hitoshura25/cvefixes huggingface dataset:
CVE-2023-31125 (TypeScript, published 2023-05-08T21:15Z)
Description: value: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-248 \u2014 Uncaught Exception
An exception is thrown from a function, but it is not caught.
Repository: https://github.com/socketio/engine.io
Files changed:
lib/server.ts
lib/userver.ts
test/server.js
Commit message: fix: prevent crash when provided with an invalid query param

A specially crafted request could lead to the following exception:

> TypeError: Cannot read properties of undefined (reading 'handlesUpgrades')
>    at Server.onWebSocket (build/server.js:515:67)

This bug was introduced in [1], released in version 5.1.0 and included
in version 4.1.0 of the `socket.io` parent package. Older versions are
not impacted.

[1]: https://github.com/socketio/engine.io/commit/7096e98a02295a62c8ea2aa56461d4875887092d


Vulnerable code:
      if (errorCode) {
      if (errorCode) {

Fixed code:
      if (errorCode !== undefined) {
      if (errorCode !== undefined) {
const { WebSocket } = require("ws");

    it("should disallow `__proto__` as transport (polling)", (done) => {
      const partialDone = createPartialDone(done, 2);

      engine = listen((port) => {
        engine.on("connection_error", (err) => {
          expect(err.req).to.be.ok();
          expect(err.code).to.be(0);
          expect(err.message).to.be("Transport unknown");
          expect(err.context.transport).to.be("__proto__");
          partialDone();
        });

        request
          .get(`http://localhost:${port}/engine.io/`)
          .query({ transport: "__proto__", EIO: 4 })
          .end((err, res) => {
            expect(err).to.be.an(Error);
            expect(res.status).to.be(400);
            expect(res.body.code).to.be(0);
            expect(res.body.message).to.be("Transport unknown");
            partialDone();
          });
      });
    });

    it("should disallow `__proto__` as transport (websocket)", (done) => {
      const partialDone = createPartialDone(done, 2);

      engine = listen((port) => {
        engine.on("connection_error", (err) => {
          expect(err.req).to.be.ok();
          expect(err.code).to.be(0);
          expect(err.message).to.be("Transport unknown");
          expect(err.context.transport).to.be("__proto__");
          partialDone();
        });

        const socket = new WebSocket(
          `ws://localhost:${port}/engine.io/?EIO=4&transport=__proto__`
        );

        socket.onerror = partialDone;
      });
    });
CVE-2015-7316 (Unknown, published 2017-09-25T17:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/plone/Products.CMFPlone
Files changed:
Commit message: Merge pull request #914 from plone/isURLInPortal-hotfix

Apply isURLInPortal fix from https://pypi.python.org/pypi/Products.PloneHotfix20150910

Vulnerable code:

Fixed code:
CVE-2022-42725 (Python, published 2022-10-10T05:15Z)
Description: value: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/linuxmint/warpinator
Files changed:
src/transfers.py
Commit message: transfers: Don't allow a received file to be saved outside of the
transfer folder.

Since relative paths are valid for GFiles, we need to make sure
they resolve as descendants of the incoming transfer folder.


Vulnerable code:

Fixed code:
import gettext
_ = gettext.gettext

        self.save_path_file = Gio.File.new_for_path(self.save_path)
            # Check for valid path (GFile resolves paths upon creation).
            if self.save_path_file.get_relative_path(self.current_gfile) is None:
                raise Exception(_("Resolved path is not valid: %s -> %s") % (path, self.current_gfile.get_path()))
CVE-2022-42725 (Python, published 2022-10-10T05:15Z)
Description: value: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/linuxmint/warpinator
Files changed:
src/transfers.py
Commit message: transfers: Always remove existing files before beginning a transfer.

The user must approve overwriting, or they've must have allowed it
via preferences. Either way, if we've made it this far, we can get
rid of existing files before starting the transfer.

This eliminates the risk of any existing symbolic directory links
potentially being followed outside of the download directory, which
would not be detected by 5244c33d4c109.


Vulnerable code:
        if op.existing:
            for name in op.top_dir_basenames:
                try:
                    path = os.path.join(self.save_path, name)
                    if os.path.isdir(path): # file not found is ok
                        shutil.rmtree(path)
                    else:
                        os.remove(path)
                except FileNotFoundError:
                    pass
                except Exception as e:
                    logging.warning("Problem removing existing files.  Transfer may not succeed: %s" % e)
                flags = Gio.FileCreateFlags.REPLACE_DESTINATION
                self.current_stream = self.current_gfile.replace(None, False, flags, None)

Fixed code:
        for name in op.top_dir_basenames:
            try:
                path = os.path.join(self.save_path, name)
                if os.path.isdir(path): # file not found is ok
                    shutil.rmtree(path)
                else:
                    os.remove(path)
            except FileNotFoundError:
                pass
            except Exception as e:
                logging.warning("Problem removing existing files.  Transfer may not succeed: %s" % e)
                self.current_stream = self.current_gfile.create(Gio.FileCreateFlags.NONE, None)
CVE-2022-42725 (Python, published 2022-10-10T05:15Z)
Description: value: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/linuxmint/warpinator
Files changed:
src/transfers.py
Commit message: transfers: Use Pathlib.Path instead of GFile for path safety check.

Pathlib.Path will resolve both links and relative paths to their
absolute paths - GFile treated links as real paths, so directory
links could potentially escape the incoming folder.

Follow-up to 5244c33d4c1


Vulnerable code:
        self.save_path_file = Gio.File.new_for_path(self.save_path)
            # Check for valid path (GFile resolves paths upon creation).
            if self.save_path_file.get_relative_path(self.current_gfile) is None:
                raise Exception(_("Resolved path is not valid: %s -> %s") % (path, self.current_gfile.get_path()))

Fixed code:
from pathlib import Path
        self.save_path_obj = Path(self.save_path).resolve()
            # Check for valid path (pathlib.Path resolves both relative and symbolically-linked paths)
            test_path = Path(path).resolve()
            if not test_path.is_relative_to(self.save_path_obj):
                raise Exception(_("Resolved path is not valid: %s -> %s") % (path, str(test_path)))
CVE-2022-42725 (Python, published 2022-10-10T05:15Z)
Description: value: Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/linuxmint/warpinator
Files changed:
src/util.py
Commit message: transfers: Use g_file_query_exists() instead of g_file_test().

When checking for existing files, g_file_test (and os.path.exists)
both follow symbolic links, whereas g_file_query_exists() notices
the link itself.

In both cases the link (and not the link's target) would have been
overwritten, but now the recipient will know about it.


Vulnerable code:
        if GLib.file_test(path, GLib.FileTest.EXISTS):

Fixed code:
        file = Gio.File.new_for_path(path)
        if file.query_exists(None):
CVE-2024-38520 (Unknown, published 2024-06-26T19:15Z)
Description: value: SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it introduces the possibility of the host being used for amplification/reflection traffic generation because it will respond to every packet with two response packets that are larger than the request packet size. These sorts of techniques are used by external actors who generate spoofed source IPs to target a destination on the internet. This vulnerability has been patched in version 5.02.5185.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SoftEtherVPN/SoftEtherVPN
Files changed:
Commit message: Merge pull request from GHSA-j35p-p8pj-vqxq

src/Cedar/Proto_IKE.c: ignore packets with no IPSec SA

Vulnerable code:

Fixed code:
CVE-2020-5266 (Unknown, published 2020-04-16T22:15Z)
Description: value: In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/ps_linklist
Files changed:
Commit message: Merge pull request from GHSA-vr7g-vqp5-966j

Store XSS on create / edit page

Vulnerable code:

Fixed code:
CVE-2020-5273 (Unknown, published 2020-04-16T22:15Z)
Description: value: In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/ps_linklist
Files changed:
Commit message: Merge pull request from GHSA-cx2r-mf6x-55rx

The custom url field must be a valid url

Vulnerable code:

Fixed code:
CVE-2019-15683 (C, published 2019-10-29T19:15Z)
Description: value: TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea98166008301e614e0d36776bf9435a536136e.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/TurboVNC/turbovnc
Files changed:
unix/Xvnc/programs/Xserver/hw/vnc/auth.c
unix/Xvnc/programs/Xserver/hw/vnc/rfbserver.c
Commit message: Server: Fix two issues identified by ASan

1. If the TLSPlain and X509Plain security types were both disabled, then
   rfbOptPamAuth() would overflow the name field in the secTypes
   structure when testing the "none" security type, since the name of
   that security type has less than five characters.  This issue was
   innocuous, since the overflow was fully contained within the secTypes
   structure, but the ASan error caused Xvnc to abort, which made it
   difficult to detect other errors.

2. If an ill-behaved RFB client sent the TurboVNC Server a fence
   message with more than 64 bytes, then the TurboVNC Server would
   try to read that message and subsequently overflow the stack before
   it detected that the payload was too large.  This could never have
   occurred with any of the VNC viewers that currently support the RFB
   flow control extensions (TigerVNC and TurboVNC, namely.)  This issue
   was also innocuous, since the stack overflow affected two variables
   (newScreens and errMsg) that were never accessed before the function
   returned.


Vulnerable code:
         !strcmp(&s->name[strlen(s->name) - 5], "plain")) && s->enabled)
      READ(data, msg.f.length)

      if (msg.f.length > sizeof(data))
      else

Fixed code:
         strstr(s->name, "plain")) && s->enabled)
      if (msg.f.length > sizeof(data)) {
        SKIP(msg.f.length)
      } else {
        READ(data, msg.f.length)
      }
CVE-2014-9096 (PHP, published 2014-11-26T15:59Z)
Description: value: Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Pligg/pligg-cms
Files changed:
recover.php
Commit message: - Security fix applied to address a vulnerability


Vulnerable code:
$id=$_REQUEST['id'];
$n=$_REQUEST['n'];

Fixed code:
$id=sanitize($_REQUEST['id'], 3);
$n=sanitize($_REQUEST['n'], 3);
CVE-2014-9096 (PHP, published 2014-11-26T15:59Z)
Description: value: Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Pligg/pligg-cms
Files changed:
recover.php
Commit message: - Added another layer of sanitization to the recover password page, as recommended by Dominik


Vulnerable code:
$username=base64_decode($id);

Fixed code:
$idTemp=base64_decode($id);
$username=sanitize($idTemp ,3);
CVE-2020-24753 (C, published 2020-09-17T18:15Z)
Description: value: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/objsys/oocborrt
Files changed:
util/cbor2json.c
Commit message: fixed missing return status test error


Vulnerable code:

Fixed code:
      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
CVE-2020-24753 (C, published 2020-09-17T18:15Z)
Description: value: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/objsys/oocborrt
Files changed:
util/cbor2json.c
Commit message: fixed missing return status test error


Vulnerable code:

Fixed code:
      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
CVE-2020-24753 (C, published 2020-09-17T18:15Z)
Description: value: A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via crafted Concise Binary Object Representation (CBOR) input to the cbor2json decoder. An uncaught error while decoding CBOR Major Type 3 text strings leads to the use of an attacker-controllable uninitialized stack value. This can be used to modify memory, causing a crash or potentially exploitable heap corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/objsys/oocborrt
Files changed:
util/cbor2json.c
Commit message: fixed missing return status test error


Vulnerable code:

Fixed code:
      if (0 != ret) return LOG_RTERR (pCborCtxt, ret);
CVE-2018-1000815 (C++, published 2018-12-20T15:29Z)
Description: value: Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in content_settings_observer.cc that can result in Websites can run inline JavaScript even if script is blocked, making attackers easier to track users. This attack appear to be exploitable via the victim must visit a specially crafted website. This vulnerability appears to have been fixed in 0.25.2.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/brave/muon
Files changed:
chromium_src/chrome/renderer/content_settings_observer.cc
Commit message: Issue: 15232 AllowScript should use atom::ContentSettingsManager like other Allow* methods in the observer


Vulnerable code:
  if (content_setting_rules_) {
    ContentSetting setting = GetContentSettingFromRules(
        content_setting_rules_->script_rules, frame,
        url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL());
    allow = setting != CONTENT_SETTING_BLOCK;

Fixed code:
  if (content_settings_manager_->content_settings()) {
    allow =
        content_settings_manager_->GetSetting(
          ContentSettingsManager::GetOriginOrURL(render_frame()->GetWebFrame()),
          url::Origin(frame->GetDocument().GetSecurityOrigin()).GetURL(),
          "javascript",
          allow) != CONTENT_SETTING_BLOCK;
CVE-2016-5737 (Ruby, published 2017-01-12T23:59Z)
Description: value: The Gerrit configuration in the Openstack Puppet module for Gerrit (aka puppet-gerrit) improperly marks text/html as a safe mimetype, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a crafted review.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openstack-infra/puppet-gerrit
Files changed:
templates/gerrit.config.erb
Commit message: Remove text/html as a safe mimetype

The non-default safe mimetype in gerrit exists purely to proect installs
against setting this - when set, downloading a text/html file will
result in that file being rendered.

Change-Id: I648ada0b26aaf35ece9ef57f609b46f23f6e422a


Vulnerable code:
[mimetype "text/html"]
        safe = true

Fixed code: