hitoshura25/cvefixes huggingface dataset:
CVE-2019-11404 (Other, published 2019-04-22T11:29Z)
Description: value: arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/arrow-kt/arrow
Files changed:
build.gradle
Commit message: Fix some http vulnerabilities

Vulnerable code:
        maven { url "http://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "http://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "http://dl.bintray.com/arrow-kt/arrow-kt" }
}

Fixed code:
        maven { url "https://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "https://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "https://dl.bintray.com/arrow-kt/arrow-kt" }
}
CVE-2015-10071 (PHP, published 2023-01-19T10:15Z)
Description: value: A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/gitter-badger/ezpublish-modern-legacy
Files changed:
kernel/user/forgotpassword.php
Commit message: Fix EZP-24140: Potential vulnerability in eZ Publish password recovery

Use openssl_random_pseudo_bytes() if available, otherwise fall back to mt_rand(). Use microtime() for entropy.


Vulnerable code:
            $hashKey = md5( $userID . ':' . $time . ':' . mt_rand() );

Fixed code:
            $hashKey = md5(
                $userID . ':' . microtime() . ':' .
                ( function_exists( "openssl_random_pseudo_bytes" ) ?
                    openssl_random_pseudo_bytes( 32 ) : mt_rand() )
            );
CVE-2022-25937 (JavaScript, published 2023-02-13T05:15Z)
Description: value: Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jarofghosts/glance
Files changed:
index.js
test/glance-test-exploit/secret.txt
test/index.js
Commit message: Fix path traversal vulnerability


Vulnerable code:
  this.dir = path.normalize(options.dir)
  if (request.fullPath.slice(0, self.dir.length) !== self.dir) {
    '404': 'File Not Found',
    '403': 'Forbidden',
    '405': 'Method Not Allowed',
    '500': 'Internal Server Error',
  http.get('http://localhost:1666/../index.js', function (res) {
    t.notStrictEqual(res.statusCode, 200)

Fixed code:
  this.dir = path.resolve(options.dir)
  if (path.relative(self.dir, request.fullPath).startsWith('..')) {
    404: 'File Not Found',
    403: 'Forbidden',
    405: 'Method Not Allowed',
    500: 'Internal Server Error',
wee
var net = require('net')
  var socket = new net.Socket()
  socket.connect(1666, 'localhost', function () {
    socket.on('data', function (data) {
      var result = data.toString().split('\n')[0]
      t.equals(result.trim(), 'HTTP/1.1 403 Forbidden')
      socket.end()
    })
    socket.write(`GET /../index.js HTTP/1.1
Host: localhost
user-agent: test/1.2.3
accept: */*

`)
  })
})

test('fails if path traversal with conveniently-named directory is attempted', function (t) {
  t.plan(1)

  var socket = new net.Socket()
  socket.connect(1666, 'localhost', function () {
    socket.on('data', function (data) {
      var result = data.toString().split('\n')[0]
      t.equals(result.trim(), 'HTTP/1.1 403 Forbidden')
      socket.end()
    })
    socket.write(`GET /../glance-test-exploit/secret.txt HTTP/1.1
Host: localhost
user-agent: test/1.2.3
accept: */*

`)
CVE-2021-4118 (Python, published 2021-12-23T18:15Z)
Description: value: pytorch-lightning is vulnerable to Deserialization of Untrusted Data
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/pytorchlightning/pytorch-lightning
Files changed:
CHANGELOG.md
pytorch_lightning/core/saving.py
requirements.txt
tests/loggers/test_csv.py
Commit message: Fix CVE-2020-1747 and CVE-2020-14343 (#11099)



Vulnerable code:
- Fixed a bug to disable logging hyperparameters in logger if there are no hparams ([#11105](https://github.com/PyTorchLightning/pytorch-lightning/issues/11105))
-
        hparams = yaml.load(fp, Loader=yaml.UnsafeLoader)
PyYAML>=5.1
from argparse import Namespace
        "namespace": Namespace(foo=Namespace(bar="buzz")),

Fixed code:
- Fixed security vulnerabilities CVE-2020-1747 and CVE-2020-14343 caused by the `PyYAML` dependency ([#11099](https://github.com/PyTorchLightning/pytorch-lightning/pull/11099))
- Fixed a bug to disable logging hyperparameters in logger if there are no hparams ([#11105](https://github.com/PyTorchLightning/pytorch-lightning/issues/11105))
        hparams = yaml.full_load(fp)
PyYAML>=5.4
CVE-2022-0845 (Python, published 2022-03-05T22:15Z)
Description: value: Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/pytorchlightning/pytorch-lightning
Files changed:
CHANGELOG.md
pytorch_lightning/utilities/argparse.py
Commit message: Replace `eval()` with `ast.literal_eval()` for security (#12212)

Co-authored-by: Carlos Mocholi <carlossmocholi@gmail.com>

Vulnerable code:
                val = eval(val)

Fixed code:

- Fixed security vulnerability "CWE-94: Improper Control of Generation of Code (Code Injection)" ([#12212](https://github.com/PyTorchLightning/pytorch-lightning/pull/12212))


from ast import literal_eval
                val = literal_eval(val)
CVE-2016-10207 (C, published 2017-02-28T18:59Z)
Description: value: The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/TigerVNC/tigervnc
Files changed:
common/rfb/CSecurityTLS.cxx
common/rfb/CSecurityTLS.h
common/rfb/SSecurityTLS.cxx
common/rfb/SSecurityTLS.h
Commit message: Proper global init/deinit of GnuTLS

These are reference counted so it is important to retain symmetry
between the calls. Failure to do so will result in bad memory access
and crashes.


Vulnerable code:
void CSecurityTLS::initGlobal()
{
  static bool globalInitDone = false;

  if (!globalInitDone) {
    gnutls_global_init();
    globalInitDone = true;
  }
}


    gnutls_global_deinit();
  initGlobal();

    static void initGlobal();

void SSecurityTLS::initGlobal()
{
  static bool globalInitDone = false;

  if (!globalInitDone) {
    if (gnutls_global_init() != GNUTLS_E_SUCCESS)
      throw AuthFailureException("gnutls_global_init failed");
    globalInitDone = true;
  }
}


    gnutls_global_deinit();
    initGlobal();

    static void initGlobal();


Fixed code:

  if (gnutls_global_init() != GNUTLS_E_SUCCESS)
    throw AuthFailureException("gnutls_global_init failed");

  gnutls_global_deinit();

  if (gnutls_global_init() != GNUTLS_E_SUCCESS)
    throw AuthFailureException("gnutls_global_init failed");

  gnutls_global_deinit();
CVE-2017-5581 (Other, published 2017-02-28T18:59Z)
Description: value: Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/TigerVNC/tigervnc
Files changed:
common/rfb/PixelBuffer.cxx
Commit message: Fix buffer overflow in ModifiablePixelBuffer::fillRect.

It can be triggered by RRE message with subrectangle out of framebuffer
boundaries. It may prevent the same kind of issue caused by evil message
from another encoding too.


Vulnerable code:
  w = r.width();
  h = r.height();
  buf = getBufferRW(r, &stride);
  commitBufferRW(r);

Fixed code:
  Rect drect;
  drect = r;
  if (!drect.enclosed_by(getRect())) {
    vlog.error("Destination rect %dx%d at %d,%d exceeds framebuffer %dx%d",
               drect.width(), drect.height(), drect.tl.x, drect.tl.y, width_, height_);
    drect = drect.intersect(getRect());
  }

  if (drect.is_empty())
    return;

  w = drect.width();
  h = drect.height();
  buf = getBufferRW(drect, &stride);
  commitBufferRW(drect);
CVE-2020-7741 (JavaScript, published 2020-10-06T15:15Z)
Description: value: This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Severity: HIGH (CVSS v3 base score: 9.9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MrSwitch/hello.js
Files changed:
src/hello.js
Commit message: fix(xss): oauth_redirect should be a valid url


Vulnerable code:
			location.assign(decodeURIComponent(p.oauth_redirect));

Fixed code:
			var url = decodeURIComponent(p.oauth_redirect);

			if (isValidUrl(url)) {
				location.assign(url);
			}
CVE-2022-4878 (Java, published 2023-01-06T10:15Z)
Description: value: A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/JATOS/JATOS
Files changed:
modules/common/app/utils/common/ZipUtil.java
Commit message: ZipUtil.java - check for path traversal attack


Vulnerable code:

Fixed code:
        destDir = destDir.toPath().normalize().toFile(); // normalize to prevent path traversal attacks
CVE-2022-28946 (Go, published 2022-05-19T19:15Z)
Description: value: An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/open-policy-agent/opa
Files changed:
ast/parser.go
ast/parser_test.go
Commit message: ast/parser: guard against invalid domains for "some" and "every" (#4548)

These would cause a runtime exception when attempting to parse

    some internal.member_2()

This is due to a technicality in how

    some x in xs

is parsed: `x in xs` will first become `internal.member_2(x, xs)`,
and `some internal.member_2(x, xs)` is then further processed. The
assumption that there're always two (resp. three for internal.member_3)
arguments won't hold if a snippet like the one above is fed into
the parser.

Thanks to Norbert Szetei of Doyensec, @doyensec, for reporting this.

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>

Vulnerable code:
			case Member.Name, MemberWithKey.Name: // OK

Fixed code:
			case Member.Name:
				if len(call) != 3 {
					p.illegal("illegal domain")
					return nil
				}
			case MemberWithKey.Name:
				if len(call) != 4 {
					p.illegal("illegal domain")
					return nil
				}
		if len(call) != 3 {
			p.illegal("illegal domain")
			return nil
		}
		if len(call) != 4 {
			p.illegal("illegal domain")
			return nil
		}

	assertParseErrorContains(t, "invalid domain (internal.member_2)", "some internal.member_2()", "illegal domain", opts)
	assertParseErrorContains(t, "invalid domain (internal.member_3)", "some internal.member_3()", "illegal domain", opts)

	assertParseErrorContains(t, "invalid domain (internal.member_2)", "every internal.member_2()", "illegal domain", opts)
	assertParseErrorContains(t, "invalid domain (internal.member_3)", "every internal.member_3()", "illegal domain", opts)
CVE-2014-1904 (Java, published 2014-03-20T16:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/spring-projects/spring-framework
Files changed:
spring-webmvc/src/main/java/org/springframework/web/servlet/tags/form/FormTag.java
spring-webmvc/src/test/java/org/springframework/web/servlet/tags/form/FormTagTests.java
Commit message: Add encoding for the default action in FormTag

Issue: SPR-11426


Vulnerable code:
 * Copyright 2002-2013 the original author or authors.
 * Copyright 2002-2013 the original author or authors.

Fixed code:
 * Copyright 2002-2014 the original author or authors.
import java.io.UnsupportedEncodingException;
import org.springframework.web.util.UriUtils;
			String encoding = pageContext.getResponse().getCharacterEncoding();
			try {
				requestUri = UriUtils.encodePath(requestUri, encoding);
			}
			catch (UnsupportedEncodingException e) {
				throw new JspException(e);
			}
 * Copyright 2002-2014 the original author or authors.
	public void testDefaultActionEncoded() throws Exception {

		this.request.setRequestURI("/a b c");
		request.setQueryString("");

		this.tag.doStartTag();
		this.tag.doEndTag();
		this.tag.doFinally();

		String output = getOutput();
		String formOutput = getFormTag(output);

		assertContainsAttribute(formOutput, "action", "/a%20b%20c");
	}
CVE-2019-11923 (C, published 2019-12-04T16:15Z)
Description: value: In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/facebook/mcrouter
Files changed:
mcrouter/lib/network/McAsciiParser.h
mcrouter/lib/network/McAsciiParser.rl
Commit message: Enforce a limit on value bytes size

Summary:
Enforce a limit on value bytes size

This is a fix for CVE-2019-11923

Reviewed By: stuclar

Differential Revision: D16471999

fbshipit-source-id: 9d614da8534e20935b1561c613bb81defd7d470a


Vulnerable code:

Fixed code:
  // limit the value size.
  static constexpr uint32_t maxValueBytes = 1 * 1024 * 1024 * 1024; // 1GB

  // Enforce maximum on value size obtained from parser                       
  if (remainingIOBufLength_ > maxValueBytes) {
    remainingIOBufLength_ = maxValueBytes;                                    
  }
CVE-2019-11937 (C++, published 2019-12-04T16:15Z)
Description: value: In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/facebook/mcrouter
Files changed:
mcrouter/lib/carbon/CarbonProtocolReader.cpp
mcrouter/lib/carbon/CarbonProtocolReader.h
Commit message: Attempt to make CarbonProtocolReader::skip tail recursive

Reviewed By: edenzik

Differential Revision: D17967570

fbshipit-source-id: fdc32e190a521349c7c8f4d6081902fa18eb0284


Vulnerable code:
      while (true) {
        const auto fieldType = readFieldHeader().first;
        if (fieldType == FieldType::Stop) {
          break;
        }
        skip(fieldType);
      }
    default: { break; }
} // carbon
    lastFieldId_ = nestedStructFieldIds_.back();
    nestedStructFieldIds_.pop_back();

Fixed code:
      const auto next = readFieldHeader().first;
      skip(next);
      break;
    }
    case FieldType::Stop: {
    default: {
      break;
    }
} // namespace carbon
    if (!nestedStructFieldIds_.empty()) {
      lastFieldId_ = nestedStructFieldIds_.back();
      nestedStructFieldIds_.pop_back();
    }
CVE-2016-4484 (Markdown, published 2017-01-23T21:59Z)
Description: value: The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
Severity: HIGH (CVSS v3 base score: 6.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://gitlab.com/cryptsetup/cryptsetup
Files changed:
README.md
Commit message: Update Readme.md.


Vulnerable code:

Fixed code:
**CVE-2016-4484 (Initrd root shell)**

This is problem in **intramfs** **scripts** only (these are **not** part of cryptsetup project), it is neiter bug in cryptsetup nor in LUKS.  
Some distributions could add these scripts to distributed package, please check your distro updates for more info.
CVE-2013-1801 (Ruby, published 2013-04-09T20:55Z)
Description: value: The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/jnunemaker/httparty
Files changed:
History
examples/custom_parsers.rb
lib/httparty/parser.rb
spec/httparty/parser_spec.rb
spec/httparty/request_spec.rb
spec/httparty_spec.rb
Commit message: Remove yaml due to possible security risk.


Vulnerable code:
  # Support Atom along with the default parsers: xml, json, yaml, etc.
  # The default parser used by HTTParty, supports xml, json, html, yaml, and
      'application/x-yaml'     => :yaml,
      'text/yaml'              => :yaml,
    def yaml
      YAML.load(body)
    end

    it "parses yaml" do
      YAML.should_receive(:load).with('body')
      subject.send(:yaml)
    end

    it 'should handle yaml automatically' do
      yaml = "books: \n  book: \n    name: Foo Bar!\n    id: \"1234\"\n"
      @request.options[:format] = :yaml
      @request.send(:parse_response, yaml).should == {'books' => {'book' => {'id' => '1234', 'name' => 'Foo Bar!'}}}
    end

    it "should allow yaml" do
      @klass.format :yaml
      @klass.default_options[:format].should == :yaml
    end

      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml, yaml")

Fixed code:
== 0.10.0 2013-01-10
* changes
  * removed yaml support because of security risk (see rails yaml issues)

  # Support Atom along with the default parsers: xml, json, etc.
  # The default parser used by HTTParty, supports xml, json, html, and
      end.should raise_error(HTTParty::UnsupportedFormat, "':foobar' Must be one of: html, json, plain, xml")
CVE-2024-22049 (Unknown, published 2024-01-04T21:15Z)
Description: value: httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.


Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/jnunemaker/httparty
Files changed:
Commit message: Merge pull request from GHSA-5pq7-52mg-hr42

escape filename in the multipart/form-data Content-Disposition header

Vulnerable code:

Fixed code: