hitoshura25/cvefixes huggingface dataset:
CVE-2023-36461 (Ruby, published 2023-07-06T19:15Z)
Description: value: Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the response through slowloris-type attacks. This vulnerability can be used to keep all Mastodon workers busy for an extended duration of time, leading to the server becoming unresponsive. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/mastodon/mastodon
Files changed:
app/lib/request.rb
Commit message: Merge pull request from GHSA-9pxv-6qvf-pjwc

* Fix timeout handling of outbound HTTP requests

* Use CLOCK_MONOTONIC instead of Time.now

Vulnerable code:

Fixed code:
#
# Also changes how the read timeout behaves so that it is cumulative (closer
# to HTTP::Timeout::Global, but still having distinct timeouts for other
# operation types)

  # Reset deadline when the connection is re-used for different requests
  def reset_counter
    @deadline = nil
  end

  # Read data from the socket
  def readpartial(size, buffer = nil)
    @deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + @read_timeout

    timeout = false
    loop do
      result = @socket.read_nonblock(size, buffer, exception: false)

      return :eof if result.nil?

      remaining_time = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
      raise HTTP::TimeoutError, "Read timed out after #{@read_timeout} seconds" if timeout || remaining_time <= 0
      return result if result != :wait_readable

      # marking the socket for timeout. Why is this not being raised immediately?
      # it seems there is some race-condition on the network level between calling
      # #read_nonblock and #wait_readable, in which #read_nonblock signalizes waiting
      # for reads, and when waiting for x seconds, it returns nil suddenly without completing
      # the x seconds. In a normal case this would be a timeout on wait/read, but it can
      # also mean that the socket has been closed by the server. Therefore we "mark" the
      # socket for timeout and try to read more bytes. If it returns :eof, it's all good, no
      # timeout. Else, the first timeout was a proper timeout.
      # This hack has to be done because io/wait#wait_readable doesn't provide a value for when
      # the socket is closed by the server, and HTTP::Parser doesn't provide the limit for the chunks.
      timeout = true unless @socket.to_io.wait_readable(remaining_time)
    end
  end
CVE-2023-36462 (Ruby, published 2023-07-06T20:15Z)
Description: value: Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker can craft a verified profile link using specific formatting to conceal arbitrary parts of the link, enabling it to appear to link to a different URL altogether. The link is visually misleading, but clicking on it will reveal the actual link. This can still be used for phishing, though, similar to IDN homograph attacks. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mastodon/mastodon
Files changed:
app/helpers/formatting_helper.rb
app/lib/text_formatter.rb
Commit message: Merge pull request from GHSA-55j9-c3mp-6fcq



Vulnerable code:
    html_aware_format(field.value, field.account.local?, with_rel_me: with_rel_me, with_domains: true, multiline: false)
    url = Addressable::URI.parse(entity[:url]).to_s
    rel = with_rel_me? ? (DEFAULT_REL + %w(me)) : DEFAULT_REL

    prefix      = url.match(URL_PREFIX_REGEX).to_s
    display_url = url[prefix.length, 30]
    suffix      = url[prefix.length + 30..-1]
    cutoff      = url[prefix.length..-1].length > 30

    <<~HTML.squish
      <a href="#{h(url)}" target="_blank" rel="#{rel.join(' ')}" translate="no"><span class="invisible">#{h(prefix)}</span><span class="#{cutoff ? 'ellipsis' : ''}">#{h(display_url)}</span><span class="invisible">#{h(suffix)}</span></a>
    HTML
  rescue Addressable::URI::InvalidURIError, IDN::Idna::IdnaError
    h(entity[:url])

Fixed code:
    if field.verified? && !field.account.local?
      TextFormatter.shortened_link(field.value_for_verification)
    else
      html_aware_format(field.value, field.account.local?, with_rel_me: with_rel_me, with_domains: true, multiline: false)
    end
  class << self
    include ERB::Util

    def shortened_link(url, rel_me: false)
      url = Addressable::URI.parse(url).to_s
      rel = rel_me ? (DEFAULT_REL + %w(me)) : DEFAULT_REL

      prefix      = url.match(URL_PREFIX_REGEX).to_s
      display_url = url[prefix.length, 30]
      suffix      = url[prefix.length + 30..-1]
      cutoff      = url[prefix.length..-1].length > 30

      <<~HTML.squish
        <a href="#{h(url)}" target="_blank" rel="#{rel.join(' ')}" translate="no"><span class="invisible">#{h(prefix)}</span><span class="#{cutoff ? 'ellipsis' : ''}">#{h(display_url)}</span><span class="invisible">#{h(suffix)}</span></a>
      HTML
    rescue Addressable::URI::InvalidURIError, IDN::Idna::IdnaError
      h(url)
    end
  end

    TextFormatter.shortened_link(entity[:url], rel_me: with_rel_me?)
CVE-2023-42451 (Ruby, published 2023-09-19T16:15Z)
Description: value: Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-706 \u2014 Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/mastodon/mastodon
Files changed:
app/lib/tag_manager.rb
Commit message: Merge pull request from GHSA-v3xf-c9qf-j667



Vulnerable code:
    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.web_domain).zero?
    domain.nil? || domain.delete('/').casecmp(Rails.configuration.x.local_domain).zero?
    uri.host = domain.delete('/')

Fixed code:
    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.web_domain).zero?
    domain.nil? || domain.delete_suffix('/').casecmp(Rails.configuration.x.local_domain).zero?
    uri.host = domain.delete_suffix('/')
CVE-2023-42452 (Ruby, published 2023-09-19T16:15Z)
Description: value: Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.x branch prior to versions 4.0.10, 4.2.8, and 4.2.0-rc2, under certain conditions, attackers can abuse the translation feature to bypass the server-side HTML sanitization, allowing unescaped HTML to execute in the browser. The impact is limited thanks to Mastodon's strict Content Security Policy, blocking inline scripts, etc. However a CSP bypass or loophole could be exploited to execute malicious XSS. Furthermore, it requires user interaction, as this can only occur upon clicking the “Translate” button on a malicious post. Versions 4.0.10, 4.2.8, and 4.2.0-rc2 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mastodon/mastodon
Files changed:
app/services/translate_status_service.rb
Commit message: Merge pull request from GHSA-2693-xr3m-jhqr



Vulnerable code:
        status_translation.content = unwrap_emoji_shortcodes(translation.text).to_html

Fixed code:
        node = unwrap_emoji_shortcodes(translation.text)
        Sanitize.node!(node, Sanitize::Config::MASTODON_STRICT)
        status_translation.content = node.to_html
CVE-2019-17533 (C, published 2019-10-13T02:15Z)
Description: value: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tbeu/matio
Files changed:
src/mat4.c
Commit message: Avoid uninitialized memory

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856


Vulnerable code:

Fixed code:
    } else {
        matvar->name[tmp - 1] = '\0';
CVE-2019-17533 (C, published 2019-10-13T02:15Z)
Description: value: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/tbeu/matio
Files changed:
src/mat4.c
Commit message: Avoid uninitialized memory

As reported by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856


Vulnerable code:

Fixed code:
    } else {
        matvar->name[tmp - 1] = '\0';
CVE-2020-19497 (C, published 2021-07-21T18:15Z)
Description: value: Integer overflow vulnerability in Mat_VarReadNextInfo5 in mat5.c in tbeu matio (aka MAT File I/O Library) 1.5.17, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/tbeu/matio
Files changed:
src/mat5.c
Commit message: Fix integer addition overflow

As reported by https://github.com/tbeu/matio/issues/121


Vulnerable code:
                        if ( len % 8 > 0 )
                            len = len+(8-(len % 8));
                        cells[i]->name = (char*)malloc(len+1);
            int cell_bytes_read,name_len;
                        name_len = name_len+(8-(name_len % 8));
                    else
                else

Fixed code:
                        if ( len % 8 > 0 ) {
                            if ( len < UINT32_MAX - 8 + (len % 8) )
                              len = len + 8 - (len % 8);
                            else {
                                Mat_VarFree(cells[i]);
                                cells[i] = NULL;
                                break;
                            }
                        }
                        cells[i]->name = (char*)malloc(len + 1);
            int cell_bytes_read;
            mat_uint32_t name_len;
                        if ( name_len < UINT32_MAX - 8 + (name_len % 8) )
                            name_len = name_len + 8 - (name_len % 8);
                        else {
                            Mat_VarFree(cells[i]);
                            cells[i] = NULL;
                            break;
                        }
                    else if ( len < UINT32_MAX - 8 + (len % 8) )
                    else {
                        Mat_VarFree(matvar);
                        matvar = NULL;
                        break;
                    }
                else if ( len < UINT32_MAX - 8 + (len % 8) )
                else {
                    Mat_VarFree(matvar);
                    matvar = NULL;
                    (void)fseek((FILE*)mat->fp, fpos, SEEK_SET);
                    break;
                }
CVE-2021-27191 (TypeScript, published 2021-02-11T18:15Z)
Description: value: The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/JoeScho/get-ip-range
Files changed:
index.test.ts
index.ts
Commit message: limit total IPs in range to avoid DoS


Vulnerable code:

Fixed code:

  it('should throw if the range is greater than 10000 default', () => {
    const throwFn = () => getIPRange('128.0.0.0/1');
    expect(throwFn).toThrow('Too many IPs in range. Total number: 2147483647. Max count is 10000, to increase, set the limit with the MAX_RANGE environment variable');
  });

  it('should throw if the range is greater than process.env.MAX_RANGE', () => {
    process.env.MAX_RANGE = '5000';

    const throwFn = () => getIPRange('128.0.0.0/1');
    expect(throwFn).toThrow('Too many IPs in range. Total number: 2147483647. Max count is 5000, to increase, set the limit with the MAX_RANGE environment variable');
  });
// Set default max range
let maxRange = 10000;

  const totalIPs = lastAddressLong - firstAddressLong;

  // Prevent DoS
  if (totalIPs > maxRange) {
    throw new Error(`Too many IPs in range. Total number: ${totalIPs}. Max count is ${maxRange}, to increase, set the limit with the MAX_RANGE environment variable`)
  }

  maxRange = parseInt(process.env.MAX_RANGE || '10000');
CVE-2022-0482 (PHP, published 2022-03-09T11:15Z)
Description: value: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-359 \u2014 Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/config/config.php
Commit message: Release v1.4.3


Vulnerable code:
$config['version'] = '1.4.3-beta.1'; // This must be changed manually.
$config['cache_busting_token'] = '8UC842';

Fixed code:
$config['version'] = '1.4.3'; // This must be changed manually.
$config['cache_busting_token'] = '6398SW';
CVE-2022-1397 (PHP, published 2022-05-10T14:15Z)
Description: value: API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/libraries/Api.php
Commit message: Check the role slug in Api.php


Vulnerable code:
            if ( ! $this->CI->accounts->check_login($username, $password))

Fixed code:
            $userdata = $this->CI->accounts->check_login($username, $password);

            if (empty($userdata['role_slug']) || $userdata['role_slug'] !== DB_SLUG_ADMIN)
CVE-2023-1269 (PHP, published 2023-03-08T11:15Z)
Description: value: Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/controllers/Console.php
application/controllers/Installation.php
application/libraries/Instance.php
Commit message: Update the seeders so that they set dynamic passwords by default


Vulnerable code:
        $this->instance->seed();
        response(PHP_EOL . '⇾ Installation completed, login with "administrator" / "administrator".' . PHP_EOL . PHP_EOL);
                    'password' => 'janedoe',
    public function seed()
                'password' => 'administrator',
                'password' => 'janedoe',

Fixed code:
        $password = $this->instance->seed();
        response(PHP_EOL . '⇾ Installation completed, login with "administrator" / "' . $password . '".' . PHP_EOL . PHP_EOL);
                    'password' => random_string(),
     *
     * @return string Return's the administrator user password.
    public function seed(): string
        
        $password = random_string();


                'password' => $password,


                'password' => random_string(),


        return $password;
CVE-2023-2102 (PHP, published 2023-04-15T13:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/views/components/backend_header.php
Commit message: Escape the user display name in the backend section


Vulnerable code:
                    <?= vars('user_display_name') ?>

Fixed code:
                    <?= e(vars('user_display_name')) ?>
CVE-2023-2103 (PHP, published 2023-04-15T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/views/components/booking_type_step.php
application/views/components/cookie_notice_modal.php
application/views/components/privacy_policy_modal.php
application/views/components/terms_and_conditions_modal.php
assets/js/pages/booking.js
Commit message: Escape the legal settings, service and category name in the booking page


Vulnerable code:
 * 
                                    echo '<optgroup label="' . $group_label . '">';
                                            . $service['name'] . '</option>';
                                echo '<option value="' . $service['id'] . '">' . $service['name'] . '</option>';
                <p><?= $cookie_notice_content ?></p>
                <p><?= $privacy_policy_content ?></p>
                <p><?= $terms_and_conditions_content ?></p>
            'text': service.name

Fixed code:
 *
                                    echo '<optgroup label="' . e($group_label) . '">';
                                            . e($service['name']) . '</option>';
                                echo '<option value="' . $service['id'] . '">' . e($service['name']) . '</option>';
                <p><?= e($cookie_notice_content) ?></p>
                <p><?= e($privacy_policy_content) ?></p>
                <p><?= e($terms_and_conditions_content) ?></p>
            'text': App.Utils.String.escapeHtml(service.name),
CVE-2023-2104 (PHP, published 2023-04-15T14:15Z)
Description: value: Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/controllers/Calendar.php
Commit message: Do not return appointments of a different user to the another provider or secretary on the default calendar screen.


Vulnerable code:

Fixed code:
            unset($appointment);

            $user_id = session('user_id');

            $role_slug = session('role_slug');

            // If the current user is a provider he must only see his own appointments.
            if ($role_slug === DB_SLUG_PROVIDER)
            {
                foreach ($response['appointments'] as $index => $appointment)
                {
                    if ((int)$appointment['id_users_provider'] !== (int)$user_id)
                    {
                        unset($response['appointments'][$index]);
                    }
                }

                $response['appointments'] = array_values($response['appointments']);

                foreach ($response['unavailabilities'] as $index => $unavailability)
                {
                    if ((int)$unavailability['id_users_provider'] !== (int)$user_id)
                    {
                        unset($response['unavailabilities'][$index]);
                    }
                }

                $response['unavailabilities'] = array_values($response['unavailabilities']);
            }

            // If the current user is a secretary he must only see the appointments of his providers.
            if ($role_slug === DB_SLUG_SECRETARY)
            {
                $providers = $this->secretaries_model->find($user_id)['providers'];

                foreach ($response['appointments'] as $index => $appointment)
                {
                    if ( ! in_array((int)$appointment['id_users_provider'], $providers))
                    {
                        unset($response['appointments'][$index]);
                    }
                }

                $response['appointments'] = array_values($response['appointments']);

                foreach ($response['unavailabilities'] as $index => $unavailability)
                {
                    if ( ! in_array((int)$unavailability['id_users_provider'], $providers))
                    {
                        unset($response['unavailabilities'][$index]);
                    }
                }

                $response['unavailabilities'] = array_values($response['unavailabilities']);
            }
CVE-2023-2105 (PHP, published 2023-04-15T14:15Z)
Description: value: Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/controllers/Login.php
Commit message: Regenerate the session ID after logging in to avoid Session Fixation attacks


Vulnerable code:

Fixed code:
            
            $this->session->sess_regenerate();