hitoshura25/cvefixes huggingface dataset:
CVE-2021-4266 (Unknown, published 2022-12-21T19:15Z)
Description: value: A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 9.5.0.0-81 is able to address this issue. The name of the patch is 3bff900d228e8cae3af256b447c5d15bdb03c174. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216468.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webdetails/cpf
Files changed:
Commit message: Merge pull request #165 from dcleao/PPP-4690

[PPP-4690] XSS on pentaho-cdf-dd/api/renderer/render?root parameter

Vulnerable code:

Fixed code:
CVE-2021-21293 (Unknown, published 2021-02-02T22:15Z)
Description: value: blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. All servers running blaze-core before version 0.14.15 are affected by a vulnerability in which unbounded connection acceptance leads to file handle exhaustion. Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. The vast majority of affected users are using it as part of http4s-blaze-server <= 0.21.16. http4s provides a mechanism for limiting open connections, but is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. The issue is fixed in version 0.14.15 for "NIO1SocketServerGroup". A "maxConnections" parameter is added, with a default value of 512. Concurrent connections beyond this limit are rejected. To run unbounded, which is not recommended, set a negative number. The "NIO2SocketServerGroup" has no such setting and is now deprecated. There are several possible workarounds described in the refrenced GitHub Advisory GHSA-xmw9-q7x9-j5qc.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/http4s/blaze
Files changed:
Commit message: Merge pull request from GHSA-xmw9-q7x9-j5qc

Fix GHSA-xmw9-q7x9-j5qc by limiting accepted connections

Vulnerable code:

Fixed code:
CVE-2024-31446 (Lua, published 2024-04-16T20:15Z)
Description: value: OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lua VM, which eventually blocks the Server thread, requiring the server to be forcibly shut down. This can be accomplished using any device in the mod and can be performed by anyone who can execute Lua code on them. This occurs while using the native Lua library. LuaJ appears to not have this issue. This vulnerability is fixed in 1.8.4. The GregTech: New Horizons modpack uses its own modified version of OpenComputers. They have applied the relevant patch in version 1.10.10-GTNH.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MightyPirates/OpenComputers
Files changed:
src/main/resources/assets/opencomputers/lua/machine.lua
Commit message: Fix pcall()/xpcall() bug.


Vulnerable code:
    local handled = false
    local result = table.pack(xpcall(f, function(...)
      if rawequal((...), tooLongWithoutYielding) then
        return tooLongWithoutYielding
      elseif handled then
        return ...
      else
        handled = true
        return msgh(...)
      end
    end, ...))

Fixed code:
    -- prevent infinite pcall() loops by checking deadline before pcall()
    local status, err = pcall(checkDeadline)
    if not status then return false, err end

    -- allow xpcall() to call the message handler recursively, per manual 2.3
    -- Lua itself promises to break the infinite loop; failing that, the timeout
    -- check will take care of this.
    local errorCapture
    errorCapture = function(ff, ...)
      -- prevent infinite xpcall() loops by checking deadline before xpcall()
      local status, err = pcall(checkDeadline)
      if not status then return false, err end

      return xpcall(ff, function(...)
        if rawequal((...), tooLongWithoutYielding) then
          return tooLongWithoutYielding
        else
          return select(2, errorCapture(msgh, ...))
        end
      end, ...)
    end

    local result = table.pack(errorCapture(f, ...))
    -- if the final returned error is due to timeout, run handler one last time
CVE-2022-4892 (PHP, published 2023-01-19T08:15Z)
Description: value: A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component Visitors Module. The manipulation of the argument original/converted leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named d64fcba4882a50e21cdbec3eb4a080cb694d26ee. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218895.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/andrzuk/MyCMS
Files changed:
lib/gener/view.php
Commit message: Vulnerability fix: add strip_tags to details view in visitors module.


Vulnerable code:
						$main_text .= '<a href="' . $original . '" target="_blank">' . $converted . '</a>';
				$main_text .= $this->row[$db_name];

Fixed code:
						$main_text .= '<a href="' . strip_tags($original) . '" target="_blank">' . strip_tags($converted) . '</a>';
				$main_text .= strip_tags($this->row[$db_name]);
CVE-2019-19855 (Other, published 2020-01-15T23:15Z)
Description: value: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows stored XSS via the auth_type parameter.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SerpicoProject/Serpico
Files changed:
views/add_user.haml
views/add_user_report.haml
views/list_user.haml
Commit message: rack protection updates


Vulnerable code:
  %h1.h2 Editing #{@report.report_name} Report
              #{user}
              #{user.username}
              #{user.type} / #{user.auth_type}

Fixed code:
  %input#authenticity-token{:type => "hidden", :name => "authenticity_token", :value => "#{env['rack.session'][:csrf]}" }
  %h1.h2 Editing #{@report.report_name} Report FFFF
              :escaped
                #{user}
              :escaped
                #{user.username}
              :escaped
                #{user.type} / #{user.auth_type}
CVE-2019-19856 (Other, published 2020-01-15T23:15Z)
Description: value: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via the type parameter.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SerpicoProject/Serpico
Files changed:
views/add_user.haml
views/add_user_report.haml
views/list_user.haml
Commit message: rack protection updates


Vulnerable code:
  %h1.h2 Editing #{@report.report_name} Report
              #{user}
              #{user.username}
              #{user.type} / #{user.auth_type}

Fixed code:
  %input#authenticity-token{:type => "hidden", :name => "authenticity_token", :value => "#{env['rack.session'][:csrf]}" }
  %h1.h2 Editing #{@report.report_name} Report FFFF
              :escaped
                #{user}
              :escaped
                #{user.username}
              :escaped
                #{user.type} / #{user.auth_type}
CVE-2019-19858 (Other, published 2020-01-15T23:15Z)
Description: value: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows stored XSS via the author parameter.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SerpicoProject/Serpico
Files changed:
views/add_user.haml
views/add_user_report.haml
views/list_user.haml
Commit message: rack protection updates


Vulnerable code:
  %h1.h2 Editing #{@report.report_name} Report
              #{user}
              #{user.username}
              #{user.type} / #{user.auth_type}

Fixed code:
  %input#authenticity-token{:type => "hidden", :name => "authenticity_token", :value => "#{env['rack.session'][:csrf]}" }
  %h1.h2 Editing #{@report.report_name} Report FFFF
              :escaped
                #{user}
              :escaped
                #{user.username}
              :escaped
                #{user.type} / #{user.auth_type}
CVE-2023-28115 (Unknown, published 2023-03-17T22:15Z)
Description: value: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer code with vulnerable POP chains. It has been fixed in version 1.4.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/KnpLabs/snappy
Files changed:
Commit message: Merge pull request #469 from KnpLabs/fix/GHSA-gq6w-q6wh-jggc

fix: security issue GHSA-gq6w-q6wh-jggc

Vulnerable code:

Fixed code:
CVE-2023-28115 (PHP, published 2023-03-17T22:15Z)
Description: value: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer code with vulnerable POP chains. It has been fixed in version 1.4.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/KnpLabs/snappy
Files changed:
src/Knp/Snappy/AbstractGenerator.php
tests/Knp/Snappy/AbstractGeneratorTest.php
Commit message: fix: security issue GHSA-gq6w-q6wh-jggc


Vulnerable code:

Fixed code:
        if (\strpos($filename, 'phar://') === 0) {
            throw new InvalidArgumentException('The output file cannot be a phar archive.');
        }

    public function testFailingGenerateWithOutputContainingPharPrefix(): void
    {
        $media = $this->getMockBuilder(AbstractGenerator::class)
            ->setMethods([
                'configure',
                'prepareOutput',
            ])
            ->setConstructorArgs(['the_binary', [], ['PATH' => '/usr/bin']])
            ->getMock()
        ;

        $media->setTimeout(2000);

        $media
            ->expects($this->once())
            ->method('prepareOutput')
            ->with($this->equalTo('phar://the_output_file'))
        ;

        $this->expectException(InvalidArgumentException::class);

        $media->generate('the_input_file', 'phar://the_output_file', ['foo' => 'bar']);
    }
CVE-2023-41330 (Unknown, published 2023-09-06T18:15Z)
Description: value: knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page.
## Issue

On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check `if (\strpos($filename, 'phar://') === 0)` in the `prepareOutput` function to resolve this CVE, however if the user is able to control the second parameter of the `generateFromHtml()` function of Snappy, it will then be passed as the `$filename` parameter in the `prepareOutput()` function. In the original vulnerability, a file name with a `phar://` wrapper could be sent to the `fileExists()` function, equivalent to the `file_exists()` PHP function. This allowed users to trigger a deserialization on arbitrary PHAR files. To fix this issue, the string is now passed to the `strpos()` function and if it starts with `phar://`, an exception is raised. However, PHP wrappers being case insensitive, this patch can be bypassed using `PHAR://` instead of `phar://`. A successful exploitation of this vulnerability allows executing arbitrary code and accessing the underlying filesystem. The attacker must be able to upload a file and the server must be running a PHP version prior to 8. This issue has been addressed in commit `d3b742d61a` which has been included in version 1.4.3. Users are advised to upgrade. Users unable to upgrade should ensure that only trusted users may submit data to the `AbstractGenerator->generate(...)` function.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/KnpLabs/snappy
Files changed:
Commit message: Merge pull request #488 from KnpLabs/fix/security-advisory-GHSA-92rv-4j2h-8mjj

fix: security advisory GHSA-92rv-4j2h-8mjj

Vulnerable code:

Fixed code:
CVE-2018-19045 (C, published 2018-11-08T20:29Z)
Description: value: keepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or PrintStats, potentially leaking sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/acassen/keepalived
Files changed:
keepalived/core/main.c
Commit message: Fix compile warning introduced in commit c6247a9

Commit c6247a9 - "Add command line and configuration option to set umask"
introduced a compile warning, although the code would have worked OK.

Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>


Vulnerable code:
		return;

Fixed code:
		return 0;
CVE-2021-44225 (Other, published 2021-11-26T00:15Z)
Description: value: In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/acassen/keepalived
Files changed:
keepalived/dbus/org.keepalived.Vrrp1.conf
Commit message: dbus: fix policy to not be overly broad

The DBus policy did not restrict the message destination, allowing any
user to inspect and manipulate any property.

Signed-off-by: Vincent Bernat <vincent@bernat.ch>


Vulnerable code:
		<allow own="org.keepalived.Vrrp1"/>
		<allow send_destination="org.keepalived.Vrrp1"/>
		<allow send_interface="org.freedesktop.DBus.Introspectable" />
		<allow send_interface="org.freedesktop.DBus.Peer" />
		<allow send_interface="org.freedesktop.DBus.Properties" />

Fixed code:
		<allow own="org.keepalived.Vrrp1" />
		<allow send_destination="org.keepalived.Vrrp1" />
		<allow send_destination="org.keepalived.Vrrp1"
		       send_interface="org.freedesktop.DBus.Introspectable" />
		<allow send_destination="org.keepalived.Vrrp1"
		       send_interface="org.freedesktop.DBus.Peer" />
		<allow send_destination="org.keepalived.Vrrp1"
		       send_interface="org.freedesktop.DBus.Properties" />
CVE-2017-20158 (Other, published 2022-12-31T11:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 is able to address this issue. The identifier of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/vova07/yii2-fileapi-widget
Files changed:
.gitignore
actions/UploadAction.php
Commit message: Fix XSS vulnerability


Vulnerable code:
.idea
                    'error' => $model->getFirstError('file')

Fixed code:
/vendor
/composer.lock
use yii\helpers\Html;
                    'error' => Html::encode($model->getFirstError('file')),
CVE-2023-0860 (Unknown, published 2023-02-16T10:15Z)
Description: value: Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/modoboa/modoboa-installer
Files changed:
Commit message: Merge pull request #474 from modoboa/security/fail2ban

Added fail2ban setup

Vulnerable code:

Fixed code:
CVE-2019-9547 (Markdown, published 2019-03-01T22:29Z)
Description: value: In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target, because the vhost target did not properly detect such chains.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-834 \u2014 Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Repository: https://github.com/spdk/spdk
Files changed:
CHANGELOG.md
Commit message: CHANGELOG: add note on vhost vulnerability

Signed-off-by: Jim Harris <james.r.harris@intel.com>
Change-Id: Id47256ecfc5d774e7d8054423cda32a90f0c4f76

Reviewed-on: https://review.gerrithub.io/c/442929
Chandler-Test-Pool: SPDK Automated Test System <sys_sgsw@intel.com>
Tested-by: SPDK CI Jenkins <sys_sgci@intel.com>
Reviewed-by: Darek Stojaczyk <dariusz.stojaczyk@intel.com>
Reviewed-by: Tomasz Zawadzki <tomasz.zawadzki@intel.com>


Vulnerable code:

Fixed code:
A security vulnerability has been identified and fixed in the SPDK vhost target.  A malicious
vhost client (i.e. virtual machine) could carefully construct a circular descriptor chain which
would result in a partial denial of service in the SPDK vhost target.  These types of descriptor
chains are now properly detected by the vhost target.  All SPDK vhost users serving untrusted
vhost clients are strongly recommended to upgrade. (Reported by Dima Stepanov and Evgeny
Yakovlev.)