hitoshura25/cvefixes huggingface dataset:
CVE-2023-50019 (C, published 2024-01-02T22:15Z)
Description: value: An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/open5gs/open5gs
Files changed:
src/amf/gmm-sm.c
Commit message: [AMF] Fixed Nudm_UECM_Registration crash (#2733)

1. UE sends RegistrationRequest to AMF.
2. AMF sends Nudm_UECM_Registration to UDM.
3. UE sends RegistrationRequest to AMF.
4. GMM state is gmm_state_authentication
5. UDM sends Nudm_UECM_Registration response to AMF.
6. AMF crashs since no Handler in gmm_state_authentication state


Vulnerable code:

Fixed code:
        CASE(OGS_SBI_SERVICE_NAME_NUDM_UECM)
            if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED &&
                sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT &&
                sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) {
                ogs_error("[%s] HTTP response error [%d]",
                        amf_ue->supi, sbi_message->res_status);
            }

            SWITCH(sbi_message->h.resource.component[1])
            CASE(OGS_SBI_RESOURCE_NAME_REGISTRATIONS)
                SWITCH(sbi_message->h.method)
                CASE(OGS_SBI_HTTP_METHOD_PUT)
                    /*
                     * Issue #2733
                     *
                     * We need to ignore this message in this state.
                     */
                    ogs_error("[%s] Ignore SBI message", amf_ue->supi);
                    break;
                DEFAULT
                    ogs_error("[%s] Invalid HTTP method [%s]",
                            amf_ue->suci, sbi_message->h.method);
                    ogs_assert_if_reached();
                END
                break;

            DEFAULT
                ogs_error("Invalid resource name [%s]",
                        sbi_message->h.resource.component[1]);
                ogs_assert_if_reached();
            END
            break;
CVE-2024-40129 (C, published 2024-07-16T19:15Z)
Description: value: Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/open5gs/open5gs
Files changed:
lib/pfcp/context.c
Commit message: [PFCP] Fixed Possible heap buffer overflow (#2585)

After examining the call stack and reading the source code, I found that
in /lib/core/ogs-pool.h line 152: (pool)->array[i] = i+1;
then in lib/pfcp/context.c line 78: pdr_random_to_index[ogs_pfcp_pdr_teid_pool.array[i]] = i;
ogs_pfcp_pdr_teid_pool.array[i] may exceed the size of pdr_random_to_index, leading to a heap-buffer-overflow.


Vulnerable code:
            sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size);

Fixed code:
            sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size+1);
CVE-2017-1000457 (C#, published 2018-01-02T18:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/i7MEDIA/mojoportal
Files changed:
Web/Help.aspx.cs
Commit message: Fix possible XSS bug in help dialog



Vulnerable code:
using System;
using System.Web.UI;
			litHelp.Text = helpText;
}

Fixed code:
using System;
using System.Web;
using System.Web.UI;
			litHelp.Text = HttpUtility.HtmlDecode(SecurityHelper.RemoveMarkup(helpText));
}
CVE-2017-5887 (Swift, published 2017-04-06T14:59Z)
Description: value: WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because pinning occurs in the stream function (this is too late; pinning should occur in the initStreamsWithData function).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/daltoniam/Starscream
Files changed:
Source/WebSocket.swift
Commit message: some cleanup and SSL pinning fix


Vulnerable code:

                    self?.cleanupStream()
            guard !sOperation.isCancelled else { return }
        if let sec = security, !certValidated && [.hasBytesAvailable, .hasSpaceAvailable].contains(eventCode) {
            let trust = aStream.property(forKey: kCFStreamPropertySSLPeerTrust as Stream.PropertyKey) as! SecTrust
            let domain = aStream.property(forKey: kCFStreamSSLPeerName as Stream.PropertyKey) as? String
            if sec.isValid(trust, domain: domain) {
                certValidated = true
            } else {
                let error = errorWithDetail("Invalid SSL certificate", code: 1)
                disconnectStream(error)
                return
            }
        }

Fixed code:
                    WebSocket.sharedWorkQueue.async {
                        self?.cleanupStream()
                    }
            guard !sOperation.isCancelled, let s = self else { return }
            // Do the pinning now if needed
            if let sec = s.security, !s.certValidated {
                let trust = outStream.property(forKey: kCFStreamPropertySSLPeerTrust as Stream.PropertyKey) as! SecTrust
                let domain = outStream.property(forKey: kCFStreamSSLPeerName as Stream.PropertyKey) as? String
                s.certValidated = sec.isValid(trust, domain: domain)
                if !s.certValidated {
                    WebSocket.sharedWorkQueue.async {
                        let error = s.errorWithDetail("Invalid SSL certificate", code: 1)
                        s.disconnectStream(error)
                    }
                    return
                }
            }
        writeQueue.cancelAllOperations()
CVE-2017-7192 (Swift, published 2017-04-06T14:59Z)
Description: value: WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/daltoniam/Starscream
Files changed:
Source/WebSocket.swift
Commit message: some cleanup and SSL pinning fix


Vulnerable code:

                    self?.cleanupStream()
            guard !sOperation.isCancelled else { return }
        if let sec = security, !certValidated && [.hasBytesAvailable, .hasSpaceAvailable].contains(eventCode) {
            let trust = aStream.property(forKey: kCFStreamPropertySSLPeerTrust as Stream.PropertyKey) as! SecTrust
            let domain = aStream.property(forKey: kCFStreamSSLPeerName as Stream.PropertyKey) as? String
            if sec.isValid(trust, domain: domain) {
                certValidated = true
            } else {
                let error = errorWithDetail("Invalid SSL certificate", code: 1)
                disconnectStream(error)
                return
            }
        }

Fixed code:
                    WebSocket.sharedWorkQueue.async {
                        self?.cleanupStream()
                    }
            guard !sOperation.isCancelled, let s = self else { return }
            // Do the pinning now if needed
            if let sec = s.security, !s.certValidated {
                let trust = outStream.property(forKey: kCFStreamPropertySSLPeerTrust as Stream.PropertyKey) as! SecTrust
                let domain = outStream.property(forKey: kCFStreamSSLPeerName as Stream.PropertyKey) as? String
                s.certValidated = sec.isValid(trust, domain: domain)
                if !s.certValidated {
                    WebSocket.sharedWorkQueue.async {
                        let error = s.errorWithDetail("Invalid SSL certificate", code: 1)
                        s.disconnectStream(error)
                    }
                    return
                }
            }
        writeQueue.cancelAllOperations()
CVE-2020-26255 (Unknown, published 2020-12-08T15:15Z)
Description: value: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/getkirby/kirby
Files changed:
Commit message: Merge pull request #2962 from getkirby/fix/upload-validation

Upload validation

Vulnerable code:

Fixed code:
CVE-2024-27087 (PHP, published 2024-02-26T17:15Z)
Description: value: Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats.  As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getkirby/kirby
Files changed:
config/fields/link.php
tests/Form/Fields/LinkFieldTest.php
Commit message: Link field: Don’t allow custom type by default

https://github.com/getkirby/kirby/security/advisories/GHSA-63h4-w25c-3qv4


Vulnerable code:
				'anchor',
				'custom'
			'anchor',
			'custom'

Fixed code:
				'anchor'
			'anchor'
CVE-2024-38532 (Unknown, published 2024-06-28T22:15Z)
Description: value: The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/usbarmory/mxs-dcp
Files changed:
Commit message: Merge pull request #7 from dress-code-IT-GmbH/master

load empty key to activate DCP internal key

Vulnerable code:

Fixed code:
CVE-2014-10074 (Other, published 2018-08-27T04:29Z)
Description: value: Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/Umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Web.UI/config/umbracoSettings.Release.config
src/Umbraco.Web.UI/config/umbracoSettings.config
Commit message: #U4-5901 Fixed Due in version 7.2.0

Remote Code Execution


Vulnerable code:
    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,html.htm,svg</disallowedUploadFiles>
    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,html.htm,svg</disallowedUploadFiles>

Fixed code:
    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,html.htm,svg,php</disallowedUploadFiles>
    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,html.htm,svg,php</disallowedUploadFiles>
CVE-2022-21129 (JavaScript, published 2023-01-31T05:15Z)
Description: value: Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.**Note:** In order to exploit this vulnerability appium-running 0.1.3  has to be installed as one of nemo-appium dependencies. 
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/paypal/nemo-appium
Files changed:
index.js
package.json
test/index.js
Commit message: prevent OS commands from being injected


Vulnerable code:
    "appium-running": "^0.1.3",
var appiumPath = process.env.APPIUM_PATH;

Fixed code:
    // validate apath since we are going to execute it
    // should end in appium, and contain no spaces
    if (apath.indexOf('appium') !== apath.length - 6 || apath.indexOf(' ') > -1) {
        return cb(new Error('Invalid path to appium executable'))
    }
    "appium-running": "0.1.3",
var appiumPath ='touch HACKED && ~/bin/appium';
        console.log('You want to see this error. It means the setup function is validating the appium path for potential OS commands');
CVE-2015-10132 (JavaScript, published 2024-04-21T20:15Z)
Description: value: A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/wp-spreadplugin
Files changed:
js/spreadplugin.min.js
readme.txt
spreadplugin.php
Commit message: One XSS vulnerability fixed

git-svn-id: https://plugins.svn.wordpress.org/wp-spreadplugin/trunk@1141104 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * Version: 3.8.6.1
Stable tag: 3.8.6.1
 * Version: 3.8.6.1
                            $output .= "<a href=\"" . add_query_arg('pagesp', $paged + 1) . "\">" . __('next', $this->stringTextdomain) . "</a>";

Fixed code:
 * Version: 3.8.6.2
Stable tag: 3.8.6.2
= 3.8.6.2 =
* One XSS vulnerability fixed

 * Version: 3.8.6.2
                            $output .= "<a href=\"" . add_query_arg('pagesp', $paged + 1, get_permalink()) . "\">" . __('next', $this->stringTextdomain) . "</a>";
CVE-2020-26279 (Unknown, published 2021-03-24T21:15Z)
Description: value: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/ipfs/go-ipfs
Files changed:
Commit message: Merge pull request #7812 from ipfs/chore/update-deps

chore: update deps

Vulnerable code:

Fixed code:
CVE-2020-26283 (Unknown, published 2021-03-24T21:15Z)
Description: value: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/ipfs/go-ipfs
Files changed:
Commit message: Merge pull request #7831 from ipfs/fix/escape-nonprintable-chars

Escape non-printable characters in user output

Vulnerable code:

Fixed code:
CVE-2022-4880 (Unknown, published 2023-01-07T13:15Z)
Description: value: A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/stakira/OpenUtau
Files changed:
Commit message: Merge pull request #544 from oxygen-dioxide/zipslip

Prevent from zip slip attack / 防范zip上级文件夹攻击

Vulnerable code:

Fixed code:
CVE-2020-11710 (Markdown, published 2020-04-12T17:15Z)
Description: value: An issue was discovered in docker-kong (for Kong) through 2.0.3. The admin API port may be accessible on interfaces other than 127.0.0.1. NOTE: The vendor argue that this CVE is not a vulnerability because it has an inaccurate bug scope and patch links. “1) Inaccurate Bug Scope - The issue scope was on Kong's docker-compose template, and not Kong's docker image itself. In reality, this issue is not associated with any version of the Kong gateway. As such, the description stating ‘An issue was discovered in docker-kong (for Kong) through 2.0.3.’ is incorrect. This issue only occurs if a user decided to spin up Kong via docker-compose without following the security documentation. The docker-compose template is meant for users to quickly get started with Kong, and is meant for development purposes only. 2) Incorrect Patch Links - The CVE currently points to a documentation improvement as a “Patch” link: https://github.com/Kong/docs.konghq.com/commit/d693827c32144943a2f45abc017c1321b33ff611.This link actually points to an improvement Kong Inc made for fool-proofing. However, instructions for how to protect the admin API were already well-documented here: https://docs.konghq.com/2.0.x/secure-admin-api/#network-layer-access-restrictions , which was first published back in 2017 (as shown in this commit: https://github.com/Kong/docs.konghq.com/commit/e99cf875d875dd84fdb751079ac37882c9972949) Lastly, the hyperlink to https://github.com/Kong/kong (an unrelated Github Repo to this issue) on the Hyperlink list does not include any meaningful information on this topic.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/Kong/docs.konghq.com
Files changed:
app/enterprise/1.3-x/deployment/installation/docker.md
app/install/docker.md
Commit message: fix(admin) bind the kong admin api port to 127 (#1869)



Vulnerable code:
  -p 8001:8001 \
  -p 8444:8444 \
        -p 8001:8001 \
        -p 8444:8444 \
        -p 8001:8001 \
        -p 8444:8444 \

Fixed code:
  -p 127.0.0.1:8001:8001 \
  -p 127.0.0.1:8444:8444 \
        -p 127.0.0.1:8001:8001 \
        -p 127.0.0.1:8444:8444 \
        -p 127.0.0.1:8001:8001 \
        -p 127.0.0.1:8444:8444 \
CVE-2020-23914 (C++, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in cpp-peglib through v0.1.12. A NULL pointer dereference exists in the peg::AstOptimizer::optimize() located in peglib.h. It allows an attacker to cause Denial of Service.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/yhirose/cpp-peglib
Files changed:
peglib.h
test/test1.cc
Commit message: Fix #121


Vulnerable code:
      : lit_(s), ignore_case_(ignore_case),
        is_word_(false) {}
      : lit_(s), ignore_case_(ignore_case),
        is_word_(false) {}

Fixed code:
      : lit_(s), ignore_case_(ignore_case), is_word_(false) {}
      : lit_(s), ignore_case_(ignore_case), is_word_(false) {}
    // Check if the start rule has ignore operator
    {
      auto &rule = grammar[data.start];
      if (rule.ignoreSemanticValue) {
        if (log) {
          auto line = line_info(s, rule.s_);
          log(line.first, line.second,
              "Ignore operator cannot be applied to '" + rule.name + "'.");
        }
        ret = false;
      }
    }

    if (!ret) { return nullptr; }

TEST_CASE("Start rule with ignore operator test", "[general]")
{
    parser parser(R"(
        ~ROOT <- _
        _ <- ' '
    )");

    bool ret = parser;
    REQUIRE(ret == false);
}