hitoshura25/cvefixes huggingface dataset:
CVE-2015-10099 (PHP, published 2023-04-10T12:15Z)
Description: value: A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/cp-appointment-calendar
Files changed:
dex_appointments.php
Commit message: Validation to prevent SQL injection.

git-svn-id: https://plugins.svn.wordpress.org/cp-appointment-calendar/trunk@1088427 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:

Fixed code:
   $itemnumber = intval($itemnumber);
CVE-2015-0823 (C++, published 2015-02-25T11:59Z)
Description: value: Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/khaledhosny/ots
Files changed:
src/gasp.cc
src/gdef.cc
src/gpos.cc
src/gsub.cc
src/hdmx.cc
src/kern.cc
src/ltsh.cc
src/math.cc
src/vdmx.cc
src/vorg.cc
Commit message: [ots] Fix (potential) use-after-free bugs

Make sure we don’t try to access the table after deleting it. Not all
the changed files are affected, but I changed them all for the sake of
consistency.


Vulnerable code:
    delete file->gasp; \
    file->gasp = 0; \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    delete file->hdmx; \
    file->hdmx = 0; \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    delete file->ltsh; \
    file->ltsh = 0; \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    delete file->vdmx; \
    file->vdmx = 0; \
    delete file->vorg; \
    file->vorg = 0; \

Fixed code:
    delete file->gasp; \
    file->gasp = 0; \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    delete file->hdmx; \
    file->hdmx = 0; \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    delete file->ltsh; \
    file->ltsh = 0; \
    OTS_FAILURE_MSG(msg_ ", table discarded"); \
    delete file->vdmx; \
    file->vdmx = 0; \
    delete file->vorg; \
    file->vorg = 0; \
CVE-2020-11710 (YAML, published 2020-04-12T17:15Z)
Description: value: An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argue that this CVE is not a vulnerability because it has an inaccurate bug scope and patch links. “1) Inaccurate Bug Scope - The issue scope was on Kong's docker-compose template, and not Kong's docker image itself. In reality, this issue is not associated with any version of the Kong gateway. As such, the description stating ‘An issue was discovered in docker-kong (for Kong) through 2.0.3.’ is incorrect. This issue only occurs if a user decided to spin up Kong via docker-compose without following the security documentation. The docker-compose template is meant for users to quickly get started with Kong, and is meant for development purposes only. 2) Incorrect Patch Links - The CVE currently points to a documentation improvement as a “Patch” link: https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611.This link actually points to an improvement Kong Inc made for fool-proofing. However, instructions for how to protect the admin API were already well-documented here: https://docs.konghq.com/2.0.x/secure-admin-api/#network-layer-access-restrictions , which was first published back in 2017 (as shown in this commit: https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949) Lastly, the hyperlink to https://github.com/Kong/kong (an unrelated Github Repo to this issue) on the Hyperlink list does not include any meaningful information on this topic.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/Kong/docker-kong
Files changed:
compose/docker-compose.yml
tests.sh
Commit message: chore(admin) restrict the admin port to 127 (#350)

* fix(admin) bind admin port to 127 only

* tests need to adjust the compose file for swarm vs docker-compose

Vulnerable code:
      - "8001:8001/tcp"
      - "8444:8444/tcp"


Fixed code:
      - "127.0.0.1:8001:8001/tcp"
      - "127.0.0.1:8444:8444/tcp"
sed -i -e 's/127.0.0.1://g' docker-compose.yml
git checkout -- docker-compose.yml
CVE-2021-21400 (Other, published 2021-04-02T15:15Z)
Description: value: wire-webapp is an open-source front end for Wire, a secure collaboration platform. In wire-webapp before version 2021-03-15-production.0, when being prompted to enter the app-lock passphrase, the typed passphrase will be sent into the most recently used chat when the user does not actively give focus to the input field. Input element focus is enforced programatically in version 2021-03-15-production.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wireapp/wire-webapp
Files changed:
src/script/page/AppLock.tsx
Commit message: fix: Force focus on input elements in AppLock modal (#10704)



Vulnerable code:

Fixed code:
  const focusElement = (input: HTMLInputElement) => setTimeout(() => input?.focus());
  const forceFocus = ({target}: React.FocusEvent<HTMLInputElement>) => focusElement(target);

              onBlur={forceFocus}
              ref={focusElement}
              onBlur={forceFocus}
              ref={focusElement}
              onBlur={forceFocus}
              ref={focusElement}
              onBlur={forceFocus}
              ref={focusElement}
CVE-2021-32683 (TypeScript, published 2021-06-15T20:15Z)
Description: value: wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab (right click -> open in new tab, or copy the URL and paste it in the URL bar), an the image payload is executed on the domain hosting the app (app.wire.com). In particular, if an image contains malicious code in addition to the actual picture, this code is executed on app.wire.com. This allows the attacker to fully control the user account. The vulnerability was patched in version 2021-06-01-production.0. As a workaround, users should not try to open image URLs.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wireapp/wire-webapp
Files changed:
src/page/template/content/conversation/input-bar.htm
src/script/Config.ts
src/script/components/asset/imageAsset.ts
src/script/view_model/content/InputBarViewModel.ts
src/worker/image-worker.js
Commit message: refactor: Remove jpeg-large support


Vulnerable code:
                <input data-bind="attr: {accept: allowedImageTypes}, file_select: uploadImages" type="file" multiple="multiple" data-uie-name="do-share-image"/>
  readonly ALLOWED_IMAGE_TYPES = ['image/bmp', 'image/gif', 'image/jpeg', 'image/jpg', 'image/png', '.jpg-large'];
            .then(blob => {
              this.imageUrl(window.URL.createObjectURL(blob));
  readonly allowedImageTypes: string;
    this.allowedImageTypes = Config.getConfig().ALLOWED_IMAGE_TYPES.join(',');

Fixed code:
                <input data-bind="attr: {accept: acceptedImageTypes}, file_select: uploadImages" type="file" multiple="multiple" data-uie-name="do-share-image"/>
  /** Image MIME types */
  readonly ALLOWED_IMAGE_TYPES = ['image/bmp', 'image/gif', 'image/jpeg', 'image/jpg', 'image/png'];
import {Config} from '../../Config';
            .then((blob: Blob) => {
              const allowedImageTypes = [
                'application/octet-stream', // Octet-stream is required to paste images from clipboard
                ...Config.getConfig().ALLOWED_IMAGE_TYPES,
              ];
              if (allowedImageTypes.includes(blob.type)) {
                this.imageUrl(window.URL.createObjectURL(blob));
              } else {
                throw new Error(`Unsupported image type "${blob.type}".`);
              }
  /** MIME types and file extensions are accepted */
  readonly acceptedImageTypes: string;
    this.acceptedImageTypes = Config.getConfig().ALLOWED_IMAGE_TYPES.join(',');
  // Unfortunately, Jimp doesn't support MIME type "image/webp": https://github.com/oliver-moran/jimp/issues/144
CVE-2022-23605 (Unknown, published 2022-02-04T23:15Z)
Description: value: Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral messages and assets might still be accessible through the local search functionality. Any attempt to view one of these message in the chat view will then trigger the deletion. This issue only affects locally stored messages. On premise instances of wire-webapp need to be updated to 2022-01-27-production.0, so that their users are no longer affected. There are no known workarounds for this issue.
Severity: LOW (CVSS v3 base score: 2.3)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/wireapp/wire-webapp
Files changed:
Commit message: Merge pull request from GHSA-2w3m-ppfg-hg62

fix(core): Improve ephemeral message handling

Vulnerable code:

Fixed code:
CVE-2022-24799 (TypeScript, published 2022-04-20T18:15Z)
Description: value: wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious message, arbitrary code is injected and executed in the context of the victim. This allows the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-03-30-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0), so that their applications are no longer affected. There are no known workarounds for this issue. ### Patches * The issue has been fixed in wire-webapp **2022-03-30-production.0** and is already deployed on all Wire managed services. * On-premise instances of wire-webapp need to be updated to docker tag **2022-03-30-production.0-v0.29.2-0-d144552** or wire-server **2022-03-30 (chart/4.8.0)**, so that their applications are no longer affected. ### Workarounds * No workarounds known ### For more information If you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com) ### Credits We thank [Posix](https://twitter.com/po6ix) for reporting this vulnerability
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wireapp/wire-webapp
Files changed:
src/script/util/messageRenderer.ts
Commit message: fix: Improve message rendering (#12748)



Vulnerable code:
        return code;
          (text, [mentionHash, mention]) => text.replace(mentionHash, mention.text),
    return text.replace(mentionHash, mentionMarkup);

Fixed code:
        return escape(code);
          (text, [mentionHash, mention]) => text.replace(mentionHash, () => mention.text),
    return text.replace(mentionHash, () => mentionMarkup);
CVE-2022-0552 (Other, published 2022-04-11T20:15Z)
Description: value: A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/openshift/origin-aggregated-logging
Files changed:
elasticsearch/Dockerfile
elasticsearch/Dockerfile.in
elasticsearch/fetch-artifacts-koji.yaml
Commit message: Update netty to 4.1.63


Vulnerable code:
    ES_VER=6.8.1.redhat-00018 \
    OPENDISTRO_VER=0.10.1.2-redhat-00006 \
    ES_VER=6.8.1.redhat-00018 \
    OPENDISTRO_VER=0.10.1.2-redhat-00006 \
- nvr: org.elasticsearch-elasticsearch-6.8.1.redhat_00018-1
- nvr: com.amazon.opendistroforelasticsearch-opendistro_security-0.10.1.2_redhat_00006-1

Fixed code:
    ES_VER=6.8.1.redhat-00019 \
    OPENDISTRO_VER=0.10.1.2-redhat-00009 \
    ES_VER=6.8.1.redhat-00019 \
    OPENDISTRO_VER=0.10.1.2-redhat-00009 \
- nvr: org.elasticsearch-elasticsearch-6.8.1.redhat_00019-1
- nvr: com.amazon.opendistroforelasticsearch-opendistro_security-0.10.1.2_redhat_00009-1
CVE-2024-36400 (Unknown, published 2024-06-04T15:15Z)
Description: value: nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-331 \u2014 Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Repository: https://github.com/viz-rs/nano-id
Files changed:
Commit message: Merge pull request #10 from viz-rs/fix-security

bump: v0.4.0

Vulnerable code:

Fixed code:
CVE-2021-43725 (PHP, published 2022-03-28T13:15Z)
Description: value: There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/spotweb/spotweb
Files changed:
lib/page/SpotPage_login.php
Commit message: Update SpotPage_login.php

For for issue: https://github.com/spotweb/spotweb/issues/718

Vulnerable code:

Fixed code:
        
        // Check redirect for chevrons, deny if found.
        if (preg_match('/[<>]/i', $this->_params['data']['performredirect'])) {			
		$result->addError(_('Script is not allowed'));
		}
CVE-2019-13568 (C, published 2019-07-31T15:15Z)
Description: value: CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/dtschump/CImg
Files changed:
CImg.h
Commit message: .


Vulnerable code:
        buffer.assign(cimg::abs(dy)*(dx_bytes + align_bytes),1,1,1,0);

Fixed code:
//        buffer.assign(cimg::abs(dy)*(dx_bytes + align_bytes),1,1,1,0);
        buffer.assign(buf_size,1,1,1,0);
CVE-2023-41049 (Unknown, published 2023-09-01T20:15Z)
Description: value: @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using  the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/decentraland/single-sign-on-client
Files changed:
Commit message: Merge pull request #2 from decentraland/feat/verify-url

feat: verify url

Vulnerable code:

Fixed code:
CVE-2015-5081 (Unknown, published 2017-08-18T18:29Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/divio/django-cms
Files changed:
Commit message: Merge pull request #4218 from divio/issues/merge_csrf_fix

Issues/merge csrf fix

Vulnerable code:

Fixed code:
CVE-2021-45930 (C++, published 2022-01-01T01:15Z)
Description: value: Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/qt/qtsvg
Files changed:
src/svg/qsvghandler.cpp
Commit message: Do stricter error checking when parsing path nodes

The SVG spec mandates that path parsing should terminate on the first
error encountered, and an error be reported. To improve the handling
of corrupt files, implement such error handling, and also limit the
number of QPainterPath elements to a reasonable range.

Fixes: QTBUG-96044
Pick-to: 6.2 5.15 5.12
Change-Id: Ic5e65d6b658516d6f1317c72de365c8c7ad81891
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Robert Löhning <robert.loehning@qt.io>


Vulnerable code:
    while (str != end) {
        while (count > 0) {
                    num++;
                    count--;
                    num++;
                    count--;
                    num++;
                    count--;
                    num++;
                    count--;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                    num += count;
                    count = 0;
                return false;
    return true;
    //XXX do error handling
    parsePathDataFast(data, qpath);

Fixed code:
    const int maxElementCount = 0x7fff; // Assume file corruption if more path elements than this
    bool ok = true;
    while (ok && str != end) {
        while (ok && count > 0) {
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                    ok = false;
                ok = false;
                break;
            if (path.elementCount() > maxElementCount)
                ok = false;
    return ok;
    if (!parsePathDataFast(data, qpath))
        qCWarning(lcSvgHandler, "Invalid path data; path truncated.");