hitoshura25/cvefixes huggingface dataset:
CVE-2021-43839 (Other, published 2021-12-21T17:15Z)
Description: value: Cronos is a commercial implementation of a blockchain. In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. This problem has been patched in Cronos v0.6.5. There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-670 \u2014 Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Repository: https://github.com/crypto-org-chain/cronos
Files changed:
CHANGELOG.md
go.mod
go.sum
gomod2nix.toml
Commit message: Problem: MsgEthereumTx wrapping tx without the extension option is not rejected (#270)

* reject MsgEthereumTx wrapping tx without the extension option.

reject MsgEthereumTx wrapping tx without the extension option.

update gomod2nix

try to build in CI

fix GOPRIVATE

fix mount

update to public ethermint

* update changelog

* v0.6.5

Vulnerable code:
## Unreleased
replace github.com/tharsis/ethermint => github.com/crypto-org-chain/ethermint v0.7.2-cronos-4
github.com/crypto-org-chain/ethermint v0.7.2-cronos-4 h1:NaCc0L5zN2u7B9WofmhJfur23UDebWSRD+Goqf9URnY=
github.com/crypto-org-chain/ethermint v0.7.2-cronos-4/go.mod h1:J96LX4KvLyl+5jV6+mt/4l6srtGX/mdDTuqQQuYrdDk=
  sumVersion = "v0.7.2-cronos-4"
    rev = "82805507f7d2e83cad547736883dc22acfb52440"
    sha256 = "01f9i8vq0jqml676wvh0kr9kxg7grqw7f64g1qd81pzm2n89k7pn"

Fixed code:
## v0.6.5

### Bug Fixes

- [cronos#255](https://github.com/crypto-org-chain/cronos/pull/255) fix empty topics in non-breaking way
- [cronos#270](https://github.com/crypto-org-chain/cronos/pull/270) reject MsgEthereumTx wrapping tx without the extension option.
replace github.com/tharsis/ethermint => github.com/crypto-org-chain/ethermint v0.7.2-cronos-6
github.com/crypto-org-chain/ethermint v0.7.2-cronos-6 h1:AHmZ4d/VvRPYEwRK8WATDVgAW+LQLuus9/oRo8UHkB4=
github.com/crypto-org-chain/ethermint v0.7.2-cronos-6/go.mod h1:J96LX4KvLyl+5jV6+mt/4l6srtGX/mdDTuqQQuYrdDk=
  sumVersion = "v0.7.2-cronos-6"
    rev = "60af027299c1aec580240d1e03d66c0ad100934b"
    sha256 = "1074b5rbi1l0ija5iz4i9d92r1as030wkqllz5ga0ahhqrgb2rp9"
CVE-2021-32796 (JavaScript, published 2021-07-27T22:15Z)
Description: value: xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/xmldom/xmldom
Files changed:
lib/dom.js
test/dom/serializer.test.js
Commit message: Merge pull request from GHSA-5fg8-2547-mr8q

resolves https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q

Vulnerable code:
				var ns = prefix ? ' xmlns:' + prefix : " xmlns";
				buf.push(ns, '="' , uri , '"');
			var ns = prefix ? ' xmlns:' + prefix : " xmlns";
			buf.push(ns, '="' , uri , '"');
		/**
		 * Well-formedness constraint: No < in Attribute Values
		 * The replacement text of any entity referred to directly or indirectly in an attribute value must not contain a <.
		 * @see https://www.w3.org/TR/xml/#CleanAttrVals
		 * @see https://www.w3.org/TR/xml/#NT-AttValue
		 */
		return buf.push(' ', node.name, '="', node.value.replace(/[<&"]/g,_xmlEncoder), '"');

Fixed code:
/**
 * Well-formed constraint: No < in Attribute Values
 * The replacement text of any entity referred to directly or indirectly in an attribute value must not contain a <.
 * @see https://www.w3.org/TR/xml/#CleanAttrVals
 * @see https://www.w3.org/TR/xml/#NT-AttValue
 */
function addSerializedAttribute(buf, qualifiedName, value) {
	buf.push(' ', qualifiedName, '="', value.replace(/[<&"]/g,_xmlEncoder), '"')
}
				addSerializedAttribute(buf, prefix ? 'xmlns:' + prefix : "xmlns", uri);
			addSerializedAttribute(buf, prefix ? 'xmlns:' + prefix : "xmlns", uri);
		return addSerializedAttribute(buf, node.name, node.value);
	describe('properly escapes attribute values', () => {
		it('should escape special characters in namespace attributes', () => {
			const input = `<xml xmlns='<&"' xmlns:attr='"&<'><test attr:test=""/></xml>`
			const doc = new DOMParser().parseFromString(input, MIME_TYPE.XML_TEXT)

			// in this case the explicit attribute nodes are serialized
			expect(new XMLSerializer().serializeToString(doc)).toBe(
				'<xml xmlns="&lt;&amp;&quot;" xmlns:attr="&quot;&amp;&lt;"><test attr:test=""/></xml>'
			)

			// in this case the namespace attributes are "inherited" from the parent,
			// which is not serialized
			expect(
				new XMLSerializer().serializeToString(doc.documentElement.firstChild)
			).toBe(
				'<test xmlns:attr="&quot;&amp;&lt;" attr:test="" xmlns="&lt;&amp;&quot;"/>'
			)
		})
	})
CVE-2021-32796 (JavaScript, published 2021-07-27T22:15Z)
Description: value: xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-91 \u2014 XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Repository: https://github.com/xmldom/xmldom
Files changed:
lib/dom.js
test/dom/serializer.test.js
Commit message: Merge pull request from GHSA-5fg8-2547-mr8q

resolves https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q

Vulnerable code:
				var ns = prefix ? ' xmlns:' + prefix : " xmlns";
				buf.push(ns, '="' , uri , '"');
			var ns = prefix ? ' xmlns:' + prefix : " xmlns";
			buf.push(ns, '="' , uri , '"');
		/**
		 * Well-formedness constraint: No < in Attribute Values
		 * The replacement text of any entity referred to directly or indirectly in an attribute value must not contain a <.
		 * @see https://www.w3.org/TR/xml/#CleanAttrVals
		 * @see https://www.w3.org/TR/xml/#NT-AttValue
		 */
		return buf.push(' ', node.name, '="', node.value.replace(/[<&"]/g,_xmlEncoder), '"');

Fixed code:
/**
 * Well-formed constraint: No < in Attribute Values
 * The replacement text of any entity referred to directly or indirectly in an attribute value must not contain a <.
 * @see https://www.w3.org/TR/xml/#CleanAttrVals
 * @see https://www.w3.org/TR/xml/#NT-AttValue
 */
function addSerializedAttribute(buf, qualifiedName, value) {
	buf.push(' ', qualifiedName, '="', value.replace(/[<&"]/g,_xmlEncoder), '"')
}
				addSerializedAttribute(buf, prefix ? 'xmlns:' + prefix : "xmlns", uri);
			addSerializedAttribute(buf, prefix ? 'xmlns:' + prefix : "xmlns", uri);
		return addSerializedAttribute(buf, node.name, node.value);
	describe('properly escapes attribute values', () => {
		it('should escape special characters in namespace attributes', () => {
			const input = `<xml xmlns='<&"' xmlns:attr='"&<'><test attr:test=""/></xml>`
			const doc = new DOMParser().parseFromString(input, MIME_TYPE.XML_TEXT)

			// in this case the explicit attribute nodes are serialized
			expect(new XMLSerializer().serializeToString(doc)).toBe(
				'<xml xmlns="&lt;&amp;&quot;" xmlns:attr="&quot;&amp;&lt;"><test attr:test=""/></xml>'
			)

			// in this case the namespace attributes are "inherited" from the parent,
			// which is not serialized
			expect(
				new XMLSerializer().serializeToString(doc.documentElement.firstChild)
			).toBe(
				'<test xmlns:attr="&quot;&amp;&lt;" attr:test="" xmlns="&lt;&amp;&quot;"/>'
			)
		})
	})
CVE-2017-16025 (JavaScript, published 2018-06-04T19:29Z)
Description: value: Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vulnerability via an invalid Cookie header. This is only present when websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to error out.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/hapijs/nes
Files changed:
lib/socket.js
package.json
test/auth.js
Commit message: Fix invalid cookie header. Closes #171


Vulnerable code:
    this._listener._connection.states.parse(cookies, (ignoreErr, state, failed) => {
  "version": "6.4.0",
    "lab": "11.x.x"

Fixed code:
    this._listener._connection.states.parse(cookies, (err, state, failed) => {

        if (err) {
            this.auth._error = Boom.unauthorized('Invalid nes authentication cookie');
            return;
        }
  "version": "6.4.1",
    "lab": "13.x.x"
        it('errors on invalid cookie', (done) => {

            const server = new Hapi.Server();
            server.connection();

            server.register({ register: Nes, options: { auth: { type: 'cookie' } } }, (err) => {

                expect(err).to.not.exist();

                server.auth.scheme('custom', internals.implementation);
                server.auth.strategy('default', 'custom', true);

                server.route({
                    method: 'GET',
                    path: '/',
                    handler: function (request, reply) {

                        return reply('hello');
                    }
                });

                server.start((err) => {

                    expect(err).to.not.exist();
                    const client = new Nes.Client('http://localhost:' + server.info.port, { ws: { headers: { cookie: '"' } } });
                    client.connect((err) => {

                        expect(err).to.be.an.error('Invalid nes authentication cookie');
                        client.disconnect();
                        server.stop(done);
                    });
                });
            });
        });
CVE-2021-3810 (TypeScript, published 2021-09-17T07:15Z)
Description: value: code-server is vulnerable to Inefficient Regular Expression Complexity
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/cdr/code-server
Files changed:
src/node/util.ts
Commit message: [Security] Fix ReDoS

Fix potential ReDoS

Vulnerable code:
  "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",

Fixed code:
  "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",
CVE-2022-2941 (PHP, published 2022-09-06T18:15Z)
Description: value: The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lesterchan/wp-useronline
Files changed:
README.md
admin.php
wp-useronline.php
Commit message: Fixed XSS. Props Juampa Rodriguez


Vulnerable code:
Stable tag: 2.88.0  
		foreach ( $options['templates'] as $key => $template )
			if ( is_array( $template ) )
			else
										'desc' => html( 'td', '%input%' )
Version: 2.88.0

Fixed code:
Stable tag: 2.88.1  
### 2.88.1
* FIXED: Fixed XSS. Props Juampa Rodriguez.

		foreach ( $options['naming'] as $key => $template ) {
			$options['naming'][$key] = wp_kses_post( trim( $template ) );
		}
		foreach ( $options['templates'] as $key => $template ) {
			if ( is_array( $template ) ) {
				if ( ! empty( $template['separators'] ) && is_array( $template['separators'] ) ) {
						foreach( $template['separators'] as $seperator_key => $seperator_value ) {
							$options['templates'][$key]['separators'][$seperator_key] = wp_kses_post( trim( $seperator_value ) );
						}
				}
			} else {
			}
		}
										'desc' => html( 'td', $type )
Version: 2.88.1
CVE-2020-14354 (C, published 2021-05-13T14:15Z)
Description: value: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/c-ares/c-ares
Files changed:
ares_getaddrinfo.c
Commit message: Prevent possible double-free in ares_getaddrinfo() if ares_destroy() is called

In the event that ares_destroy() is called prior to ares_getaddrinfo() completing,
it would result in an invalid read and double-free due to calling end_hquery() twice.

Reported By: Jann Horn @ Google Project Zero


Vulnerable code:

Fixed code:
      return;
CVE-2020-14354 (C, published 2021-05-13T14:15Z)
Description: value: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/c-ares/c-ares
Files changed:
ares_getaddrinfo.c
Commit message: Prevent possible double-free in ares_getaddrinfo() if ares_destroy() is called

In the event that ares_destroy() is called prior to ares_getaddrinfo() completing,
it would result in an invalid read and double-free due to calling end_hquery() twice.

Reported By: Jann Horn @ Google Project Zero


Vulnerable code:

Fixed code:
      return;
CVE-2024-25629 (C, published 2024-02-23T15:15Z)
Description: value: c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/c-ares/c-ares
Files changed:
src/lib/ares__read_line.c
Commit message: Merge pull request from GHSA-mg26-v6qh-x48q



Vulnerable code:

Fixed code:

    /* Probably means there was an embedded NULL as the first character in
     * the line, throw away line */
    if (len == 0) {
      offset = 0;
      continue;
    }
CVE-2012-3525 (C, published 2012-08-25T16:55Z)
Description: value: s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/Jabberd2/jabberd2
Files changed:
s2s/out.c
Commit message: Fixed possibility of Unsolicited Dialback Attacks

Vulnerable code:
    if(nad_find_attr(nad, 0, -1, "type", "valid") >= 0) {
    if(attr >= 0) {

Fixed code:
    if(nad_find_attr(nad, 0, -1, "type", "valid") >= 0 && xhash_get(out->states, rkey) == (void*) conn_INPROGRESS) {
    if(attr >= 0 && xhash_get(in->states, rkey) == (void*) conn_INPROGRESS) {
CVE-2021-43781 (Python, published 2021-12-06T18:15Z)
Description: value: Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/inveniosoftware/invenio-drafts-resources
Files changed:
invenio_drafts_resources/services/records/service.py
Commit message: security: fix missing permission check of publish

* Invenio-Drafts-Resources does not properly check permissions when a
  record is published. The vulnerability is exploitable in a default
  installation of InvenioRDM. An authenticated a user is able via REST
  API calls to publish draft records of other users if they know the
  record identifier and the draft validates (e.g. all require fields
  filled out). An attacker is not able to modify the data in the record,
  and thus e.g. cannot change a record from restricted to public.


Vulnerable code:
        self.require_permission(identity, "publish")


Fixed code:
        self.require_permission(identity, "publish", record=draft)
CVE-2024-27303 (Other, published 2024-03-06T19:15Z)
Description: value: electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/electron-userland/electron-builder
Files changed:
.changeset/large-trainers-enjoy.md
packages/app-builder-lib/templates/nsis/include/allowOnlyOneInstallerInstance.nsh
Commit message: fix: execute `%SYSTEMROOT%` cmd.exe directly during NSIS installer (#8059)



Vulnerable code:
    nsExec::Exec `cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ${_FILE}" /FO csv | %SYSTEMROOT%\System32\find.exe "${_FILE}"`
        nsExec::Exec `cmd /c taskkill /im "${APP_EXECUTABLE_FILENAME}" /fi "PID ne $pid" /fi "USERNAME eq %USERNAME%"`
            nsExec::Exec `cmd /c taskkill /f /im "${APP_EXECUTABLE_FILENAME}" /fi "PID ne $pid" /fi "USERNAME eq %USERNAME%"`

Fixed code:
---
"app-builder-lib": patch
---

fix: execute %SYSTEMROOT% cmd.exe directly during NSIS installer
    nsExec::Exec `%SYSTEMROOT%\System32\cmd.exe /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq ${_FILE}" /FO csv | %SYSTEMROOT%\System32\find.exe "${_FILE}"`
        nsExec::Exec `%SYSTEMROOT%\System32\cmd.exe /c taskkill /im "${APP_EXECUTABLE_FILENAME}" /fi "PID ne $pid" /fi "USERNAME eq %USERNAME%"`
            nsExec::Exec `%SYSTEMROOT%\System32\cmd.exe /c taskkill /f /im "${APP_EXECUTABLE_FILENAME}" /fi "PID ne $pid" /fi "USERNAME eq %USERNAME%"`