hitoshura25/cvefixes huggingface dataset:
CVE-2024-28851 (Shell, published 2024-03-15T19:15Z)
Description: value: The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/snowflakedb/snowflake-hive-metastore-connector
Files changed:
scripts/add_snowflake_hive_metastore_connector_script_action.sh
Commit message: Update the import command for custom script actions


Vulnerable code:
wget -O /tmp/HDInsightUtilities-v01.sh -q https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh && source /tmp/HDInsightUtilities-v01.sh && rm -f /tmp/HDInsightUtilities-v01.sh

Fixed code:
source <(wget -q -O - https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh)
CVE-2013-7490 (Other, published 2020-09-11T19:15Z)
Description: value: An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/perl5-dbi/dbi
Files changed:
Changes
DBI.xs
t/70callbacks.t
Commit message: Fixed risk of memory corruption with many arguments to methods RT#86744


Vulnerable code:
            PerlIO_printf(DBILOGFP, "%c   {{ %s callback %s being invoked\n",
                (PL_dirty?'!':' '), meth_name, neatsvpv(*hook_svp,0));
        SPAGAIN;
                SPAGAIN;
            SPAGAIN;

Fixed code:
    Fixed risk of memory corruption with many arguments to methods
        originally reported by OSCHWALD for Callbacks but may apply
        to other functionality in DBI method dispatch RT#86744.
    dORIGMARK;
                    MSPAGAIN;
            PerlIO_printf(DBILOGFP, "%c   {{ %s callback %s being invoked with %ld args\n",
                (PL_dirty?'!':' '), meth_name, neatsvpv(*hook_svp,0), (long)items);
        MSPAGAIN;
                MSPAGAIN;
            MSPAGAIN;
# stress test for stack reallocation and mark handling -- RT#86744
my $stress_count = 3000;
my $place_holders = join(',', ('?') x $stress_count);
my @params = ('t') x $stress_count;
my $stress_dbh = DBI->connect( 'DBI:NullP:test');
my $stress_sth = $stress_dbh->prepare("select 1");
$stress_sth->{Callbacks}{execute} = sub { return; };
$stress_sth->execute(@params);
CVE-2013-7491 (Other, published 2020-09-11T19:15Z)
Description: value: An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/perl5-dbi/dbi
Files changed:
Changes
Driver.xst
Commit message: Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]


Vulnerable code:
    ST(0) = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
        ST(0) = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);

Fixed code:
    Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]
    SV *tmp = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
    SPAGAIN;
    ST(0) = tmp;
        SV *tmp = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
        SPAGAIN;
        ST(0) = tmp;
CVE-2014-10401 (Other, published 2020-09-11T19:15Z)
Description: value: An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute.
Severity: LOW (CVSS v3 base score: 6.1)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/perl5-dbi/dbi
Files changed:
Changes
lib/DBD/File.pm
t/49dbd_file.t
Commit message: Do not connect DBD::File on non-existing folder in f_dir


Vulnerable code:
    exists $attr->{f_dir}        or $attr->{f_dir}     = $dbh->{f_dir};

Fixed code:
    Fixed security issue where DBD::File drivers would open files
        from folders other than specifically passed using the
        f_dir attribute RT#99508 [H.Merijn Brand]
use Carp;

sub connect
{
    my ($drh, $dbname, $user, $auth, $attr) = @_;

    # We do not (yet) care about conflicting attributes here
    # my $dbh = DBI->connect ("dbi:CSV:f_dir=test", undef, undef, { f_dir => "text" });
    # will test here that both test and text should exist
    if (my $attr_hash = (DBI->parse_dsn ($dbname))[3]) {
	if (defined $attr_hash->{f_dir} && ! -d $attr_hash->{f_dir}) {
	    my $msg = "No such directory '$attr_hash->{f_dir}";
	    $drh->set_err (2, $msg);
	    $attr_hash->{RaiseError} and croak $msg;
	    return;
	    }
	}
    if ($attr and defined $attr->{f_dir} && ! -d $attr->{f_dir}) {
	my $msg = "No such directory '$attr->{f_dir}";
	$drh->set_err (2, $msg);
	$attr->{RaiseError} and croak $msg;
	return;
	}

    return $drh->SUPER::connect ($dbname, $user, $auth, $attr);
    } # connect

    exists $attr->{f_dir}        or $attr->{f_dir}        = $dbh->{f_dir};
    unless (-d $dir && -r $dir && -x $dir) {
	$drh->set_err ($DBI::stderr, "Cannot use directory $dir from f_dir");
	return;
	}
# ==================== Nonexisting top-dir ========================
my %drh = DBI->installed_drivers;
my $qer = qr{\bNo such directory};
foreach my $tld ("./non-existing", "nonexisting_folder", "/Fr-dle/hurd0k/ok$$") {
    is (DBI->connect ("dbi:File:", undef, undef, {
	f_dir      => $tld,

	RaiseError => 0,
	PrintError => 0,
	}), undef, "Should not be able to open a DB to $tld");
    like ($DBI::errstr, $qer, "Error message");
    $drh{File}->set_err (undef, "");
    is ($DBI::errstr, undef, "Cleared error");
    my $dbh;
    eval { $dbh = DBI->connect ("dbi:File:", undef, undef, {
	f_dir      => $tld,

	RaiseError => 1,
	PrintError => 0,
	})};
    is ($dbh, undef, "connect () should die on $tld with RaiseError");
    like ($@,           $qer, "croak message");
    like ($DBI::errstr, $qer, "Error message");
    }
CVE-2019-20919 (Other, published 2020-09-17T18:15Z)
Description: value: An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.
Severity: LOW (CVSS v3 base score: 4.7)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/perl5-dbi/dbi
Files changed:
DBI.xs
Commit message: Fix a NULL profile dereference in dbi_profile()

hv_fetch() documentation requires checking for NULL and the code does
that. But then calls SvOK(profile) uncoditionally two lines later.
This patch fixes it.


Vulnerable code:
        if (SvOK(profile) && !PL_dirty)
            warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));

Fixed code:
        if (!PL_dirty) {
            if (!profile)
                warn("Profile attribute does not exist");
            else if (SvOK(profile))
                warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
        }
CVE-2022-28545 (Other, published 2022-05-06T17:15Z)
Description: value: FUDforum 3.1.1 is vulnerable to Stored XSS.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fudforum/FUDforum
Files changed:
install/forum_data/src/iemail.inc.t
Commit message: Fix XSS vulnerability reported by ptsecurity.com (attacker tries to send mail to an administrator
on a server that does not have a mail server configured).


Vulnerable code:
* copyright            : (C) 2001-2021 Advanced Internet Designs Inc.
	/* HTML entities check. */
	if (strpos($subj, '&') !== false) {
		$subj = html_entity_decode($subj);
	}

	$subj = encode_subject($subj);
		$smtp->subject = encode_subject($subj);

Fixed code:
* copyright            : (C) 2001-2022 Advanced Internet Designs Inc.
	/* HTML entities check. */
	if (strpos($subj, '&') !== false) {
		$subj = html_entity_decode($subj);
	}

	$text = htmlspecialchars($text);  // Prevent XSS like <img src="1" onerror="alert()">
	
	$subj = encode_subject($subj);
		$smtp->subject = $subj;
CVE-2022-28545 (Other, published 2022-05-06T17:15Z)
Description: value: FUDforum 3.1.1 is vulnerable to Stored XSS.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fudforum/FUDforum
Files changed:
install/forum_data/src/attach.inc.t
Commit message: Fix stored XSS vulnerability reported by ptsecurity.com


Vulnerable code:
* copyright            : (C) 2001-2013 Advanced Internet Designs Inc.
	$id = db_qid('INSERT INTO {SQL_TABLE_PREFIX}attach (location, message_id, original_name, owner, attach_opt, mime_type,fsize) '.
		q_limit('SELECT null AS location, 0 AS message_id, '. _esc($at['name']) .' AS original_name, '. $owner .' AS owner, '. $attach_opt .' AS attach_opt, id AS mime_type, '. $at['size'] .' AS fsize 

Fixed code:
* copyright            : (C) 2001-2022 Advanced Internet Designs Inc.
	$id = db_qid('INSERT INTO {SQL_TABLE_PREFIX}attach (location, message_id, original_name, owner, attach_opt, mime_type, fsize) '.
		q_limit('SELECT null AS location, 0 AS message_id, '. _esc(htmlspecialchars($at['name'])) .' AS original_name, '. $owner .' AS owner, '. $attach_opt .' AS attach_opt, id AS mime_type, '. $at['size'] .' AS fsize
CVE-2023-31137 (C, published 2023-05-09T14:15Z)
Description: value: MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.

The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.

One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/samboy/MaraDNS
Files changed:
dns/Decompress.c
Commit message: Fix long standing issue in this code from 2002


Vulnerable code:
/* Copyright (c) 2002-2006 Sam Trenholme
                if(len == 0) {

Fixed code:
/* Copyright (c) 2002-2023 Sam Trenholme
                if(len <= 0) {
CVE-2023-29323 (C, published 2023-04-04T23:15Z)
Description: value: ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OpenSMTPD/OpenSMTPD
Files changed:
usr.sbin/smtpd/smtpd.h
Commit message: bump version to 7.0.0


Vulnerable code:
/*	$OpenBSD: smtpd.h,v 1.670 2021/07/28 19:39:51 benno Exp $	*/
#define	SMTPD_VERSION		 "6.9.0-portable"

Fixed code:
/*	$OpenBSD: smtpd.h,v 1.671 2021/09/22 17:12:34 eric Exp $	*/
#define	SMTPD_VERSION		 "7.0.0-portable"
CVE-2014-9489 (Ruby, published 2017-10-17T14:29Z)
Description: value: The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/gollum/grit_adapter
Files changed:
lib/grit_adapter/git_layer_grit.rb
Commit message: Fix security issue with git grep -O


Vulnerable code:

Fixed code:
        query = Shellwords.split(query).select {|q| !(q =~ /^(-O)|(--open-files-in-pager)/) }
        query = Shellwords.join(query)
        query = Shellwords.shellescape(query)
CVE-2022-34132 (PHP, published 2022-06-28T00:15Z)
Description: value: Benjamin BALET Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/bbalet/jorani
Files changed:
application/controllers/Leaves.php
Commit message: BF:Prevent SQL injection fix #369


Vulnerable code:
        //The above parameters could cause an SQL injection vulnerability due to the non standard
        //SQL query in leave_model::detectOverlappingLeaves

Fixed code:
        $startdate = preg_replace("([^0-9-])", "", $startdate);
        $enddate = preg_replace("([^0-9-])", "", $enddate);
CVE-2022-34133 (PHP, published 2022-06-28T00:15Z)
Description: value: Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bbalet/jorani
Files changed:
application/controllers/Leaves.php
Commit message: BF:Persistent XSS fix #369


Vulnerable code:
      $newComment->value = $this->input->post('comment');

Fixed code:
      $newComment->value = $this->input->post('comment', TRUE);
CVE-2020-36644 (Ruby, published 2023-01-07T10:15Z)
Description: value: A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The identifier of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jamesmartin/inline_svg
Files changed:
lib/inline_svg/action_view/helpers.rb
spec/helpers/inline_svg_spec.rb
Commit message: Escape filename to avoid XSS from malicious input

Because:

* If user input is provided for the file name (as in rendering an SVG
  based on a URL parameter), the blanket marking of the SVG output as
  HTML-safe exposes an app to an XSS attack in the comment listing the
  file that was not found.

Solution:

* HTML-escape the filename rendering the comment that it was not found.


Vulnerable code:
        not_found_message = "'#{filename}' #{extension_hint(filename)}"

Fixed code:
        not_found_message = "'#{ERB::Util.html_escape_once(filename)}' #{extension_hint(filename)}"
      it "escapes malicious input" do
        malicious = "--></svg><script>alert(1)</script><svg>.svg"
        allow(InlineSvg::AssetFile).to receive(:named).
          with(malicious).
          and_raise(InlineSvg::AssetFile::FileNotFound.new)

        output = helper.send(helper_method, malicious)
        expect(output).to eq "<svg><!-- SVG file not found: '#{ERB::Util.html_escape_once(malicious)}' --></svg>"
        expect(output).to be_html_safe
      end
CVE-2021-4279 (Unknown, published 2022-12-25T20:15Z)
Description: value: A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/Starcounter-Jack/JSON-Patch
Files changed:
Commit message: Merge pull request #262 from 418sec/1-npm-fast-json-patch

Security Fix for Prototype Pollution - huntr.dev

Vulnerable code:

Fixed code:
CVE-2021-32708 (PHP, published 2021-06-24T17:15Z)
Description: value: Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allowed to supply the path or filename of an uploaded file, the supplied path or filename is not checked against unicode chars, the supplied pathname checked against an extension deny-list, not an allow-list, the supplied path or filename contains a unicode whitespace char in the extension, the uploaded file is stored in a directory that allows PHP code to be executed. Given these conditions are met a user can upload and execute arbitrary code on the system under attack. The unicode whitespace removal has been replaced with a rejection (exception). For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-367 \u2014 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Repository: https://github.com/thephpleague/flysystem
Files changed:
src/CorruptedPathDetected.php
src/WhitespacePathNormalizer.php
src/WhitespacePathNormalizerTest.php
Commit message: Reject funky whitspace paths.


Vulnerable code:
        $path = $this->removeFunkyWhiteSpace($path);
    private function removeFunkyWhiteSpace(string $path): string
        // Remove unprintable characters and invalid unicode characters.
        // We do this check in a loop, since removing invalid unicode characters
        // can lead to new characters being created.
        while (preg_match('#\p{C}+|^\./#u', $path)) {
            $path = (string) preg_replace('#\p{C}+|^\./#u', '', $path);

        return $path;
            ["some\0/path.txt", 'some/path.txt'],

Fixed code:
<?php

namespace League\Flysystem;

use RuntimeException;

final class CorruptedPathDetected extends RuntimeException implements FilesystemException
{
    public static function forPath(string $path): CorruptedPathDetected
    {
        return new CorruptedPathDetected("Corrupted path detected: " . $path);
    }
}
        $this->rejectFunkyWhiteSpace($path);
    private function rejectFunkyWhiteSpace(string $path): void
        if (preg_match('#\p{C}+#u', $path)) {
            throw CorruptedPathDetected::forPath($path);
    /**
     * @test
     * @dataProvider dpFunkyWhitespacePaths
     */
    public function rejecting_funky_whitespace(string $path): void
    {
        self::expectException(CorruptedPathDetected::class);
        $this->normalizer->normalizePath($path);
    }

    public function dpFunkyWhitespacePaths(): iterable
    {
        return [["some\0/path.txt"], ["s\x09i.php"]];
    }