hitoshura25/cvefixes huggingface dataset:
CVE-2021-21305 (Ruby, published 2021-02-08T20:15Z)
Description: value: CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/carrierwaveuploader/carrierwave
Files changed:
lib/carrierwave/processing/rmagick.rb
spec/processing/rmagick_spec.rb
Commit message: Fix Code Injection vulnerability in CarrierWave::RMagick

Refs. https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4


Vulnerable code:
      assignments = options.map { |k, v| "img.#{k} = #{v}" }
      code = "lambda { |img| " + assignments.join(";") + "}"
      eval code
          :size => %{"200x200"}

Fixed code:
      proc do |img|
        options.each do |k, v|
          if v.is_a?(String) && (matches = v.match(/^["'](.+)["']/))
            ActiveSupport::Deprecation.warn "Passing quoted strings like #{v} to #manipulate! is deprecated, pass them without quoting."
            v = matches[1]
          end
          img.public_send(:"#{k}=", v)
        end
      end
          :size => "200x200"

    it 'shows deprecation but still accepts strings enclosed with double quotes' do
      expect_any_instance_of(::Magick::Image::Info).to receive(:size=).once.with("200x200")
      expect(ActiveSupport::Deprecation).to receive(:warn).with(any_args)
      instance.manipulate! :read => {:size => %{"200x200"}}
    end

    it 'shows deprecation but still accepts strings enclosed with single quotes' do
      expect_any_instance_of(::Magick::Image::Info).to receive(:size=).once.with("200x200")
      expect(ActiveSupport::Deprecation).to receive(:warn).with(any_args)
      instance.manipulate! :read => {:size => %{'200x200'}}
    end

    it 'does not allow arbitrary code execution' do
      expect_any_instance_of(Kernel).not_to receive(:puts)
      expect do
        instance.manipulate! :read => {
            :density => "1 }; raise; {"
        }
      end.to raise_error ArgumentError, /invalid density geometry/
    end

    it 'does not allow invocation of non-public methods' do
      module Kernel
        private def foo=(value); raise; end
      end
      expect do
        instance.manipulate! :read => {
            :foo => "1"
        }
      end.to raise_error NoMethodError, /private method `foo=' called/
    end
CVE-2023-49090 (Ruby, published 2023-11-29T15:15Z)
Description: value: CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissions by performing a partial match. If the `content_type` argument of `allowlisted_content_type?` is passed a value crafted by the attacker, Content-Types not included in the `content_type_allowlist` will be allowed. This issue has been patched in versions 2.2.5 and 3.0.5.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/carrierwaveuploader/carrierwave
Files changed:
lib/carrierwave/uploader/content_type_allowlist.rb
spec/uploader/content_type_allowlist_spec.rb
Commit message: Fix Content-Type allowlist bypass vulnerability

Refs. https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj


Vulnerable code:
          content_type =~ /#{item}/

Fixed code:
          content_type =~ /\A#{item}/

      context "with a crafted content type" do
        before do
          allow(bork_file).to receive(:content_type).and_return('text/plain; image/png')
          allow(uploader).to receive(:content_type_allowlist).and_return('image/png')
        end

        it "does not allow spoofing" do
          expect { uploader.cache!(bork_file) }.to raise_error(CarrierWave::IntegrityError)
        end
      end

      context "when the allowlist contains charset" do
        before do
          allow(uploader).to receive(:content_type_allowlist).and_return(%r{text/plain;\s*charset=utf-8})
        end

        it "accepts the content with allowed charset" do
          allow(bork_file).to receive(:content_type).and_return('text/plain; charset=utf-8')
          expect { uploader.cache!(bork_file) }.not_to raise_error
        end

        it "rejects the content without charset" do
          allow(bork_file).to receive(:content_type).and_return('text/plain')
          expect { uploader.cache!(bork_file) }.to raise_error(CarrierWave::IntegrityError)
        end
      end
CVE-2024-29034 (Ruby, published 2024-03-24T20:15Z)
Description: value: CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by `content_type_allowlist`, by providing multiple values separated by commas. This bypassed value can be used to cause XSS. Upgrade to 3.0.7 or 2.2.6.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/carrierwaveuploader/carrierwave
Files changed:
lib/carrierwave/sanitized_file.rb
spec/sanitized_file_spec.rb
spec/uploader/content_type_allowlist_spec.rb
Commit message: Fix Content-Type allowlist bypass vulnerability remained

Refs. https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-vfmv-jfc5-pjjw


Vulnerable code:
          @file.content_type.to_s.chomp

      context "when the allowlist contains charset" do
        before do
          allow(uploader).to receive(:content_type_allowlist).and_return(%r{text/plain;\s*charset=utf-8})
        end

        it "accepts the content with allowed charset" do
          allow(bork_file).to receive(:content_type).and_return('text/plain; charset=utf-8')
          expect { uploader.cache!(bork_file) }.not_to raise_error
        end

        it "rejects the content without charset" do
          allow(bork_file).to receive(:content_type).and_return('text/plain')
          expect { uploader.cache!(bork_file) }.to raise_error(CarrierWave::IntegrityError)
        end
      end

Fixed code:
          Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)

    it "uses the first one when multiple mime types are given using a semicolon" do
      file = File.open(file_path("bork.txt"))
      allow(file).to receive(:content_type) { 'image/png; text/html' }

      sanitized_file = CarrierWave::SanitizedFile.new(file)

      expect(sanitized_file.content_type).to eq("image/png")
    end

    it "uses the first one when multiple mime types are given using a comma" do
      file = File.open(file_path("bork.txt"))
      allow(file).to receive(:content_type) { 'image/png, text/html' }

      sanitized_file = CarrierWave::SanitizedFile.new(file)

      expect(sanitized_file.content_type).to eq("image/png")
    end

    it "drops content type parameters" do
      file = File.open(file_path("bork.txt"))
      allow(file).to receive(:content_type) { 'text/html; charset=utf-8' }

      sanitized_file = CarrierWave::SanitizedFile.new(file)

      expect(sanitized_file.content_type).to eq("text/html")
    end
CVE-2024-30564 (TypeScript, published 2024-04-18T15:15Z)
Description: value: An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/andrei-tatar/nora-firebase-common
Files changed:
src/update-state.test.ts
src/update-state.ts
Commit message: simple fix for prototype pollution


Vulnerable code:

Fixed code:

    it('should not update via prototype props', () => {
        var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}')

        const { hasChanges } = updateState(BAD_JSON, {})

        expect(hasChanges).to.be.false;
        expect((Object.prototype as any).polluted).to.be.undefined;
    });
// https://github.com/andrei-tatar/nora-firebase-common/issues/9
const ignoreKeys: any[] = ['__proto__', 'constructor', 'prototype'];

        if (ignoreKeys.includes(key)) { continue; }
CVE-2024-25678 (C, published 2024-02-09T10:15Z)
Description: value: In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/litespeedtech/lsquic
Files changed:
src/liblsquic/lsquic_full_conn_ietf.c
Commit message: Release 4.0.4


Vulnerable code:
    LSQ_DEBUG("peer switched its DCID, attempt to switch own SCID");
            else if (is_dcid_changed)

Fixed code:
    LSQ_DEBUGC("peer switched its DCID to %"CID_FMT
              ", attempt to switch own SCID", CID_BITS(dcid_in));
            else if (is_dcid_changed
                && !LSQUIC_CIDS_EQ(CN_SCID(&conn->ifc_conn),
                                   &packet_in->pi_dcid))
CVE-2023-31128 (YAML, published 2023-05-26T22:15Z)
Description: value: NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, the `pull-checks.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. This issue is fixed in commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch. There is no risk for the user of the app within the NextCloud server. This only affects the main repository and possible forks of it. Those who have forked the NextCloud Cookbook repository should make sure their forks are on the latest version to prevent code injection attacks and similar.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/nextcloud/cookbook
Files changed:
.github/workflows/pull-checks.yml
Commit message: Fix typo in workflow file

Signed-off-by: Christian Wolf <github@christianwolf.email>


Vulnerable code:
                    git remote add head "${{ github.event.pull_request.head.repo.html_url }}"
                    git checkout -b head-branch head/${{ github.head_ref }}

Fixed code:
                env:
                    URL: ${{ github.event.pull_request.head.repo.html_url }}
                    HEAD_REF: ${{ github.head_ref }}
                    git remote add head "$URL"
                    git checkout -b head-branch head/$HEAD_REF
CVE-2017-5209 (C, published 2017-01-11T16:59Z)
Description: value: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libimobiledevice/libplist
Files changed:
src/base64.c
Commit message: base64: Rework base64decode to handle split encoded data correctly


Vulnerable code:
	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
static int base64decode_block(unsigned char *target, const char *data, size_t data_size)
{
	int w1,w2,w3,w4;
	int i;
	size_t n;

	if (!data || (data_size <= 0)) {
		return 0;
	}

	n = 0;
	i = 0;
	while (n < data_size-3) {
		w1 = base64_table[(int)data[n]];
		w2 = base64_table[(int)data[n+1]];
		w3 = base64_table[(int)data[n+2]];
		w4 = base64_table[(int)data[n+3]];

		if (w2 >= 0) {
			target[i++] = (char)((w1*4 + (w2 >> 4)) & 255);
		}
		if (w3 >= 0) {
			target[i++] = (char)((w2*16 + (w3 >> 2)) & 255);
		}
		if (w4 >= 0) {
			target[i++] = (char)((w3*64 + w4) & 255);
		}
		n+=4;
	}
	return i;
}

	size_t l = 0;
		ptr += strspn(ptr, "\r\n\t ");
		l = strcspn(ptr, "\r\n\t ");
		if (l > 3 && ptr+l <= buf+len) {
			p+=base64decode_block(outbuf+p, ptr, l);
			ptr += l;
		} else {
			break;

Fixed code:
	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1,
	int wv, w1, w2, w3, w4;
	int tmpval[4];
	int tmpcnt = 0;
		while (ptr < buf+len && (*ptr == ' ' || *ptr == '\t' || *ptr == '\n' || *ptr == '\r')) {
			ptr++;
		}
		if ((wv = base64_table[(int)(unsigned char)*ptr++]) == -1) {
			continue;
		}
		tmpval[tmpcnt++] = wv;
		if (tmpcnt == 4) {
			tmpcnt = 0;
			w1 = tmpval[0];
			w2 = tmpval[1];
			w3 = tmpval[2];
			w4 = tmpval[3];

			if (w2 >= 0) {
				outbuf[p++] = (unsigned char)(((w1 << 2) + (w2 >> 4)) & 0xFF);
			}
			if (w3 >= 0) {
				outbuf[p++] = (unsigned char)(((w2 << 4) + (w3 >> 2)) & 0xFF);
			}
			if (w4 >= 0) {
				outbuf[p++] = (unsigned char)(((w3 << 6) + w4) & 0xFF);
			}
CVE-2017-5545 (C, published 2017-01-21T01:59Z)
Description: value: The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libimobiledevice/libplist
Files changed:
tools/plistutil.c
Commit message: plistutil: Prevent OOB heap buffer read by checking input size

As pointed out in #87 plistutil would do a memcmp with a heap buffer
without checking the size. If the size is less than 8 it would read
beyond the bounds of this heap buffer. This commit prevents that.


Vulnerable code:

Fixed code:

    if (filestats.st_size < 8) {
        printf("ERROR: Input file is too small to contain valid plist data.\n");
        return -1;
    }
CVE-2017-6435 (C, published 2017-03-15T14:59Z)
Description: value: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
Severity: LOW (CVSS v3 base score: 5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libimobiledevice/libplist
Files changed:
src/bplist.c
Commit message: bplist: Make sure to bail out if malloc() fails in parse_string_node()

Credit to Wang Junjie <zhunkibatu@gmail.com> (#93)


Vulnerable code:

Fixed code:
    if (!data->strval) {
        plist_free_data(data);
        PLIST_BIN_ERR("%s: Could not allocate %" PRIu64 " bytes\n", __func__, sizeof(char) * (size + 1));
        return NULL;
    }
CVE-2017-6436 (C, published 2017-03-15T14:59Z)
Description: value: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
Severity: LOW (CVSS v3 base score: 5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libimobiledevice/libplist
Files changed:
src/bplist.c
Commit message: bplist: Fix data range check for string/data/dict/array nodes

Passing a size of 0xFFFFFFFFFFFFFFFF to parse_string_node() might result
in a memcpy with a size of -1, leading to undefined behavior.
This commit makes sure that the actual node data (which depends on the size)
is in the range start_of_object..start_of_object+size.

Credit to OSS-Fuzz


Vulnerable code:
        if (*object + size > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
        if (*object + size*2 > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
            PLIST_BIN_ERR("%s: BPLIST_REAL data bytes point outside of valid range\n", __func__);

Fixed code:
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size*2 < *object || *object + size*2 > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
            PLIST_BIN_ERR("%s: BPLIST_DICT data bytes point outside of valid range\n", __func__);
CVE-2017-6436 (C, published 2017-03-15T14:59Z)
Description: value: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocation error) via a crafted plist file.
Severity: LOW (CVSS v3 base score: 5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libimobiledevice/libplist
Files changed:
src/bplist.c
Commit message: bplist: Fix data range check for string/data/dict/array nodes

Passing a size of 0xFFFFFFFFFFFFFFFF to parse_string_node() might result
in a memcpy with a size of -1, leading to undefined behavior.
This commit makes sure that the actual node data (which depends on the size)
is in the range start_of_object..start_of_object+size.

Credit to OSS-Fuzz


Vulnerable code:
        if (*object + size > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
        if (*object + size*2 > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
            PLIST_BIN_ERR("%s: BPLIST_REAL data bytes point outside of valid range\n", __func__);

Fixed code:
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size*2 < *object || *object + size*2 > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
            PLIST_BIN_ERR("%s: BPLIST_DICT data bytes point outside of valid range\n", __func__);
CVE-2017-6439 (C, published 2017-03-15T14:59Z)
Description: value: Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
Severity: LOW (CVSS v3 base score: 5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libimobiledevice/libplist
Files changed:
src/bplist.c
Commit message: bplist: Fix data range check for string/data/dict/array nodes

Passing a size of 0xFFFFFFFFFFFFFFFF to parse_string_node() might result
in a memcpy with a size of -1, leading to undefined behavior.
This commit makes sure that the actual node data (which depends on the size)
is in the range start_of_object..start_of_object+size.

Credit to OSS-Fuzz


Vulnerable code:
        if (*object + size > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
        if (*object + size*2 > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
        if (*object + size > bplist->offset_table) {
            PLIST_BIN_ERR("%s: BPLIST_REAL data bytes point outside of valid range\n", __func__);

Fixed code:
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size*2 < *object || *object + size*2 > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
        if (*object + size < *object || *object + size > bplist->offset_table) {
            PLIST_BIN_ERR("%s: BPLIST_DICT data bytes point outside of valid range\n", __func__);
CVE-2021-38606 (Python, published 2021-08-12T16:15Z)
Description: value: reNgine through 0.5 relies on a predictable directory name.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/yogeshojha/rengine
Files changed:
web/reNgine/tasks.py
web/startScan/views.py
Commit message: Predictable directory name fixed, reported by Rob - 303sec, Thanks!


Vulnerable code:
        current_scan_dir = domain.name + '_' + \
            str(datetime.datetime.strftime(timezone.now(), '%Y_%m_%d_%H_%M_%S'))
    # delete_scan_data(results_dir)
                            
        delete_dir = obj.domain.name + '_' + \
            str(datetime.datetime.strftime(obj.start_scan_date, '%Y_%m_%d_%H_%M_%S'))
        delete_path = settings.TOOL_LOCATION + 'scan_results/' + delete_dir
        os.system('rm -rf ' + delete_path)
                ScanHistory.objects.filter(id=value).delete()

Fixed code:
import random
        current_scan_dir = domain.name + '_' + str(random.randint(100000000000, 999999999999))
    delete_scan_data(results_dir)

        delete_dir = obj.results_dir
        os.system('rm -rf /usr/src/scan_results/' + delete_dir)
                obj = get_object_or_404(ScanHistory, id=value)
                delete_dir = obj.results_dir
                os.system('rm -rf /usr/src/scan_results/' + delete_dir)
                obj.delete()