hitoshura25/cvefixes huggingface dataset:
CVE-2024-28245 (JavaScript, published 2024-03-25T20:15Z)
Description: value: KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/KaTeX/KaTeX
Files changed:
src/domTree.js
test/katex-spec.js
Commit message: fix: escape \includegraphics src and alt


Vulnerable code:
        let markup = `<img  src='${this.src} 'alt='${this.alt}' `;
                markup += ` ${attr}='${this.attributes[attr]}'`;
            return `<path d='${this.alternate}'/>`;
            return `<path d='${path[this.pathName]}'/>`;
                markup += ` ${attr}='${this.attributes[attr]}'`;

Fixed code:
        let markup = `<img src="${utils.escape(this.src)}"` +
          ` alt="${utils.escape(this.alt)}"`;
                markup += ` ${attr}="${utils.escape(this.attributes[attr])}"`;
            return `<path d="${utils.escape(this.alternate)}"/>`;
            return `<path d="${utils.escape(path[this.pathName])}"/>`;
                markup += ` ${attr}="${utils.escape(this.attributes[attr])}"`;

    it("should escape source", () => {
        const built = katex.renderToString(
            "\\includegraphics{'\"}", trustSettings);
        expect(built).toContain('<img src="&#x27;&quot;"');
    });

    it("should escape alt", () => {
        const built = katex.renderToString(
            "\\includegraphics[alt='\"]{image.png}", trustSettings);
        expect(built).toContain('<img src="image.png" alt="&#x27;&quot;"');
    });
CVE-2021-21431 (Python, published 2021-04-09T16:15Z)
Description: value: sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that. Freenode is not affected. This is fixed in version 2.0.1. As a workaround, do not use this plugin on networks where TARGMAX > 1.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/MirahezeBots/sopel-channelmgnt
Files changed:
dev-requirements.txt
setup.py
sopel_channelmgnt/channelmgnt/__init__.py
Commit message: [SECURITY] Release 2.0.1 (#65)

Fixes CVE-2021-21431

Vulnerable code:
flake8-return==1.1.2
    version='2.0',
    author_email='bots@miraheze.org',

Fixed code:
#flake8-return==1.1.2
    version='2.0.1',
    author_email='staff@mirahezebots.org',
        if ',' in str(nick):
            return bot.reply('Unable to kick. Kicking multiple users is not allowed.')
        if '#' in str(nick):
            return bot.reply('Unable to kick. Use of # when kicking is not expected.')
    if ',' in str(parse_host_mask(trigger.group().split())):
        return bot.reply('Unable to ban. Banning multiple users is not allowed.')
    if '#' in str(parse_host_mask(trigger.group().split())):
        return bot.reply('Unable to ban. Use of # when banning is not expected.')
    if ',' in str(parse_host_mask(trigger.group().split())):
        return bot.reply('Unable to ban. Banning multiple users is not allowed.')
    if '#' in str(parse_host_mask(trigger.group().split())):
        return bot.reply('Unable to ban. Use of # when banning is not expected.')
        if ',' in str(nick):
            return bot.reply('Unable to kickban. Kickbanning multiple users is not allowed.')
        if '#' in str(nick):
            return bot.reply('Unable to kickban. Use of # when kickbanning is not expected.')
CVE-2024-1892 (Other, published 2024-02-28T00:15Z)
Description: value: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/scrapy/scrapy
Files changed:
docs/news.rst
Commit message: Merge branch '2.11-redos' into 2.11


Vulnerable code:

Fixed code:
 -   Addressed `ReDoS vulnerabilities`_:
 
     -   ``scrapy.utils.iterators.xmliter`` is now deprecated in favor of
         :func:`~scrapy.utils.iterators.xmliter_lxml`, which
         :class:`~scrapy.spiders.XMLFeedSpider` now uses.
 
         To minimize the impact of this change on existing code,
         :func:`~scrapy.utils.iterators.xmliter_lxml` now supports indicating
         the node namespace with a prefix in the node name, and big files with
         highly nested trees when using libxml2 2.7+.
 
     -   Fixed regular expressions in the implementation of the
         :func:`~scrapy.utils.response.open_in_browser` function.
 
     Please, see the `cc65-xxvf-f7r9 security advisory`_ for more information.
 
     .. _ReDoS vulnerabilities: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
     .. _cc65-xxvf-f7r9 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cc65-xxvf-f7r9
 
 -   Due to its `ReDoS vulnerabilities`_, ``scrapy.utils.iterators.xmliter`` is
     now deprecated in favor of :func:`~scrapy.utils.iterators.xmliter_lxml`,
     which :class:`~scrapy.spiders.XMLFeedSpider` now uses.
 
     To minimize the impact of this change on existing code,
     :func:`~scrapy.utils.iterators.xmliter_lxml` now supports indicating
     the node namespace as a prefix in the node name, and big files with highly
     nested trees when using libxml2 2.7+.
 
     Please, see the `cc65-xxvf-f7r9 security advisory`_ for more information.
CVE-2024-3572 (Other, published 2024-04-16T00:15Z)
Description: value: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. 
Severity: nan (CVSS v3 base score: )
Weakness: CWE-409 \u2014 Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Repository: https://github.com/scrapy/scrapy
Files changed:
docs/news.rst
Commit message: Merge branch '2.11-compression-bomb' into 2.11


Vulnerable code:

Fixed code:
 -   :setting:`DOWNLOAD_MAXSIZE` and :setting:`DOWNLOAD_WARNSIZE` now also apply
     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
     advisory`_ for more information.
 
     .. _7j7m-v7m3-jqm7 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7
 
 -   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, the
     deprecated ``scrapy.downloadermiddlewares.decompression`` module has been
     removed.
 
+
 -   :setting:`DOWNLOAD_MAXSIZE` and :setting:`DOWNLOAD_WARNSIZE` now also apply
     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
     advisory`_ for more information.
 
 -   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, use of the
     ``scrapy.downloadermiddlewares.decompression`` module is discouraged and
     will trigger a warning.
CVE-2024-3574 (Other, published 2024-04-16T00:15Z)
Description: value: In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/scrapy/scrapy
Files changed:
docs/news.rst
Commit message: Merge branch '2.11-authorization' into 2.11


Vulnerable code:
 Scrapy 2.11.1 (YYYY-MM-DD)

Fixed code:
 Scrapy 2.11.1 (unreleased)
+-   Security bug fixes.
+
+Security bug fixes
+~~~~~~~~~~~~~~~~~~
 
 -   The ``Authorization`` header is now dropped on redirects to a different
     domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
     information.
 
     .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
 
 
 .. _release-1.8.4:
 
 Scrapy 1.8.4 (unreleased)
 -------------------------
 
+**Security bug fixes:**
 
 -   The ``Authorization`` header is now dropped on redirects to a different
     domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
     information.
 
     .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
CVE-2023-26042 (Unknown, published 2023-02-27T15:15Z)
Description: value: Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Part-DB/Part-DB-server
Files changed:
Commit message: Merge pull request #225 from sascha988/patch-2

vulnerability XSS fix

Vulnerable code:

Fixed code:
CVE-2015-0856 (C++, published 2015-11-24T20:59Z)
Description: value: daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/sddm/sddm
Files changed:
src/daemon/Greeter.cpp
Commit message: Disable greeters from loading KDE's debug hander

Some themes may use KDE components which will automatically load KDE's
crash handler.

If the greeter were to then somehow crash, that would leave a crash
handler allowing other actions, albeit as the locked down SDDM user.

Only SDDM users using the breeze theme from plasma-workspace are
affected. Safest and simplest fix is to handle this inside SDDM
disabling kcrash via an environment variable for all future themes that
may use these libraries.

CVE-2015-0856


Vulnerable code:

Fixed code:

            //some themes may use KDE components and that will automatically load KDE's crash handler which we don't want
            //counterintuitively setting this env disables that handler
            env.insert(QStringLiteral("KDE_DEBUG"), QStringLiteral("1"));
CVE-2018-14345 (C++, published 2018-07-17T14:29Z)
Description: value: An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/sddm/sddm
Files changed:
src/daemon/Display.cpp
src/helper/backend/PamBackend.cpp
Commit message: Fix authentication when reusing an existing session

- Check the success value before unlocking the session
- Don't attempt to use the nonexistant "sddm-check" PAM service


Vulnerable code:
            connect(m_auth, &Auth::authentication, this, [=](){
        else if (m_app->session()->path().isEmpty())
            service = QStringLiteral("sddm-check");

Fixed code:
            connect(m_auth, &Auth::authentication, this, [=](const QString &, bool success){
                if(!success)
                    return;
CVE-2018-14345 (C++, published 2018-07-17T14:29Z)
Description: value: An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/sddm/sddm
Files changed:
src/daemon/Display.cpp
src/helper/backend/PamBackend.cpp
Commit message: Fix authentication when reusing an existing session

- Check the success value before unlocking the session
- Don't attempt to use the nonexistant "sddm-check" PAM service


Vulnerable code:
            connect(m_auth, &Auth::authentication, this, [=](){
        else if (m_app->session()->path().isEmpty())
            service = QStringLiteral("sddm-check");

Fixed code:
            connect(m_auth, &Auth::authentication, this, [=](const QString &, bool success){
                if(!success)
                    return;
CVE-2015-2298 (JavaScript, published 2018-01-12T17:29Z)
Description: value: node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/node/utils/ExportEtherpad.js
Commit message: oops, fix export with wildcards


Vulnerable code:
    db.findKeys("pad:"+padId+"*", null, function(err,records){

Fixed code:
    // Get the Pad
    db.findKeys("pad:"+padId, null, function(err,padcontent){
      if(!err){
        cb(err, padcontent);
      }
    })
  },
  function(padcontent,cb){

    db.findKeys("pad:"+padId+":*", null, function(err,records){
        for (var key in padcontent) { records.push(padcontent[key]);}
CVE-2015-3309 (JavaScript, published 2020-02-13T20:15Z)
Description: value: Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/node/utils/Minify.js
Commit message: dont allow directory traversal #2


Vulnerable code:
      filename = filename.replace(/\\/g, '/'); // Windows (safe generally?)

Fixed code:
CVE-2015-4085 (JavaScript, published 2017-09-07T20:29Z)
Description: value: Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/node/hooks/express/tests.js
Commit message: fix an issue in the path handling that allowed directory traversal


Vulnerable code:
    var filePath = path.normalize(npm.root + "/../tests/frontend/")
    filePath += subPath.replace("..", "");

Fixed code:
  var rootTestFolder = path.join(npm.root, "..", "/tests/frontend/");
    var filePath = path.normalize(path.join(rootTestFolder, subPath));
    // make sure we jail the paths to the test folder, otherwise serve index
    if (filePath.indexOf(rootTestFolder) !== 0) {
      filePath = path.normalize(path.join(rootTestFolder, "index.html"));
    }
CVE-2018-6834 (Unknown, published 2018-02-08T07:29Z)
Description: value: static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ether/etherpad-lite
Files changed:
Commit message: Merge pull request #3313 from rhelmer/sanitize-window-location

better sanitize window location in error messages

Vulnerable code:

Fixed code:
CVE-2018-6835 (Unknown, published 2018-02-08T07:29Z)
Description: value: node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ether/etherpad-lite
Files changed:
Commit message: Merge pull request #3314 from rhelmer/sanitize-jsonp

better sanitize jsonp

Vulnerable code:

Fixed code:
CVE-2018-9845 (JavaScript, published 2018-04-29T18:29Z)
Description: value: Etherpad Lite before 1.6.4 is exploitable for admin access.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-178 \u2014 Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/node/hooks/express/webaccess.js
Commit message: Update webaccess.js

Vulnerable code:
    if (req.path.indexOf('/admin') != 0) {

Fixed code:
    if (req.path.toLowerCase().indexOf('/admin') != 0) {
CVE-2019-18209 (HTML, published 2019-10-19T01:15Z)
Description: value: templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/templates/pad.html
Commit message: security: support for clean & safe error handling on IE 11

Added pad_utils sanitization for clean and safe error handling on browsers that
do not encode the path of the URL.

Edited by muxator based on https://github.com/ether/etherpad-lite/pull/3647,
to be able to apply the patch on develop (the PR was for master), and perform
minor cleanups (mainly spurious statements).

Closes #3647.


Vulnerable code:
                              + '<small>in '+ url +' (line '+ line +')</small></p>';

Fixed code:
            var padutils = require('../static/js/pad_utils').padutils;

                              + '<small>in '+ padutils.escapeHTML(url) +' (line '+ line +')</small></p>';
CVE-2020-22783 (JavaScript, published 2021-04-28T21:15Z)
Description: value: Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/node/db/SessionStore.js
Commit message: SessionStore: replace password with PASSWORD_HIDDEN when storing in db

Fixes #3421.


Vulnerable code:

Fixed code:
  // don't store passwords in DB
  if (sess.user && sess.user.password) {
    sess.user.password = "PASSWORD_HIDDEN";
  }
CVE-2021-34817 (JavaScript, published 2021-07-19T14:15Z)
Description: value: A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ether/etherpad-lite
Files changed:
src/static/js/chat.js
Commit message: escape userId before setting it as HTML attribute


Vulnerable code:

Fixed code:
      msg.userId = padutils.escapeHtml(msg.userId);