hitoshura25/cvefixes huggingface dataset:
CVE-2022-31015 (Unknown, published 2022-05-31T23:15Z)
Description: value: Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-248 \u2014 Uncaught Exception
An exception is thrown from a function, but it is not caught.
Repository: https://github.com/Pylons/waitress
Files changed:
Commit message: Merge pull request #377 from Pylons/bugfix/select-closed-socket-race

Bugfix: Retry if a thread closes a socket before we select() on it

Vulnerable code:

Fixed code:
CVE-2022-31015 (Unknown, published 2022-05-31T23:15Z)
Description: value: Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed. This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket. Instead, that is always delegated to the main thread. There is no work-around for this issue. However, users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/Pylons/waitress
Files changed:
Commit message: Merge pull request #377 from Pylons/bugfix/select-closed-socket-race

Bugfix: Retry if a thread closes a socket before we select() on it

Vulnerable code:

Fixed code:
CVE-2022-1045 (JavaScript, published 2022-04-11T07:15Z)
Description: value: Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/polonel/trudesk
Files changed:
src/controllers/tickets.js
Commit message: fix(tickets): disable uploading .svg as an attachment

Vulnerable code:
      '.heic',
      '.svg',
      '.svgz'

Fixed code:
      '.heic'
CVE-2022-1718 (JavaScript, published 2022-09-29T03:15Z)
Description: value: The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/polonel/trudesk
Files changed:
src/helpers/utils/index.js
src/models/user.js
Commit message: fix(account): security fix

Vulnerable code:
  user.username = utils.sanitizeFieldPlainText(user.username.toLowerCase().trim())
  if (user.fullname) user.fullname = utils.sanitizeFieldPlainText(user.fullname.trim())
  if (user.title) user.title = utils.sanitizeFieldPlainText(user.title.trim())

Fixed code:
const MAX_FIELD_TEXT_LENGTH = 255
const MAX_SHORT_FIELD_TEXT_LENGTH = 25

module.exports.applyMaxShortTextLength = function (text) {
  return text.toString().substring(0, MAX_SHORT_FIELD_TEXT_LENGTH)
}

  user.username = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.username.toLowerCase().trim()))
  if (user.fullname) user.fullname = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.fullname.trim()))
  if (user.title) user.title = utils.applyMaxShortTextLength(utils.sanitizeFieldPlainText(user.title.trim()))
CVE-2022-1719 (JavaScript, published 2022-09-29T03:15Z)
Description: value: Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capable of executing a malicious javascript code in web page
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/polonel/trudesk
Files changed:
src/controllers/tickets.js
src/helpers/utils/index.js
Commit message: fix(tickets): security fix

Vulnerable code:
    subject: subject,

Fixed code:
  if (!_.isUndefined(status)) status = xss(status)
  if (!_.isUndefined(priority)) priority = xss(priority)
  if (!_.isUndefined(groups)) groups = xss(groups)
  if (!_.isUndefined(types)) types = xss(types)
  if (!_.isUndefined(tags)) tags = xss(tags)
  if (!_.isUndefined(assignee)) assignee = xss(assignee)
    subject: xss(subject),
module.exports.applyMaxTextLength = function (text) {
  return text.toString().substring(0, MAX_FIELD_TEXT_LENGTH)
}
CVE-2022-1728 (JavaScript, published 2022-05-16T15:15Z)
Description: value: Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/polonel/trudesk
Files changed:
src/models/user.js
src/public/js/angularjs/controllers/profile.js
src/views/subviews/profile.hbs
Commit message: fix(account): security fix

Vulnerable code:
                                            <input id="aPass" class="md-input" name="aPass" type="password" />
                                            <input id="aPassConfirm" class="md-input" name="aPassConfirm" type="password" />
                                            <input id="aEmail" class="md-input" name="aEmail" type="email" value="{{data.account.email}}"/>

Fixed code:
  if (user.password.toString().length > 255) user.password = utils.applyMaxTextLength(user.password)

      function validateEmail (email) {
        return String(email)
          .toLowerCase()
          .match(
            /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
          )
      }

        if (
          data.fullname.toString().length > 25 ||
          data.password.toString().length > 255 ||
          data.cPassword.toString().length > 255 ||
          data.email.toString().length > 255 ||
          !validateEmail(data.email.toString())
        ) {
          helpers.UI.showSnackbar('Form data invalid.', true)
          return false
        }

                                            <input id="aPass" class="md-input" name="aPass" type="password" data-validation="length" data-validation-length="max255" data-validation-error-msg="Password too long. Maximum length is 25 characters." />
                                            <input id="aPassConfirm" class="md-input" name="aPassConfirm" type="password" data-validation="length" data-validation-length="max255" data-validation-error-msg="Password too long. Maximum length is 25 characters." />
                                            <input id="aEmail" class="md-input" name="aEmail" type="email" value="{{data.account.email}}" data-validation="email" data-validation-error-msg="Please enter a valid email address."/>
CVE-2022-1754 (JavaScript, published 2022-05-20T07:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/polonel/trudesk
Files changed:
src/models/user.js
src/public/js/angularjs/controllers/profile.js
src/views/subviews/profile.hbs
Commit message: fix(account): security fix

Vulnerable code:
                                            <input id="aPass" class="md-input" name="aPass" type="password" />
                                            <input id="aPassConfirm" class="md-input" name="aPassConfirm" type="password" />
                                            <input id="aEmail" class="md-input" name="aEmail" type="email" value="{{data.account.email}}"/>

Fixed code:
  if (user.password.toString().length > 255) user.password = utils.applyMaxTextLength(user.password)

      function validateEmail (email) {
        return String(email)
          .toLowerCase()
          .match(
            /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
          )
      }

        if (
          data.fullname.toString().length > 25 ||
          data.password.toString().length > 255 ||
          data.cPassword.toString().length > 255 ||
          data.email.toString().length > 255 ||
          !validateEmail(data.email.toString())
        ) {
          helpers.UI.showSnackbar('Form data invalid.', true)
          return false
        }

                                            <input id="aPass" class="md-input" name="aPass" type="password" data-validation="length" data-validation-length="max255" data-validation-error-msg="Password too long. Maximum length is 25 characters." />
                                            <input id="aPassConfirm" class="md-input" name="aPassConfirm" type="password" data-validation="length" data-validation-length="max255" data-validation-error-msg="Password too long. Maximum length is 25 characters." />
                                            <input id="aEmail" class="md-input" name="aEmail" type="email" value="{{data.account.email}}" data-validation="email" data-validation-error-msg="Please enter a valid email address."/>
CVE-2022-1803 (JavaScript, published 2022-05-20T22:16Z)
Description: value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.
Severity: MEDIUM (CVSS v3 base score: 6.9)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/polonel/trudesk
Files changed:
src/middleware/index.js
Commit message: fix(core): iframe security fix

Vulnerable code:

Fixed code:
  res.setHeader('Content-Security-Policy', "frame-ancestors 'none';")
CVE-2022-1808 (JavaScript, published 2022-05-31T22:15Z)
Description: value: Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/polonel/trudesk
Files changed:
src/controllers/api/v1/tickets.js
Commit message: fix(core): verify user exists

Vulnerable code:
var winston = require('winston')
      function () {

Fixed code:
var winston = require('../../../logger')
  if (data.user.toString() !== req.user._id.toString()) return res.status(401).json({ error: 'Unauthorized!' })

        function (callback) {
          require('../../../models/user').find({ _id: data.user }, function (err, user) {
            if (err) return callback(err)

            if (!user) return callback(new Error('Unauthorized!'))

            return callback()
          })
        },
      function (err) {
        if (err) {
          winston.warn(err)
          return res.status(401).json({ error: 'Unauthorized!' })
        }
CVE-2022-1893 (JavaScript, published 2022-05-31T22:15Z)
Description: value: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/polonel/trudesk
Files changed:
src/controllers/main.js
Commit message: fix(core): image data removal

Vulnerable code:

Fixed code:
    if (path.extname(object.filename) === '.jpg' || path.extname(object.filename) === '.jpeg') {
      require('../helpers/utils').stripExifData(object.filePath)
    }
    if (path.extname(object.filename) === '.jpg' || path.extname(object.filename) === '.jpeg') {
      require('../helpers/utils').stripExifData(object.filePath)
    }
    if (path.extname(object.filename) === '.jpg' || path.extname(object.filename) === '.jpeg') {
      require('../helpers/utils').stripExifData(object.filePath)
    }
CVE-2022-1926 (JavaScript, published 2022-05-31T09:15Z)
Description: value: Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/polonel/trudesk
Files changed:
src/helpers/utils/index.js
src/models/chat/message.js
Commit message: fix(messages): xss security

Vulnerable code:
var mongoose = require('mongoose')
var _ = require('lodash')
var COLLECTION = 'messages'
var messageSchema = mongoose.Schema(
  var self = this
  var deletedAt = null
  var limit = object.limit === null ? 25 : object.limit
  var page = object.page === null ? 0 : object.page
    var userMetaIdx = _.findIndex(object.userMeta, function (item) {
  var q = self

Fixed code:
const MAX_EXTREME_TEXT_LENGTH = 2000
module.exports.applyExtremeTextLength = function (text) {
  return text.toString().substring(0, MAX_EXTREME_TEXT_LENGTH)
}

const mongoose = require('mongoose')
const _ = require('lodash')
const utils = require('../../helpers/utils')
const COLLECTION = 'messages'
const messageSchema = mongoose.Schema(
messageSchema.pre('save', function (next) {
  this.body = utils.sanitizeFieldPlainText(utils.applyExtremeTextLength(this.body))

  next()
})

  const self = this
  let deletedAt = null
  const limit = object.limit === null ? 25 : object.limit
  const page = object.page === null ? 0 : object.page
    const userMetaIdx = _.findIndex(object.userMeta, function (item) {
  const q = self
CVE-2022-1947 (JavaScript, published 2022-05-31T23:15Z)
Description: value: Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/polonel/trudesk
Files changed:
src/controllers/messages.js
Commit message: fix(messages): invalid permissions

Vulnerable code:
messagesController.getConversation = function (req, res) {

Fixed code:
messagesController.getConversation = async (req, res) => {

          let isPart = false
          _.each(c.participants, function (p) {
            if (p._id.toString() === req.user._id.toString()) isPart = true
          })

          if (!isPart) {
            return res.redirect('/messages')
          }
CVE-2023-45814 (C#, published 2023-10-18T22:15Z)
Description: value: Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `AuthenticationService` only supported injecting `IUser`s. However, as Refresh and SoundShapesServer implemented permissions systems support for injecting `IToken`s into endpoints was added. All was well until 4.0. Bunkum 4.0 then changed to enforce relations between `IToken`s and `IUser`s. This wasn't implemented in a very good way in the `AuthenticationService`, and ended up breaking caching in such a way that cached tokens would persist after the lifetime of the request - since we tried to cache both tokens and users. From that point until now, from what I understand, Bunkum was attempting to use that cached token at the start of the next request once cached. Naturally, when that token expired, downstream projects like Refresh would remove the object from Realm - and cause the object in the cache to be in a detached state, causing an exception from invalid use of `IToken.User`. So in other words, a use-after-free since Realm can't manage the lifetime of the cached token. Security-wise, the scope is fairly limited, can only be pulled off on a couple endpoints given a few conditions, and you can't guarantee which token you're going to get. Also, the token *would* get invalidated properly if the endpoint had either a `IToken` usage or a `IUser` usage. The fix is to just wipe the token cache after the request was handled, which is now in `4.2.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/LittleBigRefresh/Bunkum
Files changed:
Bunkum.Core/Services/AuthenticationService.cs
Commit message: Prevent IToken use-after-free in AuthenticationService


Vulnerable code:
        return null;

Fixed code:
        
        return null;
    }
    /// <inheritdoc />
    public override void AfterRequestHandled(ListenerContext context, Response response, MethodInfo method, Lazy<IDatabaseContext> database)
    {
CVE-2020-7708 (JavaScript, published 2020-08-18T15:15Z)
Description: value: The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pullVal functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/Irrelon/irrelon-path
Files changed:
dist/Path.js
package.json
src/Path.js
Commit message: Fixed functions with prototype pollution vulnerability


Vulnerable code:
  var transformedPathPart = options.transformKey(pathPart);
    if (newObj.hasOwnProperty(unEscape(internalPath))) {
      delete newObj[options.transformKey(unEscape(internalPath))];
  var transformedPathPart = options.transformKey(unEscape(pathPart));
	"version": "4.6.8",
		if (newObj.hasOwnProperty(unEscape(internalPath))) {
			delete newObj[options.transformKey(unEscape(internalPath))];
	
	

Fixed code:
    // Do not allow prototype pollution
    if (internalPath === "__proto__") return obj;
  var transformedPathPart = options.transformKey(pathPart); // Do not allow prototype pollution

  if (transformedPathPart === "__proto__") return obj;
    var unescapedPath = unEscape(internalPath); // Do not allow prototype pollution

    if (unescapedPath === "__proto__") return obj;

    if (newObj.hasOwnProperty(unescapedPath)) {
      delete newObj[options.transformKey(unescapedPath)];
  var transformedPathPart = options.transformKey(unEscape(pathPart)); // Do not allow prototype pollution

  if (transformedPathPart === "__proto__") return obj;
  if (part === "__proto__") return obj;
  if (part === "__proto__") return obj;
	"version": "4.7.0",
		// Do not allow prototype pollution
		if (internalPath === "__proto__") return obj;


	// Do not allow prototype pollution
	if (transformedPathPart === "__proto__") return obj;

		const unescapedPath = unEscape(internalPath);

		// Do not allow prototype pollution
		if (unescapedPath === "__proto__") return obj;

		if (newObj.hasOwnProperty(unescapedPath)) {
			delete newObj[options.transformKey(unescapedPath)];

	// Do not allow prototype pollution
	if (transformedPathPart === "__proto__") return obj;


	if (part === "__proto__") return obj;


	if (part === "__proto__") return obj;