hitoshura25/cvefixes huggingface dataset:
CVE-2018-17293 (C++, published 2018-09-21T07:29Z)
Description: value: An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of service (application crash by NULL pointer dereference) or possibly have unspecified other impact by crafting certain WebAssembly files.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/WAVM/WAVM
Files changed:
Programs/wavm/wavm.cpp
Commit message: Fix dereferencing null pointer when running wavm with WebAssembly main function that takes command-line arguments but no Emscripten memory to write them to


Vulnerable code:
			MemoryInstance* defaultMemory = Runtime::getDefaultMemory(moduleInstance);
			if(!defaultMemory)
			std::vector<const char*> argStrings;
			argStrings.push_back(options.filename);
			char** args = options.args;
			while(*args) { argStrings.push_back(*args++); };

			Emscripten::injectCommandArgs(emscriptenInstance, argStrings, invokeArgs);

Fixed code:
			if(!emscriptenInstance)
			else
			{
				std::vector<const char*> argStrings;
				argStrings.push_back(options.filename);
				char** args = options.args;
				while(*args) { argStrings.push_back(*args++); };
				wavmAssert(emscriptenInstance);
				Emscripten::injectCommandArgs(emscriptenInstance, argStrings, invokeArgs);
			}
CVE-2024-39326 (Unknown, published 2024-07-02T21:15Z)
Description: value: SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint 
`/admin/projects/{projectname}/skills/{skillname}/video` (and probably others) is open to a cross-site request forgery (CSRF) vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content type that can be exploited (multipart file upload), makes a state change and has no CSRF mitigations in place (samesite flag, CSRF token). It is possible to perform a CSRF attack against a logged in admin account, allowing an attacker that can target a logged in admin of Skills Service to modify the videos, captions, and text of the skill. Version 2.12.6 contains a patch for this issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/NationalSecurityAgency/skills-service
Files changed:
Commit message: Merge pull request #2600 from NationalSecurityAgency/csrf_fix

Csrf fix

Vulnerable code:

Fixed code:
CVE-2022-41920 (Go, published 2022-11-17T18:15Z)
Description: value: Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/duke-git/lancet
Files changed:
fileutil/file.go
Commit message: fix: issue#62: fix ZipSlip bug


Vulnerable code:
	destPath = filepath.Clean(destPath) + string(os.PathSeparator)
		if !strings.HasPrefix(path, destPath) {
			return fmt.Errorf("%s: illegal file path", path)

Fixed code:
		path, err := safeFilepathJoin(destPath, f.Name)
		if err != nil {
			return err
func safeFilepathJoin(path1, path2 string) (string, error) {
	relPath, err := filepath.Rel(".", path2)
	if err != nil || strings.HasPrefix(relPath, "..") {
		return "", fmt.Errorf("(zipslip) filepath is unsafe %q: %v", path2, err)
	}
	if path1 == "" {
		path1 = "."
	}
	return filepath.Join(path1, filepath.Join("/", relPath)), nil
}
CVE-2014-8990 (Lua, published 2014-12-05T16:59Z)
Description: value: default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/axkibe/lsyncd
Files changed:
default-rsyncssh.lua
Commit message: Properly sanitize mv parameters (CVE-2014-8990)

When using -rsyncssh option, some filenames
could -in addition of not syncing correctly-
crash the service and execute arbitrary commands
under the credentials of the remote user.

These issues have been assigned CVE-2014-8990

This commit fixes the incomplete and lua5.2-incompatible
sanitization performed by 18f02ad0

Signed-off-by: Sven Schwedas <sven.schwedas@tao.at>


Vulnerable code:
		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
			'\"' .. config.targetdir .. path1 .. '\"',
			'\"' .. config.targetdir .. path2 .. '\"',
			'\"' .. config.targetdir .. path1 .. '\"'

Fixed code:
		local path1 = config.targetdir .. event.path
		local path2 = config.targetdir .. event2.path
		path1 = "'" .. path1:gsub ('\'', '\'"\'"\'') .. "'"
		path2 = "'" .. path2:gsub ('\'', '\'"\'"\'') .. "'"
			path1,
			path2,
			path1
CVE-2014-8990 (Lua, published 2014-12-05T16:59Z)
Description: value: default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/axkibe/lsyncd
Files changed:
default-rsyncssh.lua
Commit message: Sanitize mv arguments:

1. Fixes crashes on file names containing `, $ or "
2. Also prevents shell execution of ``, $() … in file names, which can be
   used to gain remote shell access as lsyncd's (target) user.


Vulnerable code:
			'\"' .. config.targetdir .. event.path .. '\"',
			'\"' .. config.targetdir .. event2.path .. '\"',
			'\"' .. config.targetdir .. event.path .. '\"'

Fixed code:
		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
			'\"' .. config.targetdir .. path1 .. '\"',
			'\"' .. config.targetdir .. path2 .. '\"',
			'\"' .. config.targetdir .. path1 .. '\"'
CVE-2015-10015 (Unknown, published 2023-01-05T15:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named bc0f19965f760587645583b7624d66a260946e01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217487.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glidernet/ogn-live
Files changed:
Commit message: Merge pull request #11 from dbursem/master

Fixed SQL injection vulnerabilities by using PDO statements

Vulnerable code:

Fixed code:
CVE-2023-47114 (Python, published 2023-11-08T22:15Z)
Description: value: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. This vulnerability has been patched in version 2.23.3.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ethyca/fides
Files changed:
CHANGELOG.md
src/fides/api/service/privacy_request/dsr_package/dsr_report_builder.py
Commit message: Merge pull request from GHSA-3vpf-mcj7-5h38

* feat: give the option to escape HTML in templates

* fix: escape HTML in HTML DSR reports

* fix: static checks

* feat: use Jinja autoescape

* docs: update changelog

Vulnerable code:
        self.template_loader = Environment(loader=FileSystemLoader(DSR_DIRECTORY))
        return template.render(report_data)

Fixed code:


- Fix an HTML Injection vulnerability in DSR Packages
        self.template_loader = Environment(
            loader=FileSystemLoader(DSR_DIRECTORY), autoescape=True
        )
        rendered_template = template.render(report_data)
        return rendered_template
CVE-2024-38537 (Markdown, published 2024-07-02T20:15Z)
Description: value: Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the `polyfill.io` domain when the domain was compromised and serving malware. No exploitation of `fides.js` via `polyfill.io` has been identified as of time of publication.

The vulnerability has been patched in Fides version `2.39.1`. Users are advised to upgrade to this version or later to secure their systems against this threat. On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure `polyfill.io` and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable. Prior to the domain level intervention, there were no server-side workarounds and the confidentiality, integrity, and availability impacts of this vulnerability were high. Clients could ensure they were not affected by using a modern browser that supported the fetch standard.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ethyca/fides
Files changed:
CHANGELOG.md
clients/privacy-center/pages/api/fides-js.ts
Commit message: Remove fetch polyfill from FidesJS (#5026)



Vulnerable code:


### Changed
    // This polyfill service adds a fetch polyfill only when needed, depending on browser making the request
    if (!window.fetch) {
      var script = document.createElement('script');
      script.src = 'https://polyfill.io/v3/polyfill.min.js?features=fetch';
      document.head.appendChild(script);
    }


Fixed code:
### Removed
- Removed the `fetch` polyfill from FidesJS (#5026)[https://github.com/ethyca/fides/pull/5026]
CVE-2022-29810 (Go, published 2022-04-27T06:15Z)
Description: value: The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/hashicorp/go-getter
Files changed:
.gitignore
url.go
url_test.go
Commit message: Redact SSH key from URL query parameter

Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>


Vulnerable code:
		ru.User = url.UserPassword(ru.User.Username(), "xxxxx")
			want: "http://user:xxxxx@host.tld/this:that",
			want: "http://:xxxxx@host.tld/this:that",

Fixed code:
cmd/go-getter/go-getter
		ru.User = url.UserPassword(ru.User.Username(), "redacted")
	}
	q := ru.Query()
	if q.Get("sshkey") != "" {
		q.Set("sshkey", "redacted")
		ru.RawQuery = q.Encode()
			want: "http://user:redacted@host.tld/this:that",
			want: "http://:redacted@host.tld/this:that",
		{
			name: "non-blank SSH key in URL query parameter",
			url: &url.URL{
				Scheme:   "ssh",
				User:     url.User("git"),
				Host:     "github.com",
				Path:     "hashicorp/go-getter-test-private.git",
				RawQuery: "sshkey=LS0tLS1CRUdJTiBPUE",
			},
			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=redacted",
		},
		{
			name: "blank SSH key in URL query parameter",
			url: &url.URL{
				Scheme:   "ssh",
				User:     url.User("git"),
				Host:     "github.com",
				Path:     "hashicorp/go-getter-test-private.git",
				RawQuery: "sshkey=",
			},
			want: "ssh://git@github.com/hashicorp/go-getter-test-private.git?sshkey=",
		},
CVE-2021-41274 (Ruby, published 2021-11-17T20:15Z)
Description: value: solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `solidus_auth_devise` are affected if `protect_from_forgery` method is both: Executed whether as: A `before_action` callback (the default) or A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find). Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`). Users should promptly update to `solidus_auth_devise` version `2.5.4`. Users unable to update should if possible, change their strategy to `:exception`. Please see the linked GHSA for more workaround details.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/solidusio/solidus_auth_devise
Files changed:
lib/controllers/frontend/spree/users_controller.rb
Commit message: Merge pull request from GHSA-xm34-v85h-9pg2

Fix account takeover through CSRF attack

Vulnerable code:
   prepend_before_action :load_object, only: [:show, :edit, :update]

Fixed code:
     load_object
CVE-2023-52079 (JavaScript, published 2023-12-28T16:16Z)
Description: value: msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1.  
Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/kriszyp/msgpackr
Files changed:
unpack.js
Commit message: Ensure that string conversion doesn't recursively join or execute code


Vulnerable code:
		return read().toString()
	let structure = read().map(property => property.toString()) // ensure that all keys are strings and that the array is mutable

Fixed code:
		return asSafeString(read())
function asSafeString(property) {
	if (typeof property === 'string') return property;
	if (typeof property === 'number') return property.toString();
	throw new Error('Invalid property type for record', typeof property);
}
	let structure = read().map(asSafeString) // ensure that all keys are strings and
	// that the array is mutable
CVE-2021-32782 (JavaScript, published 2021-09-07T20:15Z)
Description: value: Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nextcloud/circles
Files changed:
js/files/circles.files.list.js
Commit message: escapeHTML when browsing shared files

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>

Vulnerable code:
					return circle.name;
					return circle.name;
					//return OC.SystemTags.getDescriptiveTag(tag)[0].outerHTML;

Fixed code:


function escapeHTML(text) {
	return text.toString()
		.split('&').join('&amp;')
		.split('<').join('&lt;')
		.split('>').join('&gt;')
		.split('"').join('&quot;')
		.split('\'').join('&#039;')
}

					return escapeHTML(circle.name);
					return escapeHTML(circle.name);
CVE-2021-23490 (JavaScript, published 2021-12-24T20:15Z)
Description: value: The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/thlorenz/parse-link-header
Files changed:
README.md
index.js
test/parse-link-header.js
Commit message: Limit linkHeader length, throw error if exceeds (#25)

* Limit linkheader length, add checkHeader func, update documentation

* indentation

Vulnerable code:
  if (!linkHeader) return null;

Fixed code:
### Environmental Variables

To avoid redundantly parsing of extremely long (invalid) input, the package uses 2 env variabes:

`PARSE_LINK_HEADER_MAXLEN` - Sets the number of characters the input should be limited to - longer inputs will not be handled. Defaults to `2000`.

`PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED` - Defines behavior for when the `PARSE_LINK_HEADER_MAXLEN` parameter is exceeded. if defined, an error will be thrown; if it's `null`, the function fails silently by returning `null`. Defaults to `null`.

const PARSE_LINK_HEADER_MAXLEN = parseInt(process.env.PARSE_LINK_HEADER_MAXLEN) || 2000;
const PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED = process.env.PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED != null

function checkHeader(linkHeader){
  if (!linkHeader) return false;

  if (linkHeader.length > PARSE_LINK_HEADER_MAXLEN) {
    if (PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED) {
      throw new Error('Input string too long, it should be under ' + PARSE_LINK_HEADER_MAXLEN + ' characters.');
    } else {
        return false;
      }
  }
  return true;
}

  if (!checkHeader(linkHeader)) return null;

test('parsing an extremely long link header', function (t) {
  function payload (n) {
    var ret = ""
    for (var i = 0; i < n; i++) {
      ret += " "
    }
    return ret
    }
  var linkHeader = '; rel="' + payload(10000) + '",'

  t.equal(
      parse(linkHeader)
    , null
    , 'correctly returns null when dealing with an extremely long link header'
  )
  t.end()
})
CVE-2012-6084 (C, published 2013-01-01T15:55Z)
Description: value: modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability negotiation during server handshakes, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/atheme/charybdis
Files changed:
modules/m_capab.c
Commit message: m_capab: fix a possible remote crash triggered by the CAPAB parsing code.


Vulnerable code:
	{{mr_capab, 0}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}

Fixed code:
	{{mr_capab, 2}, mg_ignore, mg_ignore, mg_ignore, mg_ignore, mg_ignore}