hitoshura25/cvefixes huggingface dataset:
CVE-2022-41965 (HTML, published 2022-11-28T21:15Z)
Description: value: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/opencast/opencast
Files changed:
modules/engage-paella-player/src/main/paella-opencast/ui/auth.html
Commit message: only redirect exact hostname matches


Vulnerable code:
			if (redirect != undefined) {
				window.location.href = decodeURIComponent(redirect);
			else if (id != undefined) {
			else if (series != undefined) {

Fixed code:
			if (redirect !== undefined) {
				let redirectDomain = new URL(redirect);
				if (window.location.hostname.toUpperCase() === redirectDomain.hostname.toUpperCase()) {
					window.location.href = decodeURIComponent(redirect);
				} else {
					window.location.href = "/engage/ui/index.html";
				}
			else if (id !== undefined) {
			else if (series !== undefined) {
CVE-2022-27470 (C, published 2022-05-04T03:15Z)
Description: value: SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libsdl-org/SDL_ttf
Files changed:
SDL_ttf.c
Commit message: More integer overflow (see bug #187)
Make sure that 'width + alignment' doesn't overflow, otherwise
it could create a SDL_Surface of 'width' but with wrong 'pitch'


Vulnerable code:
    Sint64 pitch = width + alignment;
    Sint64 pitch = width + alignment;
        Sint64 pitch = (width + alignment) * 4;

Fixed code:
    Sint64 pitch = (Sint64)width + (Sint64)alignment;
    Sint64 pitch = (Sint64)width + (Sint64)alignment;
        Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4;
CVE-2022-24441 (Unknown, published 2022-11-30T13:15Z)
Description: value: The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/snyk/snyk-intellij-plugin
Files changed:
Commit message: Merge pull request #417 from snyk/feat/trust

feat: add workspace trust feature

Vulnerable code:

Fixed code:
CVE-2021-32660 (Other, published 2021-06-03T17:15Z)
Description: value: Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs. In versions of `@backstage/tehdocs-common` prior to 0.6.4, a malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/backstage/backstage
Files changed:
.changeset/techdocs-fresh-and-clean.md
.github/styles/vocab.txt
Commit message: Initial changeset.

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>


Vulnerable code:

Fixed code:
---
'@backstage/techdocs-common': patch
'@backstage/plugin-techdocs': patch
---

Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...
sanitization
CVE-2021-32661 (Other, published 2021-06-03T18:15Z)
Description: value: Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.
Severity: MEDIUM (CVSS v3 base score: 7.3)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/backstage/backstage
Files changed:
.changeset/techdocs-fresh-and-clean.md
.github/styles/vocab.txt
Commit message: Initial changeset.

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>


Vulnerable code:

Fixed code:
---
'@backstage/techdocs-common': patch
'@backstage/plugin-techdocs': patch
---

Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...
sanitization
CVE-2021-41151 (JSON, published 2021-10-18T21:15Z)
Description: value: Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a `github:publish:pull-request` action and a particular source path. When the template is executed the sensitive files would be included in the published pull request. This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request. The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/backstage/backstage
Files changed:
plugins/scaffolder-backend/CHANGELOG.md
plugins/scaffolder-backend/package.json
Commit message: scaffolder-backend: release path traversal fix

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>


Vulnerable code:
'@backstage/plugin-scaffolder-backend': patch

Make sure `sourcePath` of `publish:github:pull-request` can only be used to
retrieve files from the workspace.
  "version": "0.15.8",

Fixed code:
## 0.15.9

### Patch Changes

- 0f99f1170e: Make sure `sourcePath` of `publish:github:pull-request` can only be used to
  retrieve files from the workspace.

  "version": "0.15.9",
CVE-2023-25571 (Unknown, published 2023-02-14T18:15Z)
Description: value: Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack.

This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` version 1.2.0 and greater will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition, the catalog model v0.12.4 and greater as well as the catalog backend v1.7.2 and greater now has additional validation built in that prevents `javascript:` URLs in known annotations. As a workaround, the general practice of limiting access to modifying catalog content and requiring code reviews greatly help mitigate this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/backstage/backstage
Files changed:
Commit message: Merge pull request from GHSA-7hv8-3fr9-j2hv

catalog xss fixes

Vulnerable code:

Fixed code:
CVE-2023-35926 (TypeScript, published 2023-06-22T14:15Z)
Description: value: Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities  that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.
Severity: nan (CVSS v3 base score: 9.9)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/backstage/backstage
Files changed:
plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
Commit message: feat: replace vm2 sandbox with isolated-vm

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Johan Haals <johan.haals@gmail.com>
Signed-off-by: blam <ben@blam.sh>


Vulnerable code:

Fixed code:
CVE-2024-26150 (TypeScript, published 2024-02-23T16:15Z)
Description: value: `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/backstage/backstage
Files changed:
packages/backend-common/src/paths.test.ts
packages/backend-common/src/paths.ts
Commit message: chore: return the original input path, and add a test

Signed-off-by: blam <ben@blam.sh>


Vulnerable code:
import fs from 'fs/promises';
    it('should resolve to the full path if the target is inside the directory', async () => {
        `${await fs.realpath(workspacePath)}/README.md`,
  return targetPath;

Fixed code:
    it('should resolve to the full path if the target is inside the directory', () => {
        `${workspacePath}/README.md`,

    it('should not throw an error when a folder is referenced that doesnt already exist', () => {
      expect(resolveSafeChildPath(workspacePath, 'template')).toEqual(
        `${workspacePath}/template`,
      );
    });
  // Don't return the resolved path as the original could be a symlink
  return resolvePath(base, path);
CVE-2024-26150 (TypeScript, published 2024-02-23T16:15Z)
Description: value: `@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. In `@backstage/backend-common` prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the `resolveSafeChildPath` utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. This issue is patched in `@backstage/backend-common` versions 0.21.1, 0.20.2, and 0.19.10.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/backstage/backstage
Files changed:
packages/backend-common/src/paths.test.ts
packages/backend-common/src/paths.ts
Commit message: fix: make sure to construct the target from the resolved base path too

Signed-off-by: blam <ben@blam.sh>


Vulnerable code:
    it('should resolve to the full path if the target is inside the directory', () => {
        `${workspacePath}/README.md`,
  const targetPath = resolvePath(base, path);
  if (!isChildPath(resolveRealPath(base), resolveRealPath(targetPath))) {

Fixed code:
import fs from 'fs/promises';
    it('should resolve to the full path if the target is inside the directory', async () => {
        `${await fs.realpath(workspacePath)}/README.md`,
  const resolvedBasePath = resolveRealPath(base);
  const targetPath = resolvePath(resolvedBasePath, path);
  if (!isChildPath(resolvedBasePath, resolveRealPath(targetPath))) {
CVE-2013-10006 (C++, published 2023-01-01T17:15Z)
Description: value: A vulnerability classified as problematic was found in Ziftr primecoin up to 0.8.4rc1. Affected by this vulnerability is the function HTTPAuthorized of the file src/bitcoinrpc.cpp. The manipulation of the argument strUserPass/strRPCUserColonPass leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.8.4rc2 is able to address this issue. The patch is named cdb3441b5cd2c1bae49fae671dc4a496f7c96322. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217171.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-208 \u2014 Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/Ziftr/primecoin
Files changed:
src/bitcoinrpc.cpp
src/test/util_tests.cpp
src/util.h
Commit message: Make RPC password resistant to timing attacks

Fixes issue#2838; this is a tweaked version of pull#2845 that
should not leak the length of the password and is more generic,
in case we run into other situations where we need
timing-attack-resistant comparisons.


Vulnerable code:
    return strUserPass == strRPCUserColonPass;

Fixed code:
    return TimingResistantEqual(strUserPass, strRPCUserColonPass);
BOOST_AUTO_TEST_CASE(util_TimingResistantEqual)
{
    BOOST_CHECK(TimingResistantEqual(std::string(""), std::string("")));
    BOOST_CHECK(!TimingResistantEqual(std::string("abc"), std::string("")));
    BOOST_CHECK(!TimingResistantEqual(std::string(""), std::string("abc")));
    BOOST_CHECK(!TimingResistantEqual(std::string("a"), std::string("aa")));
    BOOST_CHECK(!TimingResistantEqual(std::string("aa"), std::string("a")));
    BOOST_CHECK(TimingResistantEqual(std::string("abc"), std::string("abc")));
    BOOST_CHECK(!TimingResistantEqual(std::string("abc"), std::string("aba")));
}

/**
 * Timing-attack-resistant comparison.
 * Takes time proportional to length
 * of first argument.
 */
template <typename T>
bool TimingResistantEqual(const T& a, const T& b)
{
    if (b.size() == 0) return a.size() == 0;
    size_t accumulator = a.size() ^ b.size();
    for (size_t i = 0; i < a.size(); i++)
        accumulator |= a[i] ^ b[i%b.size()];
    return accumulator == 0;
}
CVE-2015-10131 (PHP, published 2024-03-31T06:15Z)
Description: value: A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/tfo-graphviz
Files changed:
tfo-graphviz-admin.php
Commit message: fix possible XSS vector


git-svn-id: https://plugins.svn.wordpress.org/tfo-graphviz/trunk@1166455 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
			wp_redirect(add_query_arg('updated', '', wp_get_referer()));
	<form action="<?php echo clean_url( remove_query_arg( 'updated' ) ); ?>" method="post">

Fixed code:
			wp_redirect(esc_url_raw(add_query_arg('updated', '', wp_get_referer())));
	<form action="<?php echo esc_url( remove_query_arg( 'updated' ) ); ?>" method="post">
CVE-2019-5484 (JSON, published 2019-09-13T18:15Z)
Description: value: Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/bower/bower
Files changed:
lib/util/extract.js
package.json
Commit message: Fix .tar.gz extract vulnerability


Vulnerable code:
function isSymlink(entry) {
    return entry.type === 'SymbolicLink';
    "prepublish": "in-publish && echo 'You need to use \"grunt publish\" to publish bower' && false || not-in-publish",

Fixed code:
function isSymlink(_, entry) {
    return entry.type === 'symlink';
    "prepublishOnly": "in-publish && echo 'You need to use \"grunt publish\" to publish bower' && false || not-in-publish",