hitoshura25/cvefixes huggingface dataset:
CVE-2018-12520 (C++, published 2018-07-05T20:29Z)
Description: value: An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-335 \u2014 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
Repository: https://github.com/ntop/ntopng
Files changed:
src/HTTPserver.cpp
Commit message: Added code to randomize values returned by rand()


Vulnerable code:

Fixed code:
  struct timeval tv;
  /* Randomize data */
  gettimeofday(&tv, NULL);
  srand(tv.tv_sec + tv.tv_usec);
CVE-2020-36624 (Ruby, published 2022-12-22T10:15Z)
Description: value: A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-1022 \u2014 Use of Web Link to Untrusted Target with window.opener Access
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying  security-critical properties of the window.opener object, such as the location property.
Repository: https://github.com/ahorner/text-helpers
Files changed:
lib/text_helpers/translation.rb
test/lib/text_helpers/translation_test.rb
Commit message: Protect against reverse tabnabbing (#19)

* Protect against reverse tabnabbing

https://owasp.org/www-community/attacks/Reverse_Tabnabbing

* Use faster regular expression method

Vulnerable code:
        ("target=\"_blank\"" if link =~ PROTOCOL_MATCHER),
      while text =~ KEYPATH_MATCHER do
      it "renders internal links without a target" do
      it "renders external links with target='_blank'" do
        assert_equal "<a href=\"http://external.com\" target=\"_blank\">External&nbsp;link</a>\n", @helper.html(:external_link, inline: true)

Fixed code:
        ("target=\"_blank\" rel=\"noopener\"" if link.match?(PROTOCOL_MATCHER)),
      while text.match?(KEYPATH_MATCHER) do
      it "renders internal links without a target or rel" do
      it "renders external links with target='_blank' and rel='noopener'" do
        assert_equal "<a href=\"http://external.com\" target=\"_blank\" rel=\"noopener\">External&nbsp;link</a>\n", @helper.html(:external_link, inline: true)
CVE-2008-10003 (PHP, published 2023-03-05T02:15Z)
Description: value: A vulnerability was found in iGamingModules flashgames 1.1.0. It has been classified as critical. Affected is an unknown function of the file game.php. The manipulation of the argument lid leads to sql injection. It is possible to launch the attack remotely. The name of the patch is 6e57683704885be32eea2ea614f80c9bb8f012c5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222288.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/iGamingModules/flashgames
Files changed:
game.php
Commit message: adding patched game.php for SQLI vulnerability in lid parameter.

git-svn-id: https://subversion.assembla.com/svn/impresscmsaddons/modules/flashgames/trunk@5300 7a4d4d67-0c3a-0410-b24c-89d50c169223


Vulnerable code:

Fixed code:

if (!is_numeric($lid) or $lid<=0) 
{ exit;
}
CVE-2014-2236 (Python, published 2014-03-05T16:37Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ASKBOT/askbot-devel
Files changed:
askbot/templates/users.html
askbot/utils/functions.py
askbot/views/commands.py
Commit message: fixed some xss issues


Vulnerable code:
    <p>{% trans %}users matching query {{search_query}}:{% endtrans %}</p>
            "base_url": context["base_url"],
                ) % {'url': request.path + '?tags=' + request.REQUEST['tags']}

Fixed code:
    <p>{% trans search_query=search_query|escape %}users matching query {{search_query}}:{% endtrans %}</p>
from django.utils.html import escape
            "base_url": escape(context["base_url"]),
                ) % {'url': escape(request.path) + '?tags=' + request.REQUEST['tags']}
CVE-2022-31138 (PHP, published 2022-07-11T14:15Z)
Description: value: mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/mailcow/mailcow-dockerized
Files changed:
data/web/inc/init_db.inc.php
Commit message: hotfix imapsync


Vulnerable code:
    $db_version = "20052022_0938";
          "syncjobs" => "TINYINT(1) NOT NULL DEFAULT '1'",
    $pdo->query("UPDATE `imapsync` SET `custom_params` = '' WHERE `custom_params` LIKE '%pipemess%' OR `custom_params` LIKE '%pipemes%';");
    

Fixed code:
    $db_version = "18062022_1153";
          "syncjobs" => "TINYINT(1) NOT NULL DEFAULT '0'",
    $pdo->query("UPDATE `imapsync` SET `custom_params` = '' 
      WHERE `custom_params` LIKE '%pipemess%' 
        OR custom_params LIKE '%skipmess%' 
        OR custom_params LIKE '%delete2foldersonly%' 
        OR custom_params LIKE '%delete2foldersbutnot%' 
        OR custom_params LIKE '%regexflag%' 
        OR custom_params LIKE '%pipemess%' 
        OR custom_params LIKE '%regextrans2%' 
        OR custom_params LIKE '%maxlinelengthcmd%';");
CVE-2023-34108 (Shell, published 2023-06-07T18:15Z)
Description: value: mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which is responsible for verifying user passwords during login attempts. Upon a successful login, the script returns a response in the format of "password=<valid-password>", indicating the successful authentication. By crafting a password with additional key-value pairs appended to it, an attacker can manipulate the returned string and influence the internal behavior of Dovecot. For example, using the password "123 mail_crypt_save_version=0" would cause the `passwd-verify.lua` script to return the string "password=123 mail_crypt_save_version=0". Consequently, Dovecot will interpret this string and set the internal variables accordingly, leading to unintended consequences. This vulnerability can be exploited by an authenticated attacker who has the ability to set their own password. Successful exploitation of this vulnerability could result in unauthorized access to user accounts, bypassing security controls, or other malicious activities. This issue has been patched in version `2023-05a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mailcow/mailcow-dockerized
Files changed:
data/Dockerfiles/dovecot/docker-entrypoint.sh
Commit message: [Dovecot] remove pass return in Dovecot lua auth


Vulnerable code:
      return dovecot.auth.PASSDB_RESULT_OK, "password=" .. pass
          return dovecot.auth.PASSDB_RESULT_OK, "password=" .. pass
          return dovecot.auth.PASSDB_RESULT_OK, "password=" .. pass

Fixed code:
      return dovecot.auth.PASSDB_RESULT_OK, "password=pass"
          return dovecot.auth.PASSDB_RESULT_OK, "password=pass"
          return dovecot.auth.PASSDB_RESULT_OK, "password=pass"
CVE-2024-23824 (PHP, published 2024-02-02T16:15Z)
Description: value: mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the versions 2023-12a and prior and patched in version 2024-01.
Severity: nan (CVSS v3 base score: 2.7)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mailcow/mailcow-dockerized
Files changed:
data/web/inc/functions.customize.inc.php
data/web/inc/vars.inc.php
data/web/lang/lang.de-de.json
data/web/lang/lang.en-gb.json
Commit message: [Web] limit logo file upload


Vulnerable code:

Fixed code:
  global $LOGO_LIMITS;
              if ($_data[$_item]['size'] > $LOGO_LIMITS['max_size']) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_item, $_data),
                  'msg' => 'img_size_exceeded'
                );
                return false;
              }
              list($width, $height) = getimagesize($_data[$_item]['tmp_name']);
              if ($width > $LOGO_LIMITS['max_width'] || $height > $LOGO_LIMITS['max_height']) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_item, $_data),
                  'msg' => 'img_dimensions_exceeded'
                );
                return false;
              }
// Logo max file size in bytes
$LOGO_LIMITS['max_size'] = 15 * 1024 * 1024; // 15MB

// Logo max width in pixels
$LOGO_LIMITS['max_width'] = 1920;

// Logo max height in pixels
$LOGO_LIMITS['max_height'] = 1920;

        "img_dimensions_exceeded": "Grafik überschreitet die maximale Bildgröße",
        "img_size_exceeded": "Grafik überschreitet die maximale Dateigröße",
        "img_dimensions_exceeded": "Image exceeds the maximum image size",
        "img_size_exceeded": "Image exceeds the maximum file size",
CVE-2024-24760 (Unknown, published 2024-02-02T16:15Z)
Description: value: mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`.
Severity: nan (CVSS v3 base score: 7.3)
Weakness: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/mailcow/mailcow-dockerized
Files changed:
Commit message: Merge pull request #5696 from mailcow/fix/netfilter

[Netfilter] add mailcow isolation rule to MAILCOW chain

Vulnerable code:

Fixed code:
CVE-2020-27347 (C, published 2020-11-06T03:15Z)
Description: value: In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/tmux/tmux
Files changed:
input.c
Commit message: Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.


Vulnerable code:
		} else

Fixed code:
		} else {
			if (n == nitems(p)) {
				free(copy);
				return;
			}
		}
CVE-2019-20399 (Rust, published 2020-01-23T00:15Z)
Description: value: A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/paritytech/libsecp256k1
Files changed:
Cargo.toml
src/lib.rs
src/scalar.rs
Commit message: Prevent side channel leak in Scala::check_overflow


Vulnerable code:
version = "0.3.0"
#![no_std]
        let mut yes: bool = false;
        let mut no: bool = false;
        no = no || (self.0[7] < SECP256K1_N_7); /* No need for a > check. */
        no = no || (self.0[6] < SECP256K1_N_6); /* No need for a > check. */
        no = no || (self.0[5] < SECP256K1_N_5); /* No need for a > check. */
        no = no || (self.0[4] < SECP256K1_N_4);
        yes = yes || ((self.0[4] > SECP256K1_N_4) && !no);
        no = no || ((self.0[3] < SECP256K1_N_3) && !yes);
        yes = yes || ((self.0[3] > SECP256K1_N_3) && !no);
        no = no || ((self.0[2] < SECP256K1_N_2) && !yes);
        yes = yes || ((self.0[2] > SECP256K1_N_2) && !no);
        no = no || ((self.0[1] < SECP256K1_N_1) && !yes);
        yes = yes || ((self.0[1] > SECP256K1_N_1) && !no);
        yes = yes || ((self.0[0] >= SECP256K1_N_0) && !no);
        return yes;

Fixed code:
version = "0.4.0"
subtle = { version = "2.2", default-features = false }
[features]
default = ["std"]
std = ["subtle/std", "rand/std"]

#![cfg_attr(not(feature = "std"), no_std)]
use subtle::Choice;
        let mut yes: Choice = 0.into();
        let mut no: Choice = 0.into();
        no |= Choice::from((self.0[7] < SECP256K1_N_7) as u8); /* No need for a > check. */
        no |= Choice::from((self.0[6] < SECP256K1_N_6) as u8); /* No need for a > check. */
        no |= Choice::from((self.0[5] < SECP256K1_N_5) as u8); /* No need for a > check. */
        no |= Choice::from((self.0[4] < SECP256K1_N_4) as u8);
        yes |= Choice::from((self.0[4] > SECP256K1_N_4) as u8) & !no;
        no |= Choice::from((self.0[3] < SECP256K1_N_3) as u8) & !yes;
        yes |= Choice::from((self.0[3] > SECP256K1_N_3) as u8) & !no;
        no |= Choice::from((self.0[2] < SECP256K1_N_2) as u8) & !yes;
        yes |= Choice::from((self.0[2] > SECP256K1_N_2) as u8) & !no;
        no |= Choice::from((self.0[1] < SECP256K1_N_1) as u8) & !yes;
        yes |= Choice::from((self.0[1] > SECP256K1_N_1) as u8) & !no;
        yes |= Choice::from((self.0[0] >= SECP256K1_N_0) as u8) & !no;
        return yes.into();
CVE-2017-5591 (Python, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/poezio/slixmpp
Files changed:
slixmpp/plugins/xep_0280/carbons.py
Commit message: Fix carbons


Vulnerable code:
        self.xmpp.event('carbon_received', msg)
        self.xmpp.event('carbon_sent', msg)

Fixed code:
        if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_received', msg)
        if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_sent', msg)
CVE-2017-5591 (Python, published 2017-02-09T20:59Z)
Description: value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/poezio/slixmpp
Files changed:
slixmpp/plugins/xep_0280/carbons.py
Commit message: Fix carbons


Vulnerable code:
        self.xmpp.event('carbon_received', msg)
        self.xmpp.event('carbon_sent', msg)

Fixed code:
        if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_received', msg)
        if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_sent', msg)
CVE-2023-37473 (PHP, published 2023-07-14T21:15Z)
Description: value: zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/zenstruck/collection
Files changed:
src/Collection/Doctrine/ORM/EntityRepository.php
src/Collection/Doctrine/ORM/EntityRepositoryBridge.php
tests/Doctrine/ORM/EntityRepositoryTest.php
Commit message: security(orm): prevent passing callable strings to `find()`/`query()`


Vulnerable code:
     * @param mixed|Criteria|array<string,mixed>|callable(QueryBuilder):void $specification
            if (\is_callable($specification)) {
     * @param Criteria|array<string,mixed>|callable(QueryBuilder):void $specification
        if (\is_callable($specification)) {
     * @param mixed|Criteria|array<string,mixed>|callable(QueryBuilder):void $specification
     * @param Criteria|array<string,mixed>|callable(QueryBuilder):void $specification

Fixed code:
     * @param mixed|Criteria|array<string,mixed>|(object&callable(QueryBuilder):void) $specification
            if (\is_callable($specification) && \is_object($specification)) {
     * @param Criteria|array<string,mixed>|(object&callable(QueryBuilder):void) $specification
        if (\is_callable($specification) && \is_object($specification)) {
     * @param mixed|Criteria|array<string,mixed>|(object&callable(QueryBuilder):void) $specification
     * @param Criteria|array<string,mixed>|(object&callable(QueryBuilder):void) $specification
    /**
     * @test
     */
    public function cannot_find_with_callable_strings(): void
    {
        $this->assertIsCallable('system');
        $this->assertNull($this->repo()->find('system'));
    }

    /**
     * @test
     */
    public function cannot_query_with_callable_strings(): void
    {
        $this->assertIsCallable('system');

        $repo = $this->repo();

        $this->expectException(\InvalidArgumentException::class);

        $repo->query('system');
    }