this.isAcceptedUrl(attrs['href'])) {
						attrs['href'] = '#';
					}
					// We need to clear any such attribute, otherwise it will
					// make any arbitrary link open within the application.
					if ('data-from-md' in attrs) {
						delete attrs['data-from-md'];
					}

Fixed code:
<use href="#" class="jop-noMdConv">
<map name="test" class="jop-noMdConv"><area coords="0,0,1000,1000" href="#" class="jop-noMdConv"/></map><img usemap="#test" src="https://github.com/Ry0taK.png" class="jop-noMdConv"/>
<map name="test"><area coords="0,0,1000,1000" href="javascript:top.require(`child_process`).execSync(`calc.exe`)"></map><img usemap="#test" src="https://github.com/Ry0taK.png">
				// Make sure that only non-acceptable URLs are filtered out. In
				// particular we want to exclude `javascript:` URLs. This
				// applies to A tags, and also AREA ones but to be safe we don't
				// filter on the tag name and process all HREF attributes.
				if ('href' in attrs && !this.isAcceptedUrl(attrs['href'])) {
					attrs['href'] = '#';
				}
				// We need to clear any such attribute, otherwise it will
				// make any arbitrary link open within the application.
				if ('data-from-md' in attrs) {
					delete attrs['data-from-md'];
CVE-2023-39517 (TypeScript, published 2024-06-21T20:15Z)
Description: value: Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer (`packages/renderer/htmlUtils.ts::sanitizeHtml`) preserves `<map>` `<area>` links. However, unlike `<a>` links, the `target` and `href` attributes are not removed. Additionally, because the note preview pane isn't sandboxed to prevent top navigation, links with `target` set to `_top` can replace the toplevel electron page. Because any toplevel electron page, with Joplin's setup, has access to `require` and can require node libraries, a malicious replacement toplevel page can import `child_process` and execute arbitrary shell commands. This issue has been fixed in commit 7c52c3e9a81a52ef1b42a951f9deb9d378d59b0f which is included in release version 2.12.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/laurent22/joplin
Files changed:
packages/app-cli/tests/md_to_html/sanitize_16.html
packages/renderer/htmlUtils.ts
Commit message: Desktop: Security: Disallow map and area tags (#8479)



Vulnerable code:
<map name="test" class="jop-noMdConv"><area coords="0,0,1000,1000" href="#" class="jop-noMdConv"/></map><img usemap="#test" src="https://github.com/Ry0taK.png" class="jop-noMdConv"/>
				if (disallowedTags.includes(current)) {
					disallowedTagDepth--;

Fixed code:
<img usemap="#test" src="https://github.com/Ry0taK.png" class="jop-noMdConv"/>

			// Disallow map and area tags: <area ...> links are currently not
			// sanitized as well as <a ...> links, allowing potential sandbox
			// escape.
			'map', 'area',
				// The Markdown sanitization code can result in calls like this:
				//     sanitizeHtml('<invlaid>')
				//     sanitizeHtml('</invalid>')
				// Thus, we need to be able to remove '</invalid>', even if there is no
				// corresponding opening tag.
				if (disallowedTags.includes(current) || disallowedTags.includes(name)) {
					if (disallowedTagDepth > 0) {
						disallowedTagDepth--;
					}
CVE-2021-4304 (Other, published 2023-01-05T10:15Z)
Description: value: A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command injection. The attack can be launched remotely. The patch is named 811edaae81eb044891594f00062a828f51b22cb1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217447.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/eprintsug/ulcc-core
Files changed:
cgi/toolbox/toolbox
Commit message: Fixes RCE exploit by validating verb parameter for toolbox before eval (backported from 3.4)


Vulnerable code:

Fixed code:
if ( $cmd !~ m/^[a-zA-Z0-9_]+$/ )
{
	toolbox_fail( $session, "Invalid toolbox function" );
}
CVE-2024-29864 (Other, published 2024-03-21T04:15Z)
Description: value: Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/89luca89/distrobox
Files changed:
distrobox-enter
Commit message: enter: do not use a shell when executing a custom command, Fix #1275

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>


Vulnerable code:
# and we execute container_command using sh -c
container_command_prefix="/bin/sh -c"
			container_command="$1"
		container_command_prefix="${container_command_login} -c"
		result_command="${result_command}
			${container_command_prefix} \"${container_command}\""

Fixed code:
			container_command="\"$1\""
		result_command="${result_command} ${container_command}"
CVE-2021-29418 (Other, published 2021-03-30T07:15Z)
Description: value: The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/rs/node-netmask
Files changed:
lib/netmask.coffee
test/badnets.coffee
Commit message: Rewrite byte parsing in full JS without depending on parseInt

The parseInt function is full of surprises. Instead of trying to find
all its pitfalls, let's parse bytes manually.


Vulnerable code:
    b = (ip + '').split('.');
    if b.length is 0 or b.length > 4 then throw new Error('Invalid IP')
    for byte, i in b
        if byte and byte[0] == '0'
            if byte.length > 2 and (byte[1] == 'x' or byte[1] == 'x')
                # make sure 0x prefixed bytes are parsed as hex
                byte = parseInt(byte, 16)
            else
                # make sure 0 prefixed bytes are parsed as octal
                byte = parseInt(byte, 8)
        else if byte and (byte[0] == ' ' or byte[byte.length-1] == ' ')
            throw new Error('Invalid IP')
        else
            byte = parseInt(byte, 10)
        if isNaN(byte) then throw new Error("Invalid byte: #{byte}")
        if byte < 0 or byte > 255 then throw new Error("Invalid byte: #{byte}")
        b[i] = byte

Fixed code:
    b = []
    for i in [0..3]
        if ip.length == 0
            break
        if i > 0
            if ip[0] != '.'
                throw new Error('Invalid IP')
            ip = ip.substring(1)
        [n, c] = atob(ip)
        ip = ip.substring(c)
        b.push(n)
    if ip.length != 0
        throw new Error('Invalid IP')
atob = (s) ->
    n = 0
    base = 10
    dmax = '9'
    i = 0
    if s.length > 1 and s[i] == '0'
        if s[i+1] == 'x' or s[i+1] == 'X'
            i+=2
            base = 16
        else if '0' <= s[i+1] and s[i+1] <= '7'
            i++
            base = 8
            dmax = '7'
    start = i
    chr = (b) -> return b.charCodeAt(0)
    while s.length > 0
        if '0' <= s[i] and s[i] <= dmax
            n = n*base + (chr(s[i])-chr('0'))
        else if base == 16
            if 'a' <= s[i] and s[i] <= 'f'
                n = n*base + (10+chr(s[i])-chr('a'))
            else if 'A' <= s[i] and s[i] <= 'F'
                n = n*base + (10+chr(s[i])-chr('A'))
            else
                break
        else
            break
        if n > 0xFF
            throw new Error('byte overflow')
        i++
    if i == start
        throw new Error('empty octet')
    return [n, i]

        '  1.2.3.4': shouldFailWithError 'Invalid net'
        '018.0.0.0': shouldFailWithError 'Invalid net'
        '0xfg.0.0.0': shouldFailWithError 'Invalid net'
CVE-2020-7637 (TypeScript, published 2020-04-06T13:15Z)
Description: value: class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. The classToPlainFromExist function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/typestack/class-transformer
Files changed:
src/TransformOperationExecutor.ts
test/functional/basic-functionality.spec.ts
Commit message: Fix prototype pollution vulnerabilities


Vulnerable code:

Fixed code:
                if (key === '__proto__' || key === 'constructor') {
                    continue;
                }

    it('should not pollute the prototype with a `__proto__` property',() => {
        const object = JSON.parse('{"__proto__": { "admin": true }}');
        const plainObject = {};
        classToPlainFromExist(object, plainObject);
        expect((plainObject as any).admin).toEqual(undefined);
    });

    it('should not pollute the prototype with a `constructor.prototype` property',  () => {
        const object = JSON.parse('{"constructor": { "prototype": { "admin": true }}}');
        const plainObject = {};
        classToPlainFromExist(object, plainObject);
        expect((plainObject as any).admin).toEqual(undefined);
    });
CVE-2023-28458 (Python, published 2023-04-20T21:15Z)
Description: value: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pretalx/pretalx
Files changed:
src/pretalx/agenda/management/commands/export_schedule_html.py
Commit message: Fix path traversal in static HTML export

This vulnerability was discovered by Sonar,
https://www.sonarsource.com/, who provided a detailled description of
the vulnerability, and also the fix as it is applied here.

The fix will be backported to the last release, v2.3.1, and released as
v2.3.2. A blog post will be published on pretalx.com.


Vulnerable code:
    path = Path(destination) / path.lstrip("/")

Fixed code:
    path = (Path(destination) / path.lstrip("/")).resolve()
    if not Path(destination) in path.parents:
        raise CommandError("Path traversal detected, aborting.")
    # Prevent directory traversal, make sure the path is inside the media or static root
    local_path = local_path.resolve(strict=True)
    if not any(
        path in local_path.parents
        for path in (settings.MEDIA_ROOT, settings.STATIC_ROOT)
    ):
        raise FileNotFoundError()
CVE-2023-28459 (Python, published 2023-04-20T21:15Z)
Description: value: pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pretalx/pretalx
Files changed:
src/pretalx/agenda/management/commands/export_schedule_html.py
Commit message: Fix path traversal in static HTML export

This vulnerability was discovered by Sonar,
https://www.sonarsource.com/, who provided a detailled description of
the vulnerability, and also the fix as it is applied here.

The fix will be backported to the last release, v2.3.1, and released as
v2.3.2. A blog post will be published on pretalx.com.


Vulnerable code:
    path = Path(destination) / path.lstrip("/")

Fixed code:
    path = (Path(destination) / path.lstrip("/")).resolve()
    if not Path(destination) in path.parents:
        raise CommandError("Path traversal detected, aborting.")
    # Prevent directory traversal, make sure the path is inside the media or static root
    local_path = local_path.resolve(strict=True)
    if not any(
        path in local_path.parents
        for path in (settings.MEDIA_ROOT, settings.STATIC_ROOT)
    ):
        raise FileNotFoundError()
CVE-2023-41885 (Python, published 2023-09-12T21:15Z)
Description: value: Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on its own does not also enforce strong passwords, these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off, especially given the underlying login functionality for Piccolo based sites is open source. This issue has been patched in version 0.121.0.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/piccolo-orm/piccolo
Files changed:
piccolo/apps/user/tables.py
Commit message: Merge pull request from GHSA-h7cm-mrvq-wcfr

Co-authored-by: skelmis <ethan@koldfusion.xyz>

Vulnerable code:
            # No match found

Fixed code:
            # No match found. We still call hash_password
            # here to mitigate the ability to enumerate
            # users via response timings
            cls.hash_password(password)
CVE-2023-30861 (Unknown, published 2023-05-02T18:15Z)
Description: value: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets `session.permanent = True`
3. The application does not access or modify the session at any point during a request.
4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-539 \u2014 Use of Persistent Cookies Containing Sensitive Information
The web application uses persistent cookies, but the cookies contain sensitive information.
Repository: https://github.com/pallets/flask
Files changed:
Commit message: Merge pull request from GHSA-m2qf-hxjv-5gpq

set `Vary: Cookie` header consistently for session

Vulnerable code:

Fixed code:
CVE-2023-30861 (Unknown, published 2023-05-02T18:15Z)
Description: value: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets `session.permanent = True`
3. The application does not access or modify the session at any point during a request.
4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-539 \u2014 Use of Persistent Cookies Containing Sensitive Information
The web application uses persistent cookies, but the cookies contain sensitive information.
Repository: https://github.com/pallets/flask
Files changed:
Commit message: Merge pull request #5109 from pallets/backport-vary-cookie

backport 2.2.x: set `Vary: Cookie` header consistently for session

Vulnerable code:

Fixed code:
CVE-2023-38698 (Unknown, published 2023-08-04T18:15Z)
Description: value: Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function. The vulnerability resides `@ensdomains/ens-contracts` prior to version 0.0.22.

If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves. Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future. An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost.

Version 0.0.22 contains a patch for this issue. As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ensdomains/ens-contracts
Files changed:
Commit message: Merge pull request from GHSA-rrxv-q8m4-wch3

Initial version of mitigation contracts

Vulnerable code:

Fixed code:
CVE-2023-1181 (Markdown, published 2023-03-05T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository icret/easyimages2.0 prior to 2.6.7.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/icret/easyimages2.0
Files changed:
docs/update.md
Commit message: Update update.md


Vulnerable code:
* 2023-03-04 v2.7.6 dev

Fixed code:
* 2023-03-04 v2.7.6