hitoshura25/cvefixes huggingface dataset:
CVE-2023-25801 (Python, published 2023-03-25T00:15Z)
Description: value: TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/fractional_avg_pool_op.cc
tensorflow/core/kernels/fractional_max_pool_op.cc
tensorflow/python/kernel_tests/nn_ops/fractional_avg_pool_op_test.py
tensorflow/python/kernel_tests/nn_ops/fractional_max_pool_op_test.py
Commit message: Fix security vulnerability with FractionalMax(AVG)Pool with illegal pooling_ratio

PiperOrigin-RevId: 501651261


Vulnerable code:
        context, pooling_ratio_[0] == 1 || pooling_ratio_[3] == 1,
        context, pooling_ratio_[0] == 1 || pooling_ratio_[3] == 1,
  def testPoolingRatioValueOutOfRange(self):
  def testPoolingRatioValueOutOfRange(self):

Fixed code:
        context, pooling_ratio_[0] == 1 && pooling_ratio_[3] == 1,
        context, pooling_ratio_[0] == 1 && pooling_ratio_[3] == 1,
  def testPoolingRatioIllegalSmallValue(self):
  def testPoolingIllegalRatioForBatch(self):
    with self.cached_session() as _:
      with self.assertRaises(errors.UnimplementedError):
        result = nn_ops.gen_nn_ops.fractional_avg_pool(
            np.zeros([3, 30, 50, 3]),
            [2, 3, 1.5, 1],
            True,
            True)
        self.evaluate(result)

  def testPoolingRatioIllegalSmallValue(self):
  def testPoolingIllegalRatioForBatch(self):
    with self.cached_session() as _:
      with self.assertRaises(errors.UnimplementedError):
        result = nn_ops.fractional_max_pool(
            np.zeros([3, 30, 50, 3]),
            [2, 3, 1.5, 1],
            True,
            True)
        self.evaluate(result)
CVE-2023-27579 (C++, published 2023-03-25T00:15Z)
Description: value: TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/lite/kernels/conv.cc
Commit message: Check filter_input_channel > 0 in conv kernel.

PiperOrigin-RevId: 503266928


Vulnerable code:

Fixed code:
  TF_LITE_ENSURE(context, filter_input_channel > 0);
CVE-2020-19860 (Other, published 2022-01-21T14:15Z)
Description: value: When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/NLnetLabs/ldns
Files changed:
Changelog
rr.c
Commit message: * bugfix #70: heap Out-of-bound Read vulnerability in
  rr_frm_str_internal reported by pokerfacett.


Vulnerable code:
			while (*(ldns_buffer_current(rd_buf)) == ' ') {
			if (*(ldns_buffer_current(rd_buf)) == '\"') {
			} else if (ldns_rr_descriptor_field_type(desc, r_cnt)

Fixed code:
...
	* bugfix #70: heap Out-of-bound Read vulnerability in
	  rr_frm_str_internal reported by pokerfacett.

			while (sldns_buffer_remaining(strbuf) > 0 &&
				*(ldns_buffer_current(rd_buf)) == ' ') {
			if (sldns_buffer_remaining(strbuf) > 0 &&
				*(ldns_buffer_current(rd_buf)) == '\"') {
			}
			if (!quoted && ldns_rr_descriptor_field_type(desc, r_cnt)
CVE-2023-39346 (PHP, published 2023-08-04T21:15Z)
Description: value: LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file. The problem has been patched in commit 20dba06bd1a3cf260612d4f21547c25002121cd5. There are no known workarounds.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/bjrjk/LinuxASMCallGraph
Files changed:
web/index.php
Commit message: Fixed Vulnerability

Fixed Vulnerability #6 and #8.


Vulnerable code:
        $command = "unzip -l \"$fullName.zip\" | grep php 2>&1";
            die("Don't try to do bad things!");
        $command = "unzip \"$fullName.zip\" -d \"$fullName\" 2>&1";

Fixed code:
        $command = "zipinfo \"$fullName.zip\" | grep -P l[rwx-]{9} 2>&1";
            die("Don't try to do bad! You tricky Linux hacker boy!");
        }
        $command = "unzip \"$fullName.zip\" -d \"$fullName\" | grep -P \".php|.htaccess\" 2>&1";
		if(count($message)){
            die("Don't try to do bad! You tricky web hacker boy!");
CVE-2014-3498 (Python, published 2017-06-08T18:29Z)
Description: value: The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ansible/ansible
Files changed:
lib/ansible/inventory/script.py
lib/ansible/runner/__init__.py
lib/ansible/runner/return_data.py
lib/ansible/utils/__init__.py
lib/ansible/utils/template.py
Commit message: When parsing json from untrusted sources, remove templating tags


Vulnerable code:
        self.raw  = utils.parse_json(self.data)
        data = utils.parse_json(res['stdout'])
            self.result = utils.parse_json(self.result)

def parse_json(raw_data):
        return json.loads(data)

        return results
JINJA2_OVERRIDE='#jinja2:'

    # Get jinja env overrides from template
    if data.startswith(JINJA2_OVERRIDE):
        eol = data.find('\n')
        line = data[len(JINJA2_OVERRIDE):eol]
        data = data[eol+1:]
        for pair in line.split(','):
            (key,val) = pair.split(':')
            setattr(environment,key.strip(),ast.literal_eval(val.strip()))


Fixed code:
        self.raw  = utils.parse_json(self.data, from_remote=True)
        data = utils.parse_json(res['stdout'], from_remote=True)
            self.result = utils.parse_json(self.result, from_remote=True)
def _clean_data(orig_data):
    ''' remove template tags from a string '''
    data = orig_data
    if isinstance(orig_data, basestring):
        for pattern,replacement in (('{{','{#'), ('}}','#}'), ('{%','{#'), ('%}','#}')):
            data = data.replace(pattern, replacement)
    return data

def _clean_data_struct(orig_data):
    '''
    walk a complex data structure, and use _clean_data() to
    remove any template tags that may exist
    '''
    if isinstance(orig_data, dict):
        data = orig_data.copy()
        for key in data:
            new_key = _clean_data_struct(key)
            new_val = _clean_data_struct(data[key])
            if key != new_key:
                del data[key]
            data[new_key] = new_val
    elif isinstance(orig_data, list):
        data = orig_data[:]
        for i in range(0, len(data)):
            data[i] = _clean_data_struct(data[i])
    elif isinstance(orig_data, basestring):
        data = _clean_data(orig_data)
    else:
        data = orig_data
    return data

def parse_json(raw_data, from_remote=False):
        results = json.loads(data)

    if from_remote:
        results = _clean_data_struct(results)

    return results
CVE-2020-15235 (Python, published 2020-10-05T16:15Z)
Description: value: In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/ractf/core
Files changed:
src/config/config.py
src/config/views.py
Commit message: patch unauthenticated users being able to read sensitive config fields by viewing them individually instead of listing them (#37)



Vulnerable code:
from rest_framework.status import HTTP_400_BAD_REQUEST
            if request.user.is_staff:
        return FormattedResponse(config.get(name))

Fixed code:
def is_sensitive(key):
    return key in backend.get('sensitive_fields')


from rest_framework.status import HTTP_400_BAD_REQUEST, HTTP_403_FORBIDDEN
            if request.user.is_superuser:
        if not config.is_sensitive(name) or request.is_superuser:
            return FormattedResponse(config.get(name))
        return FormattedResponse(status=HTTP_403_FORBIDDEN)
CVE-2021-21329 (Python, published 2021-03-08T18:15Z)
Description: value: RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF users with multi factor authentication enabled are able to log in without a valid token. This is fixed in commit cebb67b.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ractf/core
Files changed:
src/authentication/views.py
Commit message: Merge pull request from GHSA-fw57-f7mq-9q85



Vulnerable code:
        return self.issue_token(user)

Fixed code:
        return FormattedResponse(status=HTTP_401_UNAUTHORIZED, d={'reason': 'login_failed'}, m='login_failed')
CVE-2021-24366 (PHP, published 2021-06-21T20:15Z)
Description: value: The Admin Columns WordPress plugin before 4.3 and Admin Columns Pro WordPress plugin before 5.5.1 do not sanitise and escape its Label settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/codepress/admin-columns
Files changed:
classes/Controller/ListScreen/Sanitize/FormData.php
classes/Controller/ListScreen/Sanitize/Title.php
classes/Controller/ListScreen/Save.php
classes/Sanitize.php
classes/Settings/Column/Label.php
Commit message: Sanitise label + title


Vulnerable code:
		$this->label = $label;

Fixed code:
<?php

namespace AC\Controller\ListScreen\Sanitize;

use AC\Sanitize;

class FormData implements Sanitize {

	/**
	 * @param array $data
	 *
	 * @return array
	 */
	public function sanitize( $data ) {
		if ( isset( $data[ Title::FIELD ] ) ) {
			$data[ Title::FIELD ] = ( new Title() )->sanitize( $data[ Title::FIELD ] );
		}

		return $data;
	}

}
<?php

namespace AC\Controller\ListScreen\Sanitize;

use AC\Sanitize;

class Title implements Sanitize {

	const FIELD = 'title';

	public function sanitize( $data ) {
		return wp_kses( $data, true );
	}

}
	/**
	 * @var Sanitize\FormData
	 */
	private $sanitizer;

		$this->sanitizer = new Sanitize\FormData();
		$data = $this->sanitizer->sanitize( $data );

<?php

namespace AC;

interface Sanitize {

	public function sanitize( $data );

}
		$this->label = apply_filters( 'ac/column/label', wp_kses( $label, true ), $label );;
CVE-2019-12980 (C, published 2019-06-26T18:15Z)
Description: value: In Ming (aka libming) 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the SWFInput_readSBits function in blocks/input.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/libming/libming
Files changed:
src/blocks/input.c
Commit message: Fix left shift of a negative value in SWFInput_readSBits. Check for number before before left-shifting by (number-1).


Vulnerable code:
	if ( num & (1<<(number-1)) )

Fixed code:
	if(number && num & (1<<(number-1)))
CVE-2019-12981 (C, published 2019-06-26T18:15Z)
Description: value: Ming (aka libming) 0.4.8 has an "fill overflow" vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/libming/libming
Files changed:
src/blocks/shape.c
Commit message: SWFShape_setLeftFillStyle: prevent fill overflow


Vulnerable code:

Fixed code:
	else if (idx >= 255 && shape->useVersion == SWF_SHAPE1)
	{
		SWF_error("Too many fills for SWFShape V1.\n" 
			  "Use a higher SWFShape version\n");
	}
CVE-2019-12982 (C, published 2019-06-26T18:15Z)
Description: value: Ming (aka libming) 0.4.8 has a heap buffer overflow and underflow in the decompileCAST function in util/decompile.c in libutil.a. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted SWF file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/libming/libming
Files changed:
util/decompile.c
Commit message: decompileAction: Prevent heap buffer overflow and underflow with using OpCode


Vulnerable code:
	if( n > maxn ) SWF_error("Action overflow!!");
	switch(actions[n].SWF_ACTIONRECORD.ActionCode)

Fixed code:
	switch(OpCode(actions, n, maxn))
CVE-2013-1425 (Other, published 2019-11-07T21:15Z)
Description: value: ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/elmar/ldap-git-backup
Files changed:
README.mdown
configure.ac
debian/changelog
ldap-git-backup.in
t/030_git-from-scratch.t.in
Commit message: set default permission 0700 for backup directory

fixes CVE-2013-1425 (local information disclosure)


Vulnerable code:
    [1.0.3],
    make_path($backup_dir);

Fixed code:
- Hans Spaans <hans.spaans@nexit.nl>
    [1.0.4],
ldap-git-backup (1.0.4-1) unstable; urgency=low

  * create backup directory with default mode of 0700
    fixes CVE-2013-1425 (local information disclosure)
    Thanks to Hans Spaans <hans.spaans@nexit.nl>

 -- Elmar S. Heeb <elmar@heebs.ch>  Mon, 28 Jan 2013 19:05:13 +0000

    make_path($backup_dir, {mode => 0700});
my $mode = ((stat($backup_dir))[2]) & 0777; # mask only permission part of mode
$mode = sprintf("%#o", $mode); # string in octal to help readability of assertion
is( $mode, '0700', 'new backup directory should be created with mode 0700 (rwx------)' );
CVE-2021-41092 (Unknown, published 2021-10-04T20:15Z)
Description: value: Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/docker/cli
Files changed:
Commit message: Merge pull request #2 from moby/cli-ghsa-99pg-grm5-qq3v-default-authconfig-20.10

[20.10] registry: ensure default auth config has address

Vulnerable code:

Fixed code:
CVE-2013-10013 (Java, published 2023-01-17T16:15Z)
Description: value: A vulnerability was found in Bricco Authenticator Plugin. It has been declared as critical. This vulnerability affects the function authenticate/compare of the file src/java/talentum/escenic/plugins/authenticator/authenticators/DBAuthenticator.java. The manipulation leads to sql injection. Upgrading to version 1.39 is able to address this issue. The name of the patch is a5456633ff75e8f13705974c7ed1ce77f3f142d5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218428.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Bricco/authenticator-plugin
Files changed:
src/java/talentum/escenic/plugins/authenticator/authenticators/DBAuthenticator.java
Commit message: Prevent SQL-injection


Vulnerable code:
import java.sql.Connection;
import java.sql.Statement;
					+ columns.get("password") + "= '?'";
			
			String[] preparedVariables = new String[] {username, password};
			
			
			
			contentManager.doQuery(new Query(sql, preparedVariables, result));
		private String[] variables;
		public Query(String query, String[] variables, List list) {
			this.variables = variables;
			//Statement st = t.getConnection().createStatement();
			Statement st = t.getConnection().prepareStatement(query, variables);
				ResultSet rs = st.executeQuery(query);
	            st.close();

Fixed code:

					+ columns.get("password") + "= ?";
			contentManager.doQuery(new Query(sql, new String[] { username, password },  result));
		private String[] args;
		public Query(String query, String[] args, List list) {
			this.args = args;
			PreparedStatement prepStmt = t.getConnection().prepareStatement(query);
			prepStmt.setString(1, args[0]);
			prepStmt.setString(2, args[1]);
				ResultSet rs = prepStmt.executeQuery();
	        	prepStmt.close();
CVE-2024-22199 (Unknown, published 2024-01-11T18:15Z)
Description: value: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/gofiber/template
Files changed:
Commit message: Merge pull request #326 from gofiber/django-autoescape

fix: Django autoescape should be enable by default

Vulnerable code:

Fixed code:
CVE-2024-22199 (Unknown, published 2024-01-11T18:15Z)
Description: value: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/gofiber/template
Files changed:
Commit message: Merge pull request #326 from gofiber/django-autoescape

fix: Django autoescape should be enable by default

Vulnerable code:

Fixed code:
CVE-2024-22199 (Unknown, published 2024-01-11T18:15Z)
Description: value: This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gofiber/template
Files changed:
Commit message: Merge pull request #326 from gofiber/django-autoescape

fix: Django autoescape should be enable by default

Vulnerable code:

Fixed code: