hitoshura25/cvefixes huggingface dataset:
CVE-2019-16782 (Unknown, published 2019-12-18T20:15Z)
Description: value: There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/rack/rack
Files changed:
Commit message: Merge branch 'advisory-fix-1'

* advisory-fix-1:
  Introduce a new base class to avoid breaking when upgrading
  Add a version prefix to the private id to make easier to migrate old values
  Fallback to the public id when reading the session in the pool adapter
  Also drop the session with the public id when destroying sessions
  Fallback to the legacy id when the new id is not found
  Add the private id
  revert conditionals to master
  remove NullSession
  remove || raise and get closer to master
  store hashed id, send public id
  use session id objects
  remove more nils
  try to ensure we always have some kind of object


Vulnerable code:

Fixed code:
CVE-2021-39190 (PHP, published 2022-09-22T17:15Z)
Description: value: The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/pluginsGLPI/sccm
Files changed:
front/config.form.php
Commit message: Merge pull request from GHSA-3324-57w6-jxcq



Vulnerable code:
Session::haveRight("config", UPDATE);
Html::header(__("Setup - SCCM", "sccm"), $_SERVER["PHP_SELF"],
             "plugins", "sccm", "configuration");


Fixed code:
Session::checkRight("config", UPDATE);
Html::header(__("Setup - SCCM", "sccm"), $_SERVER["PHP_SELF"],
             "plugins", "sccm", "configuration");
CVE-2014-2260 (Other, published 2014-04-30T23:58Z)
Description: value: Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Eugeny/ajenti
Files changed:
ajenti/plugins/main/content/js/ajenti.coffee
ajenti/plugins/main/content/js/controls.binding.coffee
ajenti/plugins/main/content/js/controls.inputs.coffee
Commit message: [ui] fixes


Vulnerable code:
        # TODO SANITIZE!
        value
            @dom = @children[0].dom
        @input = @dom.find('input')[0]

Fixed code:
        ('' + value) /* Forces the conversion to string. */
        .replace(/&/g, '&amp;') /* This MUST be the 1st replacement. */
            .replace(/'/g, '&apos;') /* The 4 other predefined entities, required. */
            .replace(/"/g, '&quot;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            @dom = @children[0].dom
            @properties = @children[0].properties
        @input = $(@dom).find('input')[0]
CVE-2014-4301 (Python, published 2014-06-18T14:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in ajenti:static/, related to the traceback page.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Eugeny/ajenti
Files changed:
ajenti/routing.py
Commit message: [http] fix traceback page xss


Vulnerable code:
        """ % stack

Fixed code:
import cgi
        """ % cgi.escape(stack)
CVE-2017-7185 (C, published 2017-04-10T15:59Z)
Description: value: Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/cesanta/mongoose-os
Files changed:
mongoose/mongoose.c
Commit message: Fix crash in multipart handling

Close cesanta/dev#6974

PUBLISHED_FROM=4d4e4a46eceba10aec8dacb7f8f58bd078c92307


Vulnerable code:

Fixed code:
  if (pd->mp_stream.boundary == NULL) {
    pd->mp_stream.state = MPS_FINALIZE;
    DBG(("Invalid request: boundary not initilaized"));
    return 0;
  }
CVE-2017-14623 (Unknown, published 2017-09-20T23:29Z)
Description: value: In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/go-ldap/ldap
Files changed:
Commit message: Merge pull request #126 from tiziano88/check_empty_password

Require explicit intention for empty password.

Vulnerable code:

Fixed code:
CVE-2021-21412 (Unknown, published 2021-03-30T18:15Z)
Description: value: Potential for arbitrary code execution in npm package @thi.ng/egf `#gpg`-tagged property values (only if `decrypt: true` option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (since GPG only available in non-browser env). However, if GPG encrypted values are used/required: 1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string 2. Replace/remove them or skip parsing if present.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/thi-ng/umbrella
Files changed:
Commit message: Merge pull request from GHSA-rj44-gpjc-29r7

fix(egf): update GPG invocation to avoid arb code exec

Vulnerable code:

Fixed code:
CVE-2015-10029 (PHP, published 2023-01-07T20:15Z)
Description: value: A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/kelvinmo/simplexrd
Files changed:
CHANGELOG.md
simplexrd/simplexrd.class.php
Commit message: Changed XML loading code to prevent XML external entity processing attacks


Vulnerable code:
    
    
    
        $this->reader->xml($xml);
    
        while ($this->reader->read()) {            
            if (($this->reader->nodeType == XMLReader::ELEMENT) 
                        $this->jrd = array();                        
            
            if (($this->reader->nodeType == XMLReader::ELEMENT) 

Fixed code:
## 3.1.1

- Changed XML loading code to prevent XML external entity processing attacks




        $this->reader->xml($xml, null, LIBXML_NONET);

        while ($this->reader->read()) {
            if (($this->reader->nodeType == XMLReader::ELEMENT)
                        $this->jrd = array();

            if (($this->reader->nodeType == XMLReader::ELEMENT)
CVE-2009-5145 (Python, published 2017-08-07T17:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zopefoundation/Zope
Files changed:
doc/CHANGES.rst
src/Products/PageTemplates/ZRPythonExpr.py
src/Products/PageTemplates/tests/testZRPythonExpr.py
Commit message: LP #490514:  preserve tainting when calling into DTML from ZPT.


Vulnerable code:

Fixed code:
- LP #490514:  preserve tainting when calling into DTML from ZPT.

    if hasattr(request, 'taintWrapper'):
        request = request.taintWrapper()

    def test_call_with_request_preserves_tainting(self):
        from Products.PageTemplates.ZRPythonExpr import call_with_ns
        class Request(dict):
            def taintWrapper(self):
                return {'tainted': 'found'}
        context = ['context']
        here = ['here']
        names = {'context' : context, 'here': here, 'request' : Request()}

        found = call_with_ns(lambda td: td['tainted'], names)
        self.assertEqual(found, 'found')
CVE-2021-32811 (Other, published 2021-08-02T22:15Z)
Description: value: Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/zopefoundation/Zope
Files changed:
CHANGES.rst
constraints.txt
requirements-full.txt
setup.py
versions-prod.cfg
Commit message: Merge pull request from GHSA-g4gq-j4p2-j8fr

* - require AccessControl 5.2

* - fix wording [ci skip]

Vulnerable code:
AccessControl==5.0
AccessControl==5.0
        'AccessControl >= 4.2',
AccessControl = 5.0

Fixed code:
- Update the ``AccessControl`` version pin to fix a remote code execution issue
  (see `AccessControl security advisory GHSA-qcx9-j53g-ccgf
  <https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf>`_)

AccessControl==5.2
AccessControl==5.2
        'AccessControl >= 5.2',
AccessControl = 5.2
CVE-2023-44389 (Other, published 2023-10-04T21:15Z)
Description: value: Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zopefoundation/Zope
Files changed:
src/App/dtml/manage_tabs.dtml
Commit message: Merge pull request from GHSA-m755-gxxg-r5qh

* - html_quote titles in ZMI breadcrumbs

* Revert "- html_quote titles in ZMI breadcrumbs"

This reverts commit 9f86b416980ef1d0a59ace39f64a9a8e8cff2f3c.

* - html_quote title in ZMI breadcrumbs

Vulnerable code:
		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')">"

Fixed code:
		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')" html_quote>"
CVE-2021-23772 (Go, published 2021-12-24T12:15Z)
Description: value: This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/kataras/iris
Files changed:
HISTORY.md
context/context.go
Commit message: security fix


Vulnerable code:
				// Fix an issue that net/http has,
				// an attacker can push a filename
				// which could lead to override existing system files
				// by ../../$header.
				// Reported by Frank through security reports.
				header.Filename = strings.ReplaceAll(header.Filename, "../", "")
				header.Filename = strings.ReplaceAll(header.Filename, "..\\", "")
					// Fix an issue that net/http has,
					// an attacker can push a filename
					// which could lead to override existing system files
					// by ../../$file.
					// Reported by Frank through security reports.
					file.Filename = strings.ReplaceAll(file.Filename, "../", "")
					file.Filename = strings.ReplaceAll(file.Filename, "..\\", "")

Fixed code:
- Push a security fix reported by [Kirill Efimov](https://github.com/kirill89) for older go runtimes.

				header.Filename = filepath.Base(header.Filename)
					// Security fix for go < 1.17.5:
					// Reported by Kirill Efimov (snyk.io) through security reports.
					file.Filename = filepath.Base(file.Filename)
CVE-2023-27483 (Unknown, published 2023-03-09T21:15Z)
Description: value: crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the `Paved` type's `SetValue` method with user provided input without proper validation might use excessive amounts of memory and cause an out of memory panic. In the fieldpath package, the Paved.SetValue method sets a value on the Paved object according to the provided path, without any validation. This allows setting values in slices at any provided index, which grows the target array up to the requested index, the index is currently capped at max uint32 (4294967295) given how indexes are parsed,  but that is still an unnecessarily large value. If callers are not validating paths' indexes on their own, which most probably are not going to do, given that the input is parsed directly in the SetValue method, this could allow users to consume arbitrary amounts of memory. Applications that do not use the `Paved` type's `SetValue` method are not affected. This issue has been addressed in versions 0.16.1 and 0.19.2. Users are advised to upgrade. Users unable to upgrade can parse and validate the path before passing it to the `SetValue` method of the `Paved` type, constraining the index size as deemed appropriate.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/crossplane/crossplane-runtime
Files changed:
Commit message: Merge pull request from GHSA-vfvj-3m3g-m532

fix: enforce max index value for paths

Vulnerable code:

Fixed code:
CVE-2022-24752 (Unknown, published 2022-03-15T15:15Z)
Description: value: SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Sylius/SyliusGridBundle
Files changed:
Commit message: bug #222 [Security] Dql injection through sorting parameters blocked (TheMilek)

This PR was merged into the 1.10 branch.

Discussion
----------



Commits
-------

b702009975bcf8dd869bb6f5e619ea93c454f48b Dql injection through sorting parameters blocked


Vulnerable code:

Fixed code:
CVE-2024-34695 (C#, published 2024-05-14T15:39Z)
Description: value: WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/SakuraIsayeki/WOWS-Karma
Files changed:
WowsKarma.Api/Controllers/PostController.cs
WowsKarma.Api/Startup.cs
Commit message: feat(api): Add UserAtomicLock middleware to request pipeline

- Added `UserAtomicLock` attribute to the `CreatePost` action in `PostController.cs`
- Registered `UserAtomicLockMiddleware` as a singleton in `Startup.cs`
- Added `app.UseMiddleware<UserAtomicLockMiddleware>()` in the HTTP request pipeline


Vulnerable code:
	[HttpPost, Authorize(RequireNoPlatformBans)]
using System.Text;


Fixed code:
	[HttpPost, Authorize(RequireNoPlatformBans), UserAtomicLock]
using System.Text; 

		services.AddSingleton<UserAtomicLockMiddleware>();
		app.UseMiddleware<UserAtomicLockMiddleware>();
CVE-2023-47109 (Unknown, published 2023-11-08T22:15Z)
Description: value: PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

Severity: nan (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/PrestaShop/blockreassurance
Files changed:
Commit message: Merge pull request from GHSA-83j2-qhx2-p7jc

Remove images only from dedicated folder and forbid non image extension

Vulnerable code:

Fixed code:
CVE-2023-47109 (Unknown, published 2023-11-08T22:15Z)
Description: value: PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

Severity: nan (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/PrestaShop/blockreassurance
Files changed:
Commit message: Merge pull request #619 from matthieu-rolland/add-security-fixes



Vulnerable code:

Fixed code: