hitoshura25/cvefixes huggingface dataset:
CVE-2018-1000883 (Other, published 2018-12-20T21:29Z)
Description: value: Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to have been fixed in >= 1.3.5 or ~> 1.2.5 or ~> 1.1.9 or ~> 1.0.6.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/elixir-plug/plug
Files changed:
lib/plug/conn.ex
test/plug/conn_test.exs
Commit message: Validate cookie headers


Vulnerable code:

Fixed code:
    validate_header_value!(cookie)
  test "put_resp_cookie/4 raises on new line" do
    assert_raise Plug.Conn.InvalidHeaderError, fn ->
      conn(:get, "/")
      |> put_resp_cookie("foo", "bar\nbaz")
      |> send_resp(200, "OK")
    end
  end
CVE-2021-42917 (Unknown, published 2021-11-01T19:15Z)
Description: value: Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/xbmc/xbmc
Files changed:
Commit message: Merge pull request #20306 from fuzzard/fix_20305

[Playlist] dont use istream directly to a tinyxml structure

Vulnerable code:

Fixed code:
CVE-2023-23082 (Unknown, published 2023-02-03T22:15Z)
Description: value: A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Severity: nan (CVSS v3 base score: 4.6)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/xbmc/xbmc
Files changed:
Commit message: Merge pull request #22380 from fritsch/at25

ExifParser: Fix several out of bounds accesses while parsing exif information

Vulnerable code:

Fixed code:
CVE-2023-30207 (C++, published 2023-07-05T21:15Z)
Description: value: A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/xbmc/xbmc
Files changed:
xbmc/cores/paplayer/VideoPlayerCodec.cpp
Commit message: VideoPlayerCodec: Stop dividing by zero

When parsing a file failed so that needed fields, in our case frameSize
are not available a guess work like with m_channels or m_samplerate does
not help. Therefore fail early.


Vulnerable code:
  for (int nPacket=0; nPacket < 10 && (m_channels == 0 || m_format.m_sampleRate == 0); nPacket++)

Fixed code:
  for (int nPacket = 0;
       nPacket < 10 && (m_channels == 0 || m_format.m_sampleRate == 0 || m_format.m_frameSize == 0);
       nPacket++)
    // if we don't know the framesize yet, we will fail when converting
    if (m_srcFormat.m_frameSize == 0)
      return false;
CVE-2018-19787 (Python, published 2018-12-02T10:29Z)
Description: value: An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lxml/lxml
Files changed:
src/lxml/html/clean.py
src/lxml/html/tests/test_clean.txt
Commit message: Fix: make the cleaner also remove javascript URLs that use escaping.


Vulnerable code:
    from urllib.parse import urlsplit
        new = _substitute_whitespace('', link)
...     <a href="j\x01a\x02v\x03a\x04s\x05c\x06r\x07i\x0Ep t:evil_function()">a control char link</a>
    <a href="javascrip t:evil_function()">a control char link</a>
    <a href="javascrip%20t:evil_function()">a control char link</a>

Fixed code:
    from urllib import unquote_plus
    from urllib.parse import urlsplit, unquote_plus
        new = _substitute_whitespace('', unquote_plus(link))
...     <a href="j\x01a\x02v\x03a\x04s\x05c\x06r\x07i\x0Ep t%20:evil_function()">a control char link</a>
    <a href="javascrip t%20:evil_function()">a control char link</a>
    <a href="javascrip%20t%20:evil_function()">a control char link</a>
CVE-2021-28957 (Other, published 2021-03-21T05:15Z)
Description: value: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lxml/lxml
Files changed:
CHANGES.txt
doc/main.txt
src/lxml/__init__.py
Commit message: Prepare release of lxml 4.6.3.


Vulnerable code:
The latest version is `lxml 4.6.2`_, released 2020-11-26
(`changes for 4.6.2`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.2.pdf
__version__ = "4.6.2"

Fixed code:
4.6.3 (2021-03-21)
==================

Bugs fixed
----------

* A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung,
  which allowed JavaScript to pass through.  The cleaner now removes the HTML5
  ``formaction`` attribute.


The latest version is `lxml 4.6.3`_, released 2021-03-21
(`changes for 4.6.3`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.3.pdf

* `lxml 4.6.3`_, released 2021-03-21 (`changes for 4.6.3`_)
.. _`lxml 4.6.3`: /files/lxml-4.6.3.tgz
.. _`changes for 4.6.3`: /changes-4.6.3.html
__version__ = "4.6.3"
CVE-2021-43818 (Other, published 2021-12-13T18:15Z)
Description: value: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/lxml/lxml
Files changed:
CHANGES.txt
doc/main.txt
src/lxml/__init__.py
Commit message: Prepare release of 4.6.5.


Vulnerable code:
4.6.5 (2021-12-??)
The latest version is `lxml 4.6.4`_, released 2021-11-01
(`changes for 4.6.4`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.4.pdf
__version__ = "4.6.4"

Fixed code:
4.6.5 (2021-12-12)
The latest version is `lxml 4.6.5`_, released 2021-12-12
(`changes for 4.6.5`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.5.pdf

* `lxml 4.6.5`_, released 2021-12-12 (`changes for 4.6.5`_)
.. _`lxml 4.6.5`: /files/lxml-4.6.5.tgz
.. _`changes for 4.6.5`: /changes-4.6.5.html
__version__ = "4.6.5"
CVE-2021-43818 (Other, published 2021-12-13T18:15Z)
Description: value: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lxml/lxml
Files changed:
CHANGES.txt
doc/main.txt
src/lxml/__init__.py
Commit message: Prepare release of 4.6.5.


Vulnerable code:
4.6.5 (2021-12-??)
The latest version is `lxml 4.6.4`_, released 2021-11-01
(`changes for 4.6.4`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.4.pdf
__version__ = "4.6.4"

Fixed code:
4.6.5 (2021-12-12)
The latest version is `lxml 4.6.5`_, released 2021-12-12
(`changes for 4.6.5`_).  `Older versions <#old-versions>`_
.. _`PDF documentation`: lxmldoc-4.6.5.pdf

* `lxml 4.6.5`_, released 2021-12-12 (`changes for 4.6.5`_)
.. _`lxml 4.6.5`: /files/lxml-4.6.5.tgz
.. _`changes for 4.6.5`: /changes-4.6.5.html
__version__ = "4.6.5"
CVE-2021-43818 (Python, published 2021-12-13T18:15Z)
Description: value: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/lxml/lxml
Files changed:
src/lxml/html/clean.py
src/lxml/html/tests/test_clean.py
Commit message: Cleaner: Prevent "@import" from re-occurring in the CSS after replacements, e.g. "@@importimport".

Reported as GHSL-2021-1037


Vulnerable code:

Fixed code:
        if '@import' in style:
            return True
    def test_sneaky_import_in_style(self):
        # Prevent "@@importimport" -> "@import" replacement.
        style_codes = [
            "@@importimport(extstyle.css)",
            "@ @  import import(extstyle.css)",
            "@ @ importimport(extstyle.css)",
            "@@  import import(extstyle.css)",
            "@ @import import(extstyle.css)",
            "@@importimport()",
        ]
        for style_code in style_codes:
            html = '<style>%s</style>' % style_code
            s = lxml.html.fragment_fromstring(html)

            cleaned = lxml.html.tostring(clean_html(s))
            self.assertEqual(
                b'<style>/* deleted */</style>',
                cleaned,
                "%s  ->  %s" % (style_code, cleaned))
CVE-2021-43818 (Python, published 2021-12-13T18:15Z)
Description: value: lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lxml/lxml
Files changed:
src/lxml/html/clean.py
src/lxml/html/tests/test_clean.py
Commit message: Cleaner: Prevent "@import" from re-occurring in the CSS after replacements, e.g. "@@importimport".

Reported as GHSL-2021-1037


Vulnerable code:

Fixed code:
        if '@import' in style:
            return True
    def test_sneaky_import_in_style(self):
        # Prevent "@@importimport" -> "@import" replacement.
        style_codes = [
            "@@importimport(extstyle.css)",
            "@ @  import import(extstyle.css)",
            "@ @ importimport(extstyle.css)",
            "@@  import import(extstyle.css)",
            "@ @import import(extstyle.css)",
            "@@importimport()",
        ]
        for style_code in style_codes:
            html = '<style>%s</style>' % style_code
            s = lxml.html.fragment_fromstring(html)

            cleaned = lxml.html.tostring(clean_html(s))
            self.assertEqual(
                b'<style>/* deleted */</style>',
                cleaned,
                "%s  ->  %s" % (style_code, cleaned))
CVE-2022-2309 (Other, published 2022-07-05T10:15Z)
Description: value: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/lxml/lxml
Files changed:
src/lxml/apihelpers.pxi
src/lxml/iterparse.pxi
src/lxml/tests/test_etree.py
Commit message: Fix a crash when incorrect parser input occurs together with usages of iterwalk() on trees generated by the same parser.


Vulnerable code:
            prefix = funicodeOrNone(c_ns.prefix)
            if prefix not in nsmap:
                nsmap[prefix] = funicodeOrNone(c_ns.href)
        count += 1
        ns_tuple = (funicode(c_ns.prefix) if c_ns.prefix is not NULL else '',
                    funicode(c_ns.href))
        event_list.append( (u"start-ns", ns_tuple) )
        count += 1

Fixed code:
            if c_ns.prefix or c_ns.href:
                prefix = funicodeOrNone(c_ns.prefix)
                if prefix not in nsmap:
                    nsmap[prefix] = funicodeOrNone(c_ns.href)
        count += (c_ns.href is not NULL)
        if c_ns.href:
            ns_tuple = (funicodeOrEmpty(c_ns.prefix),
                        funicode(c_ns.href))
            event_list.append( (u"start-ns", ns_tuple) )
            count += 1
    def test_walk_after_parse_failure(self):
        # This used to be an issue because libxml2 can leak empty namespaces
        # between failed parser runs.  iterwalk() failed to handle such a tree.
        try:
            etree.XML('''<anot xmlns="1">''')
        except etree.XMLSyntaxError:
            pass
        else:
            assert False, "invalid input did not fail to parse"

        et = etree.XML('''<root>  </root>''')
        try:
            ns = next(etree.iterwalk(et, events=('start-ns',)))
        except StopIteration:
            # This would be the expected result, because there was no namespace
            pass
        else:
            # This is a bug in libxml2
            assert not ns, repr(ns)
CVE-2024-28123 (Rust, published 2024-03-21T02:52Z)
Description: value: Wasmi is an efficient and lightweight WebAssembly interpreter with a focus on constrained and embedded systems. In the WASMI Interpreter, an Out-of-bounds Buffer Write will arise if the host calls or resumes a Wasm function with more parameters than the default limit (128), as it will surpass the stack value. This doesn’t affect calls from Wasm to Wasm, only from host to Wasm. This vulnerability was patched in version 0.31.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wasmi-labs/wasmi
Files changed:
crates/wasmi/src/engine/mod.rs
Commit message: fix bug in wasmi executor


Vulnerable code:
        self.stack.values.extend(params.call_params());
        self.stack.values.extend(params.call_params());

Fixed code:
        let call_params = params.call_params();
        self.stack.values.reserve(call_params.len())?;
        self.stack.values.extend(call_params);
        let call_params = params.call_params();
        self.stack.values.reserve(call_params.len())?;
        self.stack.values.extend(call_params);
CVE-2022-29240 (C++, published 2022-09-15T22:15Z)
Description: value: Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression).
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/scylladb/scylladb
Files changed:
transport/server.cc
Commit message: transport/server.cc: Return correct size of decompressed lz4 buffer

An incorrect size is returned from the function, which could lead to
crashes or undefined behavior. Fix by erroring out in these cases.

Fixes #11476


Vulnerable code:
                    return out.size();

Fixed code:
                    if (ret != out.size()) {
                        throw std::runtime_error("Malformed CQL frame - provided uncompressed size different than real uncompressed size");
                    }
                    return static_cast<size_t>(ret);
CVE-2020-36568 (Go, published 2022-12-27T22:15Z)
Description: value: Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/revel/revel
Files changed:
binder.go
binder_test.go
Commit message: fix issue #1424


Vulnerable code:

Fixed code:
	maxIndexBound := Config.IntDefault("params.max_index", 4096)

			// Just ignore illegal index, fix issue #1424
			if index > maxIndexBound {
				binderLog.Error("Ignoring parameter for security reason", "index", index, "key", key)
				return
			}
	"github.com/revel/config"
		"arrDoS[2]":                      {"2"},
		"arrDoS[65535]":                  {"65535"},
	"arrDoS":         []int{0, 0, 2},
	if Config == nil {
		Config = config.NewContext()
		defer func() {
			Config = nil
		}()
	}
CVE-2022-1997 (PHP, published 2022-06-08T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/francoisjacquet/rosariosis
Files changed:
functions/PreparePHP_SELF.fnc.php
Commit message: Fix stored XSS security issue: remove inline JS from URL in PreparePHP_SELF.fnc.php


Vulnerable code:
		while ( strpos( $string, $remove_string ) !== false )

Fixed code:
		while ( stripos( $string, $remove_string ) !== false )
CVE-2022-2036 (PHP, published 2022-06-09T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/francoisjacquet/rosariosis
Files changed:
CHANGES.md
functions/PreparePHP_SELF.fnc.php
Commit message: Fix stored XSS security issue: decode HTML entities from URL


Vulnerable code:
	$string = html_entity_decode( (string) $string );

Fixed code:
Changes in 9.0.1
----------------
- Fix stored XSS security issue: decode HTML entities from URL in PreparePHP_SELF.fnc.php, thanks to @domiee13

	$string = html_entity_decode( (string) $string, ENT_QUOTES | ENT_HTML5 );