hitoshura25/cvefixes huggingface dataset:
CVE-2015-8791 (Other, published 2016-01-29T19:59Z)
Description: value: The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id, which triggers an invalid memory access.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Matroska-Org/libebml
Files changed:
ChangeLog
src/EbmlElement.cpp
Commit message: EbmlElement: don't read beyond end of buffer when reading variable length integers


Vulnerable code:

Fixed code:
        * EbmlElement::ReadCodedSizeValue(): Fixed an invalid memory
        access. When reading a EBML variable length integer value a read
        access beyond the end of the available buffer was possible if
        fewer bytes were available than indicated by the first byte
        resulting in a heap information leak.


      // Guard against invalid memory accesses with incomplete IDs.
      if (PossibleSizeLength > BufferSize)
        break;
CVE-2019-13615 (C++, published 2019-07-16T17:15Z)
Description: value: libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Matroska-Org/libebml
Files changed:
src/EbmlElement.cpp
Commit message: Check the max size to read before actually reading

The size check waas also missing from the length parsing


Vulnerable code:
    } while (!bFound && MaxDataSize > ReadSize);

Fixed code:
      if (MaxDataSize <= ReadSize)
        break;
    } while (!bFound);
      if (MaxDataSize <= ReadSize) {
        bFound = false;
        break;
      }
CVE-2019-13615 (C++, published 2019-07-16T17:15Z)
Description: value: libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Matroska-Org/libebml
Files changed:
src/EbmlElement.cpp
Commit message: Exit the max size loop when there's nothing left possible to find

DataStream.getFilePointer() is not correct in this context. It might force to
exit too early.


Vulnerable code:
  } while ( MaxDataSize > DataStream.getFilePointer() - SizeIdx + PossibleID_Length );

Fixed code:
  } while ( MaxDataSize >= ReadSize );
CVE-2022-36007 (Unknown, published 2022-08-15T11:21Z)
Description: value: Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue exists within the functions `load-file` and `load-resource`. These functions can be limited to load files from a list of load paths. Assuming Venice has been configured with the load paths: `[ "/Users/foo/resources" ]` When passing **relative** paths to these two vulnerable functions everything is fine: `(load-resource "test.png")` => loads the file "/Users/foo/resources/test.png" `(load-resource "../resources-alt/test.png")` => rejected, outside the load path When passing **absolute** paths to these two vulnerable functions Venice may return files outside the configured load paths: `(load-resource "/Users/foo/resources/test.png")` => loads the file "/Users/foo/resources/test.png" `(load-resource "/Users/foo/resources-alt/test.png")` => loads the file "/Users/foo/resources-alt/test.png" !!! The latter call suffers from the _Partial Path Traversal_ vulnerability. This issue’s scope is limited to absolute paths whose name prefix matches a load path. E.g. for a load-path `"/Users/foo/resources"`, the actor can cause loading a resource also from `"/Users/foo/resources-alt"`, but not from `"/Users/foo/images"`. Versions of Venice before and including v1.10.17 are affected by this issue. Upgrade to Venice >= 1.10.18, if you are on a version < 1.10.18. There are currently no known workarounds.
Severity: nan (CVSS v3 base score: 3.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jlangch/venice
Files changed:
Commit message: Merge pull request #4 from BulkSecurityGeneratorProjectV2/fix/JLL/partial-path-traversal-vulnerability

[SECURITY] Fix Partial Path Traversal Vulnerability

Vulnerable code:

Fixed code:
CVE-2015-3887 (Other, published 2017-09-21T16:29Z)
Description: value: Untrusted search path vulnerability in ProxyChains-NG before 4.9 allows local users to gain privileges via a Trojan horse libproxychains4.so library in the current working directory, which is referenced in the LD_PRELOAD path.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/rofl0r/proxychains-ng
Files changed:
configure
src/main.c
Commit message: fix for CVE-2015-3887

closes #60


Vulnerable code:

Fixed code:
	echo "--ignore-cve		default: no"
	echo "	if set to yes ignores CVE-2015-3887 and makes it possible"
	echo "	to preload from current dir (insecure)"
ignore_cve=no
	--ignore-cve) ignore_cve=1;;
	--ignore-cve=*) ignore_cve=`spliteq $1`;;
[ "$ignore_cve" = "no" ] && echo CPPFLAGS+= -DSUPER_SECURE>>config.mak
#ifndef SUPER_SECURE /* CVE-2015-3887 */
#endif
#ifdef SUPER_SECURE
		memcpy(own_dir, "/dev/null/", 2);
#else
#endif
CVE-2016-7143 (C, published 2016-09-21T14:25Z)
Description: value: The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/charybdis-ircd/charybdis
Files changed:
modules/m_sasl.c
Commit message: SASL: Disallow beginning : and space anywhere in AUTHENTICATE parameter

This is a FIX FOR A SECURITY VULNERABILITY. All Charybdis users must
apply this fix if you support SASL on your servers, or unload m_sasl.so
in the meantime.


Vulnerable code:

Fixed code:
	if (*parv[1] == ':' || strchr(parv[1], ' '))
	{
		exit_client(client_p, client_p, client_p, "Malformed AUTHENTICATE");
		return 0;
	}
CVE-2020-26213 (Go, published 2020-11-06T17:15Z)
Description: value: In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. The issue is patched in teler 0.0.1 and 0.0.1-dev5.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/kitabisa/teler
Files changed:
pkg/errors/abort.go
Commit message: :hammer: Fix segmentation fault of syscall

If teler is run via the docker image, the syscall function cannot allocate and return a nil pointer to address.


Vulnerable code:
import "syscall"

Fixed code:
import (
	"os"
	"syscall"
)
	if _, err := os.Stat("/.dockerenv"); err == nil {
		os.Exit(i[0])
	}
CVE-2022-23466 (JavaScript, published 2022-12-06T18:15Z)
Description: value: teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized. This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This vulnerability has been fixed on version `v2.0.0-rc.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kitabisa/teler
Files changed:
internal/event/www/script.js
Commit message: fix(event) dashboard: prevent DOM-XSS for incoming events


Vulnerable code:
        row.insertCell(1).innerHTML = `<td class="category-name"><strong>${data.category}</strong></td>`;
        row.insertCell(3).innerHTML = `<td class="matches"><strong>${data[data.element]}</strong></td>`;
        li.innerHTML = `<a href="#" class="menu-item" title="${name}">${name}</a>`;

Fixed code:
    const escapeHTML = (string) => {
        const map = {'&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#039;'};
        return string.replace(/[&<>"']/g, function(m) { return map[m]; });
    };
        row.insertCell(1).innerHTML = `<td class="category-name"><strong>${escapeHTML(data.category)}</strong></td>`;
        row.insertCell(3).innerHTML = `<td class="matches"><strong>${escapeHTML(data[data.element])}</strong></td>`;
        li.innerHTML = `<a href="#" class="menu-item" title="${escapeHTML(name)}">${escapeHTML(name)}</a>`;
CVE-2010-10006 (Java, published 2023-01-18T00:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-208 \u2014 Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/michaelliao/jopenid
Files changed:
JOpenId/src/org/expressme/openid/OpenIdManager.java
Commit message: fix timing vulnerability.

Vulnerable code:
        if (!sig.equals(hmac))
        

Fixed code:
        if (!safeEquals(sig, hmac))

    boolean safeEquals(String s1, String s2) {
        if (s1.length()!=s2.length())
            return false;
        int result = 0;
        for (int i=0; i<s1.length(); i++) {
            int c1 = s1.charAt(i);
            int c2 = s2.charAt(i);
            result |= (c1 ^c2);
        }
        return result==0;
    }
CVE-2016-0720 (Ruby, published 2017-04-21T15:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ClusterLabs/pcs
Files changed:
pcsd/pcsd.rb
Commit message: fix CSRF vulnerability

 * requests /remote/* (GET and POST) and /run_pcs are accessible only with token authentication
 * all web UI requests are accessible only with session authentication
 * all web UI requests (except for /manage, /managec/<cluster>/main, /permissions ) must
   include header: X-Requested-With: XMLHttpRequest


Vulnerable code:
    if not PCSAuth.loginByToken(session, cookies) and not PCSAuth.isLoggedIn(session)
      # If we're on /managec/<cluster_name>/main we redirect
      match_expr = "/managec/(.*)/(.*)"
      mymatch = request.path.match(match_expr)
      on_managec_main = false
      if mymatch and mymatch.length >= 3 and mymatch[2] == "main"
        on_managec_main = true

      if request.path.start_with?('/remote') or
        (request.path.match(match_expr) and not on_managec_main) or
        '/run_pcs' == request.path or
        '/clusters_overview' == request.path or
        request.path.start_with?('/permissions_')
        $logger.info "ERROR: Request without authentication"
      else
        session[:pre_login_path] = request.path
        redirect '/login'

Fixed code:
    gui_request = ( # these are URLs for web pages
      request.path == '/' or
      request.path == '/manage' or
      request.path == '/permissions' or
      request.path.match('/managec/.+/main')
    )
    if request.path.start_with?('/remote/') or request.path == '/run_pcs'
      unless PCSAuth.loginByToken(session, cookies)
        halt [401, '{"notauthorized":"true"}']
    else #/managec/* /manage/* /permissions
      if !gui_request and
        request.env['HTTP_X_REQUESTED_WITH'] != 'XMLHttpRequest'
        # Accept non GUI requests only with header
        # "X_REQUESTED_WITH: XMLHttpRequest". (check if they are send via AJAX).
        # This prevents CSRF attack.
      elsif not PCSAuth.isLoggedIn(session)
        if gui_request
          session[:pre_login_path] = request.path
          redirect '/login'
        else
          halt [401, '{"notauthorized":"true"}']
        end
CVE-2017-2661 (JavaScript, published 2018-03-12T15:29Z)
Description: value: ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ClusterLabs/pcs
Files changed:
CHANGELOG.md
pcsd/public/js/nodes-ember.js
pcsd/public/js/pcsd.js
Commit message: web UI: fixed XSS vulnerability


Vulnerable code:
        out += '<tr><td>' + opt + '</td><td>' + val + '</td></tr>\n';
      + this.get('status') + (this.get("is_unmanaged") ? " (unmanaged)" : "")
    dialog_obj.find('#auth_nodes_list').append("\t\t\t<tr><td>" + node + '</td><td><input type="password" name="' + node + '-pass"></td></tr>\n');

Fixed code:
- Fixed Cross-site scripting (XSS) vulnerability in web UI ([CVE-2017-2661],
  [rhbz#1434111])
[CVE-2017-2661]: https://access.redhat.com/security/cve/CVE-2017-2661
[rhbz#1434111]: https://bugzilla.redhat.com/show_bug.cgi?id=1434111
        out += '<tr><td>' + htmlEncode(opt) + '</td><td>' + htmlEncode(val) + '</td></tr>\n';
      + htmlEncode(this.get('status')) + (this.get("is_unmanaged") ? " (unmanaged)" : "")
    dialog_obj.find('#auth_nodes_list').append("\t\t\t<tr><td>" + htmlEncode(node) + '</td><td><input type="password" name="' + htmlEncode(node) + '-pass"></td></tr>\n');
CVE-2013-7444 (PHP, published 2015-09-01T14:59Z)
Description: value: The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wikimedia/mediawiki
Files changed:
includes/specials/SpecialContributions.php
Commit message: Prevent Special:Contributions from indicating that an IP address is autoblocked

If an IP address was autoblocked in the userlinks, sysops would see
"change block" and "unblock", indicating that the IP is autoblocked.

Now Special:Contributions will only display "change block" if the user
is blocked and the block type is not Block::TYPE_AUTO. This is the same
check which is used above when deciding whether to display the
block log extract.

Bug: 46457
Change-Id: I43047059cb67527d5296322ac17fe798db917bec


Vulnerable code:
				if ( $target->isBlocked() ) {

Fixed code:
				if ( $target->isBlocked() && $target->getBlock()->getType() != Block::TYPE_AUTO ) {
CVE-2015-6727 (PHP, published 2015-09-01T14:59Z)
Description: value: The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wikimedia/mediawiki
Files changed:
includes/specials/SpecialDeletedContributions.php
Commit message: SECURITY: Don't disclose if an IP is autoblocked on Special:DeletedContributions

Same patch as dc2966bd05b, just for Special:DeletedContributions this
time.

Bug: T106893
Change-Id: I2089b21fc379b612fe9bf087b5f4ea75052bdbd3


Vulnerable code:
					if ( $userObj->isBlocked() ) {

Fixed code:
					if ( $userObj->isBlocked() && $userObj->getBlock()->getType() !== Block::TYPE_AUTO ) {
CVE-2021-41800 (PHP, published 2021-10-11T08:15Z)
Description: value: MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/wikimedia/mediawiki
Files changed:
includes/specials/SpecialContributions.php
Commit message: SECURITY: fix PoolCounter protection of Special:Contributions

The call to $pager->getNumRows() itself triggers execution of
the database query backing the page, so, that call must be inside
the callback given to PoolCounterWorkViaCallback.

CVE-2021-41800

Bug: T284419
Change-Id: I8b7b41a355be265389a4a8c9ea91301d4e23ae1b


Vulnerable code:
			} elseif ( !$pager->getNumRows() ) {
				$out->addWikiMsg( 'nocontribs', $target );
					'doWork' => function () use ( $pager, $out ) {
						# Show a message about replica DB lag, if applicable
						$lag = $pager->getDatabase()->getSessionLagStatus()['lag'];
						if ( $lag > 0 ) {
							$out->showLagWarning( $lag );

						$output = $pager->getBody();
						if ( !$this->including() ) {
							$output = $pager->getNavigationBar() .
								$output .
								$pager->getNavigationBar();
						}
						$out->addHTML( $output );

Fixed code:
					'doWork' => function () use ( $pager, $out, $target ) {
						if ( !$pager->getNumRows() ) {
							$out->addWikiMsg( 'nocontribs', $target );
						} else {
							# Show a message about replica DB lag, if applicable
							$lag = $pager->getDatabase()->getSessionLagStatus()['lag'];
							if ( $lag > 0 ) {
								$out->showLagWarning( $lag );
							}

							$output = $pager->getBody();
							if ( !$this->including() ) {
								$output = $pager->getNavigationBar() .
									$output .
									$pager->getNavigationBar();
							}
							$out->addHTML( $output );
CVE-2018-16405 (Other, published 2018-09-03T19:29Z)
Description: value: An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://gitlab.com/mayan-edms/mayan-edms
Files changed:
HISTORY.rst
mayan/apps/appearance/templates/appearance/base_plain.html
Commit message: Avoid setting window.location directly to avoid exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and solution. Closes GitLab issue #494.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>


Vulnerable code:
                    window.location = currentHash.substring(1);

Fixed code:
- Appearance app: avoid setting window.location directly to avoid exploit
  of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
  and solution. Closes GitLab issue #494.
                    window.location.pathname = currentHash.substring(1);
CVE-2018-16406 (Other, published 2018-09-03T19:29Z)
Description: value: An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://gitlab.com/mayan-edms/mayan-edms
Files changed:
HISTORY.rst
mayan/apps/cabinets/widgets.py
Commit message: Cabinets app: Escape cabinet labels to avoid possible exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and proposed solutions. Closes GitLab issue #495.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>


Vulnerable code:
from django.utils.html import format_html_join
    result.append('"text": "{}",'.format(node.label))

Fixed code:
- Cabinets app: Escape cabinet labels to avoid possible exploit of
  cross site scripting. Thanks to Lokesh (@lokesh1095) for the report
  and proposed solutions. Closes GitLab issue #495.
from django.utils.html import format_html, format_html_join

    result.append(format_html('"text": "{}",', node.label))