hitoshura25/cvefixes huggingface dataset:
CVE-2016-9123 (Go, published 2017-03-28T02:59Z)
Description: value: go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/square/go-jose
Files changed:
cipher/cbc_hmac.go
cipher/cbc_hmac_test.go
cipher/concat_kdf.go
cipher/ecdh_es.go
Commit message: Use uint64 for all size calculations, size checks


Vulnerable code:
	ciphertext := make([]byte, len(plaintext)+ctx.Overhead())[:len(plaintext)]
	ret, out := resize(dst, len(dst)+len(ciphertext)+len(authtag))
	ret, out := resize(dst, len(dst)+len(plaintext))
	buffer := make([]byte, len(aad)+len(nonce)+len(ciphertext)+8)
	binary.BigEndian.PutUint64(buffer[n:], uint64(len(aad)*8))
func resize(in []byte, n int) (head, tail []byte) {
	if cap(in) >= n {
	ret, out := resize(buffer, len(buffer)+missing)
	truncated, tail := resize(ct[:len(ct)-ctx.authtagBytes-2], len(ct)-2)
	size := len(buffer)
	ciphertext, tail := resize(buffer, size+(len(key)/2))
	buffer := make([]byte, len(algID)+len(ptyUInfo)+len(ptyVInfo)+len(supPubInfo)+len(supPrivInfo))
// curve. Callers must ensure that the keys are valid before calling this function.

Fixed code:
	ciphertext := make([]byte, uint64(len(plaintext))+uint64(ctx.Overhead()))[:len(plaintext)]
	ret, out := resize(dst, uint64(len(dst))+uint64(len(ciphertext))+uint64(len(authtag)))
	ret, out := resize(dst, uint64(len(dst))+uint64(len(plaintext)))
	buffer := make([]byte, uint64(len(aad))+uint64(len(nonce))+uint64(len(ciphertext))+8)
	binary.BigEndian.PutUint64(buffer[n:], uint64(len(aad))*8)
func resize(in []byte, n uint64) (head, tail []byte) {
	if uint64(cap(in)) >= n {
	ret, out := resize(buffer, uint64(len(buffer))+uint64(missing))
	truncated, tail := resize(ct[:len(ct)-ctx.authtagBytes-2], uint64(len(ct))-2)
	size := uint64(len(buffer))
	ciphertext, tail := resize(buffer, size+(uint64(len(key))/2))
	buffer := make([]byte, uint64(len(algID))+uint64(len(ptyUInfo))+uint64(len(ptyVInfo))+uint64(len(supPubInfo))+uint64(len(supPrivInfo)))
// curve. Callers must ensure that the keys are valid before calling this function. Output
// size may be at most 1<<16 bytes (64 KiB).
	if size > 1<<16 {
		panic("ECDH-ES output size too large, must be less than 1<<16")
	}
CVE-2024-2314 (C++, published 2024-03-10T23:15Z)
Description: value: If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/iovisor/bcc
Files changed:
src/cc/frontends/clang/kbuild_helper.cc
Commit message: clang: check header ownership (#4928)

Example testing with a brendan-owned /tmp/kheaders file (note the "ERROR:" message):

~/bcc/build$ sudo /usr/share/bcc/tools/biosnoop
ERROR: header file ownership unexpected: /tmp/kheaders-5.15.47-internal
<built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found
#include "./include/linux/kconfig.h"
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
Traceback (most recent call last):
  File "/usr/share/bcc/tools/biosnoop", line 335, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3/dist-packages/bcc-0.1.5+6cd27218-py3.10.egg/bcc/__init__.py", line 479, in __init__
Exception: Failed to compile BPF module <text>
~/bcc/build$ ls -lhd /tmp/kheaders-5.15.47-internal
drwxrwxr-x 2 brendan dev 4.0K Mar  6 02:50 /tmp/kheaders-5.15.47-internal

No error when chown'd back to root.

Vulnerable code:
static inline int file_exists(const char *f)
  return (stat(f, &buffer) == 0);
  return file_exists(PROC_KHEADERS_PATH);
  if (file_exists(dirpath_tmp))

Fixed code:
static inline int file_exists_and_ownedby(const char *f, uid_t uid)
  int ret;
  if ((ret = stat(f, &buffer)) == 0) {
    if (buffer.st_uid != uid) {
      std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
      return -1;
    }
  }
  return ret;
  return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
  if (file_exists_and_ownedby(dirpath_tmp, 0))
CVE-2017-20185 (PHP, published 2023-06-06T02:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Fuzzy SWMP. It has been rated as problematic. This issue affects some unknown processing of the file swmp.php of the component GET Parameter Handler. The manipulation of the argument theme leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 792bcab637cb8c3bd251d8fc8771512c5329a93e. It is recommended to apply a patch to fix this issue. The identifier VDB-230669 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fuzzymannerz/swmp
Files changed:
php/swmp.php
Commit message: Fixed an XSS vulnerability and 'Undefined index' error for 'theme' GET parameter (#12)

* Fixed an 'index not found' error when there is no 'theme' parameter in the URL

* Fixes XSS vulnerability with `theme` URL parameter and reverts to default theme if theme doesn't exist.


Vulnerable code:

if ($_GET['theme']) {
    $config['theme'] = $_GET['theme'];

Fixed code:
if (isset($_GET['theme'])) {
    $theme = basename($_GET['theme']);
    
    if(file_exists("css/themes/{$theme}.css"))
        $config['theme'] = $theme;
CVE-2018-8050 (C++, published 2018-03-11T06:29Z)
Description: value: The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/sshock/AFFLIBv3
Files changed:
lib/afflib_pages.cpp
Commit message: Sanity check size passed to malloc...

Add sanity check before calling malloc in af_get_page() function to
avoid undefined behavior (e.g., seg fault) when dealing with a corrupt
AFF image with an invalid pagesize.

Issue found by Luis Rocha (luiscrocha@gmail.com).


Vulnerable code:

Fixed code:
	/* Sanity check to avoid undefined behaviour when calling malloc below with pagesize from a corrupt AFF image. */
	if(af->image_pagesize <= 0 || af->image_pagesize > 16*1024*1024)
	    return -1;
CVE-2021-23351 (Unknown, published 2021-03-08T05:15Z)
Description: value: The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pires/go-proxyproto
Files changed:
Commit message: Merge pull request #71 from isedev/feature/issue-69-tests

Disallow header parsing beyond 107 bytes

Vulnerable code:

Fixed code:
CVE-2023-35784 (C, published 2023-06-16T20:15Z)
Description: value: A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/libressl/openbsd
Files changed:
src/lib/libssl/s3_lib.c
Commit message: add missing pointer invalidation

ok tb


Vulnerable code:
/* $OpenBSD: s3_lib.c,v 1.242 2022/11/26 16:08:55 tb Exp $ */

Fixed code:
/* $OpenBSD: s3_lib.c,v 1.243 2023/05/16 14:10:43 jcs Exp $ */
	s->verified_chain = NULL;
CVE-2023-35784 (C, published 2023-06-16T20:15Z)
Description: value: A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/libressl/openbsd
Files changed:
src/lib/libssl/s3_lib.c
Commit message: add missing pointer invalidation

ok tb


Vulnerable code:
/* $OpenBSD: s3_lib.c,v 1.242 2022/11/26 16:08:55 tb Exp $ */

Fixed code:
/* $OpenBSD: s3_lib.c,v 1.243 2023/05/16 14:10:43 jcs Exp $ */
	s->verified_chain = NULL;
CVE-2017-16759 (PHP, published 2017-11-09T22:29Z)
Description: value: The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/librenms/librenms
Files changed:
html/install.php
includes/dbFacile.php
Commit message: security: Security Patch to deal with reported vulnerabilties (#7164)

* WIP: Security Patch

* Update install.php

Styling fix

* Update install.php

* Update dbFacile.php

* Fix whitespace


Vulnerable code:
} else {
        dbConnect();

Fixed code:
} elseif (!file_exists("../config.php")) {
        if ($stage != 6) {
            dbConnect();
        }
    mysqli_options($database_link, MYSQLI_OPT_LOCAL_INFILE, false);
CVE-2020-15877 (PHP, published 2020-07-21T17:15Z)
Description: value: An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/librenms/librenms
Files changed:
routes/web.php
Commit message: Fix settings access (#11915)

normal users could access

Vulnerable code:
    Route::group(['guard' => 'admin'], function () {

Fixed code:
    Route::group(['middleware' => ['can:admin']], function () {
CVE-2021-43324 (PHP, published 2021-11-03T15:15Z)
Description: value: LibreNMS through 21.10.2 allows XSS via a widget title.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
app/Http/Controllers/OverviewController.php
app/Http/Controllers/Widgets/WidgetController.php
Commit message: Fix widget title injection vulnerability (#13452)

Prevent html/js code from being injected into widget titles.

Vulnerable code:
        $widgets = Widget::select('widget_id', 'widget_title')->orderBy('widget_title')->get();
            'title' => __($title),

Fixed code:
        $widgets = Widget::select(['widget_id', 'widget_title'])->orderBy('widget_title')->get();
            'title' => htmlentities(__($title)),
CVE-2022-0575 (PHP, published 2022-02-14T12:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/addhost.inc.php
Commit message: XSS fix, cont. (#13776)

https://huntr.dev/bounties/13951f51-deed-4a3d-8275-52306cc5a87d/ 

Vulnerable code:
                'os'           => $_POST['os'] ? $_POST['os_id'] : 'ping',
                'hardware'     => $_POST['hardware'],
                'sysName'      => $_POST['sysName'],

Fixed code:
                'os'           => $_POST['os'] ? strip_tags($_POST['os_id']) : 'ping',
                'hardware'     => strip_tags($_POST['hardware']),
                'sysName'      => strip_tags($_POST['sysName']),
CVE-2022-0576 (PHP, published 2022-02-14T12:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/forms/alert-transports.inc.php
Commit message: security - XSS Fix 01

fixing https://huntr.dev/bounties/114ba055-a2f0-4db9-aafb-95df944ba177/ (#13775)

Vulnerable code:
$transport_id = $vars['transport_id'];
$name = $vars['name'];
$transport_type = $vars['transport-type'];

Fixed code:
$transport_id = strip_tags($vars['transport_id']);
$name = strip_tags($vars['name']);
$transport_type = strip_tags($vars['transport-type']);
CVE-2022-0589 (PHP, published 2022-02-15T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/forms/add-dashboard.inc.php
includes/html/forms/customoid.inc.php
includes/html/forms/transport-groups.inc.php
Commit message: XSS fixes (#13780)



Vulnerable code:
$dashboard_name = trim($_REQUEST['dashboard_name']);
$name = $_POST['name'];
$oid = $_POST['oid'];
$datatype = $_POST['datatype'];
$name = $vars['name'];

Fixed code:
$dashboard_name = trim(strip_tags($_REQUEST['dashboard_name']));
$name = strip_tags($_POST['name']);
$oid = strip_tags($_POST['oid']);
$datatype = strip_tags($_POST['datatype']);
$name = strip_tags($vars['name']);
CVE-2022-0772 (PHP, published 2022-02-27T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/modal/alert_rule_list.inc.php
Commit message: Resolved XSS issue from alert rule list modal (#13805)



Vulnerable code:
                                    <td><i>" . htmlentities($rule_display) . "</i></td>

Fixed code:
                                    <td><i>" . htmlentities(strip_tags($rule_display)) . "</i></td>
CVE-2022-29711 (PHP, published 2022-06-02T14:15Z)
Description: value: LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
app/Http/Controllers/Table/GraylogController.php
Commit message: fix graylog xss (#13931)



Vulnerable code:
            'source'    => $device ? Url::deviceLink($device) : $message['message']['source'],
            'message'   => $message['message']['message'] ?? '',

Fixed code:
            'source'    => $device ? Url::deviceLink($device) : htmlspecialchars($message['message']['source']),
            'message'   => htmlspecialchars($message['message']['message'] ?? ''),
CVE-2022-3231 (PHP, published 2022-09-17T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
app/Http/Controllers/Table/AlertScheduleController.php
Commit message: Fix scheduled maintenance xss (#14360)

Fix for fields title, notes, and maybe recurring_day. Other fields can't store html.

https://huntr.dev/bounties/bcb6ee68-1452-4fdb-932a-f1031d10984f/

Vulnerable code:
            'title' => $schedule->title,
            'notes' => $schedule->notes,
            'recurring_day' => $schedule->recurring ? implode(',', $schedule->recurring_day) : '',

Fixed code:
            'title' => htmlentities($schedule->title),
            'notes' => htmlentities($schedule->notes),
            'recurring_day' => $schedule->recurring ? htmlentities(implode(',', $schedule->recurring_day)) : '',
CVE-2022-3516 (PHP, published 2022-11-20T05:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/notifications.inc.php
Commit message: Fix possible RSS XSS (#14457)

Escape titles when shown.  Body was already cleaned.

Vulnerable code:
        echo "<strong><i class='fa fa-bell-o'></i>&nbsp;${notif['title']}</strong>";
        echo "<h4 class='$class' id='${notif['notifications_id']}'>${notif['title']}<span class='pull-right'>";
        echo  " id='${notif['notifications_id']}'>${notif['title']}";

Fixed code:
        echo "<strong><i class='fa fa-bell-o'></i>&nbsp;" . htmlentities($notif['title']) . '</strong>';
        echo "<h4 class='$class' id='${notif['notifications_id']}'>" . htmlentities($notif['title']) . "<span class='pull-right'>";
        echo  " id='${notif['notifications_id']}'>" . htmlentities($notif['title']);