hitoshura25/cvefixes huggingface dataset:
CVE-2014-0086 (Java, published 2014-03-31T14:58Z)
Description: value: The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/pslegr/core-1
Files changed:
impl/src/main/java/org/richfaces/webapp/PushHandlerFilter.java
Commit message: RF-13250: applying patch

Vulnerable code:
                Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);


Fixed code:
                Meteor meteor = Meteor.build(httpReq, SCOPE.REQUEST, Collections.<BroadcastFilter>emptyList(), null);
CVE-2015-10081 (PHP, published 2023-02-20T17:15Z)
Description: value: A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The patch is named a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/arnoldle/phplist-plugin-submitByMailPlugin
Files changed:
plugins/submitByMailPlugin.php
plugins/submitByMailPlugin/edit_list.php
Commit message: Added csrf prevention to edit_list.php


Vulnerable code:
 * submitByMail plugin version 1.0b2.9
    public $version = '1.0b2.9';

Fixed code:
 * submitByMail plugin version 1.0b2.9a
    public $version = '1.0b2.9a';
verifyCsrfGetToken();	// Prevent cross-site request forgery
CVE-2015-10118 (Other, published 2023-06-12T07:15Z)
Description: value: A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0. This vulnerability affects the function CopyProtect_options_page of the file wp-copyprotect.php. The manipulation of the argument CopyProtect_nrc_text leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.1.0 is able to address this issue. The patch is identified as 8b8fe4102886b326330dc1ff06b17313fb10aee5. It is recommended to upgrade the affected component. VDB-231202 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/wp-copyprotect
Files changed:
readme.txt
wp-copyprotect.php
Commit message: Sanitising user input for protection. Avoiding XSS attacks. Reference: https://codex.wordpress.org/Function_Reference/sanitize_text_field


git-svn-id: https://plugins.svn.wordpress.org/wp-copyprotect/trunk@1186194 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Stable tag: 3.0.0
== Changelog ==
Version: 3.0.0
Copyright (C) 2013  Chetan Gole - chetangole.com
***   COPY PROTECTED BY CHETANGOLE.COM/BLOG/WP-COPYPROTECT   version 3.0.0 ****
***   COPY PROTECTED BY CHETANGOLE.COM/BLOG/WP-COPYPROTECT   version 3.0.0 ****
***   COPY PROTECTED BY CHETANGOLE.COM/BLOG/WP-COPYPROTECT   version 3.0.0 ****
		update_option('CopyProtect_nrc_text',$_POST['CopyProtect_nrc_text']);
		echo '<div class="updated"><p>Settings saved</p></div>';

Fixed code:
Stable tag: 3.1.0
== Changelog ==
= ver : 3.1.0 =
 1. Sanitising user input for protection. Avoiding XSS attacks. Reference: https://codex.wordpress.org/Function_Reference/sanitize_text_field
Version: 3.1.0
Copyright (C) 2015  Chetan Gole - chetangole.com
***   COPY PROTECTED BY http://chetangole.com/blog/wp-copyprotect/   version 3.1.0 ****
***   COPY PROTECTED BY http://chetangole.com/blog/wp-copyprotect/   version 3.1.0 ****
***   COPY PROTECTED BY http://chetangole.com/blog/wp-copyprotect/   version 3.1.0 ****
		update_option('CopyProtect_nrc_text', sanitize_text_field($_POST['CopyProtect_nrc_text']));
		echo '<div class="updated"><p>Settings saved, Please clear/update cache if you are using any cache plugin</p></div>';
CVE-2022-0936 (Ruby, published 2022-04-11T07:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/autolab/autolab
Files changed:
app/controllers/attachments_controller.rb
Commit message: Force download of attachments (#1490)

* Rubocop fix

* resolve merge

* restore gemfile

* restore nl

Vulnerable code:
                        type: @attachment.mime_type, filename: @attachment.filename) && return

Fixed code:
    # Set to application/octet-stream to force download
                        type: "application/octet-stream", filename: @attachment.filename) && return
CVE-2018-17942 (C, published 2018-10-03T08:29Z)
Description: value: The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/coreutils/gnulib
Files changed:
ChangeLog
lib/vasnprintf.c
tests/test-vasnprintf.c
Commit message: vasnprintf: Fix heap memory overrun bug.

Reported by Ben Pfaff <blp@cs.stanford.edu> in
<https://lists.gnu.org/archive/html/bug-gnulib/2018-09/msg00107.html>.

* lib/vasnprintf.c (convert_to_decimal): Allocate one more byte of
memory.
* tests/test-vasnprintf.c (test_function): Add another test.


Vulnerable code:
  char *c_ptr = (char *) malloc (xsum (c_len, extra_zeroes));
      if (size < 6)

Fixed code:
2018-09-23  Bruno Haible  <bruno@clisp.org>

	vasnprintf: Fix heap memory overrun bug.
	Reported by Ben Pfaff <blp@cs.stanford.edu> in
	<https://lists.gnu.org/archive/html/bug-gnulib/2018-09/msg00107.html>.
	* lib/vasnprintf.c (convert_to_decimal): Allocate one more byte of
	memory.
	* tests/test-vasnprintf.c (test_function): Add another test.

  /* We need extra_zeroes bytes for zeroes, followed by c_len bytes for the
     digits of a, followed by 1 byte for the terminating NUL.  */
  char *c_ptr = (char *) malloc (xsum (xsum (extra_zeroes, c_len), 1));
      if (size < 5 + 1)
        ASSERT (result != buf);
      ASSERT (memcmp (buf + size, &"DEADBEEF"[size], 8 - size) == 0);
      if (result != buf)
        free (result);
    }

  /* Note: This test assumes IEEE 754 representation of 'double' floats.  */
  for (size = 0; size <= 8; size++)
    {
      size_t length;
      char *result;

      memcpy (buf, "DEADBEEF", 8);
      length = size;
      result = my_asnprintf (buf, &length, "%2.0f", 1.6314159265358979e+125);
      ASSERT (result != NULL);
      ASSERT (strcmp (result, "163141592653589790215729350939528493057529598899734151772468186268423257777068536614838678161083520756952076273094236944990208") == 0);
      ASSERT (length == 126);
      if (size < 126 + 1)
CVE-2020-7609 (JavaScript, published 2020-04-27T22:15Z)
Description: value: node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/mithunsatheesh/node-rules
Files changed:
lib/node-rules.js
Commit message: Remove fromJSON and toJSON from exposed APIs

Remove fromJSON and toJSON from exposed APIs in V5.0.0

Vulnerable code:
    RuleEngine.prototype.toJSON = function() {
        var rules = this.rules;
        if (rules instanceof Array) {
            rules = rules.map(function(rule) {
                rule.condition = rule.condition.toString();
                rule.consequence = rule.consequence.toString();
                return rule;
            });
        } else if (typeof(rules) != "undefined") {
            rules.condition = rules.condition.toString();
            rules.consequence = rules.consequence.toString();
        }
        return rules;
    };
    RuleEngine.prototype.fromJSON = function(rules) {
        this.init();
        if (typeof(rules) == "string") {
            rules = JSON.parse(rules);
        }
        if (rules instanceof Array) {
            rules = rules.map(function(rule) {
                rule.condition = eval("(" + rule.condition + ")");
                rule.consequence = eval("(" + rule.consequence + ")");
                return rule;
            });
        } else if (rules !== null && typeof(rules) == "object") {
            rules.condition = eval("(" + rules.condition + ")");
            rules.consequence = eval("(" + rules.consequence + ")");
        }
        this.register(rules);
    };

Fixed code:
CVE-2021-3839 (C, published 2022-08-23T16:15Z)
Description: value: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DPDK/dpdk
Files changed:
lib/vhost/vhost_user.c
Commit message: vhost: fix queue number check when setting inflight FD

In function vhost_user_set_inflight_fd, queue number in inflight
message is used to access virtqueue. However, queue number could
be larger than VHOST_MAX_VRING and cause write OOB as this number
will be used to write inflight info in virtqueue structure. This
patch checks the queue number to avoid the issue and also make
sure virtqueues are allocated before setting inflight information.

Fixes: ad0a4ae491fe ("vhost: checkout resubmit inflight information")
Cc: stable@dpdk.org

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>


Vulnerable code:

Fixed code:
	case VHOST_USER_SET_INFLIGHT_FD:
		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
		break;
CVE-2021-3839 (C, published 2022-08-23T16:15Z)
Description: value: A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/DPDK/dpdk
Files changed:
lib/vhost/vhost_user.c
Commit message: vhost: fix queue number check when setting inflight FD

In function vhost_user_set_inflight_fd, queue number in inflight
message is used to access virtqueue. However, queue number could
be larger than VHOST_MAX_VRING and cause write OOB as this number
will be used to write inflight info in virtqueue structure. This
patch checks the queue number to avoid the issue and also make
sure virtqueues are allocated before setting inflight information.

Fixes: ad0a4ae491fe ("vhost: checkout resubmit inflight information")
Cc: stable@dpdk.org

Reported-by: Wenxiang Qian <leonwxqian@gmail.com>
Signed-off-by: Chenbo Xia <chenbo.xia@intel.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>


Vulnerable code:

Fixed code:
	case VHOST_USER_SET_INFLIGHT_FD:
		vring_idx = ctx->msg.payload.inflight.num_queues - 1;
		break;
CVE-2022-0669 (C, published 2022-08-29T15:15Z)
Description: value: A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/DPDK/dpdk
Files changed:
lib/vhost/vhost_user.c
Commit message: vhost: fix FD leak with inflight messages

Even if unlikely, a buggy vhost-user master might attach fds to inflight
messages. Add checks like for other types of vhost-user messages.

Fixes: d87f1a1cb7b6 ("vhost: support inflight info sharing")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>


Vulnerable code:

Fixed code:
	if (validate_msg_fds(dev, ctx, 0) != 0)
		return RTE_VHOST_MSG_RESULT_ERR;

	if (validate_msg_fds(dev, ctx, 1) != 0)
		return RTE_VHOST_MSG_RESULT_ERR;
CVE-2021-36219 (Unknown, published 2021-09-27T14:15Z)
Description: value: An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign that frees a non-initialized pointer from the stack. An attacker can chain multiple enclave calls to prepare a stack that contains a valid address. This address is then freed, resulting in compromised integrity of the enclave. This was resolved after v1.58.3 and not reproducible in sgxwallet v1.77.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/skalenetwork/sgxwallet
Files changed:
Commit message: Merge branch 'develop' into SKALE-1180-VERIFY-ECDSA

# Conflicts:
#	SGXWALLET_VERSION


Vulnerable code:

Fixed code:
CVE-2024-28113 (Python, published 2024-03-12T20:15Z)
Description: value: Peering Manager is a BGP session management tool. In Peering Manager <=1.8.2, it is possible to redirect users to an arbitrary page using a crafted url. As a result users can be redirected to an unexpected location. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/peering-manager/peering-manager
Files changed:
utils/views.py
Commit message: Make sure URL is not absolute before redirecting


Vulnerable code:
        # data, use this URL only if it's safe
        if return_url and return_url.startswith("/"):

Fixed code:
from urllib.parse import urlparse

        # data, use this URL only if it's not absolute
        if return_url and not bool(urlparse(return_url).netloc):
CVE-2024-28114 (Python, published 2024-03-12T20:15Z)
Description: value: Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/peering-manager/peering-manager
Files changed:
docs/templating/index.md
peering_manager/jinja2/__init__.py
Commit message: Run Jinja2 code in sandboxed environment

Also warn user in the documentation about security risks when using code
from others.


Vulnerable code:
    from jinja2 import Environment, TemplateSyntaxError
    environment = Environment(

Fixed code:
!!! warning
    Even though Peering Manager uses a sandboxed environment to run Jinja2
    logic, the language is powerful enough to do things that can potentially
    leak confidential details or even harm the machine. Be extremely careful
    when using code from someone else.

    from jinja2 import TemplateSyntaxError
    from jinja2.sandbox import SandboxedEnvironment
    environment = SandboxedEnvironment(
CVE-2022-0224 (PHP, published 2022-01-14T18:15Z)
Description: value: dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
htdocs/compta/sociales/list.php
test/phpunit/CodingPhpTest.php
Commit message: Fix #hunterf1d1ce3e-ca92-4c7b-b1b8-934e28eaa486

Conflicts:
	test/phpunit/CodingPhpTest.php


Vulnerable code:
	$sql .= ' AND cs.fk_user IN('.implode(', ', $search_users).')';
			// Check string 'IN (".xxx' or 'IN (\'.xxx'  with xxx that is not '$this->db->sanitize' and not '$db->sanitize'. It means we forget a db->sanitize when forging sql request.
			preg_match_all('/ IN \([\'"]\s*\.\s*(.........)/i', $filecontent, $matches, PREG_SET_ORDER);
			// Check string 'IN (\'".xxx'   with xxx that is not '$this->db->sanitize' and not '$db->sanitize'. It means we forget a db->sanitize when forging sql request.
			preg_match_all('/ IN \(\'"\s*\.\s*(.........)/i', $filecontent, $matches, PREG_SET_ORDER);

Fixed code:
	$sql .= ' AND cs.fk_user IN ('.$db->sanitize(implode(', ', $search_users)).')';
			// Checks with IN

			// Check string ' IN (".xxx' or ' IN (\'.xxx'  with xxx that is not '$this->db->sanitize' and not '$db->sanitize'. It means we forget a db->sanitize when forging sql request.
			$ok=true;
			$matches=array();
			preg_match_all('/\s+IN\s*\([\'"]\s*\.\s*(.........)/i', $filecontent, $matches, PREG_SET_ORDER);
				//var_dump($val);
			// Check string ' IN (\'".xxx'   with xxx that is not '$this->db->sanitize' and not '$db->sanitize'. It means we forget a db->sanitize when forging sql request.
			$ok=true;
			$matches=array();
			preg_match_all('/\s+IN\s*\(\'"\s*\.\s*(.........)/i', $filecontent, $matches, PREG_SET_ORDER);
				//var_dump($val);
CVE-2022-0746 (PHP, published 2022-02-25T09:15Z)
Description: value: Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
htdocs/user/card.php
Commit message: Fix #hunterb812ea22-0c02-46fe-b89f-04519dfb1ebd

Vulnerable code:
				$object->login = GETPOST("login", 'alphanohtml');
				if (!empty($user->admin)) {
					$object->admin = GETPOST("admin", "int"); // admin flag can only be set/unset by an admin user. A test is also done later when forging sql request
						print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=password">'.$langs->trans("ReinitPassword").'</a></div>';
							print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&amp;action=passwordsend">'.$langs->trans("SendNewPassword").'</a></div>';
					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?action=disable&id='.$object->id.'&token='.newToken().'">'.$langs->trans("DisableUser").'</a></div>';

Fixed code:
				if (!empty($user->admin)) { 	// admin flag can only be set/unset by an admin user. A test is also done later when forging sql request
					$object->admin = GETPOST("admin", "int");
				}
				if ($user->admin && !$object->ldap_sid) {	// same test than on edit page
					$object->login = GETPOST("login", 'alphanohtml');
						print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=password&token='.newToken().'">'.$langs->trans("ReinitPassword").'</a></div>';
							print '<div class="inline-block divButAction"><a class="butAction" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=passwordsend&token='.newToken().'">'.$langs->trans("SendNewPassword").'</a></div>';
					print '<div class="inline-block divButAction"><a class="butActionDelete" href="'.$_SERVER['PHP_SELF'].'?id='.$object->id.'&action=disable&token='.newToken().'">'.$langs->trans("DisableUser").'</a></div>';
CVE-2022-2060 (Unknown, published 2022-06-13T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
Commit message: Merge branch 'develop' of git@github.com:Dolibarr/dolibarr.git into develop

Vulnerable code:

Fixed code: