hitoshura25/cvefixes huggingface dataset:
CVE-2024-29022 (PHP, published 2024-04-12T21:15Z)
Description: value: Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script into the session page to exfiltrate session IDs and User Agents. These session IDs / User Agents can subsequently be used to hijack active sessions. A malicious script can be injected into the display grid to exfiltrate information related to displays. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Upgrading to a fixed version is necessary to remediate. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dasgarner/xibo-cms
Files changed:
lib/Controller/Sessions.php
lib/Factory/SessionFactory.php
lib/Helper/Session.php
lib/Xmds/Soap.php
Commit message: Sessions: Add sanitization in getIp() and disable output of session ID in session grid.


Vulnerable code:
                $row->buttons[] = array(
                );
            $entries[] = $this->createEmpty()->hydrate($row, ['stringProperties' => ['sessionId']]);
        $userAgent = substr($_SERVER['HTTP_USER_AGENT'], 0, 253);
            'useragent' => substr($_SERVER['HTTP_USER_AGENT'], 0, 253),
            if (isset($_SERVER[$key])) {
            if (isset($_SERVER[$key])) {

Fixed code:
                /*$row->buttons[] = array(
                );*/
            $session = $this->createEmpty()->hydrate($row, [
                'stringProperties' => ['sessionId'],
                'intProperties' => ['isExpired']
            ]);
            $session->userAgent = htmlspecialchars($session->userAgent);
            $session->remoteAddress = filter_var($session->remoteAddress, FILTER_VALIDATE_IP);
            $session->excludeProperty('sessionId');
            $entries[] = $session;
        $userAgent = substr(htmlspecialchars($_SERVER['HTTP_USER_AGENT']), 0, 253);
            'useragent' => substr(htmlspecialchars($_SERVER['HTTP_USER_AGENT']), 0, 253),
            if (isset($_SERVER[$key]) && filter_var($_SERVER[$key], FILTER_VALIDATE_IP) !== false) {
            if (isset($_SERVER[$key]) && filter_var($_SERVER[$key], FILTER_VALIDATE_IP) !== false) {
CVE-2024-29023 (PHP, published 2024-04-12T21:15Z)
Description: value: Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are exposed in the return of session search API call on the sessions page. Subsequently they can be exfiltrated and used to hijack a session. Users must be granted access to the session page, or be a super admin. Users should upgrade to version 3.3.10 or 4.0.9 which fix this issue. Customers who host their CMS with the Xibo Signage service have already received an upgrade or patch to resolve this issue regardless of the CMS version that they are running. Patches are available for earlier versions of Xibo CMS that are out of security support: 2.3 patch ebeccd000b51f00b9a25f56a2f252d6812ebf850.diff. 1.8 patch a81044e6ccdd92cc967e34c125bd8162432e51bc.diff. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dasgarner/xibo-cms
Files changed:
lib/Controller/Sessions.php
lib/Factory/SessionFactory.php
lib/Helper/Session.php
lib/Xmds/Soap.php
Commit message: Sessions: Add sanitization in getIp() and disable output of session ID in session grid.


Vulnerable code:
                $row->buttons[] = array(
                );
            $entries[] = $this->createEmpty()->hydrate($row, ['stringProperties' => ['sessionId']]);
        $userAgent = substr($_SERVER['HTTP_USER_AGENT'], 0, 253);
            'useragent' => substr($_SERVER['HTTP_USER_AGENT'], 0, 253),
            if (isset($_SERVER[$key])) {
            if (isset($_SERVER[$key])) {

Fixed code:
                /*$row->buttons[] = array(
                );*/
            $session = $this->createEmpty()->hydrate($row, [
                'stringProperties' => ['sessionId'],
                'intProperties' => ['isExpired']
            ]);
            $session->userAgent = htmlspecialchars($session->userAgent);
            $session->remoteAddress = filter_var($session->remoteAddress, FILTER_VALIDATE_IP);
            $session->excludeProperty('sessionId');
            $entries[] = $session;
        $userAgent = substr(htmlspecialchars($_SERVER['HTTP_USER_AGENT']), 0, 253);
            'useragent' => substr(htmlspecialchars($_SERVER['HTTP_USER_AGENT']), 0, 253),
            if (isset($_SERVER[$key]) && filter_var($_SERVER[$key], FILTER_VALIDATE_IP) !== false) {
            if (isset($_SERVER[$key]) && filter_var($_SERVER[$key], FILTER_VALIDATE_IP) !== false) {
CVE-2021-36979 (C, published 2021-07-20T07:15Z)
Description: value: Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_armeb (called from cpu_arm_exec_armeb and tcg_cpu_exec_armeb).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/unicorn-engine/unicorn
Files changed:
samples/sample_arm.c
Commit message: Add arm ite blocks samples from #853 (#1381)



Vulnerable code:

Fixed code:
#define ARM_THUM_COND_CODE "\x9a\x42\x14\xbf\x68\x22\x4d\x22" // 'cmp r2, r3\nit ne\nmov r2, #0x68\nmov r2, #0x4d'

static void test_thumb_ite() {
    uc_engine *uc;
    uc_err err;

    uint32_t sp = 0x1234;
    uint32_t r2 = 0, r3 = 1;
    uint32_t step_r2, step_r3;

    int i, addr=ADDRESS;

    printf("Emulate a THUMB ITE block as a whole or per instruction.\n");
    err = uc_open(UC_ARCH_ARM, UC_MODE_THUMB, &uc);
    if (err) {
        printf("Failed on uc_open() with error returned: %u (%s)\n",
                err, uc_strerror(err));
        return;
    }

    uc_mem_map(uc, ADDRESS, 2 * 1024 * 1024, UC_PROT_ALL);

    uc_mem_write(uc, ADDRESS, ARM_THUM_COND_CODE, sizeof(ARM_THUM_COND_CODE) - 1);

    uc_reg_write(uc, UC_ARM_REG_SP, &sp);

    uc_reg_write(uc, UC_ARM_REG_R2, &r2);
    uc_reg_write(uc, UC_ARM_REG_R3, &r3);

    // Run once.
    printf("Running the entire binary.\n");
    err = uc_emu_start(uc, ADDRESS | 1, ADDRESS + sizeof(ARM_THUM_COND_CODE) - 1, 0, 0);
    if (err) {
        printf("Failed on uc_emu_start() with error returned: %u\n", err);
    }
    uc_reg_read(uc, UC_ARM_REG_R2, &r2);
    uc_reg_read(uc, UC_ARM_REG_R3, &r3);

    printf(">>> R2: %d\n", r2);
    printf(">>> R3: %d\n\n", r3);

    // Step each instruction.
    printf("Running the binary one instruction at a time.\n");
    for (i = 0; i < sizeof(ARM_THUM_COND_CODE) / 2; i++) {
        err = uc_emu_start(uc, addr | 1, ADDRESS + sizeof(ARM_THUM_COND_CODE) - 1, 0, 1);
        if (err) {
            printf("Failed on uc_emu_start() with error returned: %u\n", err);
        }
        uc_reg_read(uc, UC_ARM_REG_PC, &addr);
    }

    uc_reg_read(uc, UC_ARM_REG_R2, &step_r2);
    uc_reg_read(uc, UC_ARM_REG_R3, &step_r3);

    printf(">>> R2: %d\n", step_r2);
    printf(">>> R3: %d\n\n", step_r3);

    if (step_r2 != r2 || step_r3 != r3) {
        printf("Failed with ARM ITE blocks stepping!\n");
    }

    uc_close(uc);
}


    printf("==========================\n");
    test_thumb_ite();
CVE-2021-44078 (C, published 2021-12-26T05:15Z)
Description: value: An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/unicorn-engine/unicorn
Files changed:
qemu/accel/tcg/translate-all.c
uc.c
Commit message: Fix wrong offset used in split_region


Vulnerable code:
    // GVA to GPA (GPA -> HVA via page_find, HVA->HPA via host mmu)
        if (block->offset <= mr->addr &&

Fixed code:
    // GVA to GPA 
    // (GPA -> HVA via memory_region_get_ram_addr(mr) + GPA + block->host,
    // HVA->HPA via host mmu)
        // block->offset is the offset within ram_addr_t, not GPA
        if (block->mr->addr <= mr->addr &&
CVE-2022-29693 (Unknown, published 2022-06-02T14:15Z)
Description: value: Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/unicorn-engine/unicorn
Files changed:
Commit message: Merge pull request #1587 from liyansong2018/dev

Fix https://github.com/unicorn-engine/unicorn/issues/1586

Vulnerable code:

Fixed code:
CVE-2020-1920 (JavaScript, published 2021-06-01T14:15Z)
Description: value: A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/facebook/react-native
Files changed:
Libraries/Blob/URL.js
Commit message: Update validateBaseUrl to use latest regex

Summary:
Updating the regex to avoid a potential regular expression denial-of-service vulnerability.

Changelog: Update validateBaseUrl to use a more robust regular expression. Fixes CVE-2020-1920, GHSL-2020-293

Reviewed By: lunaleaps

Differential Revision: D25507604

fbshipit-source-id: c36a03c456881bc655c861e1a2c5cd41a7127c9d


Vulnerable code:
  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(

Fixed code:
  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(
CVE-2022-36032 (PHP, published 2022-09-06T19:15Z)
Description: value: ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/reactphp/http
Files changed:
README.md
examples/55-server-cookie-handling.php
src/Message/ServerRequest.php
tests/Message/ServerRequestTest.php
Commit message: Do not decode cookie names anymore


Vulnerable code:
    $key = 'react\php';
    )->withHeader('Set-Cookie', urlencode($key) . '=' . urlencode('test;more'));
    $key = 'react\php';
    )->withHeader('Set-Cookie', urlencode($key) . '=' . urlencode('test;more'));
                $key = \urldecode($nameValuePair[0]);
        $this->assertEquals(array('react;php' => 'is great'), $cookies);

Fixed code:
    $key = 'greeting';
    )->withHeader('Set-Cookie', $key . '=' . urlencode('Hello world!'));
    $key = 'greeting';
    )->withHeader('Set-Cookie', $key . '=' . urlencode('Hello world!'));
                $key = $nameValuePair[0];
        $this->assertEquals(array('react%3Bphp' => 'is great'), $cookies);
CVE-2022-36032 (PHP, published 2022-09-06T19:15Z)
Description: value: ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-565 \u2014 Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Repository: https://github.com/reactphp/http
Files changed:
README.md
examples/55-server-cookie-handling.php
src/Message/ServerRequest.php
tests/Message/ServerRequestTest.php
Commit message: Do not decode cookie names anymore


Vulnerable code:
    $key = 'react\php';
    )->withHeader('Set-Cookie', urlencode($key) . '=' . urlencode('test;more'));
    $key = 'react\php';
    )->withHeader('Set-Cookie', urlencode($key) . '=' . urlencode('test;more'));
                $key = \urldecode($nameValuePair[0]);
        $this->assertEquals(array('react;php' => 'is great'), $cookies);

Fixed code:
    $key = 'greeting';
    )->withHeader('Set-Cookie', $key . '=' . urlencode('Hello world!'));
    $key = 'greeting';
    )->withHeader('Set-Cookie', $key . '=' . urlencode('Hello world!'));
                $key = $nameValuePair[0];
        $this->assertEquals(array('react%3Bphp' => 'is great'), $cookies);
CVE-2023-26044 (Unknown, published 2023-05-17T18:15Z)
Description: value: react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.  Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. This issue has been addressed in release 1.9.0. Users are advised to upgrade. Users unable to upgrade may keep the request body limited using RequestBodyBufferMiddleware with a sensible value which should mitigate the issue. An infrastructure or DevOps workaround could be to place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/reactphp/http
Files changed:
Commit message: Merge pull request from GHSA-95x4-j7vc-h8mf

Stop parsing multipart request bodies once the configured limit of form fields and files has been reached

Vulnerable code:

Fixed code:
CVE-2024-32005 (Python, published 2024-04-12T21:15Z)
Description: value: NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/zauberzeug/nicegui
Files changed:
nicegui/nicegui.py
Commit message: prevent local file access (see security advisory GHSA-mwc7-64wg-pgvj)


Vulnerable code:

Fixed code:
        try:
            filepath.resolve().relative_to(resources[key].path.resolve())  # NOTE: use is_relative_to() in Python 3.9
        except ValueError as e:
            raise HTTPException(status_code=403, detail='forbidden') from e
CVE-2018-3732 (JavaScript, published 2018-06-07T02:29Z)
Description: value: resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pillarjs/resolve-path
Files changed:
HISTORY.md
index.js
test/resolvePath.js
Commit message: Fix resolving paths with certain special characters


Vulnerable code:
  // resolve & normalize the root path
  root = normalize(resolve(root) + sep)

  // resolve the path
  return resolve(root, path)

Fixed code:
  * Fix resolving paths with certain special characters
var join = require('path').join
  // join the relative path
  return normalize(join(resolve(root), path))
      it('should resolve relative with special characters', function () {
        assert.equal(normalize(resolvePath('f:oo$bar')),
          normalize(join(process.cwd(), './f:oo$bar')))
      })

      it('should resolve relative to rootPath with special characters', function () {
        assert.equal(normalize(resolvePath(__dirname, 'f:oo$bar')),
        normalize(resolve(__dirname, './f:oo$bar')))
      })
CVE-2023-30620 (Python, published 2023-04-21T21:15Z)
Description: value: mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed using `tarfile.extractall()` from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. An attacker may leverage this vulnerability to overwrite any local file which the server process has access to. There is no risk of file exposure with this vulnerability. This issue has been addressed in release `23.2.1.0 `. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/mindsdb/mindsdb
Files changed:
mindsdb/api/http/namespaces/file.py
mindsdb/api/http/utils.py
Commit message: Use safe extract to prevent CVE-2007-4559 bug


Vulnerable code:
from mindsdb.api.http.utils import http_error
                    f.extractall(temp_dir_path)

Fixed code:
from mindsdb.api.http.utils import http_error, safe_extract
                    safe_extract(f, temp_dir_path)
import os

def __is_within_directory(directory, target):
    abs_directory = os.path.abspath(directory)
    abs_target = os.path.abspath(target)
    prefix = os.path.commonprefix([abs_directory, abs_target])
    return prefix == abs_directory

def safe_extract(tar, path=".", members=None, *, numeric_owner=False):
    for member in tar.getmembers():
        member_path = os.path.join(path, member.name)
        if not __is_within_directory(path, member_path):
            raise Exception("Attempted Path Traversal in Tar File")
    tar.extractall(path, members, numeric_owner)
CVE-2023-38699 (Python, published 2023-08-04T18:15Z)
Description: value: MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/mindsdb/mindsdb
Files changed:
mindsdb/integrations/handlers/dremio_handler/dremio_handler.py
Commit message: Update dremio_handler.py

Vulnerable code:
        response = requests.post(self.base_url + '/apiv2/login', headers=headers, data=data, verify=False)
)

Fixed code:
        response = requests.post(self.base_url + '/apiv2/login', headers=headers, data=data)
)