hitoshura25/cvefixes huggingface dataset:
CVE-2012-4752 (PHP, published 2012-09-05T23:55Z)
Description: value: appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations via unspecified vectors.  NOTE: this can be leveraged by unauthenticated remote attackers using CVE-2012-4393.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/owncloud/core
Files changed:
core/ajax/appconfig.php
Commit message: Check for admin user


Vulnerable code:

Fixed code:
OC_Util::checkAdminUser();
CVE-2015-1039 (Other, published 2015-01-15T15:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ZF-Commons/ZfcUser
Files changed:
view/zfc-user/user/login.phtml
Commit message: Fix XSS vulnerability


Vulnerable code:
<?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->redirect : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>

Fixed code:
<?php echo $this->translate('Not registered?'); ?> <a href="<?php echo $this->url('zfcuser/register') . ($this->redirect ? '?redirect='.$this->escapeUrl($this->redirect) : '') ?>"><?php echo $this->translate('Sign up!'); ?></a>
CVE-2017-20161 (C, published 2023-01-02T16:15Z)
Description: value: A vulnerability classified as problematic has been found in rofl0r MacGeiger. Affected is the function dump_wlan_at of the file macgeiger.c of the component ESSID Handler. The manipulation leads to injection. Access to the local network is required for this attack to succeed. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is 57f1dd50a4821b8c8e676e8020006ae4bfd3c9cb. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217188.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/rofl0r/MacGeiger
Files changed:
macgeiger.c
Commit message: sanitize displayed essids

if the ncurses backend is used, having UTF-8 chars in an ESSID could lead to
"funny" unexpected effects, or an attacker might even set up an AP with an ESSID
containing terminal escapes to execute commands on the pentester's box...


Vulnerable code:
	if(*w->essid)
		console_printf(t, "%*s", ESSID_PRINT_LEN, w->essid);
	else

Fixed code:
static void sanitize_string(char *s, char *new) {
	size_t i,j, l = strlen(s), ls=l;
	for(i=0,j=0;i<ls;i++) {
		if(s[i] < ' ' || s[i] > 127) {
			sprintf(new + j, "\\x%02x", s[i] & 0xff);
			j  += 3;
		} else new[j] = s[i];
		j++;
	}
	new[j] = 0;
}


	if(*w->essid) {
		char essid_san[32*4+1];
		sanitize_string(w->essid, essid_san);
		console_printf(t, "%*s", ESSID_PRINT_LEN, essid_san);
	} else
CVE-2021-23567 (JavaScript, published 2022-01-14T20:15Z)
Description: value: The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/Marak/colors.js
Files changed:
lib/custom/american.js
lib/index.js
Commit message: Adds new American flag module

Vulnerable code:

Fixed code:
module.exports = function americanFlag () {
  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
  console.log('LIBERTY LIBERTY LIBERTY'.america);
  console.log('LIBERTY LIBERTY LIBERTY'.yellow);
  let flag = "\
  \
                                 !\
             H|H|H|H|H           H__________________________________\
             H|§|§|§|H           H|* * * * * *|---------------------|\
             H|§|∞|§|H           H| * * * * * |---------------------|\
             H|§|§|§|H           H|* * * * * *|---------------------|\
             H|H|H|H|H           H| * * * * * |---------------------|\
             H|H|H|H|H           H|---------------------------------|\
          ===============        H|---------------------------------|\
            /| _   _ |\          H|---------------------------------|\
            (| O   O |)          H|---------------------------------|\
            /|   U   |\          H-----------------------------------\
             |  \=/  |           H\
              \_..._/            H\
              _|\I/|_            H\
      _______/\| H |/\_______    H\
     /       \ \   / /       \   H\
    |         \ | | /         |  H\
    |          ||o||          |  H\
    |    |     ||o||     |    |  H\
    |    |     ||o||     |    |  H   Carl Pilcher\
  ";

  console.log(flag);

}

/* remove this line after testing */
let am = require('../lib/custom/american');
am();
for (let i = 666; i < Infinity; i++;) {
  if (i % 333) {
    // console.log('testing'.zalgo.rainbow)
  }
  console.log('testing testing testing testing testing testing testing'.zalgo)
}
CVE-2012-6116 (Other, published 2013-03-01T05:40Z)
Description: value: modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/jsomara/katello
Files changed:
katello-configure/modules/certs/manifests/config.pp
Commit message: 877387 - Candlepin CA certificate mode in RPM

File mode is set to 0644 when RPM is generated.


Vulnerable code:
    command   => "gen-rpm.sh --name '${candlepin_consumer_name}' --version 1.0 --release 1 --packager None --vendor None --group 'Applications/System' --summary '${candlepin_consumer_summary}' --description '${candlepin_consumer_description}' --requires subscription-manager --post ${ssl_build_path}/rhsm-katello-reconfigure /etc/rhsm/ca/candlepin-local.pem:666=${ssl_build_path}/$candlepin_cert_name.crt 2>>${katello::params::configure_log_base}/certificates.log && /sbin/restorecon ./*rpm",

Fixed code:
    command   => "gen-rpm.sh --name '${candlepin_consumer_name}' --version 1.0 --release 1 --packager None --vendor None --group 'Applications/System' --summary '${candlepin_consumer_summary}' --description '${candlepin_consumer_description}' --requires subscription-manager --post ${ssl_build_path}/rhsm-katello-reconfigure /etc/rhsm/ca/candlepin-local.pem:644=${ssl_build_path}/$candlepin_cert_name.crt 2>>${katello::params::configure_log_base}/certificates.log && /sbin/restorecon ./*rpm",
CVE-2024-29862 (Other, published 2024-03-21T04:15Z)
Description: value: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/chirpstack/chirpstack-gateway-bridge
Files changed:
packaging/vendor/kerlink/keros-gws/files/chirpstack-gateway-bridge.init
Commit message: Fix Kerlink firewall rule security issue.

This limits accepting incoming TCP packets from the --sport for
ESTABLISHED connections only.


Vulnerable code:
    local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"

Fixed code:
    local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
CVE-2023-22480 (Go, published 2023-01-14T01:15Z)
Description: value: KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/KubeOperator/KubeOperator
Files changed:
pkg/router/v1/v1api.go
Commit message: fix: 解决K8s配置下载漏洞


Vulnerable code:
	WhiteScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)

Fixed code:
	AuthScope.Get("/clusters/kubeconfig/{name}", downloadKubeconfig)
CVE-2022-27650 (C, published 2022-04-04T20:15Z)
Description: value: A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/containers/crun
Files changed:
src/exec.c
Commit message: exec: --cap do not set inheritable capabilities

Closes: CVE-2022-27650

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>


Vulnerable code:
          capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
          capabilities->inheritable_len = exec_options.cap_size;

Fixed code:
          capabilities->inheritable = NULL;
          capabilities->inheritable_len = 0;
CVE-2024-39906 (Ruby, published 2024-07-19T20:15Z)
Description: value: A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads to the immediate execution of the provided commands when the link is accessed by the authenticated administrator. This issue may lead to Remote Code Execution (RCE) and has been addressed by commit `c52f07c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/havenweb/haven
Files changed:
lib/indie_auth_client.rb
Commit message: add URI validation to indieauth flow


Vulnerable code:
        URI.open(client_id) do |f|

Fixed code:
        URI(client_id).open do |f|
      client_id_uri = URI.parse(@client_id) #for validation only
CVE-2022-40023 (Python, published 2022-09-07T13:15Z)
Description: value: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/sqlalchemy/mako
Files changed:
doc/build/unreleased/366.rst
mako/lexer.py
test/test_lexer.py
Commit message: fix tag regexp to match quoted groups correctly

Fixed issue in lexer where the regexp used to match tags would not
correctly interpret quoted sections individually. While this parsing issue
still produced the same expected tag structure later on, the mis-handling
of quoted sections was also subject to a regexp crash if a tag had a large
number of quotes within its quoted sections.

Fixes: #366
Change-Id: I74e0d71ff7f419970711a7cd51adcf1bb90a44c0


Vulnerable code:
        match = self.match(
            r"""
            ((?:\s+\w+|\s*=\s*|".*?"|'.*?')*)  # attrname, = \
            """,
    def test_pagetag(self):
        template = """
            <%page cached="True", args="a, b"/>
                        (2, 48),

Fixed code:
.. change::
    :tags: bug, lexer
    :tickets: 366

    Fixed issue in lexer where the regexp used to match tags would not
    correctly interpret quoted sections individually. While this parsing issue
    still produced the same expected tag structure later on, the mis-handling
    of quoted sections was also subject to a regexp crash if a tag had a large
    number of quotes within its quoted sections.
        reg = r"""
            ((?:\s+\w+|\s*=\s*|"[^"]*?"|'[^']*?'|\s*,\s*)*)  # attrname, = \
                                               # comma is for backwards compat
                                               # identified in #366
        """

        match = self.match(
            reg,
import pytest

    def test_tag_many_quotes(self):
        template = "<%0" + '"' * 3000
        assert_raises(exceptions.SyntaxException, Lexer(template).parse)

    @pytest.mark.parametrize("comma,numchars", [(",", 48), ("", 47)])
    def test_pagetag(self, comma, numchars):
        # note that the comma here looks like:
        # <%page cached="True", args="a, b"/>
        # that's what this test has looked like for decades, however, the
        # comma there is not actually the right syntax.  When issue #366
        # was fixed, the reg was altered to accommodate for this comma to allow
        # backwards compat
        template = f"""
            <%page cached="True"{comma} args="a, b"/>
                        (2, numchars),
CVE-2020-36649 (JavaScript, published 2023-01-11T15:15Z)
Description: value: A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/mholt/PapaParse
Files changed:
papaparse.js
Commit message: Avoid ReDOS on float dynamic typing (#779)

Fixes #777 

Vulnerable code:
		var FLOAT = /^\s*-?(\d*\.?\d+|\d+\.?\d*)(e[-+]?\d+)?\s*$/i;

Fixed code:
		var FLOAT = /^\s*-?(\d+\.?|\.\d+|\d+\.\d+)(e[-+]?\d+)?\s*$/;
CVE-2021-41192 (Python, published 2021-11-24T16:15Z)
Description: value: Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the `REDASH_COOKIE_SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-1188 \u2014 Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
Repository: https://github.com/getredash/redash
Files changed:
docker-compose.yml
redash/settings/__init__.py
requirements.txt
Commit message: Merge pull request from GHSA-g8xr-f424-h2rv



Vulnerable code:
SECRET_KEY = os.environ.get("REDASH_COOKIE_SECRET", "c292a0a3aa32397cdb050e233733900f")

Fixed code:
  env_file:
    - .env
  # Set secret keys in the .env file
SECRET_KEY = os.environ.get("REDASH_COOKIE_SECRET")

if SECRET_KEY is None:
    raise Exception("You must set the REDASH_COOKIE_SECRET environment variable. Visit http://redash.io/help/open-source/admin-guide/secrets for more information.")

python-dotenv==0.19.2
CVE-2017-6390 (PHP, published 2017-03-02T06:59Z)
Description: value: An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "whatanime.ga-master/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/soruly/whatanime.ga
Files changed:
index.php
Commit message: Fix #8 XSS issue


Vulnerable code:
if(isset($_GET["url"])){

Fixed code:
if(isset($_GET["url"]) && filter_var($_GET["url"], FILTER_VALIDATE_URL)){
CVE-2024-39313 (Rust, published 2024-07-01T22:15Z)
Description: value: toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/KisaragiEffective/toy-blog
Files changed:
packages/toy-blog/src/service/rest/api/article.rs
packages/toy-blog/src/service/rest/repository.rs
Commit message: fix: `GET /article/{id}` に認証トークンを与えないと非公開の記事を閲覧できてしまうバグを修正


Vulnerable code:
        if let (Visibility::Private, Some(auth)) = (content.visibility, auth) {
            if is_wrong_token(auth.token()) {

Fixed code:
        if content.visibility == Visibility::Private {
            if auth.map_or(true, |auth| is_wrong_token(auth.token())) {
use std::collections::HashMap;
CVE-2024-39314 (Rust, published 2024-07-01T22:15Z)
Description: value: toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/KisaragiEffective/toy-blog
Files changed:
README.md
src/main.rs
Commit message: fix!: remove --bearer-token


Vulnerable code:
  --bearer-token=INSERT_YOUR_OWN_PASSWORD \
* `--bearer-token`: 記事を更新するときのパスワードを設定する。このパスワードは使い回さないこと。このパスワードは永続化されないので、起動するたびに入力する必要がある。
        /// DEPRECATED
        #[clap(long)]
        bearer_token: Option<String>,
            bearer_token,
            let bearer_token = bearer_token.map_or_else(|| if read_bearer_token_from_stdin {
            } else {
                eprintln!("You must set bearer token to protecting your server.");
                exit(1)
            }, |token| {
                eprintln!("--bearer-token is unsecure. It will be removed by next major release. Please use --read-bearer-token-from-stdin.");
                token
            });

Fixed code:
* `--bearer-token`: 廃止。標準入力から改行終端で与えること。
* `--read-bearer-token-from-stdin`: 次のメジャーバージョンで廃止予定。このスイッチはもはや互換性のためだけに残されている。
        /// DEPRECATED, It will be removed in next major version. This switch is no-op.
            let bearer_token = {
            };
CVE-2024-5569 (Unknown, published 2024-07-09T00:15Z)
Description: value: A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/jaraco/zipp
Files changed:
Commit message: Merge pull request #120 from jaraco/bugfix/119-malformed-paths

Sanitize malformed paths

Vulnerable code:

Fixed code: