hitoshura25/cvefixes huggingface dataset:
CVE-2024-38367 (Ruby, published 2024-07-01T21:15Z)
Description: value: trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/CocoaPods/trunk.cocoapods.org
Files changed:
app/controllers/api/sessions_controller.rb
Commit message: Hardcode the trunk URL for prod sessions


Vulnerable code:
          url_template = "#{request.scheme}://#{request.host_with_port}/sessions/verify/%s"

Fixed code:
          url_template = ENV['RACK_ENV'] == 'test' ? "#{request.scheme}://#{request.host_with_port}/sessions/verify/%s" : 'https://trunk.cocoapods.org/sessions/verify/%s'
CVE-2013-10026 (PHP, published 2023-05-02T02:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/mail-subscribe-list
Files changed:
index.php
readme.txt
sml.php
Commit message: 2.1 Fix Vulnerability

git-svn-id: https://plugins.svn.wordpress.org/mail-subscribe-list/trunk@724718 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
													<td>'.$row->sml_name.'</td>
													<td>'.$row->sml_email.'</td>
Simple customisable plugin that displays a name/email form where visitors can submit their information, managable in the WordPress admin.
This is a **simple plugin** that allows visitors to enter their name and email address on your website, the visitos details are then added to the subscribers list which is available to view and modify in the WordPress admin area. 
Version: 2.0.9

Fixed code:
													<td>'.esc_js(esc_html($row->sml_name)).'</td>
  													<td>'.esc_js(esc_html($row->sml_email)).'</td>
Simple customisable plugin that displays a name/email form where visitors can submit their information, manageable in the WordPress admin.
This is a **simple plugin** that allows visitors to enter their name and email address on your website, the visitors details are then added to the subscribers list which is available to view and modify in the WordPress admin area. 
= 2.1

* Critical fix due to vulnerability found and fixed by Falcoz Kevin (aka 0pc0deFR). Thank you.

Version: 2.0.10
CVE-2020-7667 (Go, published 2020-06-24T12:15Z)
Description: value: In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/sassoftware/go-rpmutils
Files changed:
cpio/extract.go
cpio/extract_test.go
rpmutils_test.go
Commit message: Prevent cpio.Extract from writing into parent directories


Vulnerable code:
		target := path.Join(dest, path.Clean(entry.Header.filename))
		parent := path.Dir(target)

		if _, err := os.Stat(parent); os.IsNotExist(err) {
			if err := os.MkdirAll(parent, 0755); err != nil {
				return err
			}


Fixed code:
	"path/filepath"
	"strings"
// Extract the contents of a cpio stream from r to the destination directory dest
	dest = filepath.Clean(filepath.FromSlash(dest))
		// sanitize path
		target := path.Clean(entry.Header.filename)
		for strings.HasPrefix(target, "../") {
			target = target[3:]
		}
		target = filepath.Join(dest, filepath.FromSlash(target))
		if !strings.HasPrefix(target, dest+string(filepath.Separator)) && dest != target {
			// this shouldn't happen due to the sanitization above but always check
			return fmt.Errorf("invalid cpio path %q", entry.Header.filename)
		}
		parent := filepath.Dir(target)
		if err := os.MkdirAll(parent, 0755); err != nil {
			return err
	"path/filepath"
func TestExtractDotdot(t *testing.T) {
	setupLogging()
	f, err := os.Open("../testdata/dotdot.cpio")
	if err != nil {
		t.Fatal(err)
	}
	defer f.Close()
	tmpdir, err := ioutil.TempDir("", "cpio")
	if err != nil {
		t.Fatal(err)
	}
	defer os.RemoveAll(tmpdir)
	err = Extract(f, tmpdir)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(filepath.Join(tmpdir, "aaaaaaaaa")); err != nil {
		t.Error("expected file with ../ to extract into top of destdir:", err)
	}
}

	defer f.Close()
	defer f.Close()
	defer f.Close()
	defer os.RemoveAll(tmpdir)
CVE-2024-36405 (C, published 2024-06-10T13:15Z)
Description: value: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pq-crystals/kyber
Files changed:
ref/poly.c
ref/verify.c
ref/verify.h
Commit message: Fixed secret-dependent branch in poly_frommsg introduced by recent versions of clang with some flags (Thanks to Antoon Purnal for pointing this out!)


Vulnerable code:
  int16_t mask;
      mask = -(int16_t)((msg[i] >> j)&1);
      r->coeffs[8*i+j] = mask & ((KYBER_Q+1)/2);

Fixed code:
#include "verify.h"
      r->coeffs[8*i+j] = 0;
      cmov_int16(r->coeffs+8*i+j, ((KYBER_Q+1)/2), (msg[i] >> j)&1);


void cmov_int16(int16_t *r, int16_t v, uint16_t b)
{
  b = -b;
  *r ^= b & ((*r) ^ v);
}
#define cmov_int16 KYBER_NAMESPACE(cmov_int16)
void cmov_int16(int16_t *r, int16_t v, uint16_t b);
CVE-2024-37880 (C, published 2024-06-10T02:15Z)
Description: value: The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel that allows attackers to recover an ML-KEM 512 secret key in minutes. This occurs because poly_frommsg in poly.c does not prevent Clang from emitting a vulnerable secret-dependent branch.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/pq-crystals/kyber
Files changed:
ref/poly.c
ref/verify.c
ref/verify.h
Commit message: Fixed secret-dependent branch in poly_frommsg introduced by recent versions of clang with some flags (Thanks to Antoon Purnal for pointing this out!)


Vulnerable code:
  int16_t mask;
      mask = -(int16_t)((msg[i] >> j)&1);
      r->coeffs[8*i+j] = mask & ((KYBER_Q+1)/2);

Fixed code:
#include "verify.h"
      r->coeffs[8*i+j] = 0;
      cmov_int16(r->coeffs+8*i+j, ((KYBER_Q+1)/2), (msg[i] >> j)&1);


void cmov_int16(int16_t *r, int16_t v, uint16_t b)
{
  b = -b;
  *r ^= b & ((*r) ^ v);
}
#define cmov_int16 KYBER_NAMESPACE(cmov_int16)
void cmov_int16(int16_t *r, int16_t v, uint16_t b);
CVE-2022-29180 (Go, published 2022-05-07T04:15Z)
Description: value: A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven't been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/charmbracelet/charm
Files changed:
server/http.go
Commit message: fix: clean path before accessing file store


Vulnerable code:
	path := pattern.Path(r.Context())
	path := pattern.Path(r.Context())
	path := pattern.Path(r.Context())

Fixed code:
	"path/filepath"
	path := filepath.Clean(pattern.Path(r.Context()))
	path := filepath.Clean(pattern.Path(r.Context()))
	path := filepath.Clean(pattern.Path(r.Context()))
CVE-2009-10002 (JavaScript, published 2023-01-13T18:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr. This issue affects some unknown processing of the file fittr-flickr/features/easy-exif.js of the component EXIF Preview Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 08875dd8a2e5d0d16568bb0d67cb4328062fccde. It is recommended to apply a patch to fix this issue. The identifier VDB-218297 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dpup/fittr-flickr
Files changed:
fittr-flickr/api_relay.html
fittr-flickr/features/easy-exif.js
fittr-flickr/utils/dom.js
Commit message: A couple of potential security fixes.  Stop using innerHTML when building the EXIF preview, in theory someone could add malicious EXIF data and XSS.  Also, use JSON.parse instead of eval() to protect against MITM attacks.

Vulnerable code:
        response = eval('(' + xhr.responseText + ')');
          var html = '<table class="fittr-exif-table">';
              html += '<tr><td>' + item.label + '</td><td>' + value + '</td></tr>';
          html += '</table>';
          el.innerHTML = html;
        } else if (data.status == 200 && data.content.stat == 'fail') {
          el.innerHTML = '<i>Error loading EXIF : ' + data.content.message + '</i>';
          el.innerHTML = '<i>Error loading EXIF.</i>';
        }
function createEl(el) {
  return document.createElement(el); 

Fixed code:
        response = JSON.parse(xhr.responseText);
        el.innerHTML = '';
          var table = createEl('table', 'fittr-exif-table');
              var tr = createEl('tr');
              var td1 = createEl('td');
              td1.appendChild(createText(item.label));
              tr.appendChild(td1);
              var td2 = createEl('td');
              td2.appendChild(createText(value));
              tr.appendChild(td2);
              table.appendChild(tr);
          el.appendChild(table);
          var error = createEl('i');
          if (data.status == 200 && data.content.stat == 'fail') {
            error.appendChild(createText('Error loading EXIF : ' + data.content.message));
          } else {
            error.appendChild(createText('Error loading EXIF, status: ' + data.status));
          }
          el.appendChild(error);
        }  
function createEl(el, opt_className) {
  var el = document.createElement(el); 
  if (opt_className) el.className = opt_className;
  return el;
CVE-2012-4451 (Unknown, published 2020-01-03T17:15Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zendframework/zf2
Files changed:
Commit message: Merge branch 'security/escaper-usage'

Fixes a number of components that were not using Zend\Escaper to escape HTML,
HTML attributes, and/or URLs.


Vulnerable code:

Fixed code:
CVE-2020-15190 (Python, published 2020-09-25T19:15Z)
Description: value: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/common_runtime/eager/kernel_and_device.cc
tensorflow/python/kernel_tests/control_flow_ops_py_test.py
Commit message: Fix undefined behavior in `tf.raw_ops.Switch` in eager mode.

PiperOrigin-RevId: 332578058
Change-Id: I9727571d2f21476b10d8aa27c1b7176564b76ac9


Vulnerable code:
      outputs->push_back(Tensor(*context.mutable_output(i)));

Fixed code:
      const auto* output_tensor = context.mutable_output(i);
      if (output_tensor != nullptr) {
        outputs->push_back(Tensor(*output_tensor));
      } else {
        outputs->push_back(Tensor());
      }
  def testSwitchEagerMode(self):
    if not context.executing_eagerly():
      return
    input_data = [1, 2, 3, 4]
    vf, vt = control_flow_ops.switch(input_data, False)
    self.assertAllEqual(vf, input_data)
    self.assertAllEqual(vt, [])
CVE-2020-15190 (Python, published 2020-09-25T19:15Z)
Description: value: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/common_runtime/eager/kernel_and_device.cc
tensorflow/python/kernel_tests/control_flow_ops_py_test.py
Commit message: Fix undefined behavior in `tf.raw_ops.Switch` in eager mode.

PiperOrigin-RevId: 332578058
Change-Id: I9727571d2f21476b10d8aa27c1b7176564b76ac9


Vulnerable code:
      outputs->push_back(Tensor(*context.mutable_output(i)));

Fixed code:
      const auto* output_tensor = context.mutable_output(i);
      if (output_tensor != nullptr) {
        outputs->push_back(Tensor(*output_tensor));
      } else {
        outputs->push_back(Tensor());
      }
  def testSwitchEagerMode(self):
    if not context.executing_eagerly():
      return
    input_data = [1, 2, 3, 4]
    vf, vt = control_flow_ops.switch(input_data, False)
    self.assertAllEqual(vf, input_data)
    self.assertAllEqual(vt, [])
CVE-2020-15202 (C++, published 2020-09-25T19:15Z)
Description: value: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Severity: MEDIUM (CVSS v3 base score: 9)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/random_op.cc
Commit message: Prevent `int64` to `int` truncation in `Shard` API usage.

The function argument in `Shard` must be a function of two `int64` arguments. However, we are passing in a function with two `int` arguments. Thus, for large workloads, these arguments get truncated from positive `int64` values to negative `int` ones, resulting in a buffer out of bounds write.

PiperOrigin-RevId: 332557334
Change-Id: I236c9a2e7f53580e520571da8ba941a3aa9fa0b5


Vulnerable code:
                   alpha_flat](int start_output, int limit_output) {

Fixed code:
                   alpha_flat](int64 start_output, int64 limit_output) {
CVE-2020-15204 (Python, published 2020-09-25T19:15Z)
Description: value: In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference In linked snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault. The issue is patched in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/tensorflow/tensorflow
Files changed:
tensorflow/core/kernels/session_ops.cc
tensorflow/python/ops/raw_ops_test.py
Commit message: Prevent segfault in `GetSessionHandle{,V2}`.

In eager mode, session state is null.

PiperOrigin-RevId: 332548597
Change-Id: If094812c2e094044220b9ba28f7d7601be042f38


Vulnerable code:
    int64 id = ctx->session_state()->GetNewId();

Fixed code:

#include "tensorflow/core/platform/errors.h"
    auto session_state = ctx->session_state();
    OP_REQUIRES(ctx, session_state != nullptr,
                errors::FailedPrecondition(
                    "GetSessionHandle called on null session state"));
    int64 id = session_state->GetNewId();
from tensorflow.python.ops import gen_data_flow_ops
  def testGetSessionHandle(self):
    if context.executing_eagerly():
      with self.assertRaisesRegex(
          errors.FailedPreconditionError,
          "GetSessionHandle called on null session state"):
        gen_data_flow_ops.GetSessionHandle(value=[1])