hitoshura25/cvefixes huggingface dataset:
CVE-2015-7326 (Java, published 2017-06-07T14:29Z)
Description: value: XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/miltonio/milton2
Files changed:
milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropFindRequestFieldParser.java
milton-server-ce/src/main/java/io/milton/http/webdav/DefaultPropPatchParser.java
Commit message: patch XXE vulnerability

Vulnerable code:
        try {            
            }            

Fixed code:
        try {
				// https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
				reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
				reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
            }
			// https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
			reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
			reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
CVE-2022-36080 (Unknown, published 2022-09-07T21:15Z)
Description: value: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Linbreux/wikmd
Files changed:
Commit message: Merge pull request from GHSA-9m4m-6gqx-gfj3

SECURITY PATCH: prevent XSS by cleaning html code

Vulnerable code:

Fixed code:
CVE-2022-36081 (Unknown, published 2022-09-07T21:15Z)
Description: value: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Linbreux/wikmd
Files changed:
Commit message: Merge pull request from GHSA-w4cf-92x9-v8w2

SECURITY PATCH: Local File Enumeration when accessing /list

Vulnerable code:

Fixed code:
CVE-2021-21275 (PHP, published 2021-01-25T23:15Z)
Description: value: The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Kenny2github/Report
Files changed:
SpecialReport.php
Commit message: Add CSRF check for Special:Report

Also clean up a little of the logic


Vulnerable code:
			return self::onPost( $par, $out, $request );
	static public function onPost( $par, $out, $request ) {
		global $wgUser;
		} else {
			$dbw = wfGetDB( DB_MASTER );
			$dbw->startAtomic(__METHOD__);
			$dbw->insert( 'report_reports', [
				'report_revid' => (int)$par,
				'report_reason' => $request->getText('reason'),
				'report_user' => $wgUser->getId(),
				'report_user_text' => $wgUser->getName(),
				'report_timestamp' => wfTimestampNow()
			], __METHOD__ );
			$dbw->endAtomic(__METHOD__);
			$out->addWikiMsg( 'report-success' );
			$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );

Fixed code:
			return self::onPost( $par, $out, $request, $user );
		$out->addHTML(Html::rawElement(
			'input',
			[
				'type' => 'hidden',
				'name' => 'token',
				'value' => $user->getEditToken()
			]
		));
	static public function onPost( $par, $out, $request, $user ) {
		if (!$user->matchEditToken($request->getText( 'token' ))) {
			$out->addWikiMsg( 'sessionfailure' );
			return;
		}
		$dbw = wfGetDB( DB_MASTER );
		$dbw->startAtomic(__METHOD__);
		$dbw->insert( 'report_reports', [
			'report_revid' => (int)$par,
			'report_reason' => $request->getText('reason'),
			'report_user' => $user->getId(),
			'report_user_text' => $user->getName(),
			'report_timestamp' => wfTimestampNow()
		], __METHOD__ );
		$dbw->endAtomic(__METHOD__);
		$out->addWikiMsg( 'report-success' );
		$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );
CVE-2022-24732 (C, published 2022-03-09T20:15Z)
Description: value: Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-324 \u2014 Use of a Key Past its Expiration Date
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
Repository: https://github.com/foxcpp/maddy
Files changed:
cmd/maddy-pam-helper/pam.c
internal/auth/pam/pam.c
Commit message: auth/pam: Check for account/password expiry

See GHSA-6cp7-g972-w9m9. Thanks Youssef Rebahi-Gilbert (ysf) for
reporting the issue.


Vulnerable code:
Copyright © 2019-2020 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors

Fixed code:
//+build libpam

/*
Maddy Mail Server - Composable all-in-one email server.
Copyright © 2019-2022 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.
*/

    status = pam_acct_mgmt(local_auth, PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK);
    if (status != PAM_SUCCESS) {
        struct error_obj ret_val;
        if (status == PAM_AUTH_ERR || status == PAM_USER_UNKNOWN || status == PAM_NEW_AUTHTOK_REQD) {
            ret_val.status = 1;
        } else {
            ret_val.status = 2;
        }
        ret_val.func_name = "pam_acct_mgmt";
        ret_val.error_msg = pam_strerror(local_auth, status);
        return ret_val;
    }

Copyright © 2019-2022 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
    status = pam_acct_mgmt(local_auth, PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK);
    if (status != PAM_SUCCESS) {
        struct error_obj ret_val;
        if (status == PAM_AUTH_ERR || status == PAM_USER_UNKNOWN || status == PAM_NEW_AUTHTOK_REQD) {
            ret_val.status = 1;
        } else {
            ret_val.status = 2;
        }
        ret_val.func_name = "pam_acct_mgmt";
        ret_val.error_msg = pam_strerror(local_auth, status);
        return ret_val;
    }
CVE-2022-24732 (C, published 2022-03-09T20:15Z)
Description: value: Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/foxcpp/maddy
Files changed:
cmd/maddy-pam-helper/pam.c
internal/auth/pam/pam.c
Commit message: auth/pam: Check for account/password expiry

See GHSA-6cp7-g972-w9m9. Thanks Youssef Rebahi-Gilbert (ysf) for
reporting the issue.


Vulnerable code:
Copyright © 2019-2020 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors

Fixed code:
//+build libpam

/*
Maddy Mail Server - Composable all-in-one email server.
Copyright © 2019-2022 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.
*/

    status = pam_acct_mgmt(local_auth, PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK);
    if (status != PAM_SUCCESS) {
        struct error_obj ret_val;
        if (status == PAM_AUTH_ERR || status == PAM_USER_UNKNOWN || status == PAM_NEW_AUTHTOK_REQD) {
            ret_val.status = 1;
        } else {
            ret_val.status = 2;
        }
        ret_val.func_name = "pam_acct_mgmt";
        ret_val.error_msg = pam_strerror(local_auth, status);
        return ret_val;
    }

Copyright © 2019-2022 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
    status = pam_acct_mgmt(local_auth, PAM_SILENT|PAM_DISALLOW_NULL_AUTHTOK);
    if (status != PAM_SUCCESS) {
        struct error_obj ret_val;
        if (status == PAM_AUTH_ERR || status == PAM_USER_UNKNOWN || status == PAM_NEW_AUTHTOK_REQD) {
            ret_val.status = 1;
        } else {
            ret_val.status = 2;
        }
        ret_val.func_name = "pam_acct_mgmt";
        ret_val.error_msg = pam_strerror(local_auth, status);
        return ret_val;
    }
CVE-2023-27582 (Go, published 2023-03-13T22:15Z)
Description: value: maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username. maddy 0.6.3 includes the fix for the bug. There are no known workarounds.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/foxcpp/maddy
Files changed:
internal/auth/sasl.go
internal/auth/sasl_test.go
Commit message: auth: Actually check SASL identity argument before using it

Fixes GHSA-4g76-w3xw-2x6w.


Vulnerable code:
			if id != "user1a" {
		_, _, err := srv.Next([]byte("user1a\x00user1\x00aa"))

Fixed code:
			if identity != username {
				return ErrInvalidAuthCred
			}
			if id != "user1" {
		_, _, err := srv.Next([]byte("user1\x00user1\x00aa"))
CVE-2019-15541 (Rust, published 2019-08-26T12:15Z)
Description: value: rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/ctz/rustls
Files changed:
rustls-mio/examples/tlsserver.rs
Commit message: tlsserver: fix loop when client will never be writable


Vulnerable code:
        if self.closing && !self.tls_session.wants_write() {

Fixed code:
        if self.closing {
CVE-2021-41580 (JavaScript, published 2021-09-27T07:15Z)
Description: value: The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/jaredhanson/passport-oauth2
Files changed:
lib/strategy.js
test/oauth2.test.js
Commit message: Add test case and avoid parsing internal OAuth error when it doesn't exist.


Vulnerable code:
          if (err || !accessToken) { return self.error(self._createOAuthError('Failed to obtain access token', err)); }

Fixed code:
          if (err) { return self.error(self._createOAuthError('Failed to obtain access token', err)); }
          if (!accessToken) { return self.error(new Error('Failed to obtain access token')); }
    describe('that errors due to not receiving an access token', function() {
      var strategy = new OAuth2Strategy({
        authorizationURL: 'https://www.example.com/oauth2/authorize',
        tokenURL: 'https://www.example.com/oauth2/token',
        clientID: 'ABC123',
        clientSecret: 'secret',
        callbackURL: 'https://www.example.net/auth/example/callback',
      },
      function(accessToken, refreshToken, params, profile, done) {
        return done(new Error('something went wrong'));
      });
  
      strategy._oauth2.getOAuthAccessToken = function(code, options, callback) {
        return callback(null, undefined, undefined, undefined);
      }
  
  
      var err;
  
      before(function(done) {
        chai.passport.use(strategy)
          .error(function(e) {
            err = e;
            done();
          })
          .req(function(req) {
            req.query = {};
            req.query.code = 'SplxlOBeZQQYbYS6WxSbIA';
          })
          .authenticate();
      });

      it('should error', function() {
        expect(err).to.be.an.instanceof(Error);
        expect(err).to.not.be.an.instanceof(InternalOAuthError)
        expect(err.message).to.equal('Failed to obtain access token');
      });
    }); // that errors due to not receiving an access token
CVE-2021-21353 (JavaScript, published 2021-03-03T02:15Z)
Description: value: Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.
Severity: MEDIUM (CVSS v3 base score: 9)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/pugjs/pug
Files changed:
packages/pug-code-gen/index.js
Commit message: fix: sanitise and escape the `pretty` option (#3314)



Vulnerable code:
        "pug_indent.push('" + Array(this.indents + 1).join(this.pp) + "');"
          "pug_indent.push('" + Array(this.indents + 1).join(pp) + "');"

Fixed code:
  if (this.pp && !/^\s+$/.test(this.pp)) {
    throw new Error(
      'The pretty parameter should either be a boolean or whitespace only string'
    );
  }
        'pug_indent.push(' +
          stringify(Array(this.indents + 1).join(this.pp)) +
          ');'
          'pug_indent.push(' +
            stringify(Array(this.indents + 1).join(pp)) +
            ');'
CVE-2016-15037 (Ruby, published 2024-01-21T06:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in go4rayyan Scumblr up to 2.0.1a. Affected by this issue is some unknown functionality of the component Task Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.2 is able to address this issue. The patch is identified as 5c9120f2362ddb7cbe48f2c4620715adddc4ee35. It is recommended to upgrade the affected component. VDB-251570 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/go4rayyan/CG1
Files changed:
app/views/results/metadata/_vulnerability.html.erb
app/views/task_types/_options_fields.html.erb
app/views/tasks/index.html.erb
lib/scumblr_tasks/security/python_analyzer.rb
Commit message: Fixed a XSS bug (exploitable only by admins) for tasks with script tags in their name, thanks for reporting it Michael Carlson.  Also fixed a spelling mistake in the Python Analyzer reported by Kevin Hock.  Thanks!


Vulnerable code:
              <span data-tooltip aria-haspopup="true" class="has-tip tip-left" title="<%= vect["note"]%>"><i class="fi-info"></i></span></td>
        <span data-tooltip aria-haspopup="true" class="has-tip tip-right" title="<%= value[:description] %>"><i class="fi-info"></i></span>
            <% message +=  "<br/>" + task.metadata.try(:[], "_last_status_message").to_s if task.metadata.try(:[], "_last_status_message")%>
      :severity_level => {name: "Confidence Level",
                          description: "Confidence level to include in results",

Fixed code:
              <span data-tooltip aria-haspopup="true" class="has-tip tip-left" title="<%= h(vect["note"])%>"><i class="fi-info"></i></span></td>
        <span data-tooltip aria-haspopup="true" class="has-tip tip-right" title="<%= h(value[:description]) %>"><i class="fi-info"></i></span>
            <% message +=  "<br/>" + h(task.metadata.try(:[], "_last_status_message").to_s) if task.metadata.try(:[], "_last_status_message") %>
      :severity_level => {name: "Severity Level",
                          description: "Severity level to include in results",
CVE-2022-0654 (JavaScript, published 2022-02-23T00:15Z)
Description: value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fgribreau/node-request-retry
Files changed:
index.js
Commit message: Prevent Cookie & Authorization Headers from being forwarded when the URL redirects to another domain (information leak) #137

Vulnerable code:
  this.options = options;

Fixed code:
var url = require('url');
var querystring = require("querystring");
// Prevent Cookie & Authorization Headers from being forwarded 
// when the URL redirects to another domain (information leak) #137 
function sanitizeHeaders(options) {
  
  const HEADERS_TO_IGNORE = ["cookie", "authorization"];

  const urlObject = url.parse(options.url)
  const queryObject = querystring.parse(urlObject.query);
  
  const hasExternalLink = Object.keys(queryObject).reduce(function(acc, cur) {
    
    let qUrl = url.parse(queryObject[cur]);

    // external link if protocol || host || port is different
    if(!!qUrl.host && (qUrl.protocol !== urlObject.protocol || qUrl.host !== urlObject.host || qUrl.port !== urlObject.port) ) {
      acc = true;
    }
    
    return acc;

  }, false);

  if (hasExternalLink && options.hasOwnProperty("headers") && typeof(options.headers) === "object") {
    
    // if External Link: remove Cookie and Authorization from Headers
    Object.keys(options.headers).filter(function(key) {
      return HEADERS_TO_IGNORE.includes(key.toLowerCase())
    }).map(function(key) {
      return delete options.headers[key]
    });

  }

  return options;
}

  this.options = sanitizeHeaders(options);
CVE-2020-24074 (Unknown, published 2020-09-09T14:15Z)
Description: value: The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/kn007/silk-v3-decoder
Files changed:
Commit message: Merge pull request #64 from WinMin/master

add "totBytes check, fix #62

Vulnerable code:

Fixed code:
CVE-2020-24074 (Unknown, published 2020-09-09T14:15Z)
Description: value: The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/kn007/silk-v3-decoder
Files changed:
Commit message: Merge pull request #64 from WinMin/master

add "totBytes check, fix #62

Vulnerable code:

Fixed code: