hitoshura25/cvefixes huggingface dataset:
CVE-2015-10114 (Other, published 2023-06-05T16:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/wp-plugins/woosidebars
Files changed:
changelog.txt
classes/class-woo-sidebars.php
readme.txt
woosidebars.php
Commit message: V1.4.2 - Security Fix for _query_arg vulnerability.

git-svn-id: https://plugins.svn.wordpress.org/woosidebars/trunk@1142184 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
		wp_safe_redirect( $sendback );
Tested up to: 4.1.0
Stable tag: 1.4.1
 * Version: 1.4.1
 * Stable tag: 1.4.1
 $woosidebars->version = '1.4.1';

Fixed code:
2015-04-22 - version 1.4.2
* Security Fix - remove_query_arg vulnerability
  /classes/class-woo-sidebars.php

		wp_safe_redirect( esc_url( $sendback ) );
Tested up to: 4.1.1
Stable tag: 1.4.2
= 1.4.2 =
Security Fix for XSS vulnerability

= 1.4.2 =
* 2015-04-22
* Security Fix for remove_query_arg vulnerability

 * Version: 1.4.2
 * Stable tag: 1.4.2
 $woosidebars->version = '1.4.2';
CVE-2015-4411 (Ruby, published 2020-02-20T17:15Z)
Description: value: The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/mongodb/bson-ruby
Files changed:
lib/bson/object_id.rb
Commit message: Use \A \z for checking regex on legal


Vulnerable code:
        string.to_s =~ /^[0-9a-f]{24}$/i ? true : false

Fixed code:
        string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
CVE-2015-4412 (Ruby, published 2018-02-05T16:29Z)
Description: value: BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/mongodb/bson-ruby
Files changed:
lib/bson/object_id.rb
Commit message: Use \A \z for checking regex on legal


Vulnerable code:
        string.to_s =~ /^[0-9a-f]{24}$/i ? true : false

Fixed code:
        string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
CVE-2021-4272 (JavaScript, published 2022-12-21T19:15Z)
Description: value: A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 0fb30f9640bd5fa0cae58922eac6c00bb1a94391. It is recommended to apply a patch to fix this issue. The identifier VDB-216477 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/studygolang/studygolang
Files changed:
static/js/topics.js
Commit message: 临时处理 xss


Vulnerable code:

Fixed code:

			// JS 处理，避免 XSS。最终还是改为服务端渲染更好
			if (contentHtml.indexOf('<script') != -1) {
				contentHtml = contentHtml.replace(/<script/g, '&lt;script');
			}
			if (contentHtml.indexOf('<form') != -1) {
				contentHtml = contentHtml.replace(/<form/g, '&lt;form');
			}
			if (contentHtml.indexOf('<input') != -1) {
				contentHtml = contentHtml.replace(/<input/g, '&lt;input');
			}
			if (contentHtml.indexOf('<select') != -1) {
				contentHtml = contentHtml.replace(/<select/g, '&lt;select');
			}
			if (contentHtml.indexOf('<textarea') != -1) {
				contentHtml = contentHtml.replace(/<textarea/g, '&lt;textarea');
			}
CVE-2021-4273 (Unknown, published 2022-12-21T19:15Z)
Description: value: A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/studygolang/studygolang
Files changed:
Commit message: Merge pull request #158 from RifeWang/master

fix: 搜索异常时导致页面渲染异常, 搜索框 XSS 漏洞

Vulnerable code:

Fixed code:
CVE-2019-10808 (Unknown, published 2020-03-11T23:15Z)
Description: value: utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/xcritical-software/utilitify
Files changed:
Commit message: Merge pull request #22 from xcritical-software/fix/merge_prototype_pollution

fix(mergeDeep): do not merge __proto__ property

Vulnerable code:

Fixed code:
CVE-2017-16877 (Unknown, published 2017-11-17T17:29Z)
Description: value: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/vercel/next.js
Files changed:
Commit message: Merge branch 'fix-dir-traversal-error'


Vulnerable code:

Fixed code:
CVE-2024-34351 (TypeScript, published 2024-05-14T15:38Z)
Description: value: Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`. This vulnerability was fixed in Next.js `14.1.1`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vercel/next.js
Files changed:
packages/next/src/server/app-render/action-handler.ts
packages/next/src/server/lib/start-server.ts
Commit message: Improve redirection handling (#62561)

Currently to redirect to another RSC route of the same app, we initiate
another request to that route. This PR changes that request to directly
use the internal hostname of the current server handler, rather than
relying on other headers.

Closes NEXT-2614

Vulnerable code:
    const host = originalHost.value

Fixed code:

    // For standalone or the serverful mode, use the internal hostname directly
    // other than the headers from the request.
    const host = process.env.__NEXT_PRIVATE_HOST || originalHost.value

      process.env.__NEXT_PRIVATE_HOST = `${actualHostname}:${port}`
CVE-2019-9199 (C++, published 2019-02-26T23:29Z)
Description: value: PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/jjanku/podofo
Files changed:
tools/podofoimpose/pdftranslator.cpp
Commit message: Fixed CVE-2019-9199, issue #40 (raises PdfError with PageNotFound code on error)

The error is the page 0 (0-based) not being found, before this fix that led to
a null pointer dereference (method call on a null pointer, undefined behavior),
now just a PdfError exception is raised.



Vulnerable code:
				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );

Fixed code:
                PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
                {
                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
                }
                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
CVE-2023-48299 (Java, published 2023-11-21T21:15Z)
Description: value: TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in open-source/public models, which can be downloaded from the internet, and take advantage of machines running Torchserve. The ZipSlip issue in TorchServe has been fixed by validating the paths of files contained within a zip archive before extracting them. TorchServe release 0.9.0 includes fixes to address the ZipSlip vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pytorch/serve
Files changed:
frontend/archive/src/main/java/org/pytorch/serve/archive/utils/ZipUtils.java
Commit message: fix zip slip error (#2634)



Vulnerable code:
                String name = entry.getName();
                File file = new File(dest, name);

Fixed code:
                File file = new File(dest, entry.getName());
                File canonicalDestDir = dest.getCanonicalFile();
                File canonicalFile = file.getCanonicalFile();

                // Check for Zip Slip vulnerability
                if (!canonicalFile.getPath().startsWith(canonicalDestDir.getPath())) {
                    throw new IOException("Detected Zip Slip vulnerability: " + entry.getName());
                }

                File canonicalDestDir = dest.getCanonicalFile();
                File canonicalFile = file.getCanonicalFile();

                // Check for Zip Slip vulnerability
                if (!canonicalFile.getPath().startsWith(canonicalDestDir.getPath())) {
                    throw new IOException("Detected Zip Slip vulnerability: " + entry.getName());
                }
CVE-2014-8399 (Other, published 2014-10-31T14:55Z)
Description: value: The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors.
Severity: LOW (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/desrt/systemd-shim
Files changed:
data/org.freedesktop.systemd1.conf
Commit message: security policy: remove clause for Abandon call

I committed this after copying it out of a work-in-progress branch that
was being worked on by Serge.  I didn't realise that it was most likely
only ever intended to be for debugging purposes.

According to Martin and Stéphane this is not needed and is a potential
security problem.  Let's close that hole.


Vulnerable code:
                <allow send_destination="org.freedesktop.systemd1"
                       send_interface="org.freedesktop.systemd1.Scope"
                       send_member="Abandon"/>


Fixed code:
CVE-2014-4172 (C#, published 2020-01-24T19:15Z)
Description: value: A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/Jasig/dotnet-cas-client
Files changed:
DotNetCasClient/Utils/UrlUtil.cs
Commit message: NETC-60 URL encode ticket parameter value.


Vulnerable code:
            ub.QueryItems.Add(CasAuthentication.TicketValidator.ArtifactParameterName, serviceTicket);

Fixed code:
            ub.QueryItems.Add(CasAuthentication.TicketValidator.ArtifactParameterName, HttpUtility.UrlEncode(serviceTicket));
CVE-2018-8899 (Other, published 2018-03-22T05:29Z)
Description: value: IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/IdentityServer/IdentityServer4
Files changed:
src/Host/web.config
src/IdentityServer4/Endpoints/Results/AuthorizeResult.cs
Commit message: encode redirect uri in authorize response


Vulnerable code:

    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" />
            html = html.Replace("{uri}", Response.Request.RedirectUri);

Fixed code:
    <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="true" startupTimeLimit="3600" requestTimeout="23:00:00" />
using System.Text.Encodings.Web;
            var url = Response.Request.RedirectUri;
            url = HtmlEncoder.Default.Encode(url);
            html = html.Replace("{uri}", url);
CVE-2021-46252 (PHP, published 2022-02-15T23:15Z)
Description: value: A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/InternationalScratchWiki/scratch-confirmaccount-v3
Files changed:
src/SpecialConfirmAccounts.php
src/subpages/RequirementsBypassPage.php
Commit message: Fix CSRF when adding requirements bypass (#155)



Vulnerable code:
			$bypassPage->handleFormSubmission();
			return $bypassPage->render();
    function handleFormSubmission() {
        $request = $request = $this->pageContext->getRequest();
        $this->render();
    function showAddBypassForm() {
    function showBypassesList() {
    function render() {
        $this->showAddBypassForm();
        $this->showBypassesList();

Fixed code:
			$bypassPage->handleFormSubmission($session);
			return $bypassPage->render($session);
require_once __DIR__ . '/../common.php';

use MediaWiki\Session\Session;
    function handleFormSubmission(Session &$session) {
        $request = $this->pageContext->getRequest();
        
        if (isCSRF($session, $request->getText('csrftoken'))) {
    			$this->pageContext->getOutput()->showErrorPage('error', 'scratch-confirmaccount-csrf');
    			return;
    		}
        $this->render($session);
    function showAddBypassForm(Session &$session) {
                    new OOUI\HiddenInputWidget([
                        'name' => 'csrftoken',
                        'value' => setCSRFToken($session)
                    ]),
    function showBypassesList(Session &$session) {
            $table .= Html::element('input', ['type' => 'hidden', 'name' => 'csrftoken', 'value' => setCSRFToken($session)]);
    function render(Session &$session) {
        $this->showAddBypassForm($session);
        $this->showBypassesList($session);
CVE-2014-0072 (Objective-C, published 2017-10-30T19:29Z)
Description: value: ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/apache/cordova-plugin-file-transfer
Files changed:
src/ios/CDVFileTransfer.m
Commit message: Fix default value for trustAllHosts on iOS (YES->NO)


Vulnerable code:
    BOOL trustAllHosts = [[command.arguments objectAtIndex:6 withDefault:[NSNumber numberWithBool:YES]] boolValue]; // allow self-signed certs
    BOOL trustAllHosts = [[command.arguments objectAtIndex:2 withDefault:[NSNumber numberWithBool:YES]] boolValue]; // allow self-signed certs

Fixed code:
    BOOL trustAllHosts = [[command.arguments objectAtIndex:6 withDefault:[NSNumber numberWithBool:NO]] boolValue]; // allow self-signed certs
    BOOL trustAllHosts = [[command.arguments objectAtIndex:2 withDefault:[NSNumber numberWithBool:NO]] boolValue]; // allow self-signed certs
CVE-2014-125093 (PHP, published 2023-03-10T02:15Z)
Description: value: A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to version 1.2.2 is able to address this issue. The patch is identified as 3312b9cd79e5710d1e282fc9216a4e5ab31b3d94. It is recommended to upgrade the affected component. VDB-222610 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wp-plugins/ad-blocking-detector
Files changed:
ad-blocking-detector.php
readme.txt
Commit message: Fix full path disclosure vulnerability and increment version.

git-svn-id: https://plugins.svn.wordpress.org/ad-blocking-detector/trunk@899810 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * Version: 1.2.1
//	Start SESSION to facilitate data transfers
if ( !session_id() ) {
	session_start();
}
Stable tag: 1.2.1

Fixed code:
 * Version: 1.2.2
//      Start SESSION to facilitate data transfers
//      Error Prevention: http://www.php.net/manual/en/function.session-start.php#82957
function my_session_start()
{
        if (isset($_COOKIE['PHPSESSID'])) {
                $sessid = $_COOKIE['PHPSESSID'];
        }
        else if (isset($_GET['PHPSESSID'])) {
                $sessid = $_GET['PHPSESSID'];
        }
        else {
                session_start();
                return false;
        }

        if (!preg_match('/^[a-z0-9]{32}$/', $sessid)) {
                return false;
        }
        session_start();

        return true;
}
my_session_start();
Stable tag: 1.2.2
= 1.2.2 =
* Fixed PHP warnings when PHPSESSID cookie contains illegal characters.
= 1.2.2 =
SECURITY UPDATE: This update plugs a security hole that, in cicumstances, gave [Full Path Disclosure](https://www.owasp.org/index.php/Full_Path_Disclosure).