hitoshura25/cvefixes huggingface dataset:
CVE-2022-39254 (Python, published 2022-09-29T15:15Z)
Description: value: matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room key from their devices, the software correctly remember the request. Once they receive a forwarded room key, they accept it without checking who the room key came from. This allows homeservers to try to insert room keys of questionable validity, potentially mounting an impersonation attack. Version 0.20 fixes the issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/poljar/matrix-nio
Files changed:
nio/crypto/olm_machine.py
Commit message: fix(crypto): Only accept forwarded room keys from our own trusted devices


Vulnerable code:
    # This function is copyrighted under the Apache 2.0 license Zil0
    def _handle_forwarded_room_key_event(
        sender,  # type: str
        sender_key,  # type: str
        payload,  # type: Dict[Any, Any]
    ):
        # type: (...) -> Union[ForwardedRoomKeyEvent, BadEventType, None]
        event = ForwardedRoomKeyEvent.from_dict(payload, sender, sender_key)

        if isinstance(event, (BadEvent, UnknownBadEvent)):
            return event

            return None

        if event.session_id not in self.outgoing_key_requests:
            return None
        key_request = self.outgoing_key_requests.pop(key_request.request_id)

Fixed code:
    def _should_accept_forward(
        sender: str,
        sender_key: str,
        event: ForwardedRoomKeyEvent,
    ) -> bool:
            return False
        elif event.session_id not in self.outgoing_key_requests:
            return False
            return False

        device = self.device_store.device_from_sender_key(event.sender, sender_key)

        # Only accept forwarded room keys from our own trusted devices
        if not device or not device.verified or not device.user_id == self.user_id:
            logger.warn(
                "Received a forwarded room key from a untrusted device "
                f"{event.sender}, {sender_key}"
            )
            return False

        return True

    # This function is copyrighted under the Apache 2.0 license Zil0
    def _handle_forwarded_room_key_event(
        self,
        sender,  # type: str
        sender_key,  # type: str
        payload,  # type: Dict[Any, Any]
    ):
        # type: (...) -> Union[ForwardedRoomKeyEvent, BadEventType, None]
        event = ForwardedRoomKeyEvent.from_dict(payload, sender, sender_key)

        if isinstance(event, (BadEvent, UnknownBadEvent)):
            return event

        if not self._should_accept_forward(sender, sender_key, event):
        key_request = self.outgoing_key_requests.pop(event.session_id)
CVE-2021-39131 (JavaScript, published 2021-08-17T23:15Z)
Description: value: ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/sonicdoe/ced
Files changed:
index.js
test.js
Commit message: Throw TypeError if argument is not a buffer


Vulnerable code:

Fixed code:
  if (!Buffer.isBuffer(buf)) {
    throw new TypeError('Expected a buffer')
  }


test('throws a TypeError if the argument is not a buffer', t => {
  t.throws(() => {
    ced('tést')
  }, TypeError)
})
CVE-2022-31026 (Unknown, published 2022-06-09T13:15Z)
Description: value: Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/github/trilogy
Files changed:
Commit message: Merge pull request from GHSA-5g4r-2qhx-vqfm

Verify exact length of auth_data_len

Vulnerable code:

Fixed code:
CVE-2022-4588 (Other, published 2022-12-17T13:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in Boston Sleep slice up to 84.1.x. Affected is an unknown function of the component Layout Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 84.2.0 is able to address this issue. The name of the patch is 6523bb17d889e2ab13d767f38afefdb37083f1d0. It is recommended to upgrade the affected component. VDB-216174 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sleepepi/slice
Files changed:
CHANGELOG.md
app/views/layouts/application.html.haml
app/views/layouts/full_page.html.haml
app/views/layouts/full_page_sidebar.html.haml
app/views/layouts/full_page_sidebar_dark.html.haml
Commit message: Fixed a Cross Site Scripting (XSS) issue


Vulnerable code:
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ").html_safe
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ").html_safe
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ").html_safe
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ").html_safe

Fixed code:
### Enhancements
- **Security Changes**
  - Fixed a Cross Site Scripting (XSS) issue

    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ")
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ")
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ")
    %title= [@title, @subject.try(:subject_code_was), @project.try(:name), ENV["website_name"]].flatten.compact.uniq.join(" - ")
CVE-2022-24851 (Other, published 2022-04-15T19:15Z)
Description: value: LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an user can enter relative paths like ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The issue is fixed in version 7.9.1.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LDAPAccountManager/lam
Files changed:
lam/HISTORY
lam/lib/html.inc
lam/templates/pdfedit/pdfpage.php
Commit message: #170 fixed security issues in profile editor and PDF editor


Vulnerable code:
				$this->fieldValue = deobfuscateText($values[$this->fieldName][0]);
				$this->fieldValue = $values[$this->fieldName][0];
                2007 - 2021  Roland Gruber
	updateBasicSettings($_SESSION['currentPDFStructure']);
$logoFiles = $pdfStructurePersistenceManager->getPdfLogos($_SESSION['config']->getName(), true);
 * @param PDFStructure $structure
function updateBasicSettings(PDFStructure &$structure) {
		$structure->setLogo($_POST['logoFile']);

Fixed code:
   -> Security issues in PDF editor and profile editor
				$this->fieldValue = htmlspecialchars(deobfuscateText($values[$this->fieldName][0]));
				$this->fieldValue = htmlspecialchars($values[$this->fieldName][0]);
use LAM\PDF\PdfLogo;
                2007 - 2022  Roland Gruber
$logoFiles = $pdfStructurePersistenceManager->getPdfLogos($_SESSION['config']->getName(), true);
	updateBasicSettings($_SESSION['currentPDFStructure'], $logoFiles);
 * @param PDFStructure $structure PDF structure
 * @param PdfLogo[] $logoFiles logos
function updateBasicSettings(PDFStructure &$structure, array $logoFiles) {
	    $fileName = $_POST['logoFile'];
	    $found = false;
	    foreach ($logoFiles as $logoFile) {
	        if ($logoFile->getName() === $fileName) {
	            $found = true;
            }
        }
	    if (!$found) {
	        logNewMessage(LOG_ERR, 'Invalid PDF logo file: ' . $fileName);
	        return;
        }
		$structure->setLogo($fileName);
CVE-2022-31084 (Unknown, published 2022-06-27T21:15Z)
Description: value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/LDAPAccountManager/lam
Files changed:
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes

Vulnerable code:

Fixed code:
CVE-2022-31085 (Unknown, published 2022-06-27T21:15Z)
Description: value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/LDAPAccountManager/lam
Files changed:
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes

Vulnerable code:

Fixed code:
CVE-2022-31086 (Unknown, published 2022-06-27T21:15Z)
Description: value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/LDAPAccountManager/lam
Files changed:
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes

Vulnerable code:

Fixed code:
CVE-2022-31087 (Unknown, published 2022-06-27T21:15Z)
Description: value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/LDAPAccountManager/lam
Files changed:
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes

Vulnerable code:

Fixed code:
CVE-2022-31088 (Unknown, published 2022-06-27T21:15Z)
Description: value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/LDAPAccountManager/lam
Files changed:
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes

Vulnerable code:

Fixed code:
CVE-2020-7735 (TypeScript, published 2020-09-25T12:15Z)
Description: value: The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
Severity: MEDIUM (CVSS v3 base score: 6.6)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ng-packagr/ng-packagr
Files changed:
integration/samples/scss-paths/baz/baz component.less	
integration/samples/scss-paths/specs/metadata.ts
src/lib/styles/stylesheet-processor.ts
Commit message: fix: replace execFile with execFileSync to fix a potential malicious cmd injection


Vulnerable code:
@import 'less/test/less/debug/linenumbers';
    it(`should resolve the styles from the Less 'node_module' file ~`, () => {
import { execSync } from 'child_process';
    result.warnings().forEach((msg) => log.warn(msg.toString()));
        let cmd = `node "${require.resolve('less/bin/lessc')}" "${filePath}" --js`;
          cmd += ` --include-path="${this.styleIncludePaths.join(':')}"`;
        return execSync(cmd).toString();
      .filter((plugin) => !asyncPlugins.includes(plugin.postcssPlugin));

Fixed code:
    xit(`should resolve the styles from the Less 'node_module' file ~`, () => {
import { execFileSync } from 'child_process';
    result.warnings().forEach(msg => log.warn(msg.toString()));
        const args = [filePath, '--js'];
          args.push(`--include-path=${this.styleIncludePaths.join(':')}`);
        return execFileSync(require.resolve('less/bin/lessc'), args).toString();
      .filter(plugin => !asyncPlugins.includes(plugin.postcssPlugin));
CVE-2022-4877 (Other, published 2023-01-05T10:15Z)
Description: value: A vulnerability has been found in snoyberg keter up to 1.8.1 and classified as problematic. This vulnerability affects unknown code of the file Keter/Proxy.hs. The manipulation of the argument host leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is d41f3697926b231782a3ad8050f5af1ce5cc40b7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217444.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snoyberg/keter
Files changed:
ChangeLog.md
Keter/Proxy.hs
keter.cabal
Commit message: Fix potential xss issue in missing host response

The host field can be spoofed,
which allows an xss attack.
Eg you can put a bunch of javascript
(or whatever html) in the hostfield and
response to trick the user.
These chagnes make that impossible.


Vulnerable code:
import           Blaze.ByteString.Builder          (copyByteString)
  <> host <> "</code>, is not recognized.</p></body></html>"
Version:             1.8.1

Fixed code:
## 1.8.2 

+ Fix XSS issue in the default response.
  (special thanks to Max @ulidtko for spotting and fixing this)

import           Blaze.ByteString.Builder          (copyByteString, toByteString)
import           Blaze.ByteString.Builder.Html.Word(fromHtmlEscapedByteString)
  <> escapeHtml host <> "</code>, is not recognized.</p></body></html>"

escapeHtml :: ByteString -> ByteString
escapeHtml = toByteString . fromHtmlEscapedByteString
Version:             1.8.2
CVE-2020-5232 (Unknown, published 2020-01-31T00:15Z)
Description: value: A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consent or awareness. A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry.
Severity: MEDIUM (CVSS v3 base score: 8.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/ensdomains/ens
Files changed:
Commit message: Merge pull request from GHSA-8f9f-pc5v-9r5h

feature/migration

Vulnerable code:

Fixed code:
CVE-2024-22365 (C, published 2024-02-06T08:15Z)
Description: value: linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/linux-pam/linux-pam
Files changed:
modules/pam_namespace/pam_namespace.c
Commit message: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations

Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
being placed in user controlled directories, causing the PAM module to
block indefinitely during `openat()`.

Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
refer to a directory.

With this the check whether the final path element is a directory
becomes unnecessary, drop it.


Vulnerable code:
	int flags = O_RDONLY;
	if (rv != -1) {
		if (fstat(rv, &st) != 0) {
			save_errno = errno;
			close(rv);
			rv = -1;
			errno = save_errno;
			goto error;
		}
		if (!S_ISDIR(st.st_mode)) {
			close(rv);
			errno = ENOTDIR;
			rv = -1;
			goto error;
		}
	}


Fixed code:
	int flags = O_RDONLY | O_DIRECTORY;
CVE-2019-14323 (C, published 2019-07-28T13:15Z)
Description: value: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/troglobit/ssdp-responder
Files changed:
ssdpd.c
Commit message: Fix #1: Ensure recv buf is always NUL terminated

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>


Vulnerable code:
	char buf[MAX_PKT_SIZE];
	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
		buf[len] = 0;


Fixed code:
	char buf[MAX_PKT_SIZE + 1];
	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);
CVE-2019-14323 (C, published 2019-07-28T13:15Z)
Description: value: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/troglobit/ssdp-responder
Files changed:
ssdpd.c
Commit message: Fix #1: Ensure recv buf is always NUL terminated

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>


Vulnerable code:
	char buf[MAX_PKT_SIZE];
	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
		buf[len] = 0;


Fixed code:
	char buf[MAX_PKT_SIZE + 1];
	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);