hitoshura25/cvefixes huggingface dataset:
CVE-2022-41958 (Java, published 2022-11-25T18:15Z)
Description: value: super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/4ra1n/super-xray
Files changed:
CHANGELOG.MD
src/main/java/com/chaitin/xray/form/LookupConfigForm.java
src/main/java/com/chaitin/xray/form/MainForm.java
src/main/java/com/chaitin/xray/test/Main.java
Commit message: yaml rce


Vulnerable code:
- 内置`JRE`和`xray`的`exe`可以一键启动：`super-xray-0.7-jre-exe.zip`
                Yaml yaml = new Yaml();
        Yaml yaml = new Yaml();
        Yaml yaml = new Yaml();
        Process p = Runtime.getRuntime().exec("ls");
        System.out.println(JNAUtil.getProcessID(p));

Fixed code:
- 内置`JRE`的`exe`可以一键启动：`super-xray-0.7-jre-exe.zip`
import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.constructor.SafeConstructor;
                Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.constructor.SafeConstructor;
        Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
        Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
        String context = "!!javax.script.ScriptEngineManager [\n" +
                "  !!java.net.URLClassLoader [[\n" +
                "    !!java.net.URL [\"file:./yaml.jar\"]\n" +
                "  ]]\n" +
                "]";
        System.out.println(context);
CVE-2019-10864 (PHP, published 2019-04-23T18:29Z)
Description: value: The WP Statistics plugin through 12.6.2 for WordPress has XSS, allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-statistics/wp-statistics
Files changed:
includes/functions/functions.php
Commit message: fix xss Attach Get Title Of Page


Vulnerable code:
		return ( wp_strip_all_tags( $title ) == "" ? false : $title );

Fixed code:
		return ( wp_strip_all_tags( $title ) == "" ? false : wp_strip_all_tags( $title ) );
CVE-2020-26230 (Unknown, published 2020-11-13T19:15Z)
Description: value: Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and de-anonymization of COVID-19 positive users when using Radar COVID. The vulnerability is caused by the fact that Radar COVID connections to the server (uploading of TEKs to the backend) are only made by COVID-19 positives. Therefore, any on-path observer with the ability to monitor traffic between the app and the server can identify which users had a positive test. Such an adversary can be the mobile network operator (MNO) if the connection is done through a mobile network, the Internet Service Provider (ISP) if the connection is done through the Internet (e.g., a home network), a VPN provider used by the user, the local network operator in the case of enterprise networks, or any eavesdropper with access to the same network (WiFi or Ethernet) as the user as could be the case of public WiFi hotspots deployed at shopping centers, airports, hotels, and coffee shops. The attacker may also de-anonymize the user. For this additional stage to succeed, the adversary needs to correlate Radar COVID traffic to other identifiable information from the victim. This could be achieved by associating the connection to a contract with the name of the victim or by associating Radar COVID traffic to other user-generated flows containing identifiers in the clear (e.g., HTTP cookies or other mobile flows sending unique identifiers like the IMEI or the AAID without encryption). The former can be executed, for instance, by the Internet Service Provider or the MNO. The latter can be executed by any on-path adversary, such as the network provider or even the cloud provider that hosts more than one service accessed by the victim. The farther the adversary is either from the victim (the client) or the end-point (the server), the less likely it may be that the adversary has access to re-identification information. The vulnerability has been mitigated with the injection of dummy traffic from the application to the backend. Dummy traffic is generated by all users independently of whether they are COVID-19 positive or not. The issue was fixed in iOS in version 1.0.8 (uniform distribution), 1.1.0 (exponential distribution), Android in version 1.0.7 (uniform distribution), 1.1.0 (exponential distribution), Backend in version 1.1.2-RELEASE. For more information see the referenced GitHub Security Advisory.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/RadarCOVID/radar-covid-ios
Files changed:
Commit message: chore: release 1.1.0



Vulnerable code:

Fixed code:
CVE-2017-16792 (Ruby, published 2017-11-13T09:29Z)
Description: value: Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/geminabox/geminabox
Files changed:
lib/geminabox/server.rb
views/gem.erb
views/index.erb
Commit message: Fix CVE-2017-16792 - Stored XSS

Reject Javascript Link


Vulnerable code:
            "<a href='#{h(spec.homepage)}'>#{author}</a>"
                "<a href='#{h(spec.homepage)}'>#{author}</a>"

Fixed code:
      def href(text)
        escaped_text = Rack::Utils.escape_html(text)
        if escaped_text.start_with?('http://') || escaped_text.start_with?('https://')
          escaped_text
        else
          '#'
        end
      end

            "<a href='#{href(spec.homepage)}'>#{author}</a>"
                "<a href='#{href(spec.homepage)}'>#{author}</a>"
CVE-2019-17426 (JavaScript, published 2019-10-10T02:05Z)
Description: value: Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Automattic/mongoose
Files changed:
lib/cast.js
Commit message: fix(query): delete top-level `_bsontype` property in queries to prevent silent empty queries

Fix #8222


Vulnerable code:

Fixed code:
  // bson 1.x has the unfortunate tendency to remove filters that have a top-level
  // `_bsontype` property. Should remove this when we upgrade to bson 4.x. See gh-8222
  if (obj.hasOwnProperty('_bsontype')) {
    delete obj._bsontype;
  }
CVE-2019-19324 (Unknown, published 2020-03-20T18:15Z)
Description: value: Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-670 \u2014 Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Repository: https://github.com/xmidt-org/cjwt
Files changed:
Commit message: Merge pull request #29 from xmidt-org/correct-return-codes-and-eliminiate-silent-failure

Correct return codes and eliminiate silent failure

Vulnerable code:

Fixed code:
CVE-2020-13756 (PHP, published 2020-06-03T14:15Z)
Description: value: Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/sabberworm/PHP-CSS-Parser
Files changed:
lib/Sabberworm/CSS/CSSList/CSSBlockList.php
lib/Sabberworm/CSS/CSSList/Document.php
tests/Sabberworm/CSS/ParserTest.php
Commit message: Don’t use eval


Vulnerable code:
					$sComparison = "\$bRes = {$oSelector->getSpecificity()} $sSpecificitySearch;";
					eval($sComparison);
					if ($bRes) {
        if (is_numeric($sSpecificitySearch) || is_numeric($sSpecificitySearch[0])) {
            $sSpecificitySearch = "== $sSpecificitySearch";
        }

Fixed code:
					$sComparator = '===';
					$aSpecificitySearch = explode(' ', $sSpecificitySearch);
					$iTargetSpecificity = $aSpecificitySearch[0];
					if(count($aSpecificitySearch) > 1) {
						$sComparator = $aSpecificitySearch[0];
						$iTargetSpecificity = $aSpecificitySearch[1];
					}
					$iTargetSpecificity = (int)$iTargetSpecificity;
					$iSelectorSpecificity = $oSelector->getSpecificity();
					$bMatches = false;
					switch($sComparator) {
						case '<=':
							$bMatches = $iSelectorSpecificity <= $iTargetSpecificity;
						break;
						case '<':
							$bMatches = $iSelectorSpecificity < $iTargetSpecificity;
						break;
						case '>=':
							$bMatches = $iSelectorSpecificity >= $iTargetSpecificity;
						break;
						case '>':
							$bMatches = $iSelectorSpecificity > $iTargetSpecificity;
						break;
						default:
							$bMatches = $iSelectorSpecificity === $iTargetSpecificity;
						break;
					}
					if ($bMatches) {
		$this->assertEquals(array(new Selector('#test .help', true), new Selector('#file', true)), $oDoc->getSelectorsBySpecificity('>= 100'));
		$this->assertEquals(array(new Selector('#file', true)), $oDoc->getSelectorsBySpecificity('=== 100'));
		$this->assertEquals(array(new Selector('#file', true)), $oDoc->getSelectorsBySpecificity('== 100'));
		$this->assertEquals(array(new Selector('#file', true), new Selector('.help:hover', true), new Selector('li.green', true), new Selector('ol li::before', true)), $oDoc->getSelectorsBySpecificity('<= 100'));
		$this->assertEquals(array(new Selector('.help:hover', true), new Selector('li.green', true), new Selector('ol li::before', true)), $oDoc->getSelectorsBySpecificity('< 100'));
		$this->assertEquals(array(new Selector('li.green', true)), $oDoc->getSelectorsBySpecificity('11'));
		$this->assertEquals(array(new Selector('ol li::before', true)), $oDoc->getSelectorsBySpecificity(3));
CVE-2014-125044 (PHP, published 2023-01-05T20:15Z)
Description: value: A vulnerability, which was classified as critical, was found in soshtolsus wing-tight. This affects an unknown part of the file index.php. The manipulation of the argument p leads to file inclusion. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is named 567bc33e6ed82b0d0179c9add707ac2b257aeaf2. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217515.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/soshtolsus/wing-tight
Files changed:
index.php
Commit message: hardened index against malicious ?p= attacks


Vulnerable code:
				<?php include('pages/' . array_merge(array('p'=>'home'), $_GET)['p'] . '.html.part'); ?>

Fixed code:
				<?php
					$page_spec = array_merge(array('p'=>'home'), $_GET)['p'];
					
					if (strpos($page_spec, '/') === false)
					{
						include("{$_SERVER['DOCUMENT_ROOT']}/pages/$page_spec.html.part");
					}
					else
					{
						echo 'no one here but us chickens';
					}
				?>
CVE-2016-2138 (PHP, published 2022-07-28T15:15Z)
Description: value: In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.
Severity: nan (CVSS v3 base score: 6.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ikoniaris/kippo-graph
Files changed:
class/KippoInput.class.php
include/play.php
Commit message: Block XSS in wget commands (file links)


Vulnerable code:
                $file_link = explode(" ", trim($row['file']))[0];
                    $file_link = trim($row['file']);

Fixed code:
                $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                    $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
CVE-2016-2139 (PHP, published 2022-07-28T15:15Z)
Description: value: In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.class.php.
Severity: nan (CVSS v3 base score: 6.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ikoniaris/kippo-graph
Files changed:
class/KippoInput.class.php
include/play.php
Commit message: Block XSS in wget commands (file links)


Vulnerable code:
                $file_link = explode(" ", trim($row['file']))[0];
                    $file_link = trim($row['file']);

Fixed code:
                $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
                    $file_link = explode(" ", trim(xss_clean($row['file'])))[0];
CVE-2017-9432 (Other, published 2017-06-05T03:29Z)
Description: value: Document Liberation Project libstaroffice before 2017-04-07 has an out-of-bounds write caused by a stack-based buffer overflow related to the DatabaseName::read function in lib/StarWriterStruct.cxx.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/fosnola/libstaroffice
Files changed:
src/lib/StarWriterStruct.cxx
Commit message: ofz#1029 use correct loop index

To be honest, I think this would be clearer as two separate reads to two
separate vars...


Vulnerable code:
        for (int j=0; j<2; ++j) positions[i]=int(input->readULong(4));

Fixed code:
        for (int j=0; j<2; ++j) positions[j]=int(input->readULong(4));
CVE-2022-29174 (JavaScript, published 2022-05-17T21:15Z)
Description: value: countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/Countly/countly-server
Files changed:
frontend/express/libs/members.js
Commit message: [members] secure password reset token generation


Vulnerable code:
                    prid = sha512Hash(member.username + member.full_name, timestamp);

Fixed code:
                    prid = crypto.randomBytes(32).toString('hex');
CVE-2021-3749 (JavaScript, published 2021-08-31T11:15Z)
Description: value: axios is vulnerable to Inefficient Regular Expression Complexity
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/axios/axios
Files changed:
lib/utils.js
Commit message: Security fix for ReDoS (#3980)



Vulnerable code:
  return str.replace(/^\s*/, '').replace(/\s*$/, '');

Fixed code:
  return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, '');
CVE-2022-2584 (Go, published 2022-12-27T22:15Z)
Description: value: The dag-pb codec can panic when decoding invalid blocks.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ipld/go-codec-dagpb
Files changed:
compat_test.go
unmarshal.go
Commit message: fix: use protowire for Links bytes decoding


Vulnerable code:
		if tc.encodeError != "" {
			if err != nil {
				if !strings.Contains(err.Error(), tc.encodeError) {
					t.Fatalf("got unexpeced encode error: [%v] (expected [%v])", err.Error(), tc.encodeError)
				t.Fatalf("did not get expected encode error: %v", tc.encodeError)
			}
		} else {
			if err != nil {
				t.Fatal(err)
			} else {
				if actualBytes != tc.expectedBytes {
					t.Logf(
						"Expected bytes: [%v]\nGot: [%v]\n",
						tc.expectedBytes,
						actualBytes)
					t.Error("Did not match")
			bytesLen, n := protowire.ConsumeVarint(remaining)
			if err := unmarshalLink(remaining[:bytesLen], curLink); err != nil {
			remaining = remaining[bytesLen:]

Fixed code:
	testEncode    bool
	{
		name:          "Data some, short",
		node:          &pbNode{data: dataSome},
		expectedBytes: "0a0500010203",
		decodeError:   "unexpected EOF",
		encodeError:   "missing required fields: Links",
	},
		name:          "Links Hash some, short",
		node:          &pbNode{links: []pbLink{{hash: acid}}},
		expectedBytes: "120b0a090155000500010203",
		decodeError:   "unexpected EOF",
		testEncode:    false,
	}, {
		if tc.testEncode {
			if tc.encodeError != "" {
				if err != nil {
					if !strings.Contains(err.Error(), tc.encodeError) {
						t.Fatalf("got unexpeced encode error: [%v] (expected [%v])", err.Error(), tc.encodeError)
					}
				} else {
					t.Fatalf("did not get expected encode error: %v", tc.encodeError)
				if err != nil {
					t.Fatal(err)
				} else {
					if actualBytes != tc.expectedBytes {
						t.Logf(
							"Expected bytes: [%v]\nGot: [%v]\n",
							tc.expectedBytes,
							actualBytes)
						t.Error("Did not match")
					}
			chunk, n := protowire.ConsumeBytes(remaining)
			if err := unmarshalLink(chunk, curLink); err != nil {
CVE-2015-10010 (Python, published 2023-01-02T21:15Z)
Description: value: A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opendns/OpenResolve
Files changed:
resolverapi/endpoints.py
Commit message: Prevent Reflected XSS

The API takes user input and validates them before making DNS calls but
if invalid, a response containing the user input is reflected back to
the user as it is without any sanitization. This makes OpenResolve
vulnerable to a reflected XSS attack.


Vulnerable code:
            abort(400, message="%s type is not supported" % rdtype)
            abort(400, message="%s is not a valid domain name" % domain)
                return {'message': 'No nameserver found for %s' % ip}, 404
            abort(400, message="%s is not a valid ip address" % ip)

Fixed code:
            abort(400, message="The provided record type is not supported")
            abort(400, message="The provided domain name is invalid")
                return {'message': 'No nameserver found for the provided IP'}, 404
            abort(400, message="The provided ip address is invalid")
CVE-2015-10011 (Python, published 2023-01-02T22:15Z)
Description: value: A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipulation leads to improper output neutralization for logs. The identifier of the patch is 9eba6ba5abd89d0e36a008921eb307fcef8c5311. It is recommended to apply a patch to fix this issue. The identifier VDB-217197 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/opendns/OpenResolve
Files changed:
resolverapi/endpoints.py
Commit message: Log Injection Attack Vulnerability

By logging the unsanitized user input, a log injection attack can
occur. This commit removes user-provided values from the logs.


Vulnerable code:
            'Request from %s - %s %s', request.remote_addr, rdtype, domain)

Fixed code:
            'Request from %s - %s', request.remote_addr, rdtype)