hitoshura25/cvefixes huggingface dataset:
CVE-2024-34354 (Unknown, published 2024-05-14T15:38Z)
Description: value: CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/CriticalMoments/CMSaasStarter
Files changed:
Commit message: Merge pull request #65 from CriticalMoments/safe_get_session

Fix a security issue: https://github.com/supabase/supabase/pull/22381

Vulnerable code:

Fixed code:
CVE-2019-15903 (C, published 2019-09-04T06:15Z)
Description: value: In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libexpat/libexpat
Files changed:
expat/lib/xmlparse.c
Commit message: xmlparse.c: Deny internal entities closing the doctype


Vulnerable code:
                               XML_Bool haveMore);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer);
         int tok, const char *next, const char **nextPtr, XML_Bool haveMore) {
                      tok, next, &next, XML_FALSE);
                      tok, next, &next, XML_FALSE);
                    (XML_Bool)! parser->m_parsingStatus.finalBuffer);

Fixed code:
                               XML_Bool haveMore, XML_Bool allowClosingDoctype);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
         int tok, const char *next, const char **nextPtr, XML_Bool haveMore,
         XML_Bool allowClosingDoctype) {
      if (allowClosingDoctype != XML_TRUE) {
        /* Must not close doctype from within expanded parameter entities */
        return XML_ERROR_INVALID_TOKEN;
      }

                      tok, next, &next, XML_FALSE, XML_FALSE);
                      tok, next, &next, XML_FALSE, XML_TRUE);
                    (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
CVE-2019-15903 (C, published 2019-09-04T06:15Z)
Description: value: In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-776 \u2014 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Repository: https://github.com/libexpat/libexpat
Files changed:
expat/lib/xmlparse.c
Commit message: xmlparse.c: Deny internal entities closing the doctype


Vulnerable code:
                               XML_Bool haveMore);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer);
         int tok, const char *next, const char **nextPtr, XML_Bool haveMore) {
                      tok, next, &next, XML_FALSE);
                      tok, next, &next, XML_FALSE);
                    (XML_Bool)! parser->m_parsingStatus.finalBuffer);

Fixed code:
                               XML_Bool haveMore, XML_Bool allowClosingDoctype);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
                  (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
         int tok, const char *next, const char **nextPtr, XML_Bool haveMore,
         XML_Bool allowClosingDoctype) {
      if (allowClosingDoctype != XML_TRUE) {
        /* Must not close doctype from within expanded parameter entities */
        return XML_ERROR_INVALID_TOKEN;
      }

                      tok, next, &next, XML_FALSE, XML_FALSE);
                      tok, next, &next, XML_FALSE, XML_TRUE);
                    (XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
CVE-2010-0011 (C, published 2010-02-25T19:30Z)
Description: value: The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/Dieterbe/uzbl
Files changed:
README
tests/test-command.c
uzbl-core.c
Commit message: disable Uzbl javascript object because of security problem.


Vulnerable code:
### JAVASCRIPT HELPER OBJECT
### JAVASCRIPT SECURITY

Since defined variables and functions are set in the global namespace (`window` object) as default, it is recommended to wrap your scripts like this:

    (function(Uzbl) {
        ...
    })(Uzbl);

This way, everything is kept private. It also turns Uzbl into a local variable, which can be accessed from callback functions defined inside. However for some situations, isolating everything isn't an option, for example, with binds. You can define them directly in the script body, and use `var Uzbl = window.Uzbl;` to make the Uzbl variable local, as in the following example:

    function f() {
        var Uzbl = window.Uzbl;
        Uzbl.run(...);
        setTimeout(function() {
            Uzbl.run(...);
        }, 500);
    }

Copying the Uzbl object and creating public functions should be taken with care to avoid creating security holes. Keep in mind that the "f" function above would be defined in the `window` object, and as such any javascript in the current page can call it.
    /* uzbl commands can be run from javascript */
    uzbl.net.useragent = "Test useragent";
    parse_cmd_line("js Uzbl.run('print @useragent').toUpperCase();", result);
    g_assert_cmpstr("TEST USERAGENT", ==, result->str);

    JSStringRef var_name;
    /* uzbl javascript namespace */
    var_name = JSStringCreateWithUTF8CString("Uzbl");
    JSObjectSetProperty(context, globalobject, var_name,
                        JSObjectMake(context, uzbl.js.classref, NULL),
                        kJSClassAttributeNone, NULL);

    JSObjectDeleteProperty(context, globalobject, var_name, NULL);

    JSStringRelease(var_name);

Fixed code:
### JAVASCRIPT HELPER OBJECT DISABLED BECAUSE OF SECURITY LEAK
CVE-2010-2809 (Other, published 2010-08-19T22:00Z)
Description: value: The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/Dieterbe/uzbl
Files changed:
examples/config/config
Commit message: Don't shell-interpret \@SELECTED_URI (fixes FS#240)


Vulnerable code:
@bind  <Button2>  = sh 'if [ "\@SELECTED_URI" ]; then uzbl-browser -u "\@SELECTED_URI"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi'

Fixed code:
@bind  <Button2>  = sh 'if [ "$8" ]; then uzbl-browser -u "$8"; else echo "uri $(xclip -o | sed s/\\\@/%40/g)" > $4; fi' \@SELECTED_URI
CVE-2021-4295 (Unknown, published 2022-12-29T09:15Z)
Description: value: A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/onc-healthit/code-validator-api
Files changed:
Commit message: Merge pull request #97 from radiovideo/XXE-vulnerability-fix

Fix DocumentBuilderFactory XXE vulnerability

Vulnerable code:

Fixed code:
CVE-2017-5603 (Java, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/jitsi/jitsi
Files changed:
src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
Commit message: Checks from for received carbon messages, should be bare jid.


Vulnerable code:

Fixed code:

                // according to xep-0280 all carbons should come from
                // our bare jid
                if (!msg.getFrom().equals(
                        StringUtils.parseBareAddress(
                            jabberProvider.getOurJID())))
                {
                    logger.info("Received a carbon copy with wrong from!");
                    return;
                }
CVE-2017-5603 (Java, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Jitsi 2.5.5061 - 2.9.5544.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/jitsi/jitsi
Files changed:
src/net/java/sip/communicator/impl/protocol/jabber/OperationSetBasicInstantMessagingJabberImpl.java
Commit message: Checks from for received carbon messages, should be bare jid.


Vulnerable code:

Fixed code:

                // according to xep-0280 all carbons should come from
                // our bare jid
                if (!msg.getFrom().equals(
                        StringUtils.parseBareAddress(
                            jabberProvider.getOurJID())))
                {
                    logger.info("Received a carbon copy with wrong from!");
                    return;
                }
CVE-2022-43550 (Java, published 2023-02-09T20:15Z)
Description: value: A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/jitsi/jitsi
Files changed:
modules/service/browserlauncher/src/main/java/net/java/sip/communicator/impl/browserlauncher/BrowserLauncherImpl.java
Commit message: Adds a check for valid http link when opening a browser.


Vulnerable code:

Fixed code:
        if (url == null || !url.startsWith("http"))
        {
            logger.warn("Not a valid URL to open:" + url);
            return;
        }
CVE-2017-7266 (Python, published 2017-03-26T05:59Z)
Description: value: Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Netflix/security_monkey
Files changed:
security_monkey/auth/modules.py
security_monkey/sso/views.py
security_monkey/views/__init__.py
security_monkey/views/logout.py
setup.py
Commit message: Replacing Flask-Security with Flask-Security-Fork. Removing some explicit dependencies to rely on flask-security-fork dependencies. SSO will use flask-security login_user instead of flask-login so that security_trackable works. Replacing current_user.is_authenticated() method with property so  we can use a newer version of flask-login. (#482)



Vulnerable code:
        if current_user.is_authenticated():
        if current_user.is_authenticated():
from flask_login import login_user
            if auth.is_authenticated():
        if current_user.is_authenticated():
        if not current_user.is_authenticated():
        'Flask-Login==0.2.10',
        'Flask-Security==1.7.4',
        'Flask-WTF==0.9.5',
        'psycopg2==2.5.2',
        'bcrypt==2.0.0',
        'cryptography==1.3.2',

Fixed code:
        if current_user.is_authenticated:
        if current_user.is_authenticated:
from flask_security.utils import login_user
            if auth.is_authenticated:
        if current_user.is_authenticated:
        if not current_user.is_authenticated:
        # 'Flask-Security==1.7.4',
        'Flask-Security-Fork==1.8.2',
        'psycopg2==2.6.2',
        'bcrypt==3.1.2',
        'cryptography==1.7.1',
CVE-2020-15185 (Go, published 2020-09-17T22:15Z)
Description: value: In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.
Severity: MEDIUM (CVSS v3 base score: 2.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/helm/helm
Files changed:
pkg/downloader/chart_downloader_test.go
pkg/repo/index.go
pkg/repo/index_test.go
Commit message: Merge pull request from GHSA-jm56-5h66-w453

Signed-off-by: Matt Butcher <matt.butcher@microsoft.com>

Vulnerable code:
			t.Errorf("%s: failed with error %s", tt.name, err)
	if err := yaml.Unmarshal(data, i); err != nil {

Fixed code:
			t.Errorf("%s: failed with error %q", tt.name, err)

	// ChecksumDeprecated is deprecated in Helm 3, and therefore ignored. Helm 3 replaced
	// this with Digest. However, with a strict YAML parser enabled, a field must be
	// present on the struct for backwards compatibility.
	ChecksumDeprecated string `json:"checksum,omitempty"`

	// EngineDeprecated is deprecated in Helm 3, and therefore ignored. However, with a strict
	// YAML parser enabled, this field must be present.
	EngineDeprecated string `json:"engine,omitempty"`

	// TillerVersionDeprecated is deprecated in Helm 3, and therefore ignored. However, with a strict
	// YAML parser enabled, this field must be present.
	TillerVersionDeprecated string `json:"tillerVersion,omitempty"`

	// URLDeprecated is deprectaed in Helm 3, superseded by URLs. It is ignored. However,
	// with a strict YAML parser enabled, this must be present on the struct.
	URLDeprecated string `json:"url,omitempty"`
	if err := yaml.UnmarshalStrict(data, i); err != nil {
const indexWithDuplicates = `
apiVersion: v1
entries:
  nginx:
    - urls:
        - https://kubernetes-charts.storage.googleapis.com/nginx-0.2.0.tgz
      name: nginx
      description: string
      version: 0.2.0
      home: https://github.com/something/else
      digest: "sha256:1234567890abcdef"
  nginx:
    - urls:
        - https://kubernetes-charts.storage.googleapis.com/alpine-1.0.0.tgz
        - http://storage2.googleapis.com/kubernetes-charts/alpine-1.0.0.tgz
      name: alpine
      description: string
      version: 1.0.0
      home: https://github.com/something
      digest: "sha256:1234567890abcdef"
`

// TestLoadIndex_Duplicates is a regression to make sure that we don't non-deterministically allow duplicate packages.
func TestLoadIndex_Duplicates(t *testing.T) {
	if _, err := loadIndex([]byte(indexWithDuplicates)); err == nil {
		t.Errorf("Expected an error when duplicate entries are present")
	}
}
CVE-2020-15187 (Unknown, published 2020-09-17T22:15Z)
Description: value: In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.
Severity: MEDIUM (CVSS v3 base score: 4.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/helm/helm
Files changed:
Commit message: Merge pull request from GHSA-c52f-pq47-2r9j

switched to stricter YAML parsing on plugin metadata files

Vulnerable code:

Fixed code:
CVE-2021-21303 (Unknown, published 2021-02-05T22:15Z)
Description: value: Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted sources was not properly sanitized. When a SemVer in the `version` field of a chart is invalid, in some cases Helm allows the string to be used "as is" without sanitizing. Helm fails to properly sanitized some fields present on Helm repository `index.yaml` files. Helm does not properly sanitized some fields in the `plugin.yaml` file for plugins In some cases, Helm does not properly sanitize the fields in the `Chart.yaml` file. By exploiting these attack vectors, core maintainers were able to send deceptive information to a terminal screen running the `helm` command, as well as obscure or alter information on the screen. In some cases, we could send codes that terminals used to execute higher-order logic, like clearing a terminal screen. Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields. All users of the Helm 3 should upgrade to the fixed version 3.5.2 or later. Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data.
Severity: LOW (CVSS v3 base score: 6.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/helm/helm
Files changed:
Commit message: Merge pull request from GHSA-c38g-469g-cmgx

fix(*): Validate metadata semver and printable characters

Vulnerable code:

Fixed code:
CVE-2022-23525 (Unknown, published 2022-12-15T19:15Z)
Description: value: Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/helm/helm
Files changed:
Commit message: Merge pull request from GHSA-53c4-hhmh-vw5q

Update repo handling

Vulnerable code:

Fixed code: