hitoshura25/cvefixes huggingface dataset:
CVE-2023-44394 (PHP, published 2023-10-16T22:15Z)
Description: value: MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.258`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`).
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
wiki.php
Commit message: Merge pull request from GHSA-v642-mh27-8j6m

Due to insufficient access-level checks on the Wiki redirection page,
any user could reveal private Projects' names, by accessing wiki.php
with sequentially incremented IDs.

Fixes #32981, CVE-2023-44394

Vulnerable code:

Fixed code:
		access_ensure_project_level( VIEWER, $f_id );
	access_ensure_bug_level( VIEWER, $f_id );
CVE-2024-34077 (PHP, published 2024-05-14T15:38Z)
Description: value: MantisBT (Mantis Bug Tracker) is an open source issue tracker. Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after the confirmation URL sent by e-mail has been opened, and the user did not complete the process by updating their password. A brute-force attack calling account_update.php with increasing user IDs is possible. A successful takeover would grant the attacker full access to the compromised account, including sensitive information and functionalities associated with the account, the extent of which depends on its privileges and the data it has access to. Version 2.26.2 contains a patch for the issue. As a workaround, one may mitigate the risk by reducing the verification token's validity (change the value of the `TOKEN_EXPIRY_AUTHENTICATED` constant in `constants_inc.php`).
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
account_update.php
verify.php
Commit message: Validate confirm hash when updating account

This prevents an attacker from resetting another user's password if they
have an incomplete account validation or password reset request pending.

Fixes #34433, CVE-2024-xxxxx


Vulnerable code:
# If token is set, it's a password reset request from verify.php, and if
# not we need to reauthenticate the user
$t_verify_user_id = gpc_get( 'verify_user_id', false );
$t_account_verification = $t_verify_user_id ? token_get_value( TOKEN_ACCOUNT_VERIFY, $t_verify_user_id ) : false;
if( !$t_account_verification ) {
	auth_reauthenticate();
	$t_user_id = auth_get_current_user_id();
} else {

Fixed code:
$t_verify_user_id = gpc_get_int( 'verify_user_id', 0 );
$t_account_verification = (bool)$t_verify_user_id;
if( $t_account_verification ) {
	# Password reset request from verify.php - validate the confirmation hash
	$f_confirm_hash = gpc_get_string( 'confirm_hash' );
	$t_token_confirm_hash = token_get_value( TOKEN_ACCOUNT_ACTIVATION, $t_verify_user_id );
	if( $t_token_confirm_hash == null || $f_confirm_hash !== $t_token_confirm_hash ) {
		trigger_error( ERROR_LOST_PASSWORD_CONFIRM_HASH_INVALID, ERROR );
	}

	# Make sure the token is not expired
	if( null === token_get_value( TOKEN_ACCOUNT_VERIFY, $t_verify_user_id ) ) {
		trigger_error( ERROR_SESSION_NOT_VALID, ERROR );
	}

} else {
	# Normal account update - authenticate the user
	auth_reauthenticate();
	$t_user_id = auth_get_current_user_id();
					<input type="hidden" name="confirm_hash" value="<?php echo string_html_specialchars( $f_confirm_hash ) ?>">
CVE-2024-34080 (PHP, published 2024-05-14T15:38Z)
Description: value: MantisBT (Mantis Bug Tracker) is an open source issue tracker. If an issue references a note that belongs to another issue that the user doesn't have access to, then it gets hyperlinked. Clicking on the link gives an access denied error as expected, yet some information remains available via the link, link label, and tooltip. This can result in disclosure of the existence of the note, the note author name, the note creation timestamp, and the issue id the note belongs to. Version 2.26.2 contains a patch for the issue. No known workarounds are available.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
core/string_api.php
Commit message: Fix access level check for note links

Fixes #34434


Vulnerable code:
							$g_project_override = bug_get_field( $t_bug_id, 'project_id' );
							if(   access_compare_level(
										user_get_access_level( auth_get_current_user_id(),
										bug_get_field( $t_bug_id, 'project_id' ) ),
										config_get( 'private_bugnote_threshold' )
								   )
								|| bugnote_get_field( $c_bugnote_id, 'reporter_id' ) == auth_get_current_user_id()
								|| bugnote_get_field( $c_bugnote_id, 'view_state' ) == VS_PUBLIC
							) {
								$g_project_override = null;
								return $p_array[1] .
									string_get_bugnote_view_link(
										$t_bug_id,
										$c_bugnote_id,
										(boolean)$p_detail_info,
										(boolean)$p_fqdn
									);

Fixed code:
							$t_project_id = bug_get_field( $t_bug_id, 'project_id' );
							$t_user_id = auth_get_current_user_id();

							$g_project_override = $t_project_id;

							$t_can_view_issue = access_has_bug_level( config_get( 'view_bug_threshold' ), $t_bug_id, $t_user_id );
							if( $t_can_view_issue ) {
								$t_can_view_note = access_compare_level(
									user_get_access_level( $t_user_id, $t_project_id ),
									config_get( 'private_bugnote_threshold' )
									)
									|| bugnote_get_field( $c_bugnote_id, 'reporter_id' ) == $t_user_id
									|| bugnote_get_field( $c_bugnote_id, 'view_state' ) == VS_PUBLIC;

								if( $t_can_view_note ) {
									$g_project_override = null;
									return $p_array[1] .
										string_get_bugnote_view_link(
											$t_bug_id,
											$c_bugnote_id,
											(boolean)$p_detail_info,
											(boolean)$p_fqdn
										);
								}
CVE-2024-34081 (PHP, published 2024-05-14T15:38Z)
Description: value: MantisBT (Mantis Bug Tracker) is an open source issue tracker.  Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when resolving or closing issues (`bug_change_status_page.php`) belonging to a project linking said custom field, viewing issues (`view_all_bug_page.php`) when the custom field is displayed as a column, or printing issues (`print_all_bug_page.php`) when the custom field is displayed as a column. Version 2.26.2 contains a patch for the issue. As a workaround, ensure Custom Field Names do not contain HTML tags.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mantisbt/mantisbt
Files changed:
bug_change_status_page.php
core/print_api.php
Commit message: Proper escaping of Custom Field name for display

Fixes XSS vulnerability on
- bug_change_status_page.php (resolving and closing issues)
- view_all_bug_page.php & print_all_bug_page.php (when the custom field
  is selected as a column for display/print)

Fixes #34432, CVE-2024-34081


Vulnerable code:
			<?php echo lang_get_defaulted( $t_def['name'] ) ?>
			print_link( 'view_all_set.php?' . $t_filter_parameter . 'sort_add=' . $t_sort_field . '&dir_add=' . $p_dir . '&type=' . FILTER_ACTION_PARSE_ADD . $t_print_parameter, $p_string );

Fixed code:
			<?php echo string_attribute( lang_get_defaulted( $t_def['name'] ) ) ?>
			$t_url = 'view_all_set.php?' . $t_filter_parameter
				. 'sort_add=' . $t_sort_field
				. '&dir_add=' . $p_dir
				. '&type=' . FILTER_ACTION_PARSE_ADD
				. $t_print_parameter;
			print_link( $t_url, string_attribute( $p_string ) );
CVE-2019-16941 (Unknown, published 2019-09-28T16:15Z)
Description: value: NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-91 \u2014 XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Repository: https://github.com/NationalSecurityAgency/ghidra
Files changed:
Commit message: Merge remote-tracking branch 'origin/GT-3198_dev747368_fix_XMLDecoder_github_1090' into Ghidra_9.1

Vulnerable code:

Fixed code:
CVE-2018-19497 (Unknown, published 2018-11-29T23:29Z)
Description: value: In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/sleuthkit/sleuthkit
Files changed:
Commit message: Merge pull request #1374 from JordyZomer/develop

Fix CVE-2018-19497. 

Vulnerable code:

Fixed code:
CVE-2019-1010065 (C, published 2019-07-18T17:15Z)
Description: value: The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/sleuthkit/sleuthkit
Files changed:
tsk/fs/hfs.c
Commit message: hfs: fix keylen check in hfs_cat_traverse()

If key->key_len is 65535, calculating "uint16_t keylen' would
cause an overflow:

   uint16_t keylen;
   ...
   keylen = 2 + tsk_getu16(hfs->fs_info.endian, key->key_len)

so the code bypasses the sanity check "if (keylen > nodesize)"
which results in crash later:

    ./toolfs/fstools/fls -b 512 -f hfs <image>
    =================================================================
    ==16==ERROR: AddressSanitizer: SEGV on unknown address 0x6210000256a4 (pc 0x00000054812b bp 0x7ffca548a8f0 sp 0x7ffca548a480 T0)
    ==16==The signal is caused by a READ memory access.
        #0 0x54812a in hfs_dir_open_meta_cb /fuzzing/sleuthkit/tsk/fs/hfs_dent.c:237:20
        #1 0x51a96c in hfs_cat_traverse /fuzzing/sleuthkit/tsk/fs/hfs.c:1082:21
        #2 0x547785 in hfs_dir_open_meta /fuzzing/sleuthkit/tsk/fs/hfs_dent.c:480:9
        #3 0x50f57d in tsk_fs_dir_open_meta /fuzzing/sleuthkit/tsk/fs/fs_dir.c:290:14
        #4 0x54af17 in tsk_fs_path2inum /fuzzing/sleuthkit/tsk/fs/ifind_lib.c:237:23
        #5 0x522266 in hfs_open /fuzzing/sleuthkit/tsk/fs/hfs.c:6579:9
        #6 0x508e89 in main /fuzzing/sleuthkit/tools/fstools/fls.cpp:267:19
        #7 0x7f9daf67c2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
        #8 0x41d679 in _start (/fuzzing/sleuthkit/tools/fstools/fls+0x41d679)

Make 'keylen' int type to prevent the overflow and fix that.
Now, I get proper error message instead of crash:
    ./toolfs/fstools/fls -b 512 -f hfs <image>
    General file system error (hfs_cat_traverse: length of key 3 in leaf node 1 too large (65537 vs 4096))


Vulnerable code:
                uint16_t keylen;
                uint16_t keylen;

Fixed code:
                int keylen;
                int keylen;
CVE-2020-10232 (C++, published 2020-03-09T00:15Z)
Description: value: In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/sleuthkit/sleuthkit
Files changed:
tsk/fs/yaffs.cpp
Commit message: Fix stack buffer overflow in yaffsfs_istat

Prevent a stack buffer overflow in yaffsfs_istat by increasing the buffer size to the size required by tsk_fs_time_to_str.


Vulnerable code:
    char timeBuf[32];

Fixed code:
    char timeBuf[128];
CVE-2022-22984 (Other, published 2022-11-30T13:15Z)
Description: value: The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/snyk/snyk-mvn-plugin
Files changed:
.snyk
lib/sub-process.ts
package.json
Commit message: fix: escape child process arguments


Vulnerable code:

Fixed code:
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
  'snyk:lic:npm:shescape:MPL-2.0':
    - '*':
        reason: None Given
        expires: 2122-12-29T08:08:41.608Z
        created: 2022-11-29T08:08:41.611Z
patch: {}
import { quoteAll } from 'shescape';
  if (args) {
    args = quoteAll(args, spawnOptions);
  }
    "shescape": "1.6.1",
CVE-2022-24739 (JSON, published 2022-03-08T22:15Z)
Description: value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Rudloff/alltube
Files changed:
composer.json
composer.lock
patches/youtube-dl-disable-generic.diff
Commit message: Disable the generic extractor entirely
It can be used for SSRF attacks even when redirects are disabled


Vulnerable code:
        "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
    "content-hash": "b5c12c24e723e5246b8003cd84de873f",
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                },
                ]
diff --git a/youtube_dl/extractor/generic.py b/youtube_dl/extractor/generic.py
index f99d887ca..749ed6ecf 100644
+++ b/youtube_dl/extractor/generic.py
@@ -2252,6 +2252,7 @@ class GenericIE(InfoExtractor):
 
     def report_following_redirect(self, new_url):
         """Report information extraction."""
+        raise UnsupportedError('Redirects are not allowed')
         self._downloader.to_screen('[redirect] Following redirect to %s' % new_url)
 
     def _extract_rss(self, url, video_id, doc):

Fixed code:
        "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
    "content-hash": "87b2074ab1d8a7ee59f719e26130ca36",
                ],
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                }
diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
index 18d8dbcd6..4d3edfac3 100644
--- a/youtube_dl/extractor/__init__.py
@@ -13,7 +13,6 @@ except ImportError:
         for name, klass in globals().items()
         if name.endswith('IE') and name != 'GenericIE'
     ]
-    _ALL_CLASSES.append(GenericIE)
 
 
 def gen_extractor_classes():
CVE-2022-24739 (JSON, published 2022-03-08T22:15Z)
Description: value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/Rudloff/alltube
Files changed:
composer.json
composer.lock
patches/youtube-dl-disable-generic.diff
Commit message: Disable the generic extractor entirely
It can be used for SSRF attacks even when redirects are disabled


Vulnerable code:
        "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
    "content-hash": "b5c12c24e723e5246b8003cd84de873f",
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                },
                ]
diff --git a/youtube_dl/extractor/generic.py b/youtube_dl/extractor/generic.py
index f99d887ca..749ed6ecf 100644
+++ b/youtube_dl/extractor/generic.py
@@ -2252,6 +2252,7 @@ class GenericIE(InfoExtractor):
 
     def report_following_redirect(self, new_url):
         """Report information extraction."""
+        raise UnsupportedError('Redirects are not allowed')
         self._downloader.to_screen('[redirect] Following redirect to %s' % new_url)
 
     def _extract_rss(self, url, video_id, doc):

Fixed code:
        "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
    "content-hash": "87b2074ab1d8a7ee59f719e26130ca36",
                ],
                "psr-4": {
                    "Amp\\Serialization\\": "src"
                }
diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
index 18d8dbcd6..4d3edfac3 100644
--- a/youtube_dl/extractor/__init__.py
@@ -13,7 +13,6 @@ except ImportError:
         for name, klass in globals().items()
         if name.endswith('IE') and name != 'GenericIE'
     ]
-    _ALL_CLASSES.append(GenericIE)
 
 
 def gen_extractor_classes():
CVE-2022-24739 (PHP, published 2022-03-08T22:15Z)
Description: value: alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured). The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.) 3.0.3 contains a fix for this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Rudloff/alltube
Files changed:
classes/Factory/ViewFactory.php
index.php
templates/inc/logo.tpl
Commit message: Don't redirect to REQUEST_URI when browsing to index.php
Instead, we can make sure everything works correctly on index.php


Vulnerable code:
if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
    die;
}

    <a class="logocompatible" href="{base_url}">

Fixed code:
    /**
     * @param Uri $uri
     * @return Uri
     */
    private static function cleanBasePath(Uri $uri): Uri
    {
        $basePath = $uri->getBasePath();
        if (str_ends_with($basePath, 'index.php')) {
            /*
             * When the base path ends with index.php,
             * routing works correctly, but it breaks the URL of static assets using {base_url}.
             * So we alter the base path but only in the URI used by SmartyPlugins.
             */
            $uri = $uri->withBasePath(dirname($basePath));
        }

        return $uri;
    }

        $uri = self::cleanBasePath($uri);

    <a class="logocompatible" href="{path_for name="index"}">