hitoshura25/cvefixes huggingface dataset:
CVE-2021-21404 (Go, published 2021-04-06T20:15Z)
Description: value: Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/syncthing/syncthing
Files changed:
lib/relay/protocol/protocol.go
Commit message: Merge pull request from GHSA-x462-89pf-6r5h



Vulnerable code:

Fixed code:
	"fmt"
	if header.messageLength < 0 || header.messageLength > 1024 {
		return nil, fmt.Errorf("bad length (%d)", header.messageLength)
	}
CVE-2024-27292 (Python, published 2024-03-21T02:52Z)
Description: value: Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jhpyle/docassemble
Files changed:
docassemble_base/docassemble/base/functions.py
Commit message: updated filename_invalid function


Vulnerable code:
    if '../' in filename:

Fixed code:
    if '../' in filename or filename.startswith('/'):
CVE-2020-15110 (Python, published 2020-07-17T21:15Z)
Description: value: In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/jupyterhub/kubespawner
Files changed:
kubespawner/spawner.py
Commit message: move delimiter to pvc/pod name templates

and note version change


Vulnerable code:
        'jupyter-{username}{servername}',
        `{username}` is expanded to the escaped, dns-label safe username.
        'claim-{username}{servername}',
        # Set servername based on whether named-server initialised
        if self.name:
            # use two -- to ensure no collision possibilities
            # are created by an ambiguous boundary between username and
            # servername.
            # -- cannot occur in a string where - is the escape char.
            servername = '--{}'.format(self.name)
            safe_servername = '--{}'.format(escapism.escape(self.name, safe=safe_chars, escape_char='-').lower())
        else:
            servername = ''
            safe_servername = ''
        return template.format(
            unescaped_servername=servername,

Fixed code:
        'jupyter-{username}--{servername}',
        `{username}` is expanded to the escaped, dns-label-safe username.
        `{servername}` is expanded to the escaped, dns-label-safe server name, if any.

        Trailing `-` characters are stripped for safe handling of empty server names (user default servers).

        .. versionchanged:: 0.12
            `--` delimiter added to the template,
            where it was implicitly added to the `servername` field before.
            Additionally, `username--servername` delimiter was `-` instead of `--`,
            allowing collisions in certain circumstances.
        'claim-{username}--{servername}',
        `{servername}` is expanded to the escaped, dns-label-safe server name, if any.

        Trailing `-` characters are stripped for safe handling of empty server names (user default servers).

        .. versionchanged:: 0.12
            `--` delimiter added to the template,
            where it was implicitly added to the `servername` field before.
            Additionally, `username--servername` delimiter was `-` instead of `--`,
            allowing collisions in certain circumstances.
        raw_servername = self.name or ''
        safe_servername = escapism.escape(raw_servername, safe=safe_chars, escape_char='-').lower()
        rendered = template.format(
            unescaped_servername=raw_servername,
        # strip trailing - delimiter in case of empty servername.
        # k8s object names cannot have trailing -
        return rendered.rstrip("-")
CVE-2015-10040 (Shell, published 2023-01-13T20:15Z)
Description: value: A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/config.sh of the component Escape Sequence Handler. The manipulation leads to injection. The attack can be initiated remotely. The patch is identified as 3faa5deaa509012069afe75cd03c21bda5050a64. It is recommended to apply a patch to fix this issue. VDB-218302 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/mikeizbicki/gitlearn
Files changed:
scripts/config.sh
Commit message: fixed escape sequence vulnerability


Vulnerable code:
    head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}'

Fixed code:
    head -n 1 "$1" | cut -d'/' -f1 | sed 's/ *//g' | sed 's/[^[:digit:].]//g'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $2;}' | sed 's/[^[:digit:].]//g'
        head -n 1 "$1" | sed 's/\// /' | awk '{print $1;}' | sed 's/[^[:digit:].]//g'
CVE-2024-21511 (JavaScript, published 2024-04-23T05:15Z)
Description: value: Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sidorares/node-mysql2
Files changed:
lib/parsers/binary_parser.js
lib/parsers/text_parser.js
test/esm/unit/parsers/timezone-binary-sanitization.test.mjs
test/esm/unit/parsers/timezone-text-sanitization.test.mjs
Commit message: fix(security): sanitize timezone parameter value to prevent code injection (#2608)

* fix(security): sanitize timezone parameter value to prevent code injection. Discovered by zhaoyudi (Nebulalab）

Vulnerable code:
        return `packet.readDateTimeString(${field.decimals});`;
      return `packet.readDateTime('${timezone}');`;
      return `packet.parseDate('${timezone}')`;
      return `packet.parseDateTime('${timezone}')`;

Fixed code:
        return `packet.readDateTimeString(${parseInt(field.decimals, 10)});`;
      return `packet.readDateTime(${helpers.srcEscape(timezone)});`;
      return `packet.parseDate(${helpers.srcEscape(timezone)})`;
      return `packet.parseDateTime(${helpers.srcEscape(timezone)})`;
import { describe, test, assert } from 'poku';
import { createConnection, describeOptions } from '../../../common.test.cjs';

const connection = createConnection().promise();

describe('Binary Parser: timezone Sanitization', describeOptions);

Promise.all([
  test(async () => {
    process.env.TEST_ENV_VALUE = 'secure';
    await connection.execute({
      sql: 'SELECT NOW()',
      timezone: `'); process.env.TEST_ENV_VALUE = "not so much"; //`,
    });

    assert.strictEqual(
      process.env.TEST_ENV_VALUE,
      'secure',
      'Timezone sanitization failed - code injection possible',
    );
  }),
]).then(async () => {
  await connection.end();
});
import { describe, test, assert } from 'poku';
import { createConnection, describeOptions } from '../../../common.test.cjs';

const connection = createConnection().promise();

describe('Text Parser: timezone Sanitization', describeOptions);

Promise.all([
  test(async () => {
    process.env.TEST_ENV_VALUE = 'secure';
    await connection.query({
      sql: 'SELECT NOW()',
      timezone: `'); process.env.TEST_ENV_VALUE = "not so much"; //`,
    });

    assert.strictEqual(
      process.env.TEST_ENV_VALUE,
      'secure',
      'Timezone sanitization failed - code injection possible',
    );
  }),
]).then(async () => {
  await connection.end();
});
CVE-2020-28194 (C, published 2021-02-01T14:15Z)
Description: value: Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/accel-ppp/accel-ppp
Files changed:
accel-pppd/radius/packet.c
Commit message: radius: sanity check for vendor attribute length


Vulnerable code:

Fixed code:
				if (len < 0) {
					log_ppp_warn("radius:packet invalid vendor attribute len received\n");
					goto out_err;
				}
				if (2 + len > n) {
					log_ppp_warn("radius:packet: too long vendor attribute received (%i, %i)\n", id, len);
					goto out_err;
				}
CVE-2020-15179 (PHP, published 2020-09-15T18:15Z)
Description: value: The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.
Severity: MEDIUM (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/InternationalScratchWiki/wiki-scratchsig
Files changed:
ScratchSig2.php
Commit message: <scratchsig><script>location='https://www.youtube.com/watch?v=dQw4w9WgXcQ';</script></scratchsig>

Vulnerable code:
    $username = $input;

Fixed code:
    $username = htmlspecialchars($input);
CVE-2018-25062 (C, published 2023-01-01T09:15Z)
Description: value: A vulnerability classified as problematic has been found in flar2 ElementalX up to 6.x on Nexus 9. Affected is the function xfrm_dump_policy_done of the file net/xfrm/xfrm_user.c of the component ipsec. The manipulation leads to denial of service. Upgrading to version 7.00 is able to address this issue. The name of the patch is 1df72c9f0f61304437f4f1037df03b5fb36d5a79. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217152.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/flar2/ElementalX-N9
Files changed:
net/xfrm/xfrm_user.c
Commit message: ipsec: Fix aborted xfrm policy dump crash

An independent security researcher, Mohamed Ghannam, has reported
this vulnerability to Beyond Security's SecuriTeam Secure Disclosure
program.

The xfrm_dump_policy_done function expects xfrm_dump_policy to
have been called at least once or it will crash.  This can be
triggered if a dump fails because the target socket's receive
buffer is full.

This patch fixes it by using the cb->start mechanism to ensure that
the initialisation is always done regardless of the buffer situation.

Change-Id: Id41cdd41c4e43e0c3ac30c5d03c15b8046d70845
Fixes: 12a169e7d8f4 ("ipsec: Put dumpers on the dump list")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>


Vulnerable code:
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
	BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) >
		     sizeof(cb->args) - sizeof(cb->args[0]));

	if (!cb->args[0]) {
		cb->args[0] = 1;
		xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	}


Fixed code:
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
static int xfrm_dump_policy_start(struct netlink_callback *cb)
{
	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;

	BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args));

	xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY);
	return 0;
}

	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args;
	int (*start)(struct netlink_callback *);
						   .start = xfrm_dump_policy_start,
				.start = link->start,
CVE-2021-25979 (JavaScript, published 2021-11-08T15:15Z)
Description: value: Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/apostrophecms/apostrophe
Files changed:
modules/@apostrophecms/i18n/index.js
modules/@apostrophecms/task/index.js
Commit message: session object should exist in task reqs for better compatibility


Vulnerable code:
          crossDomainClipboard: req.session.aposCrossDomainClipboard
        if (req.session.aposCrossDomainClipboard) {
          }

Fixed code:
          crossDomainClipboard: req.session && req.session.aposCrossDomainClipboard
        if (req.session && req.session.aposCrossDomainClipboard) {
          },
          session: {}
CVE-2018-1002200 (Unknown, published 2018-07-25T17:29Z)
Description: value: plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/codehaus-plexus/plexus-archiver
Files changed:
Commit message: Merge pull request #87 from odinn1984/fix/fail_on_outside_target_files

fix: fail when trying to extract outside of dest dir

Vulnerable code:

Fixed code:
CVE-2013-0183 (Ruby, published 2013-03-01T05:40Z)
Description: value: multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/rack/rack
Files changed:
lib/rack/multipart/parser.rb
test/spec_multipart.rb
Commit message: multipart/parser: avoid unbounded #gets method

Malicious clients may send excessively long lines
to trigger out-of-memory errors in a Rack web server.


Vulnerable code:
          read_buffer = @io.gets
          break if read_buffer == full_boundary
          raise EOFError, "bad content body" if read_buffer.nil?

Fixed code:
          content = @io.read(BUFSIZE)
          raise EOFError, "bad content body" unless content
          @buf << content

          while @buf.gsub!(/\A([^\n]*\n)/, '')
            read_buffer = $1
            return if read_buffer == full_boundary
          end

          raise EOFError, "bad content body" if Utils.bytesize(@buf) >= BUFSIZE
  should "reject insanely long boundaries" do
    # using a pipe since a tempfile can use up too much space
    rd, wr = IO.pipe

    # we only call rewind once at start, so make sure it succeeds
    # and doesn't hit ESPIPE
    def rd.rewind; end
    wr.sync = true

    # mock out length to make this pipe look like a Tempfile
    def rd.length
      1024 * 1024 * 8
    end

    # write to a pipe in a background thread, this will write a lot
    # unless Rack (properly) shuts down the read end
    thr = Thread.new do
      begin
        wr.write("--AaB03x")

        # make the initial boundary a few gigs long
        longer = "0123456789" * 1024 * 1024
        (1024 * 1024).times { wr.write(longer) }

        wr.write("\r\n")
        wr.write('Content-Disposition: form-data; name="a"; filename="a.txt"')
        wr.write("\r\n")
        wr.write("Content-Type: text/plain\r\n")
        wr.write("\r\na")
        wr.write("--AaB03x--\r\n")
        wr.close
      rescue => err # this is EPIPE if Rack shuts us down
        err
      end
    end

    fixture = {
      "CONTENT_TYPE" => "multipart/form-data; boundary=AaB03x",
      "CONTENT_LENGTH" => rd.length.to_s,
      :input => rd,
    }

    env = Rack::MockRequest.env_for '/', fixture
    lambda {
      Rack::Multipart.parse_multipart(env)
    }.should.raise(EOFError)
    rd.close

    err = thr.value
    err.should.be.instance_of Errno::EPIPE
    wr.close
  end
CVE-2013-0262 (Ruby, published 2013-02-08T20:55Z)
Description: value: rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/rack/rack
Files changed:
lib/rack/file.rb
Commit message: Prevent symlink path traversals

 * Closes CVE-2013-0262


Vulnerable code:
      parts.inject(0) do |depth, part|
        case part
        when '', '.'
          depth
        when '..'
          return fail(404, "Not Found") if depth - 1 < 0
          depth - 1
        else
          depth + 1
        end
      @path = F.join(@root, *parts)

Fixed code:
      clean = []

      parts.each do |part|
        next if part.empty? || part == '.'
        part == '..' ? clean.pop : clean << part
      @path = F.join(@root, *clean)
CVE-2013-0263 (Ruby, published 2013-02-08T20:55Z)
Description: value: Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rack/rack
Files changed:
lib/rack/session/cookie.rb
Commit message: Use secure_compare for hmac comparison

 * Closes CVE-2013-0263


Vulnerable code:
          digest == generate_hmac(data, secret)

Fixed code:
          Rack::Utils.secure_compare(digest, generate_hmac(data, secret))
CVE-2013-0263 (Ruby, published 2013-02-08T20:55Z)
Description: value: Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rack/rack
Files changed:
lib/rack/utils.rb
test/spec_utils.rb
Commit message: Add secure_compare to Rack::Utils

Conflicts:
	test/spec_utils.rb


Vulnerable code:

Fixed code:
    # Constant time string comparison.
    def secure_compare(a, b)
      return false unless bytesize(a) == bytesize(b)

      l = a.unpack("C*")

      r, i = 0, -1
      b.each_byte { |v| r |= v ^ l[i+=1] }
      r == 0
    end
    module_function :secure_compare

  should "should perform constant time string comparison" do
    Rack::Utils.secure_compare('a', 'a').should.equal true
    Rack::Utils.secure_compare('a', 'b').should.equal false
  end