hitoshura25/cvefixes huggingface dataset:
CVE-2022-24739 (PHP, published 2022-03-08T22:15Z)
Description: value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/Rudloff/alltube
Files changed:
classes/Factory/ViewFactory.php
index.php
templates/inc/logo.tpl
Commit message: Don't redirect to REQUEST_URI when browsing to index.php
Instead, we can make sure everything works correctly on index.php


Vulnerable code:
if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
    die;
}

    <a class="logocompatible" href="{base_url}">

Fixed code:
    /**
     * @param Uri $uri
     * @return Uri
     */
    private static function cleanBasePath(Uri $uri): Uri
    {
        $basePath = $uri->getBasePath();
        if (str_ends_with($basePath, 'index.php')) {
            /*
             * When the base path ends with index.php,
             * routing works correctly, but it breaks the URL of static assets using {base_url}.
             * So we alter the base path but only in the URI used by SmartyPlugins.
             */
            $uri = $uri->withBasePath(dirname($basePath));
        }

        return $uri;
    }

        $uri = self::cleanBasePath($uri);

    <a class="logocompatible" href="{path_for name="index"}">
CVE-2012-0973 (Unknown, published 2012-09-25T23:55Z)
Description: value: Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php.  NOTE: some of these details are obtained from third party information.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/osclass/OSClass
Files changed:
Commit message: OSClass 2.3.5


Vulnerable code:

Fixed code:
CVE-2012-0974 (Unknown, published 2012-09-25T23:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osclass/OSClass
Files changed:
Commit message: OSClass 2.3.5


Vulnerable code:

Fixed code:
CVE-2012-1617 (PHP, published 2012-09-26T00:55Z)
Description: value: Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/osclass/OSClass
Files changed:
oc-content/themes/modern/combine.php
oc-includes/osclass/gui/combine.php
Commit message: minor check in combine.php


Vulnerable code:

Fixed code:
    if( !in_array($type, array('css', 'js')) ) {
        header ("HTTP/1.0 403 Forbidden") ;
        exit ;
    }

    if( !in_array($type, array('css', 'js')) ) {
        header ("HTTP/1.0 403 Forbidden") ;
        exit ;
    }
CVE-2012-1617 (Unknown, published 2012-09-26T00:55Z)
Description: value: Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/osclass/OSClass
Files changed:
Commit message: OSClass 2.3.5


Vulnerable code:

Fixed code:
CVE-2012-5162 (Unknown, published 2012-09-26T00:55Z)
Description: value: Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/osclass/OSClass
Files changed:
Commit message: OSClass 2.3.5


Vulnerable code:

Fixed code:
CVE-2012-5163 (Unknown, published 2012-09-26T00:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osclass/OSClass
Files changed:
Commit message: OSClass 2.3.5


Vulnerable code:

Fixed code:
CVE-2021-23393 (Python, published 2021-06-11T00:15Z)
Description: value: This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/briancappello/flask-unchained
Files changed:
flask_unchained/bundles/controller/utils.py
requirements.txt
tests/bundles/controller/test_utils.py
Commit message: add tests for validate_redirect_url


Vulnerable code:
    return urlquote(url, safe=":/?#[]@!$&'()*+,;=")
    @pytest.mark.options(EXTERNAL_SERVER_NAME='works.com')
                                            _external_host='works.com')

Fixed code:
    return urlquote(url, safe=":/?#[]@!$&'()*+,;=<>")
flask-sqlalchemy==2.5.1
        assert _validate_redirect_url('///evil.com') is False
        assert _validate_redirect_url('\\\\\\evil.com') is False
        assert _validate_redirect_url('\x00evil.com') is False
    def test_it_requires_same_scheme(self, app, monkeypatch):
        with app.test_request_context():
            monkeypatch.setattr('flask.request.host_url', 'https://example.com')
            assert _validate_redirect_url('http://example.com/foo') is False
            monkeypatch.undo()

    @pytest.mark.options(EXTERNAL_SERVER_NAME='http://works.com')
    @pytest.mark.options(EXTERNAL_SERVER_NAME='https://works.com')
    def test_it_requires_same_external_server_name_scheme(self, app, monkeypatch):
        with app.test_request_context():
            monkeypatch.setattr('flask.request.host_url', 'http://example.com')
            assert _validate_redirect_url('http://works.com') is False
            monkeypatch.undo()

                                            _external_host='http://works.com')
CVE-2024-26134 (Other, published 2024-02-19T23:15Z)
Description: value: cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/agronholm/cbor2
Files changed:
docs/versionhistory.rst
source/tags.c
Commit message: Check PyObject_Hash() return value for errors

Fixes #213.


Vulnerable code:

Fixed code:
**UNRELEASED**

- Fixed ``__hash__()`` of the C version of the ``CBORTag`` type crashing when there's a recursive
  reference cycle

    if (ret == -1)
        goto exit;
CVE-2017-5999 (Unknown, published 2017-03-06T06:59Z)
Description: value: An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPT_RIJNDAEL_256() function (the 256-bit block version of Rijndael, not AES) instead of MCRYPT_RIJNDAEL_128 (real AES) could help an attacker to create unknown havoc in the remote system.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/nuxsmin/sysPass
Files changed:
Commit message: Merge branch 'crypt'

Conflicts:
	inc/SP/Core/Upgrade/Group.class.php
	inc/SP/Core/Upgrade/Upgrade.class.php


Vulnerable code:

Fixed code:
CVE-2017-5590 (Objective-C, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for ChatSecure (3.2.0 - 4.0.0; only iOS) and Zom (all versions up to 1.0.11; only iOS).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ChatSecure/ChatSecure-iOS
Files changed:
ChatSecure/Classes/Controllers/XMPP/OTRXMPPManager.m
ChatSecure/Classes/Controllers/XMPP/OTRXMPPMessageYapStroage.h
ChatSecure/Classes/Controllers/XMPP/OTRXMPPMessageYapStroage.m
Commit message: Changed to using carbon module delegate methods


Vulnerable code:
    // Message Carbons
    _messageCarbons = [[XMPPMessageCarbons alloc] init];
    [self.messageCarbons activate:self.xmppStream];
    
- (void)xmppStream:(XMPPStream *)sender didReceiveMessage:(XMPPMessage *)xmppMessage
{
    [self storeMessage:xmppMessage stream:sender incoming:YES];
}

- (void)storeMessage:(XMPPMessage *)xmppMessage stream:(XMPPStream *)stream incoming:(BOOL)incoming
{
    if ([xmppMessage isMessageCarbon]) {
        [self handleCarbonMessage:xmppMessage stream:stream];
    } else {
        [self handleMessage:xmppMessage stream:stream incoming:incoming];
    }
}
- (void)handleMessage:(XMPPMessage *)xmppMessage stream:(XMPPStream *)stream incoming:(BOOL)incoming;
- (void)handleCarbonMessage:(XMPPMessage *)xmppMessage stream:(XMPPStream *)stream
    BOOL incoming = NO;
    XMPPMessage *forwardedMessage = [xmppMessage messageCarbonForwardedMessage];
    if ([xmppMessage isReceivedMessageCarbon]) {
        incoming = YES;

Fixed code:
    // Message Carbons
    _messageCarbons = [[XMPPMessageCarbons alloc] init];
    [self.messageCarbons addDelegate:self.messageStorage delegateQueue:self.messageStorage.moduleDelegateQueue];
    [self.messageCarbons activate:self.xmppStream];
    
@property (nonatomic, readonly) dispatch_queue_t moduleDelegateQueue;
        _moduleDelegateQueue = dispatch_queue_create("OTRXMPPMessageYapStroage-delegateQueue", 0);
- (void)xmppStream:(XMPPStream *)stream didReceiveMessage:(XMPPMessage *)xmppMessage
    if ([xmppMessage isMessageCarbon]) {
        return;
    }
    
- (void)handleCarbonMessage:(XMPPMessage *)forwardedMessage stream:(XMPPStream *)stream outgoing:(BOOL)isOutgoing
    BOOL incoming = !isOutgoing;
    if (incoming) {
#pragma - mark XMPPMessageCarbonsDelegate

- (void)xmppMessageCarbons:(XMPPMessageCarbons *)xmppMessageCarbons didReceiveMessage:(XMPPMessage *)message outgoing:(BOOL)isOutgoing
{
    [self handleCarbonMessage:message stream:xmppMessageCarbons.xmppStream outgoing:isOutgoing];
}
CVE-2017-5590 (Objective-C, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for ChatSecure (3.2.0 - 4.0.0; only iOS) and Zom (all versions up to 1.0.11; only iOS).
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/ChatSecure/ChatSecure-iOS
Files changed:
ChatSecure/Classes/Controllers/XMPP/OTRXMPPManager.m
ChatSecure/Classes/Controllers/XMPP/OTRXMPPMessageYapStroage.h
ChatSecure/Classes/Controllers/XMPP/OTRXMPPMessageYapStroage.m
Commit message: Changed to using carbon module delegate methods


Vulnerable code:
    // Message Carbons
    _messageCarbons = [[XMPPMessageCarbons alloc] init];
    [self.messageCarbons activate:self.xmppStream];
    
- (void)xmppStream:(XMPPStream *)sender didReceiveMessage:(XMPPMessage *)xmppMessage
{
    [self storeMessage:xmppMessage stream:sender incoming:YES];
}

- (void)storeMessage:(XMPPMessage *)xmppMessage stream:(XMPPStream *)stream incoming:(BOOL)incoming
{
    if ([xmppMessage isMessageCarbon]) {
        [self handleCarbonMessage:xmppMessage stream:stream];
    } else {
        [self handleMessage:xmppMessage stream:stream incoming:incoming];
    }
}
- (void)handleMessage:(XMPPMessage *)xmppMessage stream:(XMPPStream *)stream incoming:(BOOL)incoming;
- (void)handleCarbonMessage:(XMPPMessage *)xmppMessage stream:(XMPPStream *)stream
    BOOL incoming = NO;
    XMPPMessage *forwardedMessage = [xmppMessage messageCarbonForwardedMessage];
    if ([xmppMessage isReceivedMessageCarbon]) {
        incoming = YES;

Fixed code:
    // Message Carbons
    _messageCarbons = [[XMPPMessageCarbons alloc] init];
    [self.messageCarbons addDelegate:self.messageStorage delegateQueue:self.messageStorage.moduleDelegateQueue];
    [self.messageCarbons activate:self.xmppStream];
    
@property (nonatomic, readonly) dispatch_queue_t moduleDelegateQueue;
        _moduleDelegateQueue = dispatch_queue_create("OTRXMPPMessageYapStroage-delegateQueue", 0);
- (void)xmppStream:(XMPPStream *)stream didReceiveMessage:(XMPPMessage *)xmppMessage
    if ([xmppMessage isMessageCarbon]) {
        return;
    }
    
- (void)handleCarbonMessage:(XMPPMessage *)forwardedMessage stream:(XMPPStream *)stream outgoing:(BOOL)isOutgoing
    BOOL incoming = !isOutgoing;
    if (incoming) {
#pragma - mark XMPPMessageCarbonsDelegate

- (void)xmppMessageCarbons:(XMPPMessageCarbons *)xmppMessageCarbons didReceiveMessage:(XMPPMessage *)message outgoing:(BOOL)isOutgoing
{
    [self handleCarbonMessage:message stream:xmppMessageCarbons.xmppStream outgoing:isOutgoing];
}
CVE-2021-29439 (Unknown, published 2021-04-13T20:15Z)
Description: value: The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission `admin.login` can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitive and elevate their privileges on the instance. The vulnerability has been addressed in version 1.10.11. As a mitigation blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation. 
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/getgrav/grav-plugin-admin
Files changed:
Commit message: Merge branch 'release/1.10.11'


Vulnerable code:

Fixed code:
CVE-2021-3799 (PHP, published 2021-09-27T13:15Z)
Description: value: grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/getgrav/grav-plugin-admin
Files changed:
CHANGELOG.md
classes/plugin/Router.php
Commit message: Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack


Vulnerable code:
        return $response->withHeader('X-Frame-Options', 'NONE');

Fixed code:
    * Fixed `X-Frame-Options` to be `DENY` in all admin pages to prevent a clickjacking attack
        return $response->withHeader('X-Frame-Options', 'DENY');
CVE-2023-23631 (Go, published 2023-02-09T21:15Z)
Description: value: github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/ipfs/go-unixfsnode
Files changed:
hamt/shardeddir.go
hamt/util.go
Commit message: Add size check on the bitfield before allocation


Vulnerable code:
	bf := bitField(data)
func bitField(nd data.UnixFSData) bitfield.Bitfield {
	bf := bitfield.NewBitfield(int(nd.FieldFanout().Must().Int()))
	return bf

Fixed code:
	bf, err := bitField(data)
	if err != nil {
		return nil, err
	}
const maximumHamtWidth = 1 << 10

func bitField(nd data.UnixFSData) (bitfield.Bitfield, error) {
	fanout := int(nd.FieldFanout().Must().Int())
	if fanout > maximumHamtWidth {
		return nil, fmt.Errorf("hamt witdh (%d) exceed maximum allowed (%d)", fanout, maximumHamtWidth)
	}
	bf := bitfield.NewBitfield(fanout)
	return bf, nil
CVE-2023-23631 (Other, published 2023-02-09T21:15Z)
Description: value: github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/ipfs/go-unixfsnode
Files changed:
go.mod
Commit message: Merge pull request from GHSA-4gj3-6r43-3wfc

Add size check on the bitfield before allocation

Vulnerable code:
 	github.com/ipfs/go-bitfield v1.0.0
 	github.com/ipfs/go-cid v0.2.0

Fixed code:
 	github.com/ipfs/go-bitfield v1.1.0
 	github.com/ipfs/go-cid v0.3.2