hitoshura25/cvefixes huggingface dataset:
CVE-2024-32981 (PHP, published 2024-07-17T20:15Z)
Description: value: Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it. The server-side sanitisation logic has been updated to sanitise against this type of attack in version 5.2.16. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/silverstripe/silverstripe-framework
Files changed:
src/Forms/HTMLEditor/HTMLEditorSanitiser.php
tests/php/Forms/HTMLEditor/HTMLEditorSanitiserTest.php
Commit message: [CVE-2024-32981] Disallow `data:text/html` in data attributes


Vulnerable code:
                $regex = '/^\s*' . implode('\s*', str_split('javascript:')) . '/i';
                'Object with dangerous content in data attribute is completely removed'

Fixed code:
                $regex = '#^\s*(' . implode('\s*', str_split('javascript:')) . '|' . implode('\s*', str_split('data:text/html;')) . ')#i';
                'Object with dangerous javascript content in data attribute is completely removed'
            ],
            [
                'object[data]',
                '<object data="javascript:alert()">',
                '<object></object>',
                'Object with dangerous javascript content in data attribute with quotes is completely removed'
            ],
            [
                'object[data]',
                '<object data="data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5sb2NhdGlvbik8L3NjcmlwdD4=">',
                '<object></object>',
                'Object with dangerous html content in data attribute is completely removed'
            ],
            [
                'object[data]',
                '<object data="' . implode("\n", str_split(' DATA:TEXT/HTML;')) . 'base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5sb2NhdGlvbik8L3NjcmlwdD4=">',
                '<object></object>',
                'Object with split upper-case dangerous html content in data attribute is completely removed'
            ],
            [
                'object[data]',
                '<object data="data:text/xml;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5sb2NhdGlvbik8L3NjcmlwdD4=">',
                '<object data="data:text/xml;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5sb2NhdGlvbik8L3NjcmlwdD4="></object>',
                'Object with safe xml content in data attribute is retained'
CVE-2015-7314 (Ruby, published 2015-10-06T01:59Z)
Description: value: The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/gollum/gollum
Files changed:
lib/gollum/app.rb
Commit message: Added security check.


Vulnerable code:

Fixed code:
      halt 500 unless tempfile.is_a? Tempfile
CVE-2022-23462 (Other, published 2022-10-21T22:15Z)
Description: value: IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Softmotions/iowow
Files changed:
Changelog
src/json/iwjson.c
Commit message: * Fixed Github Vulnerability Report GHSL-2022-066


Vulnerable code:
  int len = snprintf(buf, 64, "%.8Lf", val);

Fixed code:
  * Fixed Github Vulnerability Report GHSL-2022-066
  int len = snprintf(buf, IWNUMBUF_SIZE, "%.8Lf", val);
CVE-2020-4044 (Unknown, published 2020-06-30T16:15Z)
Description: value: The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp-sesman process is dead, an unprivileged attacker on the server could then proceed to start their own imposter sesman service listening on port 3350. This will allow them to capture any user credentials that are submitted to XRDP and approve or reject arbitrary login credentials. For xorgxrdp sessions in particular, this allows an unauthorized user to hijack an existing session. This is a buffer overflow attack, so there may be a risk of arbitrary code execution as well.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-121 \u2014 Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Repository: https://github.com/neutrinolabs/xrdp
Files changed:
Commit message: Merge pull request from GHSA-j9fv-6fwf-p3g4

Fix for CVE-2020-4044

Vulnerable code:

Fixed code:
CVE-2022-23613 (Unknown, published 2022-02-07T22:15Z)
Description: value: xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/neutrinolabs/xrdp
Files changed:
Commit message: Merge pull request from GHSA-8h98-h426-xf32

Add lower bound to sesman data input size check

Vulnerable code:

Fixed code:
CVE-2023-40184 (Unknown, published 2023-08-30T18:15Z)
Description: value:  xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/neutrinolabs/xrdp
Files changed:
Commit message: Merge pull request from GHSA-f489-557v-47jq

Check auth_start_session() result

Vulnerable code:

Fixed code:
CVE-2023-42822 (Unknown, published 2023-09-27T18:15Z)
Description: value:  xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/neutrinolabs/xrdp
Files changed:
Commit message: Merge pull request from GHSA-2hjx-rm4f-r9hw

CVE-2023-42822

Vulnerable code:

Fixed code:
CVE-2024-39917 (Unknown, published 2024-07-12T16:15Z)
Description: value: xrdp is an open source RDP server. xrdp versions prior to 0.10.0 have a vulnerability that allows attackers to make an infinite number of login attempts. The number of max login attempts is supposed to be  limited by a configuration parameter `MaxLoginRetry` in `/etc/xrdp/sesman.ini`. However, this mechanism was not effectively working. As a result, xrdp allows an infinite number of login attempts. 
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/neutrinolabs/xrdp
Files changed:
Commit message: Merge pull request from GHSA-7w22-h4w7-8j5j

Enforce no login screen if require_credentials is set

Vulnerable code:

Fixed code:
CVE-2022-4952 (C#, published 2023-07-17T02:15Z)
Description: value: A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JSON Serializer. The manipulation leads to resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f194a9ef2a8901bb131c5fa12272305ce. It is recommended to upgrade the affected component. VDB-234238 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OmniSharp/csharp-language-server-protocol
Files changed:
src/JsonRpc/Serialization/SerializerBase.cs
Commit message: Set max depth for JSON serializer to mitigate known DOS vulnerability (#902)

The other option is to update Newtonsoft.Json, which now also sets the
maximum depth by default, but this mitigates without having to update.

Vulnerable code:
            var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings();

Fixed code:
            var settings = JsonConvert.DefaultSettings != null ? JsonConvert.DefaultSettings() : new JsonSerializerSettings { MaxDepth = 128 };
CVE-2021-4274 (HTML, published 2022-12-21T19:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sileht/bird-lg
Files changed:
templates/layout.html
Commit message: Fix XSS when handling query

Fixes #63


Vulnerable code:
			request_args = "{{session.request_args|safe}}";

Fixed code:
			request_args = "{{session.request_args}}";
CVE-2020-16587 (C++, published 2020-12-09T21:15Z)
Description: value: A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
Commit message: Fix #491, issue with part number range check reconstructing chunk offset table

The chunk offset was incorrectly testing for a part number that was the
same size (i.e. an invalid index)

Signed-off-by: Kimball Thurston <kdt3rd@gmail.com>


Vulnerable code:
            if(partNumber<0 || partNumber> static_cast<int>(parts.size()))

Fixed code:
            if(partNumber<0 || partNumber>= static_cast<int>(parts.size()))
CVE-2020-16588 (C++, published 2020-12-09T21:15Z)
Description: value: A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
OpenEXR/exrmakepreview/makePreview.cpp
Commit message: Fix logic for 1 pixel high/wide preview images (Fixes #493)


Vulnerable code:
    float fx = (previewWidth  > 0)? (float (w - 1) / (previewWidth  - 1)): 1;
    float fy = (previewHeight > 0)? (float (h - 1) / (previewHeight - 1)): 1;

Fixed code:
    float fx = (previewWidth  > 1)? (float (w - 1) / (previewWidth  - 1)): 1;
    float fy = (previewHeight > 1)? (float (h - 1) / (previewHeight - 1)): 1;
CVE-2020-16589 (C++, published 2020-12-09T21:15Z)
Description: value: A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
OpenEXR/IlmImf/ImfTiledInputFile.cpp
Commit message: Fix for #494: validate tile coordinates when doing copyPixels


Vulnerable code:

Fixed code:
        else
        {
             if(!isValidTile (dx, dy, lx, ly) )
             {
                 throw IEX_NAMESPACE::IoExc ("rawTileData read an invalid tile");
             }
        }
CVE-2021-20298 (C++, published 2022-08-23T16:15Z)
Description: value: A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
OpenEXR/IlmImf/ImfB44Compressor.cpp
Commit message: reduce B44 _tmpBufferSize (was allocating two bytes per byte) (#843)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>

Vulnerable code:
        [checkArraySize (uiMult (maxScanLineSize, numScanLines),

Fixed code:
        [checkArraySize (uiMult (maxScanLineSize / sizeof(unsigned short), numScanLines),
CVE-2021-20299 (C++, published 2022-03-16T15:15Z)
Description: value: A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
OpenEXR/IlmImf/ImfMultiPartInputFile.cpp
Commit message: add sanity check for reading multipart files with no parts (#840)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>

Vulnerable code:

Fixed code:
    if ( _data->_headers.size() == 0)
    {
        throw IEX_NAMESPACE::ArgExc ("Files must contain at least one header");
    }
CVE-2021-45942 (C++, published 2022-01-01T01:15Z)
Description: value: OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
src/lib/OpenEXR/ImfDeepScanLineInputFile.cpp
Commit message: DeepScanlineInputFile now uses chunk size test from DeepTiledInputFile (#1205)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>

Vulnerable code:
    int compressorMaxDataSize = std::numeric_limits<int>::max();
    if (sampleCountTableDataSize > uint64_t(compressorMaxDataSize))
        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not "
              << "support the allocation of data with size  > "
              << compressorMaxDataSize
              << " file table size    :" << sampleCountTableDataSize << ".\n");

Fixed code:
    uint64_t compressorMaxDataSize = static_cast<uint64_t>(std::numeric_limits<int>::max());
    if (packedDataSize         > compressorMaxDataSize ||
        unpackedDataSize > compressorMaxDataSize ||
        sampleCountTableDataSize        > compressorMaxDataSize)
        THROW (IEX_NAMESPACE::ArgExc, "This version of the library does not"
            << "support the allocation of data with size  > "
            << compressorMaxDataSize
            << " file table size    :" << sampleCountTableDataSize
            << " file unpacked size :" << unpackedDataSize
            << " file packed size   :" << packedDataSize << ".\n");
CVE-2021-45942 (C++, published 2022-01-01T01:15Z)
Description: value: OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AcademySoftwareFoundation/openexr
Files changed:
src/lib/OpenEXR/ImfCompositeDeepScanLine.cpp
Commit message: enforce xSampling/ySampling==1 in CompositeDeepScanLine (#1209)

Signed-off-by: Peter Hillman <peterh@wetafx.co.nz>

Vulnerable code:

Fixed code:

        //
        // Frame buffer must have xSampling and ySampling set to 1
        // (Sampling in FrameBuffers must match sampling in file,
        //  and Header::sanityCheck enforces sampling in deep files is 1)
        //

        if(q.slice().xSampling!=1 || q.slice().ySampling!=1)
        {
             THROW (IEX_NAMESPACE::ArgExc, "X and/or y subsampling factors "
				"of \"" << q.name() << "\" channel in framebuffer "
				"are not 1");
        }
CVE-2022-39304 (Go, published 2022-12-20T20:15Z)
Description: value: ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.

Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/bradleyfalzon/ghinstallation
Files changed:
transport.go
Commit message: Add StatusCode to error message if refreshToken() fails due to an suspended app (#44)

Add StatusCode to error message if refreshToken() fails due to an suspended app

Vulnerable code:
		return fmt.Errorf("request %+v received non 2xx response status %q with body %+v and TLS %+v", resp.Request, resp.Body, resp.Request, resp.TLS)

Fixed code:
		return fmt.Errorf("received non 2xx response status %q when fetching %v", resp.Status, req.URL)
CVE-2020-1896 (C++, published 2021-02-02T07:15Z)
Description: value: A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/facebook/hermes
Files changed:
lib/VM/JSLib/HermesBuiltin.cpp
test/hermes/stack-overflow-apply.js
Commit message: Added stack overflow check for hermes::vm:: hermesBuiltinApply

Summary: This adds a missing check for stack overflow.

Reviewed By: tmikov

Differential Revision: D20104955

fbshipit-source-id: 1f37e23d2e28ebcd3aa4176d134b8418e7059ebd


Vulnerable code:

Fixed code:
  if (LLVM_UNLIKELY(newFrame.overflowed()))
    return runtime->raiseStackOverflow(Runtime::StackOverflowKind::NativeStack);


try {
  v0 = [1.1];
  function v1() {
    v1(...v0);
  }
  v1();
} catch (e) {
    print("caught:", e.name, e.message);
}
//CHECK: caught: RangeError {{.*}}