hitoshura25/cvefixes huggingface dataset:
CVE-2020-36828 (PHP, published 2024-03-31T09:15Z)
Description: value: A vulnerability was found in DiscuzX up to 3.4-20200818. It has been classified as problematic. Affected is the function show_next_step of the file upload/install/include/install_function.php. The manipulation of the argument uchidden leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.4-20210119 is able to address this issue. The name of the patch is 4a9673624f46f7609486778ded9653733020c567. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258612.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/codersclub/DiscuzX
Files changed:
upload/install/include/install_function.php
Commit message: !187 修复 install.php中uchidden参数的XSS漏洞
* 修复install.php中uchidden参数的XSS漏洞
* 修复install.php中uchidden参数的XSS漏洞

Vulnerable code:

Fixed code:

	if(!empty($uchidden)) {
		$uc_info_transfer = unserialize(urldecode($uchidden));
		if(!isset($uc_info_transfer['ucapi']) && !isset($uc_info_transfer['ucfounderpw'])){
			$uchidden = '';
		} else {
			$uchidden = dhtmlspecialchars($uchidden);
		}
	}
CVE-2022-25858 (JavaScript, published 2022-07-15T20:15Z)
Description: value: The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/terser/terser
Files changed:
lib/compress/evaluate.js
lib/compress/index.js
lib/utils/index.js
test/compress/regexp.js
Commit message: fix potential regexp DDOS


Vulnerable code:
    regexp_source_fix
    if (evaluated === undefined) {
const all_flags = "gimuy";
        console.log(JSON.stringify("COMPASS? Overpass.".match(new RegExp("([Sap]+)", "ig"))));
        console.log(JSON.stringify("COMPASS? Overpass.".match(/([Sap]+)/gi)));
        console.log(new RegExp("^https://"))
        console.log(/^https:\/\//)

Fixed code:
    regexp_source_fix,
    regexp_is_safe,
    if (evaluated === undefined && regexp_is_safe(this.value.source)) {
    regexp_is_safe,
                && regexp_is_safe(params[0])

// Subset of regexps that is not going to cause regexp based DDOS
// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;

/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
export const regexp_is_safe = (source) => re_safe_regexp.test(source);

const all_flags = "dgimsuy";
        console.log(JSON.stringify("COMPASS? Overpass.".match(new RegExp("(pass)", "ig"))));
        console.log(JSON.stringify("COMPASS? Overpass.".match(/(pass)/gi)));
        console.log(new RegExp("^https//"))
        console.log(/^https\/\//)

regexp_no_ddos: {
    options = { unsafe: true, evaluate: true }
    input: {
        console.log(/(b+)b+/.test("bbb"))
        console.log(RegExp("(b+)b+").test("bbb"))
    }
    expect: {
        console.log(/(b+)b+/.test("bbb"))
        console.log(RegExp("(b+)b+").test("bbb"))
    }
    expect_stdout: ["true", "true"]
}
CVE-2021-22568 (Other, published 2021-12-09T17:15Z)
Description: value: When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/dart-lang/sdk
Files changed:
CHANGELOG.md
DEPS
Commit message: Bump pub

New commits in this revision:

git log --format=%C(auto) %h %s cafadd17ba285dad9ebe6d34c617bc0d70d096b3..98a01e1cdbf441f030f1be76417860b6b372663d ✓
 cafadd17 Don't use null safety (yet) (#3112)
 98a01e1c Store credentials in a config directory (#3092)
 4ee280b7 Fixed messages (#3110)
 bbdac802 Third party hosted pub registry authentication (#3007)
 b1bedc53 `--examples` for get/upgrade/downgrade/add/remove (#2857)

Change-Id: Ibf6ffe33820c97114958c1564a7c22a46ff73d9c
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/213348
Commit-Queue: Sigurd Meldgaard <sigurdm@google.com>
Reviewed-by: Jonas Jensen <jonasfj@google.com>


Vulnerable code:
- Fixes unicode terminal detection windows
  "pub_rev": "d95c5713dda518ed53ada70e00789e6aadbfbe48",

Fixed code:


- Adds support for token-based authorization to third party package-repositories
  with the new command `dart pub token`.
- Credentials are no longer stored in the pub-cache, but in a platform dependent
  config directory:
  * On Linux `$XDG_CONFIG_HOME/dart/pub-credentials.json` if `$XDG_CONFIG_HOME`
    is defined, otherwise `$HOME/.config/dart/pub-credentials.json`
  * On Mac OS: `$HOME/Library/Application Support/dart/pub-credentials.json`
  * On Windows: `%APPDATA%/dart/pub-credentials.json`

- Fixes unicode terminal detection windows.
- New flag `--example` to the commands 
  `dart pub get/upgrade/downgrade/add/remove` that will result in the `example/`
  folder dependencies to be updated after operating in the current directory. 
  "pub_rev": "cafadd17ba285dad9ebe6d34c617bc0d70d096b3",
CVE-2018-18434 (Java, published 2018-10-17T06:29Z)
Description: value: An issue was discovered in litemall 0.9.0. Arbitrary file download is possible via ../ directory traversal in linlinjava/litemall/wx/web/WxStorageController.java in the litemall-wx-api component.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/linlinjava/litemall
Files changed:
litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/web/WxStorageController.java
Commit message: fix[litemall-wx-api]: 修复文件路径中包含"../"带来的安全问题


Vulnerable code:
            ResponseEntity.notFound();
            ResponseEntity.notFound();
            ResponseEntity.notFound();
            ResponseEntity.notFound();

Fixed code:
            return ResponseEntity.notFound().build();
        }
        if(key.contains("../")){
            return ResponseEntity.badRequest().build();
            return ResponseEntity.notFound().build();
            return ResponseEntity.notFound().build();
        }
        if(key.contains("../")){
            return ResponseEntity.badRequest().build();

            return ResponseEntity.notFound().build();
CVE-2015-10110 (Other, published 2023-06-02T00:15Z)
Description: value: A vulnerability classified as problematic was found in ruddernation TinyChat Room Spy Plugin up to 1.2.8 on WordPress. This vulnerability affects the function wp_show_room_spy of the file room-spy.php. The manipulation of the argument room leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.9 is able to address this issue. The name of the patch is ab72627a963d61fb3bc31018e3855b08dc94a979. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230392.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/tinychat-roomspy
Files changed:
readme.txt
room-spy.php
Commit message: Added a character limit and removal of special characters to combat XSS attacks.

git-svn-id: https://plugins.svn.wordpress.org/tinychat-roomspy/trunk@1138083 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Stable tag: 1.2.8
* Version: 1.2.8
* Date: 14th April 2015
define('COMPARE_VERSION', '1.2.7');

Fixed code:
Stable tag: 1.2.9
* Version: 1.2.9
* Date: 18th April 2015
define('COMPARE_VERSION', '1.2.8');
	$room=(strlen($room) > 32) ? substr($room,0,32).'' : $room;
	$room=htmlspecialchars($room,ENT_QUOTES, 'UTF-8');
CVE-2022-23857 (Go, published 2022-01-24T02:15Z)
Description: value: model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/navidrome/navidrome
Files changed:
model/criteria/criteria.go
scanner/tag_scanner.go
Commit message: Fix potential SQL injection in Smart Playlists


Vulnerable code:
		log.Error("Invalid field in 'sort' field", "field", c.Sort)
		mapped = c.Sort
		mapped = mapped + " " + c.Order
	// Special case: if lastModifiedSInce is zero, re-import all files

Fixed code:
		log.Error("Invalid field in 'sort' field. Using 'title'", "sort", c.Sort)
		mapped = fieldMap["title"].field
		if strings.EqualFold(c.Order, "asc") || strings.EqualFold(c.Order, "desc") {
			mapped = mapped + " " + c.Order
		} else {
			log.Error("Invalid value in 'order' field. Valid values: 'asc', 'desc'", "order", c.Order)
		}
	// Special case: if lastModifiedSince is zero, re-import all files
CVE-2013-7381 (Unknown, published 2020-02-12T15:15Z)
Description: value: libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/mytrile/node-libnotify
Files changed:
Commit message: Merge pull request #4 from nealpoole/exec-fix

Replacing call to exec with execFile.

Vulnerable code:

Fixed code:
CVE-2023-39976 (C, published 2023-08-08T06:15Z)
Description: value: log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/ClusterLabs/libqb
Files changed:
lib/log_blackbox.c
tests/check_log.c
Commit message: log: fix potential overflow with long log messages (#490)

qb_vsnprintf_serialize was called with 'max_size' as the
limiting number for the length of the formatted log
message. But the buffer also needs to contain the
log header (given by 'actual_size'), so we now pass
't->max_line_length' as the maximum length of the
formatted log message to limit space to the actual 
bytes left

Also added error checks to the blackbox calls at
the end of the test, as these now provide a proper
test that the BB is functioning. Before they were
masking failures.

Vulnerable code:
	msg_len = qb_vsnprintf_serialize(chunk, max_size, cs->format, ap);
	if (msg_len >= max_size) {
        qb_log_blackbox_write_to_file("blackbox.dump");
        qb_log_blackbox_print_from_file("blackbox.dump");

Fixed code:
	msg_len = qb_vsnprintf_serialize(chunk, t->max_line_length, cs->format, ap);
	if (msg_len >= t->max_line_length) {
        rc = qb_log_blackbox_write_to_file("blackbox.dump");
	ck_assert_int_gt(rc, 0);
        rc = qb_log_blackbox_print_from_file("blackbox.dump");
	ck_assert_int_le(rc, 0);
CVE-2024-28199 (Ruby, published 2024-03-11T23:15Z)
Description: value: phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. If you splat user-provided attributes when rendering any HTML tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. Patches are available on RubyGems for all 1.x minor versions. Users are advised to upgrade. Users unable to upgrade should consider configuring a content security policy that does not allow `unsafe-inline`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/phlex-ruby/phlex
Files changed:
lib/phlex/sgml.rb
test/phlex/view/naughty_business.rb
Commit message: Fix improper case-sensitivity

See https://github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g


Vulnerable code:
			if attributes[:href]&.start_with?(/\s*javascript:/)
				attributes.delete(:href)
			end

			if attributes["href"]&.start_with?(/\s*javascript:/)
				attributes.delete("href")
			end

				if HTML::EVENT_ATTRIBUTES[name] || name.match?(/[<>&"']/)

Fixed code:
				lower_name = name.downcase
				next if lower_name == "href" && v.start_with?(/\s*javascript:/i)

				if HTML::EVENT_ATTRIBUTES[lower_name] || name.match?(/[<>&"']/)
	with "naughty javascript links" do
		view do
			def template
				a(href: "javascript:alert(1)") { "a" }
				a(href: "JAVASCRIPT:alert(1)") { "b" }
				a(href: :"JAVASCRIPT:alert(1)") { "c" }
				a(HREF: "javascript:alert(1)") { "d" }
			end
		end

		it "removes the href attributes" do
			expect(output).to be == "<a>a</a><a>b</a><a>c</a><a>d</a>"
		end
	end

	with "naughty uppercase event tag" do
		view do
			def template
				button ONCLICK: "ALERT(1)" do
					"naughty button"
				end
			end
		end

		it "raises" do
			expect { output }.to raise_exception ArgumentError,
				message: be == "Unsafe attribute name detected: ONCLICK."
		end
	end
CVE-2021-31590 (JavaScript, published 2021-07-19T20:15Z)
Description: value: PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pwndoc/pwndoc
Files changed:
.gitignore
backend/src/app.js
backend/src/config/config.json
backend/src/lib/auth.js
backend/src/lib/report-generator.js
backend/src/routes/settings.js
docker-compose.yml
docs/roles.md
Commit message: Update JWT generation

JWT is now dynamic
config files have moved


Vulnerable code:
var config = require('./config.json')[env];
        }
}
// Secret for JWT tokens creation (make it dynamic for production)
var jwtSecret = "ASy4FVjsXNLQl09LbieroWsjO5UXjvX5";
exports.jwtSecret = jwtSecret;
    var customRoles = require('./roles.json')}
var reportConfig = require('./report.json');
    var settings = JSON.parse(fs.readFileSync(`${__basedir}/lib/app-settings.json`));
            var settings = JSON.parse(fs.readFileSync(`${__basedir}/lib/app-settings.json`))            
            fs.writeFileSync(`${__basedir}/lib/app-settings.json`, settingsString)
      - ./backend/src/lib:/app/src/lib
Custom roles can be defined in `backend/src/lib/roles.json`

Fixed code:

# Configuration files
config.json
report.json
var config = require('./config/config.json')[env];
        },
        "jwtSecret": "eb942782a7f0842c51b112d37ff2993de45307831eea267a3acc012bf7550711"
}
// Dynamic generation of JWT Secret if not exist (different for each environnment)
var fs = require('fs')
var env = process.env.NODE_ENV || 'dev'
var config = require('../config/config.json')

if (!config[env].jwtSecret) {
    config[env].jwtSecret = require('crypto').randomBytes(32).toString('hex')
    var configString = JSON.stringify(config, null, 4)
    fs.writeFileSync(`${__basedir}/config/config.json`, configString)
}

var jwtSecret = config[env].jwtSecret
exports.jwtSecret = jwtSecret
    var customRoles = require('../config/roles.json')}
var reportConfig = require('../config/report.json');
    var settings = JSON.parse(fs.readFileSync(`${__basedir}/config/app-settings.json`));
            var settings = JSON.parse(fs.readFileSync(`${__basedir}/config/app-settings.json`))            
            fs.writeFileSync(`${__basedir}/config/app-settings.json`, settingsString)
      - ./backend/src/config:/app/src/config
Custom roles can be defined in `backend/src/config/roles.json`
CVE-2013-4701 (PHP, published 2013-08-21T16:55Z)
Description: value: Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openid/php-openid
Files changed:
Auth/Yadis/XML.php
Commit message: disable external XML entities and libxml errors

thanks to Kousuke Ebihara for the report and patch.


Vulnerable code:
        if (!@$this->doc->loadXML($xml_string)) {

Fixed code:
        // disable external entities and libxml errors
        $loader = libxml_disable_entity_loader(true);
        $errors = libxml_use_internal_errors(true);
        $parse_result = @$this->doc->loadXML($xml_string);
        libxml_disable_entity_loader($loader);
        libxml_use_internal_errors($errors);

        if (!$parse_result) {
CVE-2021-28379 (PHP, published 2021-03-15T06:15Z)
Description: value: web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/myvesta/vesta
Files changed:
web/upload/UploadHandler.php
Commit message: Preventing uploads from other origin

Credits to:  Fady Othman, Security Consultant # ZINAD IT

Vulnerable code:

Fixed code:
$hostname = exec('hostname');
$port = $_SERVER['SERVER_PORT'];
$expected_http_origin="https://".$hostname.":".$port;
if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
    die ("Nope.");
}
CVE-2021-46850 (Other, published 2022-10-24T14:15Z)
Description: value: myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/myvesta/vesta
Files changed:
bin/v-activate-vesta-license
Commit message: Checking licence format

Credits to:  @numanturle Numan Türle

Vulnerable code:

Fixed code:
is_user_format_valid "$license" "license"
CVE-2013-4623 (Other, published 2013-09-30T22:55Z)
Description: value: The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/polarssl/polarssl
Files changed:
ChangeLog
include/polarssl/x509.h
library/ssl_tls.c
Commit message: ssl_parse_certificate() now calls x509parse_crt_der() directly


Vulnerable code:
        ret = x509parse_crt( ssl->session_negotiate->peer_cert, ssl->in_msg + i,
                             n );

Fixed code:
   * ssl_parse_certificate() now calls x509parse_crt_der() directly
     instead of the x509parse_crt() wrapper that can also parse PEM
	 certificates
/**
 * \brief          Parse a single DER formatted certificate and add it
 *                 to the chained list.
 *
 * \param chain    points to the start of the chain
 * \param buf      buffer holding the certificate DER data
 * \param buflen   size of the buffer
 *
 * \return         0 if successful, or a specific X509 or PEM error code
 */
int x509parse_crt_der( x509_cert *chain, const unsigned char *buf, size_t buflen );

        ret = x509parse_crt_der( ssl->session_negotiate->peer_cert,
                                 ssl->in_msg + i, n );