hitoshura25/cvefixes huggingface dataset:
CVE-2015-20108 (Ruby, published 2023-05-27T19:15Z)
Description: value: xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/SAML-Toolkits/ruby-saml
Files changed:
lib/xml_security.rb
Commit message: Fix possible xpath injection


Vulnerable code:
        hashed_element = document.at_xpath("//*[@ID='#{uri[1..-1]}']")

Fixed code:
        hashed_element = document.at_xpath("//*[@ID=$uri]", nil, { 'uri' => uri[1..-1] })
CVE-2016-10577 (JSON, published 2018-05-29T20:29Z)
Description: value: ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/ibmdb/node-ibm_db
Files changed:
installer/driverInstall.js
package.json
Commit message: fix for issue #208


Vulnerable code:
var http = require('http');
var installerURL = 'http://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli/';
        
            var compress = targz.decompress({src: INSTALLER_FILE, dest: "DOWNLOAD_DIR"}, function(err){
                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node"
             port: 80,
  "homepage": "http://github.com/ibmdb/node-ibm_db/",

Fixed code:
var http = require('https');
var installerURL = 'https://public.dhe.ibm.com/ibmdl/export/pub/software/data/db2/drivers/odbc_cli';
            process.stdout.write((platform == 'win32') ? "\033[0G": "\r");
            process.stdout.write("Downloaded " + (100.0 * byteIndex / fileLength).toFixed(2) + 
                                 "% (" + byteIndex + " bytes)");
             console.log("\n");
            var compress = targz.decompress({src: INSTALLER_FILE, dest: DOWNLOAD_DIR}, function(err){
                var nameToolCommand = "install_name_tool -change libdb2.dylib $IBM_DB_HOME/lib/libdb2.dylib ./build/Release/odbc_bindings.node" ;
             port: 443,
  "homepage": "https://github.com/ibmdb/node-ibm_db/",
CVE-2013-3081 (PHP, published 2014-06-09T19:55Z)
Description: value: SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header to /articles/test/.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/JojoCMS/Jojo-CMS
Files changed:
plugins/jojo_core/classes/Jojo.php
Commit message: Fix SQL injection issue CVE-2013-3081


Vulnerable code:
            return $iparray[0];
            return getenv('REMOTE_ADDR');
        } else {
            return false;

Fixed code:
        $ip = false;
            $ip = $iparray[0];
            $ip = getenv('REMOTE_ADDR');
        /* check IP is valid format */
        if (preg_match('/\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b/', $ip)) {
        	return $ip;
        }
        return false;
CVE-2024-32035 (Unknown, published 2024-04-15T20:15Z)
Description: value: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in image decoders. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.  This flaw can be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on ImageSharp for image processing tasks. Users and administrators are advised to update to the latest version of ImageSharp that addresses this vulnerability to mitigate the risk of exploitation. The problem has been patched in v3.1.4 and v2.1.8.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SixLabors/ImageSharp
Files changed:
Commit message: Merge pull request #2706 from SixLabors/af/memlimit-01

Limit all memory allocations in the MemoryAllocator layer

Vulnerable code:

Fixed code:
CVE-2024-32036 (Unknown, published 2024-04-15T20:15Z)
Description: value: ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SixLabors/ImageSharp
Files changed:
Commit message: Merge pull request #2716 from SixLabors/js/clear-buffers

Clear Pixel Buffers on Decode.

Vulnerable code:

Fixed code:
CVE-2024-41131 (Unknown, published 2024-07-22T15:15Z)
Description: value: ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SixLabors/ImageSharp
Files changed:
Commit message: Merge pull request #2754 from SixLabors/backport-v3/gif-lzw

v3 - Backport. Handle out of bounds Gif LZW max code

Vulnerable code:

Fixed code:
CVE-2024-41132 (Unknown, published 2024-07-22T15:15Z)
Description: value: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SixLabors/ImageSharp
Files changed:
Commit message: Merge pull request #2764 from SixLabors/js/v4-merge-2758-fix

v4 Fix 2758

Vulnerable code:

Fixed code:
CVE-2024-41132 (Unknown, published 2024-07-22T15:15Z)
Description: value: ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SixLabors/ImageSharp
Files changed:
Commit message: Merge pull request #2759 from SixLabors/js/fix-2758

v3.1.x Fix 2758

Vulnerable code:

Fixed code:
CVE-2023-48707 (Unknown, published 2023-11-24T18:15Z)
Description: value: CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/codeigniter4/shield
Files changed:
Commit message: Merge pull request from GHSA-v427-c49j-8w6x

fix: Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication 

Vulnerable code:

Fixed code:
CVE-2023-48708 (Unknown, published 2023-11-24T18:15Z)
Description: value: CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. Users unable to upgrade should disable logging for successful login attempts by the configuration files.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/codeigniter4/shield
Files changed:
Commit message: Merge pull request from GHSA-j72f-h752-mx4w

fix: raw token logging

Vulnerable code:

Fixed code:
CVE-2020-19491 (C, published 2021-07-21T18:15Z)
Description: value: There is an invalid memory access bug in cgif.c that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possibly unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/pts/sam2p
Files changed:
cgif.c
Commit message: fixed segfault in GIF reading; this fixes https://github.com/pts/sam2p/issues/67


Vulnerable code:
  			  AddExtensionBlock(sp, ExtData[0], ExtData+1);

Fixed code:
                          AddExtensionBlock(&ext, ExtData[0], ExtData+1);
                          ext.ExtensionBlocks[ext.ExtensionBlockCount-1].code=ext_code;
CVE-2020-19492 (Other, published 2021-07-21T18:15Z)
Description: value: There is a floating point exception in ReadImage that leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial of service or possibly unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pts/sam2p
Files changed:
input-tga.ci
Commit message: improved error reporting for 0-width in TGA loading; this fixes https://github.com/pts/sam2p/issues/66


Vulnerable code:
  if (wh / width != height) {

Fixed code:
  if (width != 0 && wh / width != height) {
CVE-2022-21122 (JavaScript, published 2022-06-08T09:15Z)
Description: value: The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/metarhia/metacalc
Files changed:
CHANGELOG.md
lib/sheet.js
test/unit.js
Commit message: Prevent arbitrary js code execution

PR-URL: https://github.com/metarhia/metacalc/pull/16


Vulnerable code:
  if (prop === 'Math') return Math;

Fixed code:
- Prevent arbitrary js code execution

const wrap = (target) =>
  new Proxy(target, {
    get: (target, prop) => {
      if (prop === 'constructor') return null;
      const value = target[prop];
      if (typeof value === 'number') return value;
      return wrap(value);
    },
  });

const math = wrap(Math);

  if (prop === 'Math') return math;

metatests.test('Prevent arbitrary js code execution', async (test) => {
  const sheet = new Sheet();
  sheet.cells['A1'] =
    '=Math.constructor.constructor("console.log(\\"Hello, World!\\")")();';
  try {
    const res = sheet.values['A1'];
    test.strictSame(res, undefined);
  } catch (error) {
    test.strictSame(
      error.message,
      `Cannot read property '${'constructor'}' of null`
    );
  }
  test.end();
});
CVE-2020-36646 (C++, published 2023-01-07T20:15Z)
Description: value: A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/MediaArea/ZenLib
Files changed:
Source/ZenLib/Ztring.cpp
Commit message: fix V522 [CWE-690] There might be dereferencing of a potential null pointer 'Gmt'.


Vulnerable code:

Fixed code:
    if (Gmt)
    {
    }
CVE-2024-29897 (PHP, published 2024-03-28T14:15Z)
Description: value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit `6bc0685`. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere. This vulnerability is fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/miraheze/mw-config
Files changed:
GlobalSettings.php
Commit message: T11999: Disable Special:RequestWikiQueue outside of metawiki (#5518)



Vulnerable code:

Fixed code:
use MediaWiki\SpecialPage\DisabledSpecialPage;
// T11999: Disable Special:RequestWikiQueue outside of metawiki
if ( $wi->dbname !== 'metawiki' ) {
	$wgSpecialPages['RequestWikiQueue'] = DisabledSpecialPage::getCallback( 'RequestWikiQueue', 'createwiki-requestwikiqueue-disabled' );
}
CVE-2024-34701 (PHP, published 2024-05-14T15:39Z)
Description: value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there.

Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings.

As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm..
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/miraheze/mw-config
Files changed:
LocalSettings.php
Commit message: Add wgCreateWikiDisableRESTAPI (#5549)



Vulnerable code:

Fixed code:
	'wgCreateWikiDisableRESTAPI' => [
		'default' => true,
		'metawiki' => false,
		'metawikibeta' => false,
	],
CVE-2024-34701 (PHP, published 2024-05-14T15:39Z)
Description: value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there.

Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings.

As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm..
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/miraheze/mw-config
Files changed:
GlobalSettings.php
Commit message: T12102: Disable CreateWiki's special pages outside of the global wikis (#5551)



Vulnerable code:

Fixed code:
use MediaWiki\SpecialPage\DisabledSpecialPage;
if ( $wi->dbname !== 'metawiki' && $wi->dbname !== 'metawikibeta' ) {
	$wgSpecialPages['RequestWikiQueue'] = DisabledSpecialPage::getCallback( 'RequestWikiQueue', 'createwiki-requestwikiqueue-disabled' );
	$wgSpecialPages['RequestWiki'] = DisabledSpecialPage::getCallback( 'RequestWiki', 'createwiki-requestwiki-disabled' );
	$wgSpecialPages['CreateWiki'] = DisabledSpecialPage::getCallback( 'CreateWiki', 'createwiki-createwiki-disabled' );
}
CVE-2023-43641 (Other, published 2023-10-09T22:15Z)
Description: value: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/lipnitsk/libcue
Files changed:
CMakeLists.txt
ChangeLog
Commit message: Changelog, CMakeLists.txt: Release 2.3.0

Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>


Vulnerable code:
SET(PACKAGE_VERSION 2.2.1)

Fixed code:
SET(PACKAGE_VERSION 2.3.0)
libcue (2.3.0)
	[Vlad Stulikov, Vasiliy Sazonov]
	* Bug fix - no EOF handling

	[Kevin Backhouse]
	* Fix CVE-2023-43641
CVE-2023-43641 (C, published 2023-10-09T22:15Z)
Description: value: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/lipnitsk/libcue
Files changed:
cd.c
Commit message: Check that the array index isn't negative. This fixes CVE-2023-43641.

Signed-off-by: Kevin Backhouse <kevinbackhouse@github.com>


Vulnerable code:
	if (i > MAXINDEX) {

Fixed code:
	if (i < 0 || i > MAXINDEX) {