hitoshura25/cvefixes huggingface dataset:
CVE-2012-4267 (Other, published 2012-08-13T22:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rodnaph/sockso
Files changed:
templates/com/pugh/sockso/templates/web/browse/TPlaylist.jamon
templates/com/pugh/sockso/templates/web/browse/TPlaylists.jamon
Commit message: added fixed for XSS holes (fixes #93)


Vulnerable code:
<& ../IHeader; properties=properties; title="Playlist: " + playlist.getName(); user=user; locale=locale; &>
        <% Utils.u2e(playlist.getName()) #n %>
                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.u2e(playlist.getName()) #n %></a>
                    <% Utils.u2e(playlist.getUser().getName()) #n %>

Fixed code:
<& ../IHeader; properties=properties; title="Playlist: " + Utils.XMLEncode(playlist.getName()); user=user; locale=locale; &>
        <% Utils.XMLEncode(playlist.getName()) #n %>
                <a href="<% properties.getUrl("/browse/playlist/"+playlist.getId()) #n %>"><% Utils.XMLEncode(playlist.getName()) #n %></a>
                    <% Utils.XMLEncode(playlist.getUser().getName()) #n %>
CVE-2018-9275 (C, published 2018-04-04T18:29Z)
Description: value: In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Yubico/yubico-pam
Files changed:
util.c
Commit message: util: make sure to close the authfile before returning success

fixes #136


Vulnerable code:

Fixed code:

		  fclose(opwfile);
CVE-2012-3426 (Python, published 2012-07-31T10:45Z)
Description: value: OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/service.py
tests/test_keystoneclient.py
Commit message: Carrying over token expiry time when token chaining

Fixes bug #998185

This commit causes the token expiry time to be maintained when
one token is being created from another

Change-Id: I7b61692a60d9227423b93c267864a5abe939ca33


Vulnerable code:
                                            metadata=metadata_ref))

Fixed code:
                                            metadata=metadata_ref,
                                            expires=old_token_ref['expires']))
import time
    def test_token_expiry_maintained(self):
        foo_client = self.get_client(self.user_foo)
        orig_token = foo_client.service_catalog.catalog['token']

        time.sleep(1.01)
        reauthenticated_token = foo_client.tokens.authenticate(
                                    token=foo_client.auth_token)

        self.assertEquals(orig_token['expires'],
                          reauthenticated_token.expires)
CVE-2012-3542 (Python, published 2012-09-05T23:55Z)
Description: value: OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/identity/core.py
Commit message: Require authz to update user's tenant (bug 1040626)

Change-Id: I82f80b84af2bc4db00b3dcb87a2ec338816a82e9


Vulnerable code:

Fixed code:
        self.assert_admin(context)
CVE-2012-4456 (Python, published 2012-10-09T15:55Z)
Description: value: The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/identity/core.py
tests/test_content_types.py
Commit message: Require authz for user role list (bug 1006815)

Change-Id: I65f25dcca3e265f44746930917434b45e64de15e


Vulnerable code:

Fixed code:
        self.assert_admin(context)
    def test_user_role_list_requires_auth(self):
        """User role list should 401 without an X-Auth-Token (bug 1006815)."""
        # values here don't matter because we should 401 before they're checked
        path = '/v2.0/tenants/%(tenant_id)s/users/%(user_id)s/roles' % {
                'tenant_id': uuid.uuid4().hex,
                'user_id': uuid.uuid4().hex,
        }

        r = self.admin_request(path=path, expected_status=401)
        self.assertValidErrorResponse(r)
CVE-2012-4456 (Python, published 2012-10-09T15:55Z)
Description: value: The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/catalog/core.py
tests/test_content_types.py
Commit message: Require authz for service CRUD (bug 1006822)

Change-Id: Ia90f0aa2b856b9a9874d4865fb92ee913e8125c5


Vulnerable code:

Fixed code:
        self.identity_api = identity.Manager()
        self.policy_api = policy.Manager()
        self.token_api = token.Manager()
        self.assert_admin(context)
        self.assert_admin(context)
        self.assert_admin(context)
        self.assert_admin(context)
import uuid
    def test_service_crud_requires_auth(self):
        """Service CRUD should 401 without an X-Auth-Token (bug 1006822)."""
        # values here don't matter because we should 401 before they're checked
        service_path = '/v2.0/OS-KSADM/services/%s' % uuid.uuid4().hex
        service_body = {
                'OS-KSADM:service': {
                    'name': uuid.uuid4().hex,
                    'type': uuid.uuid4().hex,
                    },
                }

        r = self.admin_request(method='GET',
                               path='/v2.0/OS-KSADM/services',
                               expected_status=401)
        self.assertValidErrorResponse(r)

        r = self.admin_request(method='POST',
                               path='/v2.0/OS-KSADM/services',
                               body=service_body,
                               expected_status=401)
        self.assertValidErrorResponse(r)

        r = self.admin_request(method='GET',
                               path=service_path,
                               expected_status=401)
        self.assertValidErrorResponse(r)

        r = self.admin_request(method='DELETE',
                               path=service_path,
                               expected_status=401)
        self.assertValidErrorResponse(r)
CVE-2012-4457 (Python, published 2012-10-09T15:55Z)
Description: value: OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/service.py
tests/test_keystoneclient.py
Commit message: Raise unauthorized if tenant disabled (bug 988920)

If the client attempts to explicitly authenticate against a disabled
tenant, keystone should return HTTP 401 Unauthorized.

Change-Id: I49fe56b6ef8d9f2fc6b9357472dae8964bb9cb9c


Vulnerable code:
from keystone.common import utils

Fixed code:

                # If the tenant is disabled don't allow them to authenticate
                if tenant_ref and not tenant_ref.get('enabled', True):
                    LOG.warning('Tenant %s is disabled' % tenant_id)
                    raise exception.Unauthorized()
            except exception.MetadataNotFound:
                metadata_ref = {}
                catalog_ref = {}

            # If the tenant is disabled don't allow them to authenticate
            if tenant_ref and not tenant_ref.get('enabled', True):
                LOG.warning('Tenant %s is disabled' % tenant_id)
                raise exception.Unauthorized()
    def test_authenticate_disabled_tenant(self):
        from keystoneclient import exceptions as client_exceptions

        admin_client = self.get_client(admin=True)

        tenant = {
            'name': uuid.uuid4().hex,
            'description': uuid.uuid4().hex,
            'enabled': False,
        }
        tenant_ref = admin_client.tenants.create(
            tenant_name=tenant['name'],
            description=tenant['description'],
            enabled=tenant['enabled'])
        tenant['id'] = tenant_ref.id

        user = {
            'name': uuid.uuid4().hex,
            'password': uuid.uuid4().hex,
            'email': uuid.uuid4().hex,
            'tenant_id': tenant['id'],
        }
        user_ref = admin_client.users.create(
            name=user['name'],
            password=user['password'],
            email=user['email'],
            tenant_id=user['tenant_id'])
        user['id'] = user_ref.id

        # password authentication
        self.assertRaises(
            client_exceptions.Unauthorized,
            self._client,
            username=user['name'],
            password=user['password'],
            tenant_id=tenant['id'])

        # token authentication
        client = self._client(
            username=user['name'],
            password=user['password'])
        self.assertRaises(
            client_exceptions.Unauthorized,
            self._client,
            token=client.auth_token,
            tenant_id=tenant['id'])
CVE-2012-5563 (Python, published 2012-12-18T01:55Z)
Description: value: OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining.  NOTE: this issue exists because of a CVE-2012-3426 regression.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/service.py
tests/test_service.py
Commit message: Ensure token expiration is maintained (bug 1079216)

Change-Id: I95853ec36e9c4cd937cfac7e08b648e830f9efd0


Vulnerable code:

Fixed code:
                                        expires=auth_token_data['expires'],
import time
from keystone import config
CONF = config.CONF




class TokenExpirationTest(test.TestCase):
    def setUp(self):
        super(TokenExpirationTest, self).setUp()
        self.identity_api = kvs_identity.Identity()
        self.load_fixtures(default_fixtures)
        self.api = service.TokenController()

    def _maintain_token_expiration(self):
        """Token expiration should be maintained after re-auth & validation."""
        r = self.api.authenticate(
            {},
            auth={
                'passwordCredentials': {
                    'username': self.user_foo['name'],
                    'password': self.user_foo['password']
                }
            })
        unscoped_token_id = r['access']['token']['id']
        original_expiration = r['access']['token']['expires']

        time.sleep(0.5)

        r = self.api.validate_token(
            dict(is_admin=True, query_string={}),
            token_id=unscoped_token_id)
        self.assertEqual(original_expiration, r['access']['token']['expires'])

        time.sleep(0.5)

        r = self.api.authenticate(
            {},
            auth={
                'token': {
                    'id': unscoped_token_id,
                },
                'tenantId': self.tenant_bar['id'],
            })
        scoped_token_id = r['access']['token']['id']
        self.assertEqual(original_expiration, r['access']['token']['expires'])

        time.sleep(0.5)

        r = self.api.validate_token(
            dict(is_admin=True, query_string={}),
            token_id=scoped_token_id)
        self.assertEqual(original_expiration, r['access']['token']['expires'])

    def test_maintain_uuid_token_expiration(self):
        self.opt_in_group('signing', token_format='UUID')
        self._maintain_token_expiration()
CVE-2012-5571 (Python, published 2012-12-18T01:55Z)
Description: value: OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/openstack/keystone
Files changed:
keystone/contrib/ec2/core.py
Commit message: Ensures User is member of tenant in ec2 validation

It is possible that a user is no longer a member of a tenant when
they attempt to use an ec2 token. This checks to make sure that
the user still has at least one valid role in the tenant before
authenticating them. This should automatically work for the s3
version as well since it is a subclass.

Fixes bug 1064914

Change-Id: Ieb237bae936a7b00ce7ba4d4c59aec6c7a69ec21


Vulnerable code:
        # TODO(termie): optimize this call at some point and put it into the
        #               the return for metadata
        # fill out the roles in the metadata
        roles_ref = []
        for role_id in metadata_ref.get('roles', []):
            roles_ref.append(self.identity_api.get_role(context, role_id))


Fixed code:

        # TODO(termie): optimize this call at some point and put it into the
        #               the return for metadata
        # fill out the roles in the metadata
        roles = metadata_ref.get('roles', [])
        if not roles:
            raise exception.Unauthorized(message='User not valid for tenant.')
        roles_ref = [self.identity_api.get_role(context, role_id)
                     for role_id in roles]
CVE-2021-31597 (JSON, published 2021-04-23T00:15Z)
Description: value: The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Severity: HIGH (CVSS v3 base score: 9.4)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/mjwwit/node-XMLHttpRequest
Files changed:
lib/XMLHttpRequest.js
package.json
Commit message: Fix issue where rejectUnauthorized would default to false instead of true


Vulnerable code:
      options.rejectUnauthorized = opts.rejectUnauthorized;
            newOptions.rejectUnauthorized = opts.rejectUnauthorized;
  "version": "1.6.0",

Fixed code:
      options.rejectUnauthorized = opts.rejectUnauthorized === false ? false : true;
            newOptions.rejectUnauthorized = opts.rejectUnauthorized === false ? false : true;
  "version": "1.6.1",
CVE-2018-16789 (Other, published 2019-03-21T16:00Z)
Description: value: libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/shellinabox/shellinabox
Files changed:
debian/changelog
libhttp/url.c
Commit message: Rolling code for version 2.21


Vulnerable code:

Fixed code:
shellinabox (2.21) unstable; urgency=medium

  * Patched DoS vulnerability reported by Imre Rad.

 -- Marc Singer <elf@debian.org>  Sun, 09 Sep 2018 12:10:40 -0700

        /* elf-2018.09.09: Detection of broken multipart/form-data
           fixes DoS vulnerability.

           On 9/9/18 10:43 AM, Imre Rad wrote:
           Hi Markus, Marc!

           I identified a vulnerability today in Shellinabox, it is
           remote a denial of service, shellinaboxd eating up 100% cpu
           and not processing subsequent requests after the attack was
           mounted.
        */
        else {
          warn ("[http] Ignorning broken multipart/form-data");
          break;
        }
CVE-2020-26274 (HTML, published 2020-12-16T20:15Z)
Description: value: In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
CHANGELOG.md
docs/history.html
docs/index.html
docs/security.html
lib/util.js
Commit message: inetLatency() command injection vulnaribility fix


Vulnerable code:
      <a href="security.html" class="recommendation">Security advisory:<br>Update to v4.30.5</a>
      <div class="version">Current Version: <span id="version">4.31.0</span></div>

Fixed code:
| 4.31.1         | 2020-12-11     | `inetLatency()` command injection vulnaribility fix |
                  <tr>
                    <th scope="row">4.31.1</th>
                    <td>2020-12-06</td>
                    <td><span class="code">inetLatency()</span> command injection vulnaribility fix</td>
                  </tr>
      <a href="security.html" class="recommendation">Security advisory:<br>Update to v4.31.1</a>
      <div class="version">Current Version: <span id="version">4.31.1</span></div>
              <h2>Command Injection Vulnerability</h2>
              <p><span class="bold">Affected versions:</span>
                < 4.31.1<br>
                  <span class="bold">Date:</span> 2020-12-11<br>
                  <span class="bold">CVE indentifier</span> (not yet)
              </p>

              <h4>Impact</h4>
              <p>Here we had an issue that there was a possibility to inject commands to the command line of your machine via systeminformation. Affected commands: <span class="code">inetLatency()</span>.</p>

              <h4>Patch</h4>
              <p>Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1</p>

              <h4>Workarround</h4>
              <p>If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to <span class="code">inetLatency()</span></p>


      s[i] === '\'' ||
      s[i] === '`' ||
CVE-2020-26300 (JavaScript, published 2021-09-09T01:15Z)
Description: value: systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
lib/util.js
Commit message: improved shell sanitation


Vulnerable code:

Fixed code:
  result = result.replace(/\t/g, "");
  result = result.replace(/\n/g, "");
  result = result.replace(/\"/g, "");