hitoshura25/cvefixes huggingface dataset:
CVE-2020-5223 (PHP, published 2020-01-23T02:15Z)
Description: value: In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
Severity: LOW (CVSS v3 base score: 4.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrivateBin/PrivateBin
Files changed:
CHANGELOG.md
js/privatebin.js
js/test/AttachmentViewer.js
tpl/bootstrap.php
tpl/page.php
Commit message: addressing jsverifyRngState 8b8f0d4ec2a67139b5, fixes HTML injection via filename, closes #554


Vulnerable code:
            // update text
            I18n._($attachmentLink, label, $attachmentLink.attr('download'));
                prefix = prefix.replace(/%(s|d)/g, '%%');
                        element.children()[0].text === prefix + filename + postfix
		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-Bppv5Tt3fBwlJMQaL3ktLhrCNKZQwWo9ox4A/CAXiUs3rQLjfPSuEVViyuYy11e9oOaTKrMb7ejrkwDjhK1NmA==" crossorigin="anonymous"></script>
		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-Bppv5Tt3fBwlJMQaL3ktLhrCNKZQwWo9ox4A/CAXiUs3rQLjfPSuEVViyuYy11e9oOaTKrMb7ejrkwDjhK1NmA==" crossorigin="anonymous"></script>

Fixed code:
    * FIXED: HTML injection via unescaped attachment filename (#554)
            // update text - ensuring no HTML is inserted into the text node
            I18n._(
                $attachmentLink,
                $('<div />').text(label).html(),
                $('<div />').text($attachmentLink.attr('download')).html()
            );
                prefix  = prefix.replace(/%(s|d)/g, '%%');
                        element.children()[0].text === $('<div />').text(prefix + filename + postfix).html()
		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-HxU8g6MFviBCv6fEKEL+bn0fICxg9++ZUxxqySWXkX4iGgLodH/OVZDfr3dgKK5vZAv+0niWLuf+CWZ+/gUwWw==" crossorigin="anonymous"></script>
		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-HxU8g6MFviBCv6fEKEL+bn0fICxg9++ZUxxqySWXkX4iGgLodH/OVZDfr3dgKK5vZAv+0niWLuf+CWZ+/gUwWw==" crossorigin="anonymous"></script>
CVE-2024-39899 (Unknown, published 2024-07-09T19:15Z)
Description: value: PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/PrivateBin/PrivateBin
Files changed:
Commit message: Merge branch 'shorten-non-self-url'


Vulnerable code:

Fixed code:
CVE-2022-24437 (JavaScript, published 2022-05-01T16:15Z)
Description: value: The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/feross/git-pull-or-clone
Files changed:
index.js
Commit message: fix: fix command injection vector


Vulnerable code:
    const args = ['clone', flag, url, outPath]

Fixed code:
    const args = ['clone', flag, '--', url, outPath]
CVE-2024-38517 (C++, published 2024-07-09T19:15Z)
Description: value: Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fmalita/rapidjson
Files changed:
include/rapidjson/reader.h
test/unittest/readertest.cpp
Commit message: Prevent int underflow when parsing exponents

When parsing negative exponents, the current implementation takes
precautions for |exp| to not underflow int.

But that is not sufficient: later on [1], |exp + expFrac| is also
stored to an int - so we must ensure that the sum stays within int
representable values.

Update the exp clamping logic to take expFrac into account.

[1] https://github.com/Tencent/rapidjson/blob/master/include/rapidjson/reader.h#L1690


Vulnerable code:
                        if (exp >= 214748364) {                         // Issue #313: prevent overflow exponent

Fixed code:
                    // (exp + expFrac) must not underflow int => we're detecting when -exp gets
                    // dangerously close to INT_MIN (a pessimistic next digit 9 would push it into
                    // underflow territory):
                    //
                    //        -(exp * 10 + 9) + expFrac >= INT_MIN
                    //   <=>  exp <= (expFrac - INT_MIN - 9) / 10
                    RAPIDJSON_ASSERT(expFrac <= 0);
                    int maxExp = (expFrac + 2147483639) / 10;

                        if (RAPIDJSON_UNLIKELY(exp > maxExp)) {
    TEST_DOUBLE(fullPrecision, "1.00000000001e-2147483638", 0.0);
CVE-2021-23438 (JavaScript, published 2021-09-01T19:15Z)
Description: value: This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/aheckmann/mpath
Files changed:
lib/index.js
Commit message: fix: throw error if `parts` contains an element that isn't a string or number

Fix #13


Vulnerable code:

Fixed code:
    if (typeof parts[i] !== 'string' && typeof parts[i] !== 'number') {
      throw new TypeError('Each segment of path to `get()` must be a string or number, got ' + typeof parts[i]);
    }
    if (typeof parts[i] !== 'string' && typeof parts[i] !== 'number') {
      throw new TypeError('Each segment of path to `has()` must be a string or number, got ' + typeof parts[i]);
    }
    if (typeof parts[i] !== 'string' && typeof parts[i] !== 'number') {
      throw new TypeError('Each segment of path to `unset()` must be a string or number, got ' + typeof parts[i]);
    }
    if (typeof parts[i] !== 'string' && typeof parts[i] !== 'number') {
      throw new TypeError('Each segment of path to `set()` must be a string or number, got ' + typeof parts[i]);
    }
CVE-2019-18848 (Ruby, published 2019-11-12T15:15Z)
Description: value: The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/nov/json-jwt
Files changed:
lib/json/jwe.rb
lib/json/jws.rb
Commit message: explicitly specifying number of elements when splitting JWE string

ref.) CVE-2019-18848


Vulnerable code:
        _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.').collect do |segment|
        header, claims, signature = input.split('.', JWS::NUM_OF_SEGMENTS).collect do |segment|
        jws.signature_base_string = input.split('.')[0, JWS::NUM_OF_SEGMENTS - 1].join('.')

Fixed code:
        _header_json_, jwe.jwe_encrypted_key, jwe.iv, jwe.cipher_text, jwe.authentication_tag = input.split('.', NUM_OF_SEGMENTS).collect do |segment|
        header, claims, signature = input.split('.', NUM_OF_SEGMENTS).collect do |segment|
        jws.signature_base_string = input.split('.')[0, NUM_OF_SEGMENTS - 1].join('.')
CVE-2019-20375 (C, published 2020-01-10T05:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://bitbucket.org/ritt/elog
Files changed:
src/elogd.c
Commit message: Apply HTML escaping to "loc" command


Vulnerable code:
      if (isparam("value") && *getparam("value"))
         rsputs(loc(getparam("value")));

Fixed code:
      if (isparam("value") && *getparam("value")) {
         strencode2(str, getparam("value"), sizeof(str));
         rsputs(loc(str));
      }
CVE-2019-20376 (C, published 2020-01-10T05:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://bitbucket.org/ritt/elog
Files changed:
src/elogd.c
Commit message: Serve SVG files as attachments only to avoid XSS vulnerabilities


Vulnerable code:
         else

Fixed code:
         else if (strcmp(filetype[i].ext, ".SVG") == 0) {
            rsprintf("Content-Type: %s\r\n", filetype[i].type);
            if (strrchr(file_name, '/'))
               strlcpy(str, strrchr(file_name, '/')+1, sizeof(str));
            else
               strlcpy(str, file_name, sizeof(str));
            if (str[6] == '_' && str[13] == '_')
               rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str+14);
            else
               rsprintf("Content-Disposition: attachment; filename=\"%s\"\r\n", str);
         } else
CVE-2019-1010062 (PHP, published 2019-07-16T13:15Z)
Description: value: PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/pluck-cms/pluck
Files changed:
data/inc/images.php
Commit message: Fix issue #44. Thanks to Klaus.


Vulnerable code:

Fixed code:
		/* fix issue 44. Thanks to Klaus.  */
        $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');  
        if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist))
			show_error($lang['general']['upload_failed'], 1);
		/* end of fix issue 44. Thanks to Klaus.  */
CVE-2015-8309 (Python, published 2017-03-27T15:59Z)
Description: value: Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/devsnd/cherrymusic
Files changed:
cherrymusicserver/httphandler.py
res/js/playlistmanager.js
Commit message: fixes for CVE-2015-8309 (download arbitrary files) and CVE-2015-8309 (XSS vulnerability)

Many thanks to feedersec for checking the security of CherryMusic!

Note to CM users: Both those vulnerabilities only work for logged-in users.


Vulnerable code:
            if '/../' in f:

            pltabs += '<a href="#" onclick="playlistManager.showPlaylist('+pl.id+')">'+isplaying+' '+pl.name+ isunsaved;

Fixed code:
            # don't allow to traverse up in the file system
            if '/../' in f or f.startswith('../'):
                return 'invalid_file'
            # CVE-2015-8309: do not allow absolute file paths
            if os.path.isabs(f):
            // fix for CVE-2015-8310
            var escaped_playlist_name = $("<div>").text(pl.name).html();
            pltabs += '<a href="#" onclick="playlistManager.showPlaylist('+pl.id+')">'+isplaying+' '+escaped_playlist_name + isunsaved;
CVE-2015-8310 (Python, published 2017-03-27T15:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/devsnd/cherrymusic
Files changed:
cherrymusicserver/httphandler.py
res/js/playlistmanager.js
Commit message: fixes for CVE-2015-8309 (download arbitrary files) and CVE-2015-8309 (XSS vulnerability)

Many thanks to feedersec for checking the security of CherryMusic!

Note to CM users: Both those vulnerabilities only work for logged-in users.


Vulnerable code:
            if '/../' in f:

            pltabs += '<a href="#" onclick="playlistManager.showPlaylist('+pl.id+')">'+isplaying+' '+pl.name+ isunsaved;

Fixed code:
            # don't allow to traverse up in the file system
            if '/../' in f or f.startswith('../'):
                return 'invalid_file'
            # CVE-2015-8309: do not allow absolute file paths
            if os.path.isabs(f):
            // fix for CVE-2015-8310
            var escaped_playlist_name = $("<div>").text(pl.name).html();
            pltabs += '<a href="#" onclick="playlistManager.showPlaylist('+pl.id+')">'+isplaying+' '+escaped_playlist_name + isunsaved;
CVE-2022-31185 (HTML, published 2022-08-01T20:15Z)
Description: value: mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicked the `Hide Email Address` checkbox on their account page, or during signup. This could lead to an account's email being leaked, which may be problematic if your email needs to remain private for any reason. Users hosting their own mprweb instance will need to upgrade to the latest commit to get this fixed. Users on the official instance will already have this issue fixed.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/makedeb/mprweb
Files changed:
aurweb/routers/accounts.py
docker/redis-entrypoint.sh
templates/account/show.html
templates/partials/account_form.html
Commit message: Redis and Hide Email Address fixes

Closes #97.


Vulnerable code:
    H: str = Form(default=False),  # Hide Email
            HideEmail=H,
sed -ri 's/^bind .*$/bind 0.0.0.0 -::1/g' /etc/redis/redis.conf
                <input class="checkbox" id="id_hide" type="checkbox" name="H" {% if H %}checked="checked"{% endif %}>

Fixed code:
    H: str = Form(default="off"),  # Hide Email
    # Check if we should turn on HideEmail.
    if H == "on":
        hide_email = 1
    else:
        hide_email = 0

            HideEmail=hide_email,
sed -ri -e 's/^bind .*$/bind 0.0.0.0 -::1/g' -e 's/^protected-mode .*$/protected-mode no/g' /etc/redis/redis.conf
                    {% if request.user != user and user.HideEmail == 1 %}
		    <p class="data">None</a></p>
                    {% else %}
                    {% endif %}
                <input class="checkbox" id="id_hide" type="checkbox" name="H" value="on" {% if H or request.user.HideEmail == 1 %}checked="checked"{% endif %}>
CVE-2020-15569 (C++, published 2020-07-06T14:15Z)
Description: value: PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/milkytracker/MilkyTracker
Files changed:
src/milkyplay/PlayerGeneric.cpp
Commit message: Fix use-after-free in PlayerGeneric destructor


Vulnerable code:
	if (mixer)
		delete mixer;
		if (mixer->isActive() && !mixer->isDeviceRemoved(player))

Fixed code:
		if (mixer && mixer->isActive() && !mixer->isDeviceRemoved(player))
	
	if (mixer)
		delete mixer;
CVE-2022-34927 (C++, published 2022-08-03T01:15Z)
Description: value: MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied a crafted XM module file.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/milkytracker/MilkyTracker
Files changed:
src/milkyplay/LoaderXM.cpp
Commit message: Fix possible stack corruption with XM instrument headers claiming a size of less than 4

Closes #275


Vulnerable code:
			if (instr[y].size < 29)

Fixed code:
			if (instr[y].size >= 4 && instr[y].size < 29)
CVE-2019-10160 (Python, published 2019-06-07T18:29Z)
Description: value: A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-172 \u2014 Encoding Error
The product does not properly encode or decode the data, resulting in unexpected values.
Repository: https://github.com/python/cpython
Files changed:
Lib/test/test_urlparse.py
Lib/urllib/parse.py
Commit message: bpo-36742: Corrects fix to handle decomposition in usernames (#13812)



Vulnerable code:
            for c in denorm_chars:
                url = "{}://netloc{}false.netloc/path".format(scheme, c)
                with self.subTest(url=url, char='{:04X}'.format(ord(c))):
                    with self.assertRaises(ValueError):
                        urllib.parse.urlsplit(url)
    n = netloc.rpartition('@')[2] # ignore anything to the left of '@'
    n = n.replace(':', '')        # ignore characters already included
    n = n.replace('#', '')        # but not the surrounding text

Fixed code:
            for netloc in ["netloc{}false.netloc", "n{}user@netloc"]:
                for c in denorm_chars:
                    url = "{}://{}/path".format(scheme, netloc.format(c))
                    with self.subTest(url=url, char='{:04X}'.format(ord(c))):
                        with self.assertRaises(ValueError):
                            urllib.parse.urlsplit(url)
    n = netloc.replace('@', '')   # ignore characters already included
    n = n.replace(':', '')        # but not the surrounding text
    n = n.replace('#', '')
CVE-2019-19274 (C, published 2019-11-26T15:15Z)
Description: value: typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/python/cpython
Files changed:
Python/ast.c
Commit message: bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.

Vulnerable code:
                if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)

Fixed code:
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)