hitoshura25/cvefixes huggingface dataset:
CVE-2018-21268 (JSON, published 2020-06-25T17:15Z)
Description: value: The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/jaw187/node-traceroute
Files changed:
package.json
traceroute.js
Commit message: conversion to spawn and stream


Vulnerable code:
  "dependencies": {},
    "lab": "9.x.x"

        const command = (internals.isWin ? 'tracert -d ' : 'traceroute -q 1 -n ') + host;
        Child.exec(command, (err, stdout, stderr) => {
            if (err) {
                return callback(err);
            const results = internals.parseOutput(stdout);
            return callback(null, results);

internals.parseOutput = function (output) {

    const lines = output.split('\n');
    const hops = [];

    lines.shift();
    lines.pop();

    if (internals.isWin) {
        for (let i = 0; i < lines.length; ++i) {
            if (/^\s+1/.test(lines[i])) {
                break;
            }
        }
        lines.splice(0,i);
        lines.pop();
        lines.pop();
    }

    for (let i = 0; i < lines.length; ++i) {
        hops.push(internals.parseHop(lines[i]));
    }

    return hops;
};

Fixed code:
    "lab": "10.x.x"
        const command = (internals.isWin ? 'tracert' : 'traceroute');
        const args = internals.isWin ? ['-d', host] : ['-q', 1, '-n', host];

        const traceroute = Child.spawn(command, args);

        const hops = [];
        let counter = 0;
        traceroute.stdout.on('data', (data) => {
            ++counter;
            if ((!internals.isWin && counter < 2) || (internals.isWin && counter < 5)) {
                return null;
            const result = data.toString().replace(/\n$/,'');
            if (!result) {
                return null;
            }

            const hop = internals.parseHop(result);
            hops.push(hop);

        traceroute.on('close', (code) => {

            if (callback) {
                return callback(null, hops);
            }
        });

        return traceroute;
CVE-2024-25714 (C, published 2024-02-11T03:15Z)
Description: value: In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/babelouest/rhonabwy
Files changed:
src/jws.c
Commit message: Mitigate HMAC signature side-channel attack

Thanks to Erwan Legrand


Vulnerable code:
  if (sig != NULL && 0 == o_strcmp((const char *)jws->signature_b64url, (const char *)sig)) {

Fixed code:
  if (!o_strnullempty((const char *)jws->signature_b64url) &&
      !o_strnullempty((const char *)sig) &&
      o_strlen((const char *)sig) == o_strlen((const char *)jws->signature_b64url) &&
      0 == gnutls_memcmp(jws->signature_b64url, sig, o_strlen((const char *)sig))) {
CVE-2021-25941 (JavaScript, published 2021-05-14T14:15Z)
Description: value: Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/ASaiAnudeep/deep-override
Files changed:
src/index.js
Commit message: Security fix for Prototype Pollution

Vulnerable code:
module.exports = override;

Fixed code:
        if (key == '__proto__' || key == 'constructor' || key == 'prototype')
          return
module.exports = override;
CVE-2018-25059 (Unknown, published 2022-12-30T11:15Z)
Description: value: A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. The manipulation of the argument r.URL.Path leads to path traversal. Upgrading to version 0.2.3 is able to address this issue. The name of the patch is 1af2facb6d95976c532b7f8f82747d454a092272. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217040.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jessfraz/pastebinit
Files changed:
Commit message: Merge pull request #3 from ilyaglow/security-fix

Fix path traversal and storage path leak

Vulnerable code:

Fixed code:
CVE-2023-32684 (Unknown, published 2023-05-30T18:15Z)
Description: value: Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host. The official templates of Lima and the well-known third party products (Colima, Rancher Desktop, and Finch) are unlikely to be affected by this issue. To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the qcow2 (or vmdk) backing file path string. As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`. Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file. The issue has been patched in Lima in version 0.16.0 by prohibiting using a backing file path in the VM base image.
Severity: nan (CVSS v3 base score: 2.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/lima-vm/lima
Files changed:
Commit message: Merge pull request from GHSA-f7qw-jj9c-rpq9

Prohibit using a differential disk as a base disk 

Vulnerable code:

Fixed code:
CVE-2022-1291 (JSON, published 2022-04-10T20:15Z)
Description: value: XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hhurz/tableexport.jquery.plugin
Files changed:
bower.json
package.json
tableExport.js
tableExport.min.js
Commit message: Release 1.25


Vulnerable code:
  "version": "1.22.0",
  "version": "1.22.0",
    "jquery": ">=1.9.1",
 * Version 1.22.0
 * Version 1.22.0

Fixed code:
  "version": "1.25.0",
  "version": "1.25.0",
    "jquery": ">=3.2.1",
 * Version 1.25.0
 * Version 1.25.0
CVE-2011-5018 (PHP, published 2020-01-08T23:15Z)
Description: value: Koala Framework before 2011-11-21 has XSS via the request_uri parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/koala-framework/koala-framework
Files changed:
Kwf/Exception/Abstract.php
Commit message: fix XSS security issue: escape request_uri in 404 pages


Vulnerable code:
            $_SERVER['REQUEST_URI'] : '' ;

Fixed code:
            htmlspecialchars($_SERVER['REQUEST_URI']) : '' ;
CVE-2023-37474 (Python, published 2023-07-14T20:15Z)
Description: value: Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This issue has been addressed in commit `043e3c7d` which has been included in release 1.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/9001/copyparty
Files changed:
copyparty/httpcli.py
Commit message: fix traversal vulnerability GHSA-pxfv-7rr3-2qjg:
the /.cpr endpoint allowed full access to server filesystem,
unless mitigated by prisonparty


Vulnerable code:
            static_path = os.path.join(self.E.mod, "web/", self.vpath[5:])

Fixed code:
    absreal,
            path_base = os.path.join(self.E.mod, "web")
            static_path = absreal(os.path.join(path_base, self.vpath[5:]))
            if not static_path.startswith(path_base):
                t = "attempted path traversal [{}] => [{}]"
                self.log(t.format(self.vpath, static_path), 1)
                self.tx_404()
                return False
CVE-2023-38501 (Python, published 2023-07-25T22:15Z)
Description: value: copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/9001/copyparty
Files changed:
copyparty/httpcli.py
copyparty/httpsrv.py
copyparty/util.py
Commit message: fix GHSA-f54q-j679-p9hh: reflected-XSS in cookie-setters;
it was possible to set cookie values which contained newlines,
thus terminating the http header and bleeding into the body.

We now disallow control-characters in queries,
but still allow them in paths, as copyparty supports
filenames containing newlines and other mojibake.

The changes in `set_k304` are not necessary in fixing the vulnerability,
but makes the behavior more correct.


Vulnerable code:
                t = "attempted path traversal [{}] => [{}]"
        ck = gencookie("k304", self.uparam["k304"], self.args.R, False, 86400 * 299)

Fixed code:

            zs = unquotep(arglist)
            m = self.conn.hsrv.ptn_cc.search(zs)
            if m:
                hit = zs[m.span()[0] :]
                t = "malicious user; Cc in query [{}] => [{!r}]"
                self.log(t.format(self.req, hit), 1)
                return False

                if pex.code == 999:
                    return False

        for zs in response:
            m = self.conn.hsrv.ptn_cc.search(zs)
            if m:
                hit = zs[m.span()[0] :]
                t = "malicious user; Cc in out-hdr {!r} => [{!r}]"
                self.log(t.format(zs, hit), 1)
                raise Pebkac(999)

                t = "malicious user; attempted path traversal [{}] => [{}]"
        v = self.uparam["k304"].lower()
        if v == "y":
            dur = 86400 * 299
        else:
            dur = None
            v = "x"

        ck = gencookie("k304", v, self.args.R, False, dur)
import re
        self.ptn_cc = re.compile(r"[\x00-\x1f]")

    999: "MissingNo",
CVE-2022-0699 (C, published 2022-10-17T16:15Z)
Description: value: A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/OSGeo/shapelib
Files changed:
contrib/shpsort.c
Commit message: Remove double free() in contrib/shpsrt, issue #39

This fixes issue #39

Vulnerable code:
      free(copy);

Fixed code:
CVE-2021-3258 (PHP, published 2021-02-05T16:15Z)
Description: value: Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary remote code execution.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/q2a-projects/Q2A-Ultimate-SEO
Files changed:
q2a-ultimate-seo/layer.php
Commit message: Sanitizing Meta output


Vulnerable code:
			$this->meta_title = @$metas['title'];
			$this->meta_description = @$metas['description'];
			$this->meta_keywords = @$metas['keywords'];
			$description = $this->meta_description;
			$description = @$this->content['description'];
			$title = $this->meta_title;
			$title = @$this->content['q_view']['raw']['title'];
						$this->metas[$index]['content'] = $variable;
						$useo_social_tc_desc_length = 120;
						$replace   = array(qa_opt('site_title'), @$this->content['q_view']['raw']['title'], $category_name);
				$this->content['keywords'] = $this->meta_keywords;
				$this->content['description'] = $this->meta_description;
							<input placeholder="' . $this->content['q_view']['raw']['title'] . '" id="useo-meta-editor-title" class="qa-form-tall-text" type="text" value="'. $this->meta_title .'" name="useo-meta-editor-title">
							<textarea placeholder="' . $this->content['description'] . '" id="useo-meta-editor-description" class="qa-form-tall-text" cols="40" rows="3" name="useo-meta-editor-description">'. $this->meta_description .'</textarea>

Fixed code:
			$this->meta_title = htmlspecialchars(@$metas['title']);
			$this->meta_description = htmlspecialchars(@$metas['description']);
			$this->meta_keywords = htmlspecialchars(@$metas['keywords']);
			$description = htmlspecialchars($this->meta_description);
			$description = htmlspecialchars(@$this->content['description']);
			$title = htmlspecialchars($this->meta_title);
			$title = htmlspecialchars(@$this->content['q_view']['raw']['title']);
						$this->metas[$index]['content'] = htmlspecialchars($variable);
					$useo_social_tc_desc_length = 120;
						$replace   = array(qa_opt('site_title'), htmlspecialchars(@$this->content['q_view']['raw']['title']), $category_name);
				$this->content['keywords'] = htmlspecialchars($this->meta_keywords);
				$this->content['description'] = htmlspecialchars($this->meta_description);
							<input placeholder="' . htmlspecialchars($this->content['q_view']['raw']['title']) . '" id="useo-meta-editor-title" class="qa-form-tall-text" type="text" value="'. $this->meta_title .'" name="useo-meta-editor-title">
							<textarea placeholder="' . htmlspecialchars($this->content['description']) . '" id="useo-meta-editor-description" class="qa-form-tall-text" cols="40" rows="3" name="useo-meta-editor-description">'. $this->meta_description .'</textarea>
CVE-2023-3188 (Go, published 2023-06-10T02:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/owncast/owncast
Files changed:
activitypub/webfinger/webfinger.go
auth/indieauth/client.go
Commit message: fix: disable redirects to guard against possible SSRFs


Vulnerable code:
	response, err := http.DefaultClient.Get(requestURL.String())
	client := &http.Client{}

Fixed code:
	// Do not support redirects.
	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}

	response, err := client.Get(requestURL.String())
	// Do not support redirects.
	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}
CVE-2024-29026 (Go, published 2024-03-20T22:15Z)
Description: value: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a lenient CORS policy allows attackers to make a cross origin request, reading privileged information. This can be used to leak the admin password. Commit 9215d9ba0f29d62201d3feea9e77dcd274581624 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/owncast/owncast
Files changed:
router/middleware/auth.go
Commit message: fix(auth): limit admin cors access to only localhost:3000


Vulnerable code:
		// The following line is kind of a work around.
		// If you want HTTP Basic Auth + Cors it requires _explicit_ origins to be provided in the
		// Access-Control-Allow-Origin header.  So we just pull out the origin header and specify it.
		// If we want to lock down admin APIs to not be CORS accessible for anywhere, this is where we would do that.
		w.Header().Set("Access-Control-Allow-Origin", r.Header.Get("Origin"))

Fixed code:
		// Alow CORS only for localhost:3000 to support Owncast development.
		validAdminHost := "http://localhost:3000"
		w.Header().Set("Access-Control-Allow-Origin", validAdminHost)
CVE-2024-31450 (Go, published 2024-04-19T19:15Z)
Description: value: Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. The Owncast application exposes an administrator API at the URL /api/admin. The emoji/delete endpoint of said API allows administrators to delete custom emojis, which are saved on disk. The parameter name is taken from the JSON request and directly appended to the filepath that points to the emoji to delete. By using path traversal sequences (../), attackers with administrative privileges can exploit this endpoint to delete arbitrary files on the system, outside of the emoji directory. This vulnerability is fixed in 0.1.3.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/owncast/owncast
Files changed:
controllers/admin/emoji.go
Commit message: fix(api): protect emoji delete api from path traversal exploit


Vulnerable code:
	// var emojiFileName = filepath.Base(emoji.Name)

Fixed code:
	if !filepath.IsLocal(targetPath) {
		controllers.WriteSimpleResponse(w, false, "Emoji path is not valid")
		return
	}
CVE-2018-11590 (Other, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file via an integer overflow during syntax parsing. This was addressed by fixing stack size detection on Linux in jsutils.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jsutils.c
Commit message: Fix stack size detection on Linux (fix #1427)


Vulnerable code:
  return 1000000 - count; // give it 1 megabyte of stack

Fixed code:
            Fix stack size detection on Linux (fix #1427)
  const uint32_t max_stack = 1000000; // give it 1 megabyte of stack
  if (count>max_stack) return 0;
  return max_stack - count;
CVE-2018-11591 (Other, published 2018-05-31T16:29Z)
Description: value: Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file via a NULL pointer dereference during syntax parsing. This was addressed by adding validation for a debug trace print statement in jsvar.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/espruino/Espruino
Files changed:
ChangeLog
src/jsvar.c
Commit message: Add sanity check for debug trace print statement (fix #1420)


Vulnerable code:
  else if (jsvIsArrayBuffer(var)) jsiConsolePrintf("%s ", jswGetBasicObjectName(var)); // way to get nice name

Fixed code:
            Add sanity check for debug trace print statement (fix #1420)
  else if (jsvIsArrayBuffer(var)) jsiConsolePrintf("%s ", jswGetBasicObjectName(var)?jswGetBasicObjectName(var):"unknown ArrayBuffer"); // way to get nice name