hitoshura25/cvefixes huggingface dataset:
CVE-2015-10032 (PHP, published 2023-01-09T09:15Z)
Description: value: A vulnerability was found in HealthMateWeb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file createaccount.php. The manipulation of the argument username/password/first_name/last_name/company/phone leads to cross site scripting. The attack can be launched remotely. The patch is named 472776c25b1046ecaf962c46fed7c713c72c28e3. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217663.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/StevenElberger/HealthMateWeb
Files changed:
createaccount.php
newaccount.html
Commit message: Add XSS prevention to createaccount.php, clean up some code


Vulnerable code:
	echo "Connected successfully";
	// -- To do: form checking (e.g., username already exists, etc.)
	$sql = "INSERT INTO physician (group_id, username, password, first_name, last_name, company, phone) VALUES (1, '".$_POST['username']."', '".$_POST['password']."', '".$_POST['firstN']."', '".$_POST['lastN']."', '".$_POST['company']."', '".$_POST['phone']."')";
		echo "Account created successfully.";
		<p>First name: <input type="text" name="firstN" size="16" maxlength="16" /></p>
		<p>Last name: <input type="text" name="lastN" size="16" maxlength="16" /></p>

Fixed code:
	echo "<p>Connected successfully</p>";
	
	// Placeholders for variables from form
	$username = $password = $first_name = $last_name = $company = $phone = "";
	
	// Prevent XSS hacks / exploits by stripping the data
	if ($_SERVER["REQUEST_METHOD"] == "POST") {
		$username = test_input($_POST["username"]);
		$password = test_input($_POST["password"]);
		$first_name = test_input($_POST["first_name"]);
		$last_name = test_input($_POST["last_name"]);
		$company = test_input($_POST["company"]);
		$phone = test_input($_POST["phone"]);
	}
	
	// Removes unwanted and potentially malicious characters
	// from the form data
	function test_input($data) {
		$data = trim($data);
		$data = stripslashes($data);
		$data = htmlspecialchars($data);
		return $data;
	}
	// -- To do: form checking (e.g., username already exists, security, etc.)
	$sql = "INSERT INTO physician (group_id, username, password, first_name, last_name, company, phone) VALUES (1, '".$username."', '".$password."', '".$first_name."', '".$last_name."', '".$company."', '".$phone."')";
		echo "<p>Account created successfully.</p>";
	// Peace out
		<p>First name: <input type="text" name="first_name" size="16" maxlength="16" /></p>
		<p>Last name: <input type="text" name="last_name" size="16" maxlength="16" /></p>
CVE-2017-12474 (C++, published 2017-09-06T08:29Z)
Description: value: The AP4_AtomSampleTable::GetSample function in Core/Ap4AtomSampleTable.cpp in Bento4 mp42ts before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4AtomSampleTable.cpp
Source/C++/Core/Ap4AvccAtom.cpp
Source/C++/Core/Ap4Processor.cpp
Source/C++/Core/Ap4Version.h
Commit message: fixed possible crashes on malformed inputs.


Vulnerable code:
    for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
#define AP4_VERSION        0x01050000
#define AP4_VERSION_STRING "1.5.0.0"

Fixed code:
    // check that we have an stsc atom
    if (!m_StscAtom) {
        return AP4_ERROR_INVALID_FORMAT;
    }
    
    for (unsigned int i=0; i<m_PictureParameters.ItemCount(); i++) {
                    cursors[i].m_Locator.m_SampleTable &&
#define AP4_VERSION        0x01050001
#define AP4_VERSION_STRING "1.5.0.1"
CVE-2017-12475 (C++, published 2017-09-06T08:29Z)
Description: value: The AP4_Processor::Process function in Core/Ap4Processor.cpp in Bento4 mp4encrypt before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4AtomSampleTable.cpp
Source/C++/Core/Ap4AvccAtom.cpp
Source/C++/Core/Ap4Processor.cpp
Source/C++/Core/Ap4Version.h
Commit message: fixed possible crashes on malformed inputs.


Vulnerable code:
    for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
#define AP4_VERSION        0x01050000
#define AP4_VERSION_STRING "1.5.0.0"

Fixed code:
    // check that we have an stsc atom
    if (!m_StscAtom) {
        return AP4_ERROR_INVALID_FORMAT;
    }
    
    for (unsigned int i=0; i<m_PictureParameters.ItemCount(); i++) {
                    cursors[i].m_Locator.m_SampleTable &&
#define AP4_VERSION        0x01050001
#define AP4_VERSION_STRING "1.5.0.1"
CVE-2017-12476 (C++, published 2017-09-06T08:29Z)
Description: value: The AP4_AvccAtom::InspectFields function in Core/Ap4AvccAtom.cpp in Bento4 mp4dump before 1.5.0-616 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4AtomSampleTable.cpp
Source/C++/Core/Ap4AvccAtom.cpp
Source/C++/Core/Ap4Processor.cpp
Source/C++/Core/Ap4Version.h
Commit message: fixed possible crashes on malformed inputs.


Vulnerable code:
    for (unsigned int i=0; i<m_SequenceParameters.ItemCount(); i++) {
#define AP4_VERSION        0x01050000
#define AP4_VERSION_STRING "1.5.0.0"

Fixed code:
    // check that we have an stsc atom
    if (!m_StscAtom) {
        return AP4_ERROR_INVALID_FORMAT;
    }
    
    for (unsigned int i=0; i<m_PictureParameters.ItemCount(); i++) {
                    cursors[i].m_Locator.m_SampleTable &&
#define AP4_VERSION        0x01050001
#define AP4_VERSION_STRING "1.5.0.1"
CVE-2017-14638 (C++, published 2017-09-21T17:29Z)
Description: value: AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp in Bento4 version 1.5.0-617 has missing NULL checks, leading to a NULL pointer dereference, segmentation fault, and application crash in AP4_Atom::SetType in Core/Ap4Atom.h.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4AtomFactory.cpp
Commit message: fix for #182


Vulnerable code:
            atom->SetType(AP4_ATOM_TYPE_HVCE);
            atom->SetType(AP4_ATOM_TYPE_AVCE);

Fixed code:
            if (atom) {
                atom->SetType(AP4_ATOM_TYPE_HVCE);
            }
            if (atom) {
                atom->SetType(AP4_ATOM_TYPE_AVCE);
            }
CVE-2017-14639 (C++, published 2017-09-21T17:29Z)
Description: value: AP4_VisualSampleEntry::ReadFields in Core/Ap4SampleEntry.cpp in Bento4 1.5.0-617 uses incorrect character data types, which causes a stack-based buffer underflow and out-of-bounds write, leading to denial of service (application crash) or possibly unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4SampleEntry.cpp
Commit message: fix for #190


Vulnerable code:
    char compressor_name[33];
    int name_length = compressor_name[0];
        m_CompressorName = &compressor_name[1];

Fixed code:
    AP4_UI08 compressor_name[33];
    AP4_UI08 name_length = compressor_name[0];
        m_CompressorName = (const char*)(&compressor_name[1]);
CVE-2017-14640 (C++, published 2017-09-21T17:29Z)
Description: value: A NULL pointer dereference was discovered in AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4AtomSampleTable.cpp
Commit message: fix for #183


Vulnerable code:
    result = m_SttsAtom->GetDts(index, dts, &duration);
    if (AP4_FAILED(result)) return result;

Fixed code:
    if (m_SttsAtom) {
        result = m_SttsAtom->GetDts(index, dts, &duration);
        if (AP4_FAILED(result)) return result;
    }
CVE-2017-14641 (C++, published 2017-09-21T17:29Z)
Description: value: A NULL pointer dereference was discovered in the AP4_DataAtom class in MetaData/Ap4MetaData.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/MetaData/Ap4MetaData.cpp
Commit message: fix for #184


Vulnerable code:
    m_DataType(DATA_TYPE_BINARY)
    AP4_Atom(AP4_ATOM_TYPE_DATA, size)

Fixed code:
    m_DataType(DATA_TYPE_BINARY),
    m_Source(NULL)
    AP4_Atom(AP4_ATOM_TYPE_DATA, size),
    m_Source(NULL)
CVE-2017-14642 (C++, published 2017-09-21T17:29Z)
Description: value: A NULL pointer dereference was discovered in the AP4_HdlrAtom class in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash in AP4_StdcFileByteStream::ReadPartial in System/StdC/Ap4StdCFileByteStream.cpp, which leads to remote denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4HdlrAtom.cpp
Commit message: fix for #185


Vulnerable code:
    int name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
    if (name_size == 0) return;

Fixed code:
    if (size < AP4_FULL_ATOM_HEADER_SIZE+20) return;
    AP4_UI32 name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
    if (name == NULL) return;
CVE-2017-14643 (C++, published 2017-09-21T17:29Z)
Description: value: The AP4_HdlrAtom class in Core/Ap4HdlrAtom.cpp in Bento4 version 1.5.0-617 uses an incorrect character data type, leading to a heap-based buffer over-read and application crash in AP4_BytesToUInt32BE in Core/Ap4Utils.h.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4HdlrAtom.cpp
Source/C++/Core/Ap4StszAtom.cpp
Commit message: fix for #187


Vulnerable code:
    if (name[0] == name_size-1) {

Fixed code:
    if ((AP4_UI08)name[0] == (AP4_UI08)(name_size-1)) {
        // check for overflow
        if (m_SampleCount > (size-8)/4) {
            m_SampleCount = 0;
            return;
        }
        
        // read the entries
CVE-2017-14646 (C++, published 2017-09-21T17:29Z)
Description: value: The AP4_AvccAtom and AP4_HvccAtom classes in Bento4 version 1.5.0-617 do not properly validate data sizes, leading to a heap-based buffer over-read and application crash in AP4_DataBuffer::SetData in Core/Ap4DataBuffer.cpp.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/axiomatic-systems/Bento4
Files changed:
Source/C++/Core/Ap4AvccAtom.cpp
Source/C++/Core/Ap4HvccAtom.cpp
Commit message: fix for #188


Vulnerable code:
        m_SequenceParameters.Append(AP4_DataBuffer());
        AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
        m_SequenceParameters[i].SetData(&payload[cursor]+2, param_length);
        cursor += 2+param_length;
        m_PictureParameters.Append(AP4_DataBuffer());
        AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
        m_PictureParameters[i].SetData(&payload[cursor]+2, param_length);
        cursor += 2+param_length;

Fixed code:
        if (cursor+2 <= payload_size) {
            AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
            cursor += 2;
            if (cursor + param_length < payload_size) {
                m_SequenceParameters.Append(AP4_DataBuffer());
                m_SequenceParameters[i].SetData(&payload[cursor], param_length);
                cursor += param_length;
            }
        }
        if (cursor+2 <= payload_size) {
            AP4_UI16 param_length = AP4_BytesToInt16BE(&payload[cursor]);
            cursor += 2;
            if (cursor + param_length < payload_size) {
                m_PictureParameters.Append(AP4_DataBuffer());
                m_PictureParameters[i].SetData(&payload[cursor], param_length);
                cursor += param_length;
            }
        }

    // keep a raw copy
    if (payload_size < 22) return;
CVE-2017-15924 (C, published 2017-10-27T16:29Z)
Description: value: In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/shadowsocks/shadowsocks-libev
Files changed:
src/manager.c
Commit message: Fix #1734


Vulnerable code:
build_config(char *prefix, struct server *server)
    if (server->fast_open[0]) fprintf(f, ",\n\"fast_open\": %s", server->fast_open);
    if (server->mode)   fprintf(f, ",\n\"mode\":\"%s\"", server->mode);
    if (server->method) fprintf(f, ",\n\"method\":\"%s\"", server->method);
    if (server->plugin) fprintf(f, ",\n\"plugin\":\"%s\"", server->plugin);
    if (server->plugin_opts) fprintf(f, ",\n\"plugin_opts\":\"%s\"", server->plugin_opts);
    char *method = manager->method;
    build_config(working_dir, server);
    if (server->method) method = server->method;
             "%s -m %s --manager-address %s -f %s/.shadowsocks_%s.pid -c %s/.shadowsocks_%s.conf",
             executable, method, manager->manager_address,
             working_dir, server->port, working_dir, server->port);

Fixed code:
build_config(char *prefix, struct manager_ctx *manager, struct server *server)
    if (server->method)
        fprintf(f, ",\n\"method\":\"%s\"", server->method);
    else if (manager->method)
        fprintf(f, ",\n\"method\":\"%s\"", manager->method);
    if (server->fast_open[0])
        fprintf(f, ",\n\"fast_open\": %s", server->fast_open);
    if (server->mode)
        fprintf(f, ",\n\"mode\":\"%s\"", server->mode);
    if (server->plugin)
        fprintf(f, ",\n\"plugin\":\"%s\"", server->plugin);
    if (server->plugin_opts)
        fprintf(f, ",\n\"plugin_opts\":\"%s\"", server->plugin_opts);
    int port;
    port = atoi(server->port);

    build_config(working_dir, manager, server);
             "%s --manager-address %s -f %s/.shadowsocks_%d.pid -c %s/.shadowsocks_%d.conf",
             executable, manager->manager_address, working_dir, port, working_dir, port);
CVE-2016-9243 (Python, published 2017-03-27T17:59Z)
Description: value: HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/pyca/cryptography
Files changed:
src/cryptography/hazmat/primitives/kdf/hkdf.py
tests/hazmat/primitives/test_hkdf.py
Commit message: Fixes #3211 -- fixed hkdf's output with short length (#3215)



Vulnerable code:
        while (self._algorithm.digest_size // 8) * len(output) < self._length:

Fixed code:
        while self._algorithm.digest_size * (len(output) - 1) < self._length:
    def test_derive_short_output(self, backend):
        hkdf = HKDF(
            hashes.SHA256(),
            4,
            salt=None,
            info=None,
            backend=backend
        )

        assert hkdf.derive(b"\x01" * 16) == b"gJ\xfb{"
CVE-2024-26130 (Python, published 2024-02-21T17:15Z)
Description: value: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did not match the provided private key and an `encryption_algorithm` with `hmac_hash` set (via `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur, crashing the Python process. This has been resolved in version 42.0.4, the first version in which a `ValueError` is properly raised.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pyca/cryptography
Files changed:
src/cryptography/hazmat/backends/openssl/backend.py
tests/hazmat/primitives/test_pkcs12.py
Commit message: Fixes #10422 -- don't crash when a PKCS#12 key and cert don't match (#10423)



Vulnerable code:

Fixed code:
                if p12 == self._ffi.NULL:
                    errors = self._consume_errors()
                    raise ValueError(
                        (
                            "Failed to create PKCS12 (does the key match the "
                            "certificate?)"
                        ),
                        errors,
                    )
    @pytest.mark.supported(
        only_if=lambda backend: backend._lib.Cryptography_HAS_PKCS12_SET_MAC,
        skip_message="Requires OpenSSL with PKCS12_set_mac",
    )
    def test_set_mac_key_certificate_mismatch(self, backend):
        cacert, _ = _load_ca(backend)
        key = ec.generate_private_key(ec.SECP256R1())
        encryption = (
            serialization.PrivateFormat.PKCS12.encryption_builder()
            .hmac_hash(hashes.SHA256())
            .build(b"password")
        )

        with pytest.raises(ValueError):
            serialize_key_and_certificates(
                b"name", key, cacert, [], encryption
            )
CVE-2024-39934 (Rust, published 2024-07-04T19:15Z)
Description: value: Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because the "shared holotree usage" feature allows any user to edit any Python environment.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/elabit/robotmk
Files changed:
src/bin/scheduler/setup/rcc.rs
src/results.rs
tests/test_scheduler.rs
Commit message: don't enable shared holotrees

CMK-17546


Vulnerable code:
    debug!("Initializing shared holotree");
    (sucessful_plans, rcc_setup_failures.shared_holotree) =
        shared_holotree_init(global_config, sucessful_plans)
            .context("Received termination signal while initializing shared holotree")?;
    if !rcc_setup_failures.shared_holotree.is_empty() {
        error!(
            "Dropping the following plans due to shared holotree initialization failure: {}",
            failed_plan_ids_human_readable(rcc_setup_failures.shared_holotree.keys())
        );
    }

fn shared_holotree_init(
    global_config: &GlobalConfig,
    plans: Vec<Plan>,
) -> Result<(Vec<Plan>, HashMap<String, String>), Cancelled> {
    let mut command_spec =
        RCCEnvironment::bundled_command_spec(&global_config.rcc_config.binary_path);
    command_spec.add_arguments(["holotree", "shared", "--enable", "--once"]);
    run_command_spec_once_in_current_session(
        global_config,
        plans,
        &command_spec,
        "shared_holotree_init",
    )
}

    pub shared_holotree: HashMap<String, String>,
            "shared_holotree_init.stderr",
            "shared_holotree_init.stdout",
    assert!(stdout.contains("holotree-shared                       ...  \"true\""));
    assert!(stdout.contains("holotree-global-shared                ...  \"true\""));

Fixed code:
CVE-2018-17292 (C, published 2018-09-21T07:29Z)
Description: value: An issue was discovered in WAVM before 2018-09-16. The loadModule function in Include/Inline/CLI.h lacks checking of the file length before a file magic comparison, allowing attackers to cause a Denial of Service (application crash caused by out-of-bounds read) by crafting a file that has fewer than 4 bytes.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/WAVM/WAVM
Files changed:
Include/Inline/CLI.h
Commit message: Fix out-of-bounds array access when passing a <4 byte input file to wavm or wavm-compile


Vulnerable code:
	if(*(U32*)fileBytes.data() == 0x6d736100)

Fixed code:
	if(fileBytes.size() >= 4 && *(U32*)fileBytes.data() == 0x6d736100)