hitoshura25/cvefixes huggingface dataset:
CVE-2024-28865 (Python, published 2024-03-18T22:15Z)
Description: value: django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article content that can cause severe use of server CPU through a regular expression loop. Version 0.10.1 fixes this issue. As a workaround, close off access to create and edit articles by anonymous users.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/django-wiki/django-wiki
Files changed:
docs/release_notes.rst
src/wiki/core/markdown/mdx/codehilite.py
src/wiki/plugins/macros/mdx/macro.py
src/wiki/templatetags/wiki_tags.py
tests/plugins/macros/test_toc.py
Commit message: Merge pull request from GHSA-wj85-w4f4-xh8h (#1350)

* ReDos: Apply `re.escape` to unsafe variable `keyword` before passing to `re.compile`

* Replace ReDos-vulnerable regex with the one from upstream Python-Markdown

* ReDos backtracking fix for macro plugin

* Add release note for GHSA-wj85-w4f4-xh8h

* Bump release date

* Bump version

Vulnerable code:
        r"""
(?P<fence>^(?:~{3,}|`{3,}))[ ]*         # Opening ``` or ~~~
(\{?\.?(?P<lang>[a-zA-Z0-9_+-]*))?[ ]*  # Optional {, and lang
# Optional highlight lines, single- or double-quote-delimited
(hl_lines=(?P<quot>"|')(?P<hl_lines>.*?)(?P=quot))?[ ]*
}?[ ]*\n                                # Optional closing }
(?P<code>.*?)(?<=\n)
(?P=fence)[ ]*$""",
MACRO_RE = r"(\[(?P<macro>\w+)(?P<kwargs>\s\w+\:.+)*\])"
        kw_p = re.compile(r"(\S*%s\S*)" % keyword, re.IGNORECASE)

Fixed code:
0.10.1
------

Released on 2024-03-16

Security
~~~~~~~~

* Fixes reDOS issues: Denial of Service possible through unsafe regular expressions `GHSA-wj85-w4f4-xh8h <https://github.com/django-wiki/django-wiki/security/advisories/GHSA-wj85-w4f4-xh8h>`__ (Santos Gallegos, Benjamin Balder Bach)


from textwrap import dedent


        dedent(
            r"""
            (?P<fence>^(?:~{3,}|`{3,}))[ ]*                          # opening fence
            ((\{(?P<attrs>[^\}\n]*)\})|                              # (optional {attrs} or
            (\.?(?P<lang>[\w#.+-]*)[ ]*)?                            # optional (.)lang
            (hl_lines=(?P<quot>"|')(?P<hl_lines>.*?)(?P=quot)[ ]*)?) # optional hl_lines)
            \n                                                       # newline (end of opening fence)
            (?P<code>.*?)(?<=\n)                                     # the code block
            (?P=fence)[ ]*$                                          # closing fence
        """
        ),

MACRO_RE = (
    r"""\[(?P<macro>\w+)(?P<kwargs>(\s+\w+\:([^\:\]\s]+|'[^']+'))+)*\]"""
)



        kw_p = re.compile(r"(\S*%s\S*)" % re.escape(keyword), re.IGNORECASE)
    maxDiff = None
CVE-2023-27475 (Go, published 2023-03-07T18:15Z)
Description: value: Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gookit/goutil
Files changed:
fsutil/operate.go
Commit message: fix zipslip


Vulnerable code:

Fixed code:
	"fmt"
	"strings"

		if strings.Contains(file.Name, "..") {
			return fmt.Errorf("illegal file path in zip: %v", file.Name)
		}
CVE-2015-10045 (PHP, published 2023-01-15T10:15Z)
Description: value: A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/tutrantta/project_todolist
Files changed:
library/Database.php
Commit message: add SQL injection preventor


Vulnerable code:
				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $value . "'";
			if(is_string($value)) $arrValues[] = " '$value' ";
			if(is_string($value)) $arrTempValue[] = "$key = '$value' ";

Fixed code:
	function sqlInjectionPrevent($value) {
		return mysqli_real_escape_string($this->connection, $value);
	}

				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $this->sqlInjectionPrevent($value) . "'";
		var_dump($sql);
			if(is_string($value)) $arrValues[] = " '" . $this->sqlInjectionPrevent($value) . "' ";
			if(is_string($value)) $arrTempValue[] = "$key = '" . $this->sqlInjectionPrevent($value) . "' ";
CVE-2020-26225 (Unknown, published 2020-11-16T22:15Z)
Description: value: In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a malicious link. The problem was introduced in version 4.0.0 and is fixed in 4.2.0
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/productcomments
Files changed:
Commit message: Merge pull request from GHSA-58w4-w77w-qv3w

Make sure ajax requests are sent in application/json format

Vulnerable code:

Fixed code:
CVE-2020-26248 (Unknown, published 2020-12-03T21:15Z)
Description: value: In the PrestaShop module "productcomments" before version 4.2.1, an attacker can use a Blind SQL injection to retrieve data or stop the MySQL service. The problem is fixed in 4.2.1 of the module.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/PrestaShop/productcomments
Files changed:
Commit message: Merge pull request from GHSA-5v44-7647-xfw9

Cast ids into int

Vulnerable code:

Fixed code:
CVE-2022-35933 (Unknown, published 2022-09-02T20:15Z)
Description: value: This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/productcomments
Files changed:
Commit message: Merge pull request from GHSA-prrh-qvhf-x788

Escape username

Vulnerable code:

Fixed code:
CVE-2016-10928 (PHP, published 2019-08-22T20:15Z)
Description: value: The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/onelogin/wordpress-saml
Files changed:
onelogin-saml-sso/php/functions.php
Commit message: Generate random password for provisioned users


Vulnerable code:
		$userdata['user_pass'] = '@@@nopass@@@';

Fixed code:
		$userdata['user_pass'] = wp_generate_password();
CVE-2021-43138 (JavaScript, published 2022-04-06T17:15Z)
Description: value: In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/caolan/async
Files changed:
lib/internal/iterator.js
test/mapValues.js
Commit message: Fix prototype pollution vulnerability


Vulnerable code:

Fixed code:
        if (key === '__proto__') {
            return next();
        }

        it('prototype pollution', (done) => {
            var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');

            async.mapValues(input, (val, key, next) => {
                next(null, val)
            }, (err, result) => {
                expect(result.exploit).to.equal(undefined)
                done(err);
            })
        })
CVE-2021-3917 (Rust, published 2022-08-23T20:15Z)
Description: value: A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/coreos/coreos-installer
Files changed:
src/install.rs
Commit message: install: restrict access permissions on /boot/ignition{,/config.ign}

The Ignition config may contain secrets.  Don't expose it, or anything in
its parent directory, to unprivileged processes.

https://github.com/coreos/fedora-coreos-tracker/issues/889


Vulnerable code:
use std::fs::{copy as fscopy, create_dir_all, read_dir, File, OpenOptions};
use std::os::unix::fs::FileTypeExt;
    create_dir_all(&config_dest).context("creating Ignition config directory")?;

Fixed code:
use std::fs::{
    copy as fscopy, create_dir_all, read_dir, set_permissions, File, OpenOptions, Permissions,
};
use std::os::unix::fs::{FileTypeExt, PermissionsExt};
    if !config_dest.is_dir() {
        create_dir_all(&config_dest).with_context(|| {
            format!(
                "creating Ignition config directory {}",
                config_dest.display()
            )
        })?;
        // Ignition data may contain secrets; restrict to root
        set_permissions(&config_dest, Permissions::from_mode(0o700)).with_context(|| {
            format!(
                "setting file mode for Ignition directory {}",
                config_dest.display()
            )
        })?;
    }
    // Ignition config may contain secrets; restrict to root
    set_permissions(&config_dest, Permissions::from_mode(0o600)).with_context(|| {
        format!(
            "setting file mode for destination Ignition config {}",
            config_dest.display()
        )
    })?;
CVE-2017-12858 (Other, published 2017-08-23T14:29Z)
Description: value: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/nih-at/libzip
Files changed:
THANKS
lib/zip_dirent.c
Commit message: Fix double free().

Found by Brian 'geeknik' Carpenter using AFL.


Vulnerable code:
	if (!from_buffer) {
	    _zip_buffer_free(buffer);
	}

Fixed code:
Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
CVE-2017-14107 (C, published 2017-09-01T17:29Z)
Description: value: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/nih-at/libzip
Files changed:
lib/zip_open.c
Commit message: Make eocd checks more consistent between zip and zip64 cases.


Vulnerable code:
    if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) {

Fixed code:
    if (offset+size > buf_offset + eocd_offset) {
	/* cdir spans past EOCD record */
	zip_error_set(error, ZIP_ER_INCONS, 0);
	return NULL;
    }
    if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) {
CVE-2019-17582 (Other, published 2021-02-09T19:15Z)
Description: value: A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/nih-at/libzip
Files changed:
THANKS
lib/zip_dirent.c
Commit message: Fix double free().

Found by Brian 'geeknik' Carpenter using AFL.


Vulnerable code:
	if (!from_buffer) {
	    _zip_buffer_free(buffer);
	}

Fixed code:
Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
CVE-2024-27294 (Other, published 2024-02-29T23:15Z)
Description: value: dp-golang is a Puppet module for Go installations.  Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/danielparks/puppet-golang
Files changed:
CHANGELOG.md
manifests/from_tarball.pp
Commit message: Security: ignore file ownership when extracting Go

Certain Go tarballs specified that some files, such as the `go` binary,
were supposed to be owned by a non-root user. When running as root,
dp-golang extracted those files and preserved ownership, which lead to
those files being writable by a non-root user.

Affected Go tarballs:

  * Go for macOS version 1.4.3 through 1.21rc3, inclusive.
  * go1.4-bootstrap-20170518.tar.gz
  * go1.4-bootstrap-20170531.tar.gz

This switches to extracting the tarballs with `tar`’s `--no-same-owner`
and `--no-same-permissions` flags.


Vulnerable code:
      extract_flags => '--strip-components 1 -xf',

Fixed code:
### Security fix

Certain Go tarballs (see below) had files owned by non-root users:

    ❯ curl -SsL https://go.dev/dl/go1.20.14.darwin-amd64.tar.gz | tar -tzvf - | head -3
    drwxr-xr-x  0 0      0           0 Feb  2 10:19 go/
    -rw-r--r--  0 gopher wheel    1339 Feb  2 10:09 go/CONTRIBUTING.md
    -rw-r--r--  0 gopher wheel    1479 Feb  2 10:09 go/LICENSE

In this case, the non-root user in question mapped to the first user created on
the macOS system (UID 501).

When running as root, previous versions of dp-golang would preserve file
ownership when extracting the tarball, even if `owner` was set to something
else. **This meant that files, such as the `go` binary, ended up being writable
by a non-root user.**

This version of dp-golang enables [`tar`]’s `--no-same-owner` and
`--no-same-permissions` flags, which cause files to be extracted as the user
running Puppet, or as the user/group specified in the Puppet code.

GitHub security advisory: [GHSA-8h8m-h98f-vv84]

#### Affected Go tarballs

  * Go for macOS version 1.4.3 through 1.21rc3, inclusive.
  * go1.4-bootstrap-20170518.tar.gz
  * go1.4-bootstrap-20170531.tar.gz

[`tar`]: https://www.man7.org/linux/man-pages/man1/tar.1.html
[GHSA-8h8m-h98f-vv84]: https://github.com/danielparks/puppet-golang/security/advisories/GHSA-8h8m-h98f-vv84

      extract_flags => '--strip-components 1 --no-same-owner --no-same-permissions -xf',
CVE-2022-24278 (JSON, published 2022-06-10T20:15Z)
Description: value: The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/neocotic/convert-svg
Files changed:
packages/convert-svg-core/src/Converter.js
packages/convert-svg-test-helper/src/fixtures/input/issue-86.svg
packages/convert-svg-test-helper/src/tests.json
Commit message: Convert only first SVG element from input

If the input to be converted contains multiple SVG elements, only the first SVG element should be converted. Currently, and undesirably, all SVG elements were being inserted into the page within Puppeteer, resulting in them all being stacked prior to the screenshot being taken.

Another symptom of this was that all recent safety measures implemented for remote code injection vulnerabilities can be easily circumvented by inserting a simple empty SVG element at the start of the input as it was the only one being sanitized.


Vulnerable code:
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg'), options));

Fixed code:
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg:first'), options));
<svg></svg>
<svg viewBox="0 0 240 80" height="1000" width="1000" onload="eval(atob(this.id))" id="ZG9jdW1lbnQud3JpdGUoJzxzdmctZHVtbXk+PC9zdmctZHVtbXk+PGlmcmFtZSBzcmM9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwMHB4Ij48L2lmcmFtZT48c3ZnIHZpZXdCb3g9IjAgMCAyNDAgODAiIGhlaWdodD0iMTAwMCIgd2lkdGg9IjEwMDAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRleHQgeD0iMCIgeT0iMCIgY2xhc3M9IlJycnJyIiBpZD0iZGVtbyI+ZGF0YTwvdGV4dD48L3N2Zz4nKTs="></svg>
  {
    "name": "when SVG has multiple SVG elements",
    "file": "issue-86.svg",
    "options": { "width": 1000, "height": 1000 },
    "message": "should only read first SVG element"
  },
CVE-2022-25759 (JSON, published 2022-07-22T20:15Z)
Description: value: The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/neocotic/convert-svg
Files changed:
package-lock.json
packages/convert-svg-core/package.json
packages/convert-svg-core/src/Converter.js
packages/convert-svg-test-helper/src/fixtures/input/issue-81.svg
packages/convert-svg-test-helper/src/tests.json
Commit message: Strip onload attribute from SVG input

In order to prevent a remote code injection, the `onload` attribute needs to be removed from the SVG input as Puppeteer/Chromium will execute any code within it which could potentially be malicious.

Fixes #81


Vulnerable code:
				"cheerio": "^1.0.0-rc.10",
    "cheerio": "^1.0.0-rc.10",
    const output = await this[_convert](input, options);

    return output;
    const svg = cheerio.default.html(cheerio.load(input, null, false)('svg'));
    let html = '';
    if (svg) {
      html += `<!DOCTYPE html>
    } else {
      throw new Error('SVG element not found in input. Check the SVG input');
    }
    const output = await page.screenshot(Object.assign({

    return output;

Fixed code:
				"cheerio": "^1.0.0-rc.11",
    "cheerio": "^1.0.0-rc.11",
const _sanitize = Symbol('sanitize');
    return await this[_convert](input, options);
    const svg = cheerio.default.html(this[_sanitize](cheerio.load(input, null, false)('svg')));

    if (!svg) {
      throw new Error('SVG element not found in input. Check the SVG input');
    }
    const html = `<!DOCTYPE html>
    return await page.screenshot(Object.assign({
  [_sanitize](svg) {
    return svg.removeAttr('onload');
  }

<svg viewBox="0 0 240 80" height="1000" width="1000" onload="eval(atob(this.id))" id="ZG9jdW1lbnQud3JpdGUoJzxzdmctZHVtbXk+PC9zdmctZHVtbXk+PGlmcmFtZSBzcmM9ImZpbGU6Ly8vZXRjL3Bhc3N3ZCIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwMHB4Ij48L2lmcmFtZT48c3ZnIHZpZXdCb3g9IjAgMCAyNDAgODAiIGhlaWdodD0iMTAwMCIgd2lkdGg9IjEwMDAiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PHRleHQgeD0iMCIgeT0iMCIgY2xhc3M9IlJycnJyIiBpZD0iZGVtbyI+ZGF0YTwvdGV4dD48L3N2Zz4nKTs="></svg>
  {
    "name": "when SVG has onload attribute",
    "file": "issue-81.svg",
    "message": "should strip onload attribute"
  },