hitoshura25/cvefixes huggingface dataset:
CVE-2021-32838 (Python, published 2021-09-20T18:15Z)
Description: value: Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/python-restx/flask-restx
Files changed:
flask_restx/inputs.py
Commit message: optimize email regex (credits: @kevinbackhouse, fix: #372)


Vulnerable code:
    r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@]+(?:\.[^@]+)*)" r"$",

Fixed code:
    r"^" "(?P<local>[^@]*[^@.])" r"@" r"(?P<server>[^@\.]+(?:\.[^@\.]+)*)" r"$",
CVE-2021-29063 (Unknown, published 2021-06-21T20:15Z)
Description: value: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/fredrik-johansson/mpmath
Files changed:
Commit message: Merge pull request #570 from vks/fix-redos

Fix ReDOS vulnerability

Vulnerable code:

Fixed code:
CVE-2017-1000418 (C, published 2018-01-02T18:29Z)
Description: value: The WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/Mindwerks/wildmidi
Files changed:
README.md
src/wildmidi_lib.c
Commit message: wildmidi_lib.c (WildMidi_Open, WildMidi_OpenBuffer): refuse to proceed if less then 18 bytes of input

Fixes bug #178.


Vulnerable code:

Fixed code:
* Fixed WildMidi_Open() might read beyond buffer with too short inputs
  (Bug #178).
    if (midisize < 18) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
        return (NULL);
    }
    if (size < 18) {
        _WM_GLOBAL_ERROR(__FUNCTION__, __LINE__, WM_ERR_CORUPT, "(too short)", 0);
        return (NULL);
    }
CVE-2020-36642 (PHP, published 2023-01-06T11:15Z)
Description: value: A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifier of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/trampgeek/jobe
Files changed:
application/libraries/LanguageTask.php
Commit message: Prevent command injection attacks via the cputime parameter. Fixes
issue #39 (https://github.com/trampgeek/jobe/issues/39).
Thanks Marlon (myxxl).


Vulnerable code:
     * value copied into $this from the run request if present of from the
            $param = $this->default_params[$key];

Fixed code:
     * value copied into $this from the run request if present or from the
     * If a non-numeric value is provided for a parameter that has a numeric
     * default, the default is used instead. This prevents command injection
     * as per issue #39 (https://github.com/trampgeek/jobe/issues/39). Thanks
     * Marlon (myxl).
        $default = $this->default_params[$key];
            if (is_numeric($default) && !is_numeric($param)) {
                $param = $default; // Prevent command injection attacks.
            }
            $param = $default;
CVE-2021-4297 (PHP, published 2023-01-01T19:15Z)
Description: value: A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is able to address this issue. The patch is identified as 694da5013dbecc8d30dd83e2a83e78faadf93771. It is recommended to upgrade the affected component. VDB-217174 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/trampgeek/jobe
Files changed:
README.md
application/controllers/Restapi.php
Commit message: Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46). Thanks Marlon.

Vulnerable code:
Version: 1.6.4, 22 January 2021
                !isset($run['language_id'])
        ) {

Fixed code:
Version: 1.6.5, 31 January 2021

### 1.6.5 (31 January 2021)

  1. Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46).
  1. Add a load tester (ad hoc, experimental), loadtester.py.
                !isset($run['language_id']) ) {
        if (isset($run->sourcefilename) && !self::is_valid_source_filename($run->sourcefilename)) {
            $this->error('runs_post: invalid sourcefilename');
        }
    
    // Return true unless the given filename looks dangerous, e.g. has '/' or '..'
    // substrings. Uses code from https://stackoverflow.com/questions/2021624/string-sanitizer-for-filename
    private function is_valid_source_filename($filename) {
        $sanitised = preg_replace(
        '~
        [<>:"/\\|?*]|            # file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
        [\x00-\x1F]|             # control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
        [\x7F\xA0\xAD]|          # non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
        [#\[\]@!$&\'()+,;=]|     # URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
        [{}^\~`]                 # URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
        ~x',
        '-', $filename);
        // Avoid ".", ".." or ".hiddenFiles"
        $sanitised = ltrim($sanitised, '.-');
        return $sanitised === $filename;
    }
CVE-2022-41828 (Markdown, published 2022-09-29T21:15Z)
Description: value: In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/aws/amazon-redshift-jdbc-driver
Files changed:
CHANGELOG.md
README.md
pom.xml
Commit message: Release of 2.1.0.8 version


Vulnerable code:
* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.7/redshift-jdbc42-2.1.0.7.zip
* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.7/redshift-jdbc42-2.1.0.7.jar
    <version>2.1.0.7</version>

Fixed code:
v2.1.0.8 (2022-06-08)
------------
- Fix [issue#54](https://github.com/aws/amazon-redshift-jdbc-driver/issues/54) [ilesh Garish]
- Fix [issue#53](https://github.com/aws/amazon-redshift-jdbc-driver/issues/53) [ilesh Garish]
- Fix Object Factory to check class type when instantiating an object
  from class name. [ilesh Garish]
- Set default 15 min timeout to protect pops-up for OAuth2 Browser Plugin [ilesh Garish]

* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.8/redshift-jdbc42-2.1.0.8.zip
* https://s3.amazonaws.com/redshift-downloads/drivers/jdbc/2.1.0.8/redshift-jdbc42-2.1.0.8.jar
    <version>2.1.0.8</version>
CVE-2024-32888 (Markdown, published 2024-05-15T03:15Z)
Description: value: The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aws/amazon-redshift-jdbc-driver
Files changed:
CHANGELOG.md
Commit message: Update CHANGELOG.md for version 2.1.0.28

Vulnerable code:

Fixed code:
v2.1.0.28 (2024-05-14)
----------------------
- Security improvements (CVE-2024-32888)
- Consolidated SDK API calls for retrieving cluster credentials for serverless instances.
- Added logging of returned cluster identifiers during custom domain name resolution to aid debugging.
- Added Object IDentifier (OID) mappings for missing Redshift data types.
- Added null check for IsServerless property within IamHelper to address Dbeaver error (GitHub Issue #114)

v2.1.0.27 (2024-05-07)
----------------------
- This version was published to Maven in error and is not recommended for use.
CVE-2024-21639 (C++, published 2024-01-12T22:15Z)
Description: value: CEF (Chromium Embedded Framework ) is a simple framework for embedding Chromium-based browsers in other applications. `CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory` does not check the size of the shared memory, which leads to out-of-bounds read outside the sandbox. This vulnerability was patched in commit 1f55d2e.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/chromiumembedded/cef
Files changed:
libcef/browser/osr/host_display_client_osr.cc
libcef/browser/osr/video_consumer_osr.cc
Commit message: osr: Fix potential shared memory OOB access


Vulnerable code:
  bool size_result = viz::ResourceSizes::MaybeSizeInBytes(
      pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes);
  if (!size_result) {
  shared_memory_ = region.Map();
  DCHECK(shared_memory_.IsValid());

Fixed code:
  if (!viz::ResourceSizes::MaybeSizeInBytes(
          pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes)) {
    DLOG(ERROR) << "OnAllocatedSharedMemory with size that overflows";
    return;
  }

  auto mapping = region.Map();
  if (!mapping.IsValid()) {
    DLOG(ERROR) << "Shared memory mapping failed.";
    return;
  }
  if (mapping.size() < expected_bytes) {
    DLOG(ERROR) << "Shared memory size was less than expected.";
  shared_memory_ = std::move(mapping);
  if (info->pixel_format != media::PIXEL_FORMAT_ARGB) {
    DLOG(ERROR) << "Unsupported pixel format " << info->pixel_format;
    return;
  }
CVE-2024-21640 (C++, published 2024-01-13T08:15Z)
Description: value: Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.`CefVideoConsumerOSR::OnFrameCaptured` does not check `pixel_format` properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.


Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/chromiumembedded/cef
Files changed:
libcef/browser/osr/host_display_client_osr.cc
libcef/browser/osr/video_consumer_osr.cc
Commit message: osr: Fix potential shared memory OOB access


Vulnerable code:
  bool size_result = viz::ResourceSizes::MaybeSizeInBytes(
      pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes);
  if (!size_result) {
  shared_memory_ = region.Map();
  DCHECK(shared_memory_.IsValid());

Fixed code:
  if (!viz::ResourceSizes::MaybeSizeInBytes(
          pixel_size, viz::SinglePlaneFormat::kRGBA_8888, &expected_bytes)) {
    DLOG(ERROR) << "OnAllocatedSharedMemory with size that overflows";
    return;
  }

  auto mapping = region.Map();
  if (!mapping.IsValid()) {
    DLOG(ERROR) << "Shared memory mapping failed.";
    return;
  }
  if (mapping.size() < expected_bytes) {
    DLOG(ERROR) << "Shared memory size was less than expected.";
  shared_memory_ = std::move(mapping);
  if (info->pixel_format != media::PIXEL_FORMAT_ARGB) {
    DLOG(ERROR) << "Unsupported pixel format " << info->pixel_format;
    return;
  }
CVE-2022-23637 (PHP, published 2022-02-14T21:15Z)
Description: value: K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/k-box/k-box
Files changed:
config/markdown.php
Commit message: Update markdown configuration


Vulnerable code:
    'allow_unsafe_links' => true,

Fixed code:
    'allow_unsafe_links' => false,
CVE-2013-7345 (Other, published 2014-03-24T16:31Z)
Description: value: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/file/file
Files changed:
magic/Magdir/commands
Commit message: limit to 100 repetitions to avoid excessive backtracking Carsten Wolff


Vulnerable code:
# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
0	regex		=^\\s*BEGIN\\s*[{]	awk script text

Fixed code:
# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
CVE-2014-0207 (C, published 2014-07-09T11:07Z)
Description: value: The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
src/readcdf.c
Commit message: Apply patches from file-CVE-2012-1571.patch
From Francisco Alonso Espejo:
    file < 5.18/git version can be made to crash when checking some
    corrupt CDF files (Using an invalid cdf_read_short_sector size)
    The problem I found here, is that in most situations (if
    h_short_sec_size_p2 > 8) because the blocksize is 512 and normal
    values are 06 which means reading 64 bytes.As long as the check
    for the block size copy is not checked properly (there's an assert
    that makes wrong/invalid assumptions)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.54 2014/02/25 20:52:02 christos Exp $")
	if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
		    pos, CDF_SEC_SIZE(h) * sst->sst_len));
FILE_RCSID("@(#)$File: readcdf.c,v 1.39 2014/02/27 23:26:18 christos Exp $")
    size_t count, const uint64_t clsid[2])
        if (!NOTMIME(ms))
		str = cdf_clsid_to_mime(clsid, clsid2mime);
    const cdf_stream_t *sst, const uint64_t clsid[2])
		str = cdf_clsid_to_mime(clsid, clsid2desc);
		if (str)
                        if (file_printf(ms, ", %s", str) == -1)
				return -2;
        }
        m = cdf_file_property_info(ms, info, count, clsid);
        if ((i = cdf_file_summary_info(ms, &h, &scn,
	    root_storage->d_storage_uuid)) < 0)
                expn = "Can't expand summary_info";

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.55 2014/02/27 23:26:17 christos Exp $")
	if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
		    pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
FILE_RCSID("@(#)$File: readcdf.c,v 1.40 2014/03/06 15:23:33 christos Exp $")
    size_t count, const cdf_directory_t *root_storage)
        if (!NOTMIME(ms) && root_storage)
		str = cdf_clsid_to_mime(root_storage->d_storage_uuid, clsid2mime);
    const cdf_stream_t *sst, const cdf_directory_t *root_storage)
		if (root_storage) {
			str = cdf_clsid_to_mime(root_storage->d_storage_uuid, clsid2desc);
			if (str)
				if (file_printf(ms, ", %s", str) == -1)
					return -2;
			}
		}
        m = cdf_file_property_info(ms, info, count, root_storage);
        if ((i = cdf_file_summary_info(ms, &h, &scn, root_storage)) < 0)
            expn = "Can't expand summary_info";
CVE-2014-0237 (C, published 2014-06-01T04:29Z)
Description: value: The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
Commit message: Remove loop that kept reading the same offset (Jan Kaluza)


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.55 2014/02/27 23:26:17 christos Exp $")
	size_t i, maxcount;
	ssi->si_count = CDF_TOLE2(si->si_count);
	for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
		if (i >= CDF_LOOP_LIMIT) {
			DPRINTF(("Unpack summary info loop limit"));
			errno = EFTYPE;
			return -1;
		}
		if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset),
		    info, count, &maxcount) == -1) {
			return -1;
		}
	}

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.56 2014/05/05 16:11:21 christos Exp $")
	size_t maxcount;
	ssi->si_count = CDF_TOLE4(si->si_count);
	if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
	    count, &maxcount) == -1)
		return -1;
CVE-2014-0238 (C, published 2014-06-01T04:29Z)
Description: value: The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/file/file
Files changed:
src/cdf.c
Commit message: CVE-2014-0207: Prevent 0 element vectors and vectors longer than the number
of properties from accessing random memory.


Vulnerable code:
FILE_RCSID("@(#)$File: cdf.c,v 1.58 2014/05/13 16:41:06 christos Exp $")
			for (j = 0; j < nelements; j++, i++) {

Fixed code:
FILE_RCSID("@(#)$File: cdf.c,v 1.59 2014/05/14 23:22:48 christos Exp $")
			if (nelements == 0) {
				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
				goto out;
			}
			for (j = 0; j < nelements && i < sh.sh_properties;
			    j++, i++)
			{