hitoshura25/cvefixes huggingface dataset:
CVE-2024-27097 (Unknown, published 2024-03-13T21:15Z)
Description: value: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ckan/ckan
Files changed:
Commit message: Merge pull request from GHSA-8g38-3m6v-232j

use repr for logging user input

Vulnerable code:

Fixed code:
CVE-2020-7761 (JavaScript, published 2020-11-05T11:15Z)
Description: value: This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/absolunet/kafe
Files changed:
src/kafe/string-validate.js
Commit message: Switch email pattern to practical implementation of RFC 5322


Vulnerable code:
		return (/^\w+([\.\+-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test(str));

Fixed code:

		// Practical implementation of RFC 5322
		// https://www.regular-expressions.info/email.html
		return (/^[a-z0-9!#$%&'*+/=?^_‘{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_‘{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(str));
CVE-2024-32881 (Python, published 2024-04-26T21:15Z)
Description: value: Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal Slack access. This issue was patched in version 3.63.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/danswer-ai/danswer
Files changed:
backend/danswer/server/manage/slack_bot.py
Commit message: Slack improvement


Vulnerable code:
def put_tokens(tokens: SlackBotTokens) -> None:
def get_tokens() -> SlackBotTokens:

Fixed code:
def put_tokens(
    tokens: SlackBotTokens,
    _: User | None = Depends(current_admin_user),
) -> None:
def get_tokens(_: User | None = Depends(current_admin_user)) -> SlackBotTokens:
CVE-2015-8851 (JavaScript, published 2020-01-30T21:15Z)
Description: value: node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-331 \u2014 Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Repository: https://github.com/broofa/node-uuid
Files changed:
package.json
test/test.js
uuid.js
Commit message: v1.4.4: close #122 #118 #108


Vulnerable code:
  "name"          : "node-uuid",
  "description"   : "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
  "url"           : "http://github.com/broofa/node-uuid",
  "keywords"      : ["uuid", "guid", "rfc4122"],
  "author"        : "Robert Kieffer <robert@broofa.com>",
  "contributors"  : [
    {"name": "Christoph Tavan <dev@tavan.de>", "github": "https://github.com/ctavan"}
  ],
    "test": "node test/test.js",
    "coverage": "nyc npm test && nyc report"
  "lib"           : ".",
  "main"          : "./uuid.js",
  "repository"    : { "type" : "git", "url" : "https://github.com/broofa/node-uuid.git" },
  "version"       : "1.4.2",
  "license"       : "MIT",
  "devDependencies": { "nyc": "^2.2.0" }

      var _rb = _global.require('crypto').randomBytes;
 

Fixed code:
  "author": {
    "email": "robert@broofa.com",
    "name": "Robert Kieffer"
  },
  "bugs": {
    "url": "https://github.com/broofa/node-uuid/issues"
  },
  "contributors": [
    {
      "name": "AJ ONeal",
      "email": "coolaj86@gmail.com"
    },
    {
      "name": "Christoph Tavan",
      "email": "dev@tavan.de"
    }
  ],
  "dependencies": {},
  "description": "Rigorous implementation of RFC4122 (v1 and v4) UUIDs.",
  "devDependencies": {
    "nyc": "^2.2.0"
  },
  "directories": {},
  "homepage": "https://github.com/broofa/node-uuid",
  "installable": true,
  "keywords": [
    "guid",
    "rfc4122",
    "uuid"
  ],
  "lib": ".",
  "licenses": [
    {
      "type": "MIT",
      "url": "https://raw.github.com/broofa/node-uuid/master/LICENSE.md"
    }
  ],
  "main": "./uuid.js",
  "maintainers": [
    {
      "name": "broofa",
      "email": "robert@broofa.com"
    }
  ],
  "name": "node-uuid",
  "optionalDependencies": {},
  "repository": {
    "type": "git",
    "url": "https://github.com/broofa/node-uuid.git"
  },
    "coverage": "nyc npm test && nyc report",
    "test": "node test/test.js"
  "url": "http://github.com/broofa/node-uuid",
  "version": "1.4.4"
  if (!/_rb/.test(uuid._rng.toString())) {
    throw new Error("should use crypto for node.js");
  }
      var _rb = require('crypto').randomBytes;
  uuid._rng = _rng;
CVE-2017-20182 (JavaScript, published 2023-03-10T02:15Z)
Description: value: A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The patch is named 329eb1dd1580ca1f9d4f95bc69939833226515c9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222611.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mvpoland/django-ajax-utilities
Files changed:
django_ajax/static/ajax-utilities/js/pagination.js
Commit message: Improve XSS protection

Modern browsers treat the backslash as normal slashes when used in the URLs. So instead of using the hash value "#page://google.com", we can use "#page:/\google.com" to bypasses the XSS protection

Vulnerable code:
                if (url[0] != '/' || url[1] == '/')

Fixed code:
		// we cannot start with "/\". Modern browsers handle backslashes as normal slashes.
                if (url[0] != '/' || url[1] == '/' || url.startsWith("/\\")
CVE-2020-5280 (Unknown, published 2020-03-25T18:15Z)
Description: value: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/http4s/http4s
Files changed:
Commit message: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix ghsa-66q9-f7ff-mmx6 for 0.20.x

Vulnerable code:

Fixed code:
CVE-2020-5280 (Unknown, published 2020-03-25T18:15Z)
Description: value: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/http4s/http4s
Files changed:
Commit message: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix ghsa-66q9-f7ff-mmx6 for 0.21.x

Vulnerable code:

Fixed code:
CVE-2020-5280 (Unknown, published 2020-03-25T18:15Z)
Description: value: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/http4s/http4s
Files changed:
Commit message: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix GHSA-66q9-f7ff-mmx6

Vulnerable code:

Fixed code:
CVE-2021-21294 (Unknown, published 2021-02-02T22:15Z)
Description: value: Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. http4s provides a general "MaxActiveRequests" middleware mechanism for limiting open connections, but it is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. In 0.21.17, 0.22.0-M2, and 1.0.0-M14, a new "maxConnections" property, with a default value of 1024, has been added to the `BlazeServerBuilder`. Setting the value to a negative number restores unbounded behavior, but is strongly disrecommended. The NIO2 backend does not respect `maxConnections`. Its use is now deprecated in http4s-0.21, and the option is removed altogether starting in http4s-0.22. There are several possible workarounds described in the refrenced GitHub Advisory GHSA-xhv5-w9c5-2r2w.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/http4s/http4s
Files changed:
Commit message: Merge pull request from GHSA-xhv5-w9c5-2r2w

Fix ghsa-xhv5-w9c5-2r2w for 1.0.x

Vulnerable code:

Fixed code:
CVE-2021-32643 (Scala, published 2021-05-27T18:15Z)
Description: value: Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.
Severity: MEDIUM (CVSS v3 base score: 5.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/http4s/http4s
Files changed:
core/src/main/scala/org/http4s/StaticFile.scala
tests/src/test/scala/org/http4s/StaticFileSuite.scala
Commit message: Fix directory leak in StaticFile.fromUrl


Vulnerable code:
      if (file.isDirectory())
  test("return none from a URL that is a directory") {

Fixed code:
      if (url.getProtocol === "file" && file.isDirectory)
  test("return none from a file URL that is a directory") {
  test("not return none from an HTTP URL whose path is a directory") {
    // We need a universal directory that also exists as a resource on
    // a server.  Creating a temp directory would be better, but then
    // we need an HTTP server that responds to a wildcard path.
    //
    // Or we can be lazy and just use `/`.
    assume(new File("/").isDirectory, "/ is not a directory")
    StaticFile
      .fromURL[IO](new URL("https://github.com//"), testBlocker)
      .value
      .map(_.fold(Status.NotFound)(_.status))
      .assertEquals(Status.Ok)
  }
CVE-2022-24803 (Ruby, published 2022-04-01T00:15Z)
Description: value: Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/jirutka/asciidoctor-include-ext
Files changed:
lib/asciidoctor/include_ext/include_processor.rb
Commit message: Make #read_lines code more robust, avoid using IO.open directly


Vulnerable code:
      if selector
        IO.foreach(path).select.with_index(1, &selector)
      else
        URI.open(path, &:read)

Fixed code:
      # IO.open is deliberately not used directly to avoid potential security risks.
      # TODO: Get rid of 'open-uri' (URI.open).
      io = target_http?(path) ? URI : File

      io.open(path) do |f|
        if selector
          f.each.select.with_index(1, &selector)
        else
          f.read
        end
CVE-2024-31218 (JavaScript, published 2024-04-05T15:15Z)
Description: value: Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/webhood-io/webhood
Files changed:
src/backend/migrations/1712252550_generate_random_admin.js
Commit message: fix: generate random admin account on pocketbase if one does not exist


Vulnerable code:

Fixed code:
migrate((db) => {
  const dao = new Dao(db)
  const totalAdmins = dao.totalAdmins()
  if (totalAdmins > 0) {
    return
  }

  const admin = new Admin()
  admin.email = "admin@localhost"
  admin.password = [...Array(30)].map(() => (Math.random() +1).toString(36)[2]).join('')

  return dao.saveAdmin(admin)
}, (db) => {
  const dao = new Dao(db)
  const admin = dao.findAdminByEmail("admin@localhost")
  if(!admin) {
    return
  }
  return dao.deleteAdmin(admin)
})
CVE-2016-1202 (Unknown, published 2016-04-25T18:59Z)
Description: value: Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/electron/electron
Files changed:
Commit message: Merge pull request #2976 from atom/node_modules_paths

Prevent Node from adding paths outside the app to search paths

Vulnerable code:

Fixed code:
CVE-2018-1000118 (C++, published 2018-03-07T14:29Z)
Description: value: Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/electron/electron
Files changed:
atom/app/command_line_args.cc
Commit message: Use case-insensitive switch comparisons


Vulnerable code:
    std::string switch_name(a, strcspn(a, "="));

Fixed code:
    std::string switch_name =
        base::ToLowerASCII(base::StringPiece(a, strcspn(a, "=")));
CVE-2023-1428 (C++, published 2023-06-09T11:15Z)
Description: value: There exists an vulnerability causing an abort() to be called in gRPC. 
The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/grpc/grpc
Files changed:
src/core/ext/transport/chttp2/transport/hpack_parser.cc
src/core/lib/transport/metadata_batch.cc
src/core/lib/transport/metadata_batch.h
test/core/transport/chttp2/hpack_parser_corpus/clusterfuzz-testcase-minimized-hpack_parser_fuzzer-4859070937169920
Commit message: [chttp2] Fix fuzzer found bug (#32507)

<!--

If you know who should review your pull request, please assign it to
that
person, otherwise the pull request would get assigned randomly.

If your pull request is for a specific language, please add the
appropriate
lang label.

-->

Vulnerable code:
      AddToSummary(Key::key(), Key::Encode(value).size());

Fixed code:
      AddToSummary(Key::key(), EncodedSizeOfKey(Key(), value));
size_t EncodedSizeOfKey(HttpSchemeMetadata, HttpSchemeMetadata::ValueType x) {
  switch (x) {
    case HttpSchemeMetadata::kHttp:
      return 4;
    case HttpSchemeMetadata::kHttps:
      return 5;
    default:
      return 0;
  }
}

// Given a metadata key and a value, return the encoded size.
// Defaults to calling the key's Encode() method and then calculating the size
// of that, but can be overridden for specific keys if there's a better way of
// doing this.
// May return 0 if the size is unknown/unknowable.
template <typename Key>
size_t EncodedSizeOfKey(Key, const typename Key::ValueType& value) {
  return Key::Encode(value).size();
}

inline size_t EncodedSizeOfKey(TeMetadata, TeMetadata::ValueType x) {
  return x == TeMetadata::kTrailers ? 8 : 0;
}

size_t EncodedSizeOfKey(HttpSchemeMetadata, HttpSchemeMetadata::ValueType x);

inline size_t EncodedSizeOfKey(GrpcLbClientStatsMetadata,
                               GrpcLbClientStatsMetadata::ValueType) {
  return 0;
}

frames {
  max_metadata_length: 58
  parse: "@\002te\000@\002te\002@\000et\000;e"
}