hitoshura25/cvefixes huggingface dataset:
CVE-2017-12847 (Other, published 2017-08-23T21:29Z)
Description: value: Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
Severity: MEDIUM (CVSS v3 base score: 6.3)
Weakness: CWE-665 \u2014 Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Repository: https://github.com/NagiosEnterprises/nagioscore
Files changed:
configure.ac
Commit message: configure.ac: use /run/nagios.lock as the default lockfile path.

The previous default path for the lockfile was located in
$localstatedir, which is generally writable by the nagios user. That
presents a security risk, since the nagios user can delete the
lockfile and replace it with another file containing the PID of a
root-owned process. This commit changes the default lockfile path to
/run/nagios.lock, and completes the fix for Github issue #404.


Vulnerable code:
		[sets path and file name for lock file]),
	lockfile=$localstatedir/nagios.lock

Fixed code:
		[sets path for lock file (default: /run/nagios.lock)]),
	lockfile=/run/nagios.lock
CVE-2017-12847 (Other, published 2017-08-23T21:29Z)
Description: value: Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
Severity: MEDIUM (CVSS v3 base score: 6.3)
Weakness: CWE-665 \u2014 Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Repository: https://github.com/NagiosEnterprises/nagioscore
Files changed:
Changelog
THANKS
base/nagios.c
configure.ac
Commit message: halfway revert hack/configure changes - switch order of daemon_init/drop_privileges


Vulnerable code:
			/* enter daemon mode (unless we're restarting...) */
			if(daemon_mode == TRUE && sigrestart == FALSE) {

				result = daemon_init();

				/* we had an error daemonizing, so bail... */
				if(result == ERROR) {
					logit(NSLOG_PROCESS_INFO | NSLOG_RUNTIME_ERROR, TRUE, "Bailing out due to failure to daemonize. (PID=%d)", (int)getpid());
					cleanup();
					exit(EXIT_FAILURE);
					}

				/* get new PID */
				nagios_pid = (int)getpid();
				}


eval localstatedir=$localstatedir
eval lockfile=$lockfile
eval CHECKRESULTDIR=$CHECKRESULTDIR
AC_SUBST(CHECKRESULTDIR)
AC_SUBST(lockfile)


Fixed code:
* Fix minor map issues (Troy Lea)
* Fix lockfile issues (Bryan Heden)
* Troy Lea
			
			/* enter daemon mode (unless we're restarting...) */
			if(daemon_mode == TRUE && sigrestart == FALSE) {

				result = daemon_init();

				/* we had an error daemonizing, so bail... */
				if(result == ERROR) {
					logit(NSLOG_PROCESS_INFO | NSLOG_RUNTIME_ERROR, TRUE, "Bailing out due to failure to daemonize. (PID=%d)", (int)getpid());
					cleanup();
					exit(EXIT_FAILURE);
					}

				/* get new PID */
				nagios_pid = (int)getpid();
				}
AC_SUBST(CHECKRESULTDIR)
AC_SUBST(lockfile)
CVE-2018-25094 (PHP, published 2023-12-03T11:15Z)
Description: value: A vulnerability was found in ???????????????? Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/59160781/project
Files changed:
ckeditor/filemanager/browser/default/image.php
Commit message: fix a critical security vulnerability

/ckeditor/filemanager/browser/default/image.php?fid=/settings/database.php&id=&w=&h=
/ckeditor/filemanager/browser/default/image.php?fid=../../../etc/passwd&id=&w=&h

Vulnerable code:
if (isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {

Fixed code:

if ( isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
  // hotfix: these checks need to be changed later
  if(!Kotchasan\Login::isMember() || strpos($_REQUEST['fid'], '..') === false || strpos($_REQUEST['fid'], '.php') === false) exit();
CVE-2020-14156 (C++, published 2020-06-15T18:15Z)
Description: value: user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/openbmc/phosphor-host-ipmid
Files changed:
user_channel/passwd_mgr.cpp
Commit message: Use more restrictive permissions on /etc/ipmi-pass

This forces the permissions on /etc/ipmi-pass to be 0600 or RW only by
owner. This is to prevent non-owners from reading the file, even though
it is obfuscated to make it harder for ipmi passwords to leak.

Tested: change ipmi passwords and see that the /etc/ipmi-pass file has
        0600 permissions.

Change-Id: I4be0b8a65f98ced031493f7767879eb054e1ee84
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>


Vulnerable code:
    // Set the file mode as of actual ipmi-pass file.
    if (fchmod(fileno((temp)()), st.st_mode) < 0)

Fixed code:
    // Set the file mode as read-write for owner only
    if (fchmod(fileno((temp)()), S_IRUSR | S_IWUSR) < 0)
CVE-2020-15100 (Other, published 2020-07-14T20:15Z)
Description: value: In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/schokokeksorg/freewvs
Files changed:
freewvs
Commit message: limit data we read from file to avoid DoS via large files


Vulnerable code:
                        filestr = file.read()

Fixed code:
                        filestr = file.read(200000)
CVE-2020-15101 (Other, published 2020-07-14T22:15Z)
Description: value: In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.
Severity: MEDIUM (CVSS v3 base score: 3.3)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/schokokeksorg/freewvs
Files changed:
freewvs
Commit message: protect against deep recursion of directories


Vulnerable code:
    for root, _, files in os.walk(fdir):

Fixed code:
    for root, dirs, files in os.walk(fdir):
        # this protects us against nested directories causing
        # an exception
        if root.count(os.sep) > 500:
            del dirs[:]
CVE-2014-0012 (Other, published 2014-05-19T14:55Z)
Description: value: FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/mitsuhiko/jinja2
Files changed:
CHANGES
jinja2/bccache.py
Commit message: Fixed a security issue with temporary files on the filesystem cache on UNIX.


Vulnerable code:
    If no directory is specified the system temporary items folder is used.
            directory = tempfile.gettempdir()

Fixed code:
- Security issue: Changed the default folder for the filesystem cache to be
  user specific and read and write protected on UNIX systems.  See `Debian bug
  734747`_ for more information.

.. _Debian bug 734747: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747
import os
import errno
    If no directory is specified a default cache directory is selected.  On
    Windows the user's temp directory is used, on UNIX systems a directory
    is created for the user in the system temp directory.
            directory = self._get_default_cache_dir()
    def _get_default_cache_dir(self):
        tmpdir = tempfile.gettempdir()

        # On windows the temporary directory is used specific unless
        # explicitly forced otherwise.  We can just use that.
        if os.name == 'n':
            return tmpdir
        if not hasattr(os, 'getuid'):
            raise RuntimeError('Cannot determine safe temp directory.  You '
                               'need to explicitly provide one.')

        dirname = '_jinja2-cache-%d' % os.getuid()
        actual_dir = os.path.join(tmpdir, dirname)
        try:
            os.mkdir(actual_dir, 0700)
        except OSError as e:
            if e.errno != errno.EEXIST:
                raise

        return actual_dir
CVE-2022-36009 (Go, published 2022-08-19T21:15Z)
Description: value: gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `"events_default"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `"events_default"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/matrix-org/gomatrixserverlib
Files changed:
eventauth_test.go
eventcontent.go
Commit message: Fix parsing of `"events_default"` level in `m.room.power_levels` events


Vulnerable code:
			EventDefaultLevel  levelJSONValue            `json:"event_default"`

Fixed code:

var negativePowerLevelTestRoom = &testAuthEvents{
	CreateJSON: json.RawMessage(`{
		"type": "m.room.create",
		"state_key": "",
		"sender": "@u1:a",
		"room_id": "!r1:a",
		"event_id": "$e1:a",
		"content": {
			"room_version": "10"
		}
	}`),
	PowerLevelsJSON: json.RawMessage(`{
		"type": "m.room.power_levels",
		"state_key": "",
		"sender": "@u1:a",
		"room_id": "!r1:a",
		"event_id": "$e3:a",
		"content": {
			"events_default": -9007199254740990,
			"state_default": -9007199254740990,
			"users_default": -9007199254740990,
			"users": {
			}
		}
	}`),
	MemberJSON: map[string]json.RawMessage{
		"@u1:a": json.RawMessage(`{
			"type": "m.room.member",
			"state_key": "@u1:a",
			"sender": "@u1:a",
			"room_id": "!r1:a",
			"event_id": "$e2:a",
			"content": {
				"membership": "join"
			}
		}`),
	},
}

func TestNegativePowerLevels(t *testing.T) {
	// User should be able to demote the user default level
	// below their own effective level.
	eventShouldSucceed, err := NewEventFromTrustedJSON(RawJSON(`{
		"type": "m.room.message",
		"sender": "@u1:a",
		"room_id": "!r1:a",
		"event_id": "$e5:a",
		"content": {
			"stuff": "i am a message event"
		}
	}`), false, RoomVersionV1)
	if err != nil {
		t.Fatal(err)
	}
	if err = Allowed(eventShouldSucceed, negativePowerLevelTestRoom); err != nil {
		t.Error("TestNegativePowerLevels should have succeeded but it didn't:", err)
	}
}
			EventDefaultLevel  levelJSONValue            `json:"events_default"`
CVE-2021-22538 (Go, published 2021-03-31T21:15Z)
Description: value: A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/google/exposure-notifications-verification-server
Files changed:
pkg/rbac/rbac.go
pkg/rbac/rbac_test.go
Commit message: Merge pull request from GHSA-5v95-v8c8-3rh6

This fixes a security vulnerability where, with a carefully crafted request or malicious proxy, a user with UserWrite permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions.

Vulnerable code:

Fixed code:
		// Verify the provided permission is a known permission. This prevents a
		// security vulnerability whereby a carefully crafted request is able to
		// provide a value that correctly passes an the bitwise AND check and then
		// modifies the target permission using OR to escalate privilege.
		if _, ok := PermissionMap[update]; !ok {
			if update != LegacyRealmAdmin && update != LegacyRealmUser {
				return 0, fmt.Errorf("provided permission %v is unknown", update)
			}
		}


	t.Run("legacy_admin", func(t *testing.T) {
		t.Parallel()

		if _, err := CompileAndAuthorize(LegacyRealmAdmin, []Permission{LegacyRealmAdmin}); err != nil {
			t.Error(err)
		}
	})

	t.Run("legacy_user", func(t *testing.T) {
		t.Parallel()

		if _, err := CompileAndAuthorize(LegacyRealmAdmin, []Permission{LegacyRealmUser}); err != nil {
			t.Error(err)
		}
	})

	t.Run("escalate", func(t *testing.T) {
		t.Parallel()

		if _, err := CompileAndAuthorize(UserRead|UserWrite, []Permission{16383}); err == nil {
			t.Errorf("expected error")
		}
	})
CVE-2022-31082 (PHP, published 2022-06-27T21:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi-inventory-plugin
Files changed:
inc/deploypackage.class.php
Commit message: Merge pull request from GHSA-q6m7-h6rj-5wmw



Vulnerable code:
            'name'                    => '[deploy on demand] ' . $this->fields['name'],
            'entities_id'             => $computer->fields['entities_id'],
            'reprepare_if_successful' => 0,
            'is_deploy_on_demand'     => 1,
            'is_active'               => 1,

Fixed code:
use Glpi\Toolbox\Sanitizer;

                'name'                    => '[deploy on demand] ' . Sanitizer::dbEscape($this->fields['name']),
                'entities_id'             => $computer->fields['entities_id'],
                'reprepare_if_successful' => 0,
                'is_deploy_on_demand'     => 1,
                'is_active'               => 1,
CVE-2021-46561 (Unknown, published 2022-01-26T18:15Z)
Description: value: controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new organization.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/CVEProject/cve-services
Files changed:
Commit message: Merge pull request #534 from CVEProject/hotfix/restrict_org_change

Keep Org Admins from changing user's org.

Vulnerable code:

Fixed code:
CVE-2021-21386 (Python, published 2021-03-24T21:15Z)
Description: value: APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/dwisiswant0/apkleaks
Files changed:
apkleaks/apkleaks.py
Commit message: Escapes decompiling arguments


Vulnerable code:
		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
		os.system(dec)

Fixed code:
from pipes import quote
		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
		comm = "%s" % (" ".join(quote(arg) for arg in args))
		os.system(comm)
CVE-2021-21386 (Python, published 2021-03-24T21:15Z)
Description: value: APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/dwisiswant0/apkleaks
Files changed:
apkleaks/apkleaks.py
Commit message: Escapes decompiling arguments


Vulnerable code:
		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
		os.system(dec)

Fixed code:
from pipes import quote
		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
		comm = "%s" % (" ".join(quote(arg) for arg in args))
		os.system(comm)
CVE-2023-34795 (C, published 2023-06-16T16:15Z)
Description: value: xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/brechtsanders/xlsxio
Files changed:
Changelog.txt
include/xlsxio_version.h
lib/xlsxio_read.c

Vulnerable code:
  * PR from captaingroove tp add minizip-ng support (#115)
#define XLSXIO_VERSION_MICRO 34

Fixed code:
0.2.35

2023-05-30  Brecht Sanders  https://github.com/brechtsanders/

  * fix free of uninitialized pointer in xlsxioread_sheetlist_close() (#121)

  * PR from captaingroove to add minizip-ng support (#115)
#define XLSXIO_VERSION_MICRO 35
  result->xmlparser = NULL;
CVE-2023-6293 (TypeScript, published 2023-11-24T20:15Z)
Description: value: Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/robinbuschmann/sequelize-typescript
Files changed:
src/shared/object.ts
test/specs/utils/object.spec.ts
Commit message: fix: deny modifying the object prototype (#1698)



Vulnerable code:
    Object.getOwnPropertyNames(source).forEach((key) => assign(key, target, source));

Fixed code:
    Object.getOwnPropertyNames(source).forEach(
      (key) =>
        !['__proto__', 'constructor', 'prototype'].includes(key) && assign(key, target, source)
    );
import { addScopeOptions } from '../../../src/scopes/scope-service';
      it('ignore prototype property', () => {
        const BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
        const empty_scope = {};

        addScopeOptions(empty_scope, BAD_JSON);
        expect(empty_scope).not.to.have.property('polluted');
      });