hitoshura25/cvefixes huggingface dataset:
CVE-2017-7239 (Perl, published 2017-04-10T15:59Z)
Description: value: Ninka before 1.3.2 might allow remote attackers to obtain sensitive information, manipulate license compliance scan results, or cause a denial of service (process hang) via a crafted filename.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/dmgerman/ninka
Files changed:
Changes
Makefile.PL
lib/Ninka.pm
lib/Ninka/CommentExtractor.pm
Commit message: Addresses  CVE-2017-7239: ninka license identification tool: insufficient escaping of external input


Vulnerable code:
our $VERSION = '1.3.1';
    my $command = $self->determine_comments_command();
    my $comments = execute_command($command);
    if ($command =~ /^comments/ && length($comments) == 0) {
        $command = create_head_cmd($self->{input_file}, 700);
        $comments = execute_command($command);
                return "$comments_binary -c1 '$input_file' 2> /dev/null";
    return "head -$count_lines $input_file";

Fixed code:
2017-04-02  Daniel M. German  <dmg@uvic.ca>

        These changes address CVE-2017-7239

	* lib/Ninka.pm: upgraded to version to 1.3.2

	* Makefile.PL: Added IO::CaptureOutput to dependencies

	* CommentExtractor.pm:

	- replaced call to system with a single argument with a list of arguments.

	- replaced the use of open3 with captureoutput to simplify the code

        'IO::CaptureOutput' => '0',
                  
our $VERSION = '1.3.2';
use IO::CaptureOutput qw/capture_exec/;
    my @command = $self->determine_comments_command();
    my $comments = execute_command(@command);
    if ($command[0] =~ /^comments/ && length($comments) == 0) {
        @command = create_head_cmd($self->{input_file}, 700);
        $comments = execute_command(@command);
                return ($comments_binary, "-c1", $input_file);
    return ("head",  "-$count_lines",  $input_file);
    my (@command) = @_;
    # make sure we have more than one element in the array
    #    otherwise system will use the shell to do the execution
    die "command (@command) seems to be missing parameters" unless (scalar(@command) > 1);

    my ($stdout, $error, $success, $status) = capture_exec( @command );

    my $commandSt = join(' ', @command);
    die "execution of program [$commandSt] failed: status [$status], error [$error]" if ($status != 0);

    return $stdout;
}


# insecure execute command. Leave here for the time being
# it is dead code
sub execute_command_old {
CVE-2020-36619 (C, published 2022-12-19T14:15Z)
Description: value: A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/EliasOenal/multimon-ng
Files changed:
demod_flex.c
Commit message: Remove uncontrolled format string vulnerability


Vulnerable code:

Fixed code:
    // unixinput.c::_verbprintf uses this output as a format string
    // which introduces an uncontrolled format string vulnerability
    // and also, generally, risks stack corruption
    if (ch == '%') {
        if (idx < (MAX_ALN - 2)) {
            buf[idx] = '%';
            buf[idx + 1] = '%';
            return 2;
        }
        return 0;
    }
CVE-2021-34187 (PHP, published 2021-06-28T16:15Z)
Description: value: main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/chamilo/chamilo-lms
Files changed:
public/main/inc/ajax/model.ajax.php
public/main/inc/lib/database.lib.php
public/main/inc/lib/extra_field.lib.php
Commit message: Fix database field from 1.11.x

https://github.com/chamilo/chamilo-lms/commit/f7f93579ed64765c2667910b9c24d031b0a00571


Vulnerable code:
        $sidx = in_array($sidx, $columns) ? $sidx : 'title';
                    $groupFilter,
                    false,
                    true
                $result = $obj->getUserGroupInCourse(
                    $options,
                    $groupFilter,
                    false,
                    true
                );
                        break;
                                $extraFields[] = ['field' => $rule->field, 'id' => $field_option['id']];
                                'field' => $rule->field,
                                        'field' => $rule->field,
                        'field' => $rule->field,
                            //$inject_extra_fields .= " tag$counter.tag as {$extra['field']}, ";
            $slct->addOption(get_lang('Please select an option'), '');

Fixed code:
    $col = Database::escapeField($col);

        $columnOrderValidList = array_merge(['firstname', 'lastname'], $columns);
        $sidx = in_array($sidx, $columnOrderValidList) ? $sidx : 'title';
                    $groupFilter
                $result = $obj->getUserGroupInCourse($options, $groupFilter);

    public static function escapeField($field)
    {
        return self::escape_string(preg_replace("/[^a-zA-Z0-9_]/", '', $field));
    }
                        break;                        
                    $ruleField = Database::escapeField($rule->field);
                                $extraFields[] = ['field' => $ruleField, 'id' => $field_option['id']];
                                    // Where will be injected in the parseConditions()
                                        'field' => $ruleField,
                                        'field' => $ruleField,
                            'field' => $ruleField,
        $col = Database::escapeField($col);

                            // If using OR
            $slct->addOption(get_lang('Please select an option'));
CVE-2017-18594 (C++, published 2019-08-29T00:15Z)
Description: value: nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/nmap/nmap
Files changed:
nse_libssh2.cc
Commit message: Avoid a crash (double-free) when SSH connection fails


Vulnerable code:
#include "nse_debug.h"
* Returns list of supported authenication methods

Fixed code:
        sshu->session = NULL;
* Returns list of supported authentication methods
CVE-2019-19619 (Other, published 2019-12-06T04:15Z)
Description: value: domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/documize/community
Files changed:
domain/section/markdown/markdown.go
go.mod
go.sum
Commit message: Sanitize HTML in Markdown sections


Vulnerable code:
	result := blackfriday.Run([]byte(data))
	return string(result)

Fixed code:
	"github.com/microcosm-cc/bluemonday"
	unsafe := blackfriday.Run([]byte(data))
	safe := bluemonday.UGCPolicy().SanitizeBytes(unsafe)

	return string(safe)
	github.com/microcosm-cc/bluemonday v1.0.2
github.com/microcosm-cc/bluemonday v1.0.2 h1:5lPfLTTAvAbtS0VqT+94yOtFnGfUWYyx0+iToC3Os3s=
github.com/microcosm-cc/bluemonday v1.0.2/go.mod h1:iVP4YcDBq+n/5fb23BhYFvIMq/leAFZyRl6bYmGDlGc=
golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
CVE-2021-3666 (Unknown, published 2021-09-13T18:15Z)
Description: value: body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/fiznool/body-parser-xml
Files changed:
Commit message: Fix prototype pollution vulnerability


Vulnerable code:

Fixed code:
CVE-2021-25969 (Ruby, published 2021-10-20T12:15Z)
Description: value: In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/owen2345/camaleon-cms
Files changed:
app/apps/themes/default/views/partials/_comments_list.html.erb
app/helpers/camaleon_cms/comment_helper.rb
app/views/camaleon_cms/default_theme/partials/_comments_list.html.erb
app/views/camaleon_cms/default_theme/partials/_comments_list2.html.erb
Commit message: Sanitize comments


Vulnerable code:
                    <%= raw comment.content %>
<% end %>
                    <div class='comment_content'>#{comment.content}</div>
                    <%= raw comment.content %>
<% end %>
                <div><%= raw comment.content %></div>
</ul>

Fixed code:
                    <%= comment.content %>
<% end %>
                    <div class='comment_content'>#{sanitize comment.content}</div>
                    <%= comment.content %>
<% end %>
                <div><%= comment.content %></div>
</ul>
CVE-2021-25970 (Ruby, published 2021-10-20T12:15Z)
Description: value: Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/owen2345/camaleon-cms
Files changed:
app/controllers/camaleon_cms/admin/users_controller.rb
app/helpers/camaleon_cms/session_helper.rb
app/models/concerns/camaleon_cms/user_methods.rb
Commit message: Logout user on password change, except in the session making the change


Vulnerable code:
    render inline: @user.update(params.require(:password).permit!) ? "" : @user.errors.full_messages.join(', ')
    return nil unless cookies[:auth_token].present?
    c = cookies[:auth_token].split("&")
    return nil unless c.size == 3
    @cama_current_user = current_site.users_include_admins.find_by_auth_token(c[0]).try(:decorate)

Fixed code:
    update_session = current_user_is?(@user)
    @user.update(params.require(:password).permit!)
    render inline: @user.errors.full_messages.join(', ')
    # keep user logged in when changing their own password
    update_auth_token_in_cookie @user.auth_token if update_session && @user.saved_change_to_password_digest?
  end

  def update_auth_token_in_cookie(token)
    return unless cookie_auth_token_complete?
    current_token = cookie_split_auth_token
    updated_token = [token, *current_token[1..-1]]
    cookies[:auth_token] = updated_token.join("&")
  end

  def current_user_is?(user)
    user_auth_token_from_cookie == user.auth_token rescue false
    return nil unless cookie_auth_token_complete?
    @cama_current_user = current_site.users_include_admins.find_by_auth_token(user_auth_token_from_cookie).try(:decorate)
  end

  def cookie_auth_token_complete?
    cookie_split_auth_token&.size == 3
  end

  def cookie_split_auth_token
    cookies[:auth_token]&.split("&")
  end

  def user_auth_token_from_cookie
    cookie_split_auth_token.first
    # invaliidate sessions when changing password
    before_update { generate_token :auth_token if will_save_change_to_password_digest? }
CVE-2021-25971 (Ruby, published 2021-10-20T12:15Z)
Description: value: In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/owen2345/camaleon-cms
Files changed:
app/uploaders/camaleon_cms_local_uploader.rb
Commit message: Fix error when uploading an SVG with no size


Vulnerable code:
      res['dimension'] = "#{im[:width]}x#{im[:height]}"

Fixed code:
      res['dimension'] = "#{im[:width]}x#{im[:height]}" rescue "0x0" # Malformed SVGs raise an exception here.
CVE-2021-25972 (Ruby, published 2021-10-20T12:15Z)
Description: value: In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/owen2345/camaleon-cms
Files changed:
app/controllers/camaleon_cms/admin/media_controller.rb
config/locales/camaleon_cms/admin/en.yml
Commit message: Disallow uploads from localhost


Vulnerable code:
        r = cama_tmp_upload( params[:url], formats: params[:formats], name: params[:name])

Fixed code:
  LOCALHOST_DOMAIN_MATCHER = %r{
    localhost|
    127\.0\.0\.1|
    0\.0\.0\.0|
    0x7f\.0x0\.0x0\.0x1| # hex encoding
    0177\.0\.0\.01| # octal encoding
    2130706433 # dword encoding
  }x

        r = if local_url?(params[:url])
              { error: t("camaleon_cms.admin.media.local_upload_denied") }
            else
              cama_tmp_upload( params[:url], formats: params[:formats], name: params[:name])
            end
  def local_url?(url)
    url.try :match?, LOCALHOST_DOMAIN_MATCHER
  end

        local_upload_denied: 'Cannot upload from localhost'
CVE-2015-8792 (Other, published 2016-01-29T19:59Z)
Description: value: The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/Matroska-Org/libmatroska
Files changed:
ChangeLog
src/KaxBlock.cpp
Commit message: KaxBlockInternal: check EBML lace sizes against available buffer space


Vulnerable code:

Fixed code:
2015-10-20  Moritz Bunkus  <moritz@bunkus.org>

        * KaxInternalBlock::ReadData(): Fixed an invalid memory
        access. When reading a block group or a simple block that uses
        EBML lacing the frame sizes indicated in the lacing weren't
        checked against the available number of bytes. If the indicated
        frame size was bigger than the whole block's size the parser would
        read beyond the end of the buffer resulting in a heap information
        leak.

            if (!FrameSize || (static_cast<uint32>(FrameSize + SizeRead) > LastBufferSize))
              throw SafeReadIOCallback::EndOfStreamX(SizeRead);
              if (!FrameSize || (static_cast<uint32>(FrameSize + SizeRead) > LastBufferSize))
                throw SafeReadIOCallback::EndOfStreamX(SizeRead);
CVE-2015-8792 (Other, published 2016-01-29T19:59Z)
Description: value: The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Matroska-Org/libmatroska
Files changed:
ChangeLog
src/KaxBlock.cpp
Commit message: KaxBlockInternal: check EBML lace sizes against available buffer space


Vulnerable code:

Fixed code:
2015-10-20  Moritz Bunkus  <moritz@bunkus.org>

        * KaxInternalBlock::ReadData(): Fixed an invalid memory
        access. When reading a block group or a simple block that uses
        EBML lacing the frame sizes indicated in the lacing weren't
        checked against the available number of bytes. If the indicated
        frame size was bigger than the whole block's size the parser would
        read beyond the end of the buffer resulting in a heap information
        leak.

            if (!FrameSize || (static_cast<uint32>(FrameSize + SizeRead) > LastBufferSize))
              throw SafeReadIOCallback::EndOfStreamX(SizeRead);
              if (!FrameSize || (static_cast<uint32>(FrameSize + SizeRead) > LastBufferSize))
                throw SafeReadIOCallback::EndOfStreamX(SizeRead);
CVE-2023-40013 (Unknown, published 2023-08-14T21:15Z)
Description: value: SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in Cross-site Scripting (XSS). When trying to sanitize the svg the lib removes event attributes such as `onmouseover`, `onclick` but the list of events is not exhaustive.  Any website which uses external-svg-loader and allows its users to provide svg src, upload svg files would be susceptible to stored XSS attack. This issue has been addressed in commit `d3562fc08` which is included in releases from 1.6.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/shubhamjain/svg-loader
Files changed:
Commit message: Merge pull request from GHSA-xc2r-jf2x-gjr8

Fix XSS vulnerability

Vulnerable code:

Fixed code:
CVE-2017-0899 (Ruby, published 2017-08-31T20:29Z)
Description: value: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/commands/query_command.rb
lib/rubygems/text.rb
test/rubygems/test_gem_commands_query_command.rb
test/rubygems/test_gem_text.rb
Commit message: Clean any text present in gems before displaying it

This makes sure that any data pulled out of a gem spec is cleaned of all
non-printable characters before printing it. This prevents a gem from
causing havoc with a users terminal.


Vulnerable code:
      output << make_entry(matching_tuples, platforms)
    work = text.dup

Fixed code:
      output << clean_text(make_entry(matching_tuples, platforms))
  ##
  # Remove any non-printable characters and make the text suitable for
  # printing.
  def clean_text(text)
    text.gsub(/[\u0000-\u0008\u000b-\u000c\u000e-\u001F\u007f]/, ".".freeze)
  end

    work = clean_text(text)
pl (1)
    Platform: i386-linux
    Author: A User
    Homepage: http://example.com

    this is a summary
    EOF

    assert_equal expected, @ui.output
    assert_equal '', @ui.error
  end

  def test_execute_details_cleans_text
    spec_fetcher do |fetcher|
      fetcher.spec 'a', 2 do |s|
        s.summary = 'This is a lot of text. ' * 4
        s.authors = ["Abraham Lincoln \u0001", "\u0002 Hirohito"]
        s.homepage = "http://a.example.com/\u0003"
      end

      fetcher.legacy_platform
    end

    @cmd.handle_options %w[-r -d]

    use_ui @ui do
      @cmd.execute
    end

    expected = <<-EOF

*** REMOTE GEMS ***

a (2)
    Authors: Abraham Lincoln ., . Hirohito
    Homepage: http://a.example.com/.

    This is a lot of text. This is a lot of text. This is a lot of text.
    This is a lot of text.

  def test_format_removes_nonprintable_characters
    assert_equal "text with weird .. stuff", format_text("text with weird \u001b\u0002 stuff", 40)
  end