hitoshura25/cvefixes huggingface dataset:
CVE-2014-125057 (PHP, published 2023-01-07T10:15Z)
Description: value: A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token Handler. The manipulation of the argument _token leads to incorrect comparison. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 6b2813696ccb88d0576dfb305122ee880eb36197. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217599.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/mrobit/robitailletheknot
Files changed:
app/filters.php
Commit message: Patch security vulnerability.


Vulnerable code:
	if (Session::token() != Input::get('_token'))

Fixed code:
	if (Session::token() !== Input::get('_token'))
CVE-2019-12210 (C, published 2019-06-04T21:29Z)
Description: value: In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Yubico/pam-u2f
Files changed:
pam-u2f.c
util.c
util.h
Commit message: Do not leak file descriptor when doing exec

When opening a custom debug file, the descriptor would stay
open when calling exec and leak to the child process.

Make sure all files are opened with close-on-exec.

This fixes CVE-2019-12210.

Thanks to Matthias Gerstner of the SUSE Security Team for reporting
the issue.


Vulnerable code:
 *  Copyright (C) 2014-2018 Yubico AB - See COPYING
        struct stat st;
        FILE *file;
        if(lstat(filename, &st) == 0) {
          if(S_ISREG(st.st_mode)) {
            file = fopen(filename, "a");
            if(file != NULL) {
              cfg->debug_file = file;
            }
    authpending_file_descriptor = open(cfg->authpending_file, O_RDONLY | O_CREAT, 0664);
 * Copyright (C) 2014-2018 Yubico AB - See COPYING
  fd = open(authfile, O_RDONLY, 0);
  else if (fd >= 0)
 * Copyright (C) 2014-2018 Yubico AB - See COPYING

Fixed code:
 *  Copyright (C) 2014-2019 Yubico AB - See COPYING
  struct stat st;
  FILE *file = NULL;
  int fd = -1;

        fd = open(filename, O_WRONLY | O_APPEND | O_CLOEXEC | O_NOFOLLOW | O_NOCTTY);
        if (fd >= 0 && (fstat(fd, &st) == 0) && S_ISREG(st.st_mode)) {
          file = fdopen(fd, "a");
          if(file != NULL) {
            cfg->debug_file = file;
            cfg->is_custom_debug_file = 1;
            file = NULL;
            fd = -1;

  if (fd != -1)
    close(fd);

  if (file != NULL)
    fclose(file);
    authpending_file_descriptor =
      open(cfg->authpending_file, O_RDONLY | O_CREAT | O_CLOEXEC | O_NOFOLLOW | O_NOCTTY, 0664);
  if (cfg->is_custom_debug_file) {
    fclose(cfg->debug_file);
  }

 * Copyright (C) 2014-2019 Yubico AB - See COPYING
  fd = open(authfile, O_RDONLY | O_CLOEXEC | O_NOCTTY);
  } else {
    fd = -1; /* fd belongs to opwfile */

  if (fd != -1)

 * Copyright (C) 2014-2019 Yubico AB - See COPYING
  int is_custom_debug_file;
CVE-2022-24813 (PHP, published 2022-04-04T18:15Z)
Description: value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/miraheze/CreateWiki
Files changed:
includes/RequestWiki/RequestWikiRequestViewer.php
Commit message: T9018: Add submission check for anonymous users POSTing

Vulnerable code:

		if ( isset( $formData['submit-comment'] ) ) {
			$request->addComment( $formData['comment'], $form->getUser() );
				$request->approve( $form->getUser(), $formData['reason'] );
				$request->decline( $formData['reason'], $form->getUser() );

Fixed code:
		$user = $form->getUser();

		if ( $user->isAnon() ) {
			$out->addHTML( Html::errorBox( wfMessage( 'exception-nologin-text' )->parse() ) );
			
			return false;
		} elseif ( isset( $formData['submit-comment'] ) ) {
			$request->addComment( $formData['comment'], $user );
				$request->approve( $user, $formData['reason'] );
				$request->decline( $formData['reason'], $user );
CVE-2024-29898 (PHP, published 2024-03-28T14:15Z)
Description: value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the `(read)` permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/miraheze/CreateWiki
Files changed:
includes/RequestWiki/Handler/RestWikiRequest.php
includes/RequestWiki/RequestWikiRequestViewer.php
Commit message: Remove checks for `(read)` (#497)

Unnecessary checks, since if the user doesn't have this perm it should
not be able to reach the special pages or APIs to begin with.

Vulnerable code:
			if ( $wikiRequestVisibility !== 'read' && $this->getAuthority()->isAllowed( 'read' ) ) {
		if ( $visibilityConds[$request->visibility] !== 'read' && $permissionManager->userHasRight( $userR, 'read' ) ) {

Fixed code:
			if ( $wikiRequestVisibility !== 'read' ) {
		if ( $visibilityConds[$request->visibility] !== 'read' ) {
CVE-2018-10897 (Python, published 2018-08-01T17:29Z)
Description: value: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rpm-software-management/yum-utils
Files changed:
reposync.py
Commit message: reposync: refactor: sanitize remote_path usage

For better readability (remote_path == relativepath).


Vulnerable code:
                remote = pkg.returnSimple('relativepath')
                rpmname = os.path.basename(remote)
                remote = pkg.returnSimple('relativepath')
                local = local_repo_path + '/' + remote
                remote = pkg.returnSimple('relativepath')
                local = os.path.join(local_repo_path, remote)
                    print urljoin(pkg.repo.urls[0], pkg.relativepath)
            rpmfn = pkg.remote_path
            pkg.localpath = os.path.join(local_repo_path, rpmfn)

Fixed code:
                rpmname = os.path.basename(pkg.remote_path)
                local = os.path.join(local_repo_path, pkg.remote_path)
                local = os.path.join(local_repo_path, pkg.remote_path)
                    print urljoin(pkg.repo.urls[0], pkg.remote_path)
            pkg.localpath = os.path.join(local_repo_path, pkg.remote_path)
CVE-2018-10897 (Other, published 2018-08-01T17:29Z)
Description: value: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rpm-software-management/yum-utils
Files changed:
docs/reposync.1
reposync.py
Commit message: reposync: prevent path traversal. BZ 1552328


Vulnerable code:

Fixed code:
.IP "\fB\-\-allow-path-traversal\fP"
Allow packages stored outside their repo directory to be synced.
These are packages that are referenced in metadata by using absolute paths or
up-level ".." symbols, and are normally skipped by \fBreposync\fR for security
reasons.

\fBCAUTION:\fR Using this option has potential security implications since, by
providing malicious repodata, an attacker could make \fBreposync\fR write to
arbitrary locations on the file system that are accessible by the user running
it.
def is_subpath(path, root):
    root = os.path.realpath(root)
    path = os.path.realpath(os.path.join(root, path))
    # join() is used below to ensure root ends with a slash
    return path.startswith(os.path.join(root, ''))

    parser.add_option("", "--allow-path-traversal", default=False,
        action="store_true",
        help=_("Allow packages stored outside their repo directory to be synced "
               "(UNSAFE, USE WITH CAUTION!)"))
        # Ensure we don't traverse out of local_repo_path by dropping any
        # packages whose remote_path is absolute or contains up-level
        # references (unless explicitly allowed).
        # See RHBZ#1600221 for details.
        if not opts.allow_path_traversal:
            newlist = []
            skipped = False
            for pkg in download_list:
                if is_subpath(pkg.remote_path, local_repo_path):
                    newlist.append(pkg)
                    continue
                my.logger.warning(
                    _('WARNING: skipping package %s: remote path "%s" not '
                      'within repodir, unsafe to mirror locally')
                    % (pkg, pkg.remote_path)
                )
                skipped = True
            if skipped:
                my.logger.info(
                    _('You can enable unsafe remote paths by using '
                      '--allow-path-traversal (see reposync(1) for details)')
                )
            download_list = newlist
CVE-2017-7418 (Unknown, published 2017-04-04T17:59Z)
Description: value: ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/proftpd/proftpd
Files changed:
Commit message: Merge pull request #444 from proftpd/auth-symlinks-anywhere-in-chroot

Walk the entire DefaultRoot path, checking for symlinks of any compon…

Vulnerable code:

Fixed code:
CVE-2013-7459 (Python, published 2017-02-15T15:59Z)
Description: value: Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/dlitz/pycrypto
Files changed:
lib/Crypto/SelfTest/Cipher/common.py
src/block_template.c
Commit message: Throw exception when IV is used with ECB or CTR

The IV parameter is currently ignored when initializing
a cipher in ECB or CTR mode.

For CTR mode, it is confusing: it takes some time to see
that a different parameter is needed (the counter).

For ECB mode, it is outright dangerous.

This patch forces an exception to be raised.


Vulnerable code:
        for mode in (self.module.MODE_ECB, self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB, self.module.MODE_OPENPGP):

            if mode != self.module.MODE_OPENPGP:
                decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
            else:
                eiv = ciphertext[:self.module.block_size+2]
                ciphertext = ciphertext[self.module.block_size+2:]
                decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv)

Fixed code:

        ## ECB mode
        mode = self.module.MODE_ECB
        encryption_cipher = self.module.new(a2b_hex(self.key), mode)
        ciphertext = encryption_cipher.encrypt(self.plaintext)
        decryption_cipher = self.module.new(a2b_hex(self.key), mode)
        decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
        self.assertEqual(self.plaintext, decrypted_plaintext)

        ## OPENPGP mode
        mode = self.module.MODE_OPENPGP
        encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
        eiv_ciphertext = encryption_cipher.encrypt(self.plaintext)
        eiv = eiv_ciphertext[:self.module.block_size+2]
        ciphertext = eiv_ciphertext[self.module.block_size+2:]
        decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv)
        decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
        self.assertEqual(self.plaintext, decrypted_plaintext)

        ## All other non-AEAD modes (but CTR)
        for mode in (self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB):
            decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)

	if (IVlen != 0 && mode == MODE_ECB)
	{
		PyErr_Format(PyExc_ValueError, "ECB mode does not use IV");
		return NULL;
	}
	if (IVlen != 0 && mode == MODE_CTR)
	{
		PyErr_Format(PyExc_ValueError,
			"CTR mode needs counter parameter, not IV");
		return NULL;
	}
CVE-2021-32774 (PHP, published 2021-07-20T01:15Z)
Description: value: DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/miraheze/DataDump
Files changed:
includes/DataDumpPager.php
includes/specials/SpecialDataDump.php
Commit message: Merge pull request from GHSA-29mh-4vhv-x8mr

* Add CSRF token check for generating dumps

* Update SpecialDataDump.php

* Add token for action=download

* Fix indendation

* Fix indendation

* fix indentation

* Convert to forms

* fix link generation

* don't check on download pt1

* don't check on download pt2

* rm stray code

* rm accidentally added character

* rm stray whitespace

* rm unused variable

* standardize

Co-authored-by: R4356th <61620631+R4356th@users.noreply.github.com>
Co-authored-by: The-Voidwalker <voidwalker.wikipedia@gmail.com>
Co-authored-by: R4356th <radman.siddiki@gmail.com>

Vulnerable code:
				$linkRenderer = MediaWikiServices::getInstance()->getLinkRenderer();


				$formatted = $linkRenderer->makeLink( $this->pageTitle, wfMessage( 'datadump-delete-button' )->text(), [], $query );
				$this->doDelete( $type, $dump );

Fixed code:
				$link = $this->pageTitle->getLinkURL( $query );
				$element = Html::element(
					'input', 
					[
						'type' => 'submit',
						'title' => $this->pageTitle,
						'value' => wfMessage('datadump-delete-button')->text()
					]
				);
				$token = Html::element(
					'input',
					[
						'type' => 'hidden',
						'name' => 'token',
						'value' => $this->getUser()->getEditToken()
					]
				);
				$formatted = Html::openElement(
					'form',
					[
						'action' => $link,
						'method' => 'POST'
					]
				) . $element . $token . Html::closeElement('form');
			} elseif ( !$user->matchEditToken( $this->getContext()->getRequest()->getText( 'wpEditToken' ) ) ) {
				return;
		
		$user = $this->getUser();
				if ( $user->matchEditToken($request->getVal('token'))) {
					$this->doDelete( $type, $dump );
				} else { 
					$out->addWikiMsg( 'sessionfailure' );
				}
CVE-2015-7315 (Other, published 2017-09-25T17:29Z)
Description: value: Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/zopefoundation/Products.CMFCore
Files changed:
Products/CMFCore/CHANGES.txt
Products/CMFCore/RegistrationTool.py
Commit message: Make sure RegistrationTool.addMember is not published


Vulnerable code:
- Nothing changed yet.
        '''Creates a PortalMember and returns it. The properties argument
        can be a mapping with additional member properties. Raises an
        exception if the given id already exists, the password does not
        comply with the policy in effect, or the authenticated user is not
        allowed to grant one of the roles listed (where Member is a special
        role that can always be granted); these conditions should be
        detected before the fact so that a cleaner message can be printed.
        '''

Fixed code:
- Make sure RegistrationTool.addMember is not published
  [vangheem]
        # XXX Do not make this a normal method comment. Doing so makes
        # this method publishable

        # Creates a PortalMember and returns it. The properties argument
        # can be a mapping with additional member properties. Raises an
        # exception if the given id already exists, the password does not
        # comply with the policy in effect, or the authenticated user is not
        # allowed to grant one of the roles listed (where Member is a special
        # role that can always be granted); these conditions should be
        # detected before the fact so that a cleaner message can be printed.
CVE-2023-36814 (Unknown, published 2023-07-03T17:15Z)
Description: value: Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/zopefoundation/Products.CMFCore
Files changed:
Commit message: Merge pull request from GHSA-4hpj-8rhv-9x87

Improve handling of PortalFolder filter input.

Vulnerable code:

Fixed code:
CVE-2016-10522 (Ruby, published 2018-07-05T16:29Z)
Description: value: rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/sferik/rails_admin
Files changed:
app/controllers/rails_admin/application_controller.rb
spec/integration/rails_admin_spec.rb
Commit message: [Security] Fixes CSRF vulnerability, introduced by 53eef4fe2ec0953381f4e3197c885adc0423dd49

Reported by SourceClear, Inc.


Vulnerable code:

Fixed code:
    protect_from_forgery with: :exception


  describe 'CSRF protection' do
    before do
      allow_any_instance_of(ActionController::Base).to receive(:protect_against_forgery?).and_return(true)
    end

    it 'is enforced' do
      visit new_path(model_name: 'league')
      fill_in 'league[name]', with: 'National league'
      find('input[name="authenticity_token"]', visible: false).set("invalid token")
      expect { click_button 'Save' }.to raise_error ActionController::InvalidAuthenticityToken
    end
  end