hitoshura25/cvefixes huggingface dataset:
CVE-2020-14163 (C, published 2020-06-15T21:15Z)
Description: value: An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider the case where garbage collection is triggered after the key operation but before the value operation, as demonstrated by improper read access to memory in ecma_gc_set_object_visited in ecma/base/ecma-gc.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jerryscript-project/jerryscript
Files changed:
jerry-core/ecma/operations/ecma-container-object.c
Commit message: Fix adding entries to the internal buffer of a Map object (#3805)

When appending the key/value pair separately, garbage collection could be
triggered before the value is added, which could cause problems during
marking. This patch changes insertion to add both values at the same
time, which prevents partial entries from being present in the internal
buffer.

Fixes #3804.

JerryScript-DCO-1.0-Signed-off-by: Dániel Bátyai dbatyai@inf.u-szeged.hu

Vulnerable code:
  ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));

    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (value_arg));

Fixed code:
    ecma_value_t values[] = { ecma_copy_value_if_not_object (key_arg), ecma_copy_value_if_not_object (value_arg) };
    ecma_collection_append (container_p, values, 2);
  }
  else
  {
    ecma_collection_push_back (container_p, ecma_copy_value_if_not_object (key_arg));
CVE-2020-26947 (Other, published 2020-10-10T21:15Z)
Description: value: monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users to gain privileges via a Trojan horse library in the current working directory.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/monero-project/monero-gui
Files changed:
CMakeLists.txt
Commit message: cmake: set CMAKE_SKIP_RPATH on Linux to fix empty RPATH token issue


Vulnerable code:

Fixed code:
    set(CMAKE_SKIP_RPATH ON)
CVE-2021-46871 (Other, published 2023-01-10T06:15Z)
Description: value: tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phoenixframework/phoenix_html
Files changed:
lib/phoenix_html/tag.ex
test/phoenix_html/tag_test.exs
Commit message: Make sure class={@value} in HEEx is escaped


Vulnerable code:
  defp build_attrs([{k, true} | t]),
    do: [?\s, key_escape(k) | build_attrs(t)]

  defp build_attrs([{_, false} | t]),
    do: build_attrs(t)

  defp build_attrs([{_, nil} | t]),
    do: build_attrs(t)

    value
      assert attributes_escape([{:class, ["btn", nil, false, "active"]}]) |> safe_to_string() ==
               ~s( class="btn active")

Fixed code:
  defp build_attrs([{k, true} | t]),
    do: [?\s, key_escape(k) | build_attrs(t)]

  defp build_attrs([{_, false} | t]),
    do: build_attrs(t)

  defp build_attrs([{_, nil} | t]),
    do: build_attrs(t)

    |> attr_escape()
    attr_escape(value)
      assert attributes_escape([{:class, "<active>"}]) |> safe_to_string() == ~s( class="&lt;active&gt;")
      assert attributes_escape([{:class, ["btn", nil, false, "<active>"]}]) |> safe_to_string() ==
               ~s( class="btn &lt;active&gt;")
    end

    test "handle class value as false/nil/true" do
      assert attributes_escape([{:class, false}]) |> safe_to_string() == ~s()
      assert attributes_escape([{:class, nil}]) |> safe_to_string() == ~s()
      assert attributes_escape([{:class, true}]) |> safe_to_string() == ~s( class)
CVE-2017-12775 (PHP, published 2017-08-29T15:29Z)
Description: value: qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/q2a/question2answer
Files changed:
qa-include/qa-install.php
Commit message: Security fix in qa-install.php


Vulnerable code:
	$inemail = qa_post_text('email');
	$inpassword = qa_post_text('password');
	$inhandle = qa_post_text('handle');
	$fielderrors = array_merge(
		qa_handle_email_filter($inhandle, $inemail),
		qa_password_validate($inpassword)
	);
	if (empty($fielderrors)) {
		require_once QA_INCLUDE_DIR.'app/users.php';
		$userid = qa_create_new_user($inemail, $inpassword, $inhandle, QA_USER_LEVEL_SUPER);
		qa_set_logged_in_user($userid, $inhandle);
		qa_set_option('feedback_email', $inemail);
		$success .= "Congratulations - Your Question2Answer site is ready to go!\n\nYou are logged in as the super administrator and can start changing settings.\n\nThank you for installing Question2Answer.";

Fixed code:
	require_once QA_INCLUDE_DIR.'db/admin.php';
	if (qa_db_count_users() == 0) { // prevent creating multiple accounts
		$inemail = qa_post_text('email');
		$inpassword = qa_post_text('password');
		$inhandle = qa_post_text('handle');
		$fielderrors = array_merge(
			qa_handle_email_filter($inhandle, $inemail),
			qa_password_validate($inpassword)
		);
		if (empty($fielderrors)) {
			require_once QA_INCLUDE_DIR.'app/users.php';
			$userid = qa_create_new_user($inemail, $inpassword, $inhandle, QA_USER_LEVEL_SUPER);
			qa_set_logged_in_user($userid, $inhandle);
			qa_set_option('feedback_email', $inemail);
			$success .= "Congratulations - Your Question2Answer site is ready to go!\n\nYou are logged in as the super administrator and can start changing settings.\n\nThank you for installing Question2Answer.";
		}
CVE-2022-39286 (Python, published 2022-10-26T20:15Z)
Description: value: Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/jupyter/jupyter_core
Files changed:
jupyter_core/application.py
jupyter_core/tests/test_application.py
Commit message: Merge pull request from GHSA-m678-f26j-3hrp


Vulnerable code:
        path.insert(0, os.getcwd())
    wd = mkdtemp()
    with patch.object(os, "getcwd", lambda: wd):
        app = DummyApp(config_dir=config_dir)
        app.initialize([])
    with open(pjoin(wd, "dummy_app_config.py"), "w", encoding="utf-8") as f:
        f.write("c.DummyApp.n = 2")
    assert app.m == 1, "Loaded config from config dir"
    assert app.n == 2, "Loaded config from CWD"
    wd = mkdtemp()
    with patch.object(os, "getcwd", lambda: wd):
        with pytest.raises(SyntaxError):
            app = DummyApp(config_dir=config_dir)
            app.raise_config_file_errors = True
            app.initialize([])
    shutil.rmtree(wd)

Fixed code:
            # Insert config dir as first item.
    os.environ["JUPYTER_CONFIG_PATH"] = str(config_dir)

    app = DummyApp(config_dir=config_dir)
    app.initialize([])
    assert app.m == 1, "Loaded config from config dir"

    shutil.rmtree(config_dir)
    del os.environ["JUPYTER_CONFIG_PATH"]
def test_load_config_no_cwd():
    config_dir = mkdtemp()
    wd = mkdtemp()
    with open(pjoin(wd, "dummy_app_config.py"), "w", encoding="utf-8") as f:
        f.write("c.DummyApp.m = 1\n")
        f.write("c.DummyApp.n = 1")
    assert app.n == 0
    assert app.m == 0
    os.environ["JUPYTER_CONFIG_PATH"] = str(config_dir)

    with pytest.raises(SyntaxError):
        app = DummyApp(config_dir=config_dir)
        app.raise_config_file_errors = True
        app.initialize([])
    del os.environ["JUPYTER_CONFIG_PATH"]
CVE-2020-36827 (Perl, published 2024-03-24T01:15Z)
Description: value: The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/amaltsev/XAO-Web
Files changed:
Makefile.PL
Web.pm
lib/XAO/DO/Web/Action.pm
t/testcases/Web/Page.pm
Commit message: 1.84 Security fix for json-embed in Web::Action

Encoding <> characters in json output


Vulnerable code:
        'XAO::Base'                 => 1.27,
        'XAO::Base'                 => 1.27,
        'XAO::Base'                 => 1.27,
$VERSION='1.83';
        $self->textout(to_json($data));
            expect      => Encode::encode_utf8('™'),
            template    => qq(<script><%MyAction datamode='test-alt' arg='Foo\x{2122}' format='json-embed'%></script>),
            expect      => qr/Foo\x{2122}/,
        my $page=XAO::Objects->new(objname => 'Web::Page');
            $self->assert($got =~ $expect,
        '<$TEST/j$>'    => '\\u0027\\"!@#$%^&*()_-=[]\\\\<>? ',

Fixed code:
        'XAO::Base'                 => 1.28,
        'XAO::Base'                 => 1.28,
        'XAO::Base'                 => 1.28,
$VERSION='1.84';
        my $json=to_json($data);

        # The data is typically embedded in a <script>...</script> set
        # of tags, so if the content of a data field has </script> then
        # that would close the outer script tag allowing that content to
        # execute in the page context. Bad bad bad.
        #
        $json =~ s/([<>])/'\\u' . sprintf('%04x',ord($1))/esg;

        $self->textout($json);
    my $byte2122=Encode::encode('utf8',"\x{2122}");

            expect      => $byte2122,
            objname     => 'Web::MyAction',
            args        => { datamode => 'test-alt', format => 'json-embed', arg => qq(Foo\x{2122}) },
            expect      => qr/Foo$byte2122/,
        d1c => {
            template    => qq(<script><%MyAction datamode='test-alt' arg='</script><script>alert(1);' format='json-embed'%></script>),
            expect      => qr/\\u003c\/script\\u003e\\u003cscript\\u003ealert/,
        },
        my $page=XAO::Objects->new(objname => $test->{'objname'} || 'Web::Page');
            $self->assert($got =~ $expect ? 1 : 0,
        '<$TEST/j$>'    => '\\u0027\\"!@#$%^&*()_-=[]\\\\\\u003c\\u003e? ',
CVE-2020-36631 (Unknown, published 2022-12-25T20:15Z)
Description: value: A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/barronwaffles/dwc_network_server_emulator
Files changed:
Commit message: Merge pull request #538 from InvoxiPlayGames/master

Fix SQL injection

Vulnerable code:

Fixed code:
CVE-2015-10025 (C#, published 2023-01-07T13:15Z)
Description: value: A vulnerability has been found in luelista miniConf up to 1.7.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file miniConf/MessageView.cs of the component URL Scanning. The manipulation leads to denial of service. Upgrading to version 1.7.7 and 1.8.0 is able to address this issue. The patch is named c06c2e5116c306e4e1bc79779f0eda2d1182f655. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217615.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/luelista/miniConf
Files changed:
Setups/codesign-and-make-setup.bat
miniConf/Form1.cs
miniConf/MessageView.cs
miniConf/Properties/AssemblyInfo.cs
Commit message: Version 1.7.7
behebt Denial of Service Bug durch Fehler in URL-scanning Regex


Vulnerable code:
"C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@cherry.luelistan.net:/srv/hosts/max-weller.de/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3}|[a-z0-9%])|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
[assembly: AssemblyVersion("1.7.6.4")]
[assembly: AssemblyFileVersion("1.7.6.4")]

Fixed code:
"C:\Program Files (x86)\Git\bin\scp.exe" %INSTALLER% maxweller@oak.teamwiki.net:/var/www/hosts/downloads.max-weller.de/miniconf/miniconf-minefield-setup.exe
                                    Console.WriteLine("Displaying notification via notify-send ...");
                                    Console.WriteLine("Showing balloon tip: " + msg.From.Resource + " in " + msg.From.User);
            text = Regex.Replace(text, "(?i)\\b((?:[a-z][\\w-]+:(?:/{1,3})|www\\d{0,3}[.]|[a-z0-9.\\-]+[.][a-z]{2,4}/)(?:[^\\s()<>]+|\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\))+(?:\\(([^\\s()<>]+|(\\([^\\s()<>]+\\)))*\\)|[^\\s`!()\\[\\]{};:'\".,<>?«»“”‘’]))",
[assembly: AssemblyVersion("1.7.7.0")]
[assembly: AssemblyFileVersion("1.7.7.0")]
CVE-2020-36429 (C, published 2021-07-20T07:15Z)
Description: value: Variant_encodeJson in open62541 1.x before 1.0.4 has an out-of-bounds write for a large recursion depth.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/open62541/open62541
Files changed:
src/ua_types_encoding_json.c
Commit message: fix(json): Check max recursion depth in more places


Vulnerable code:
    ctx->commaNeeded[++ctx->depth] = false;
    if(ctx->depth > UA_JSON_ENCODING_MAX_RECURSION)
    if(ctx->depth > UA_JSON_ENCODING_MAX_RECURSION)
    if(ctx->depth > UA_JSON_ENCODING_MAX_RECURSION)

Fixed code:
    if(ctx->depth >= UA_JSON_ENCODING_MAX_RECURSION)
        return UA_STATUSCODE_BADENCODINGERROR;
    if(ctx->depth >= UA_JSON_ENCODING_MAX_RECURSION)
        return UA_STATUSCODE_BADENCODINGERROR;
    ctx->depth++;
    ctx->commaNeeded[ctx->depth] = false;
    if(ctx->depth >= UA_JSON_ENCODING_MAX_RECURSION)
    if(ctx->depth >= UA_JSON_ENCODING_MAX_RECURSION)
    if(ctx->depth >= UA_JSON_ENCODING_MAX_RECURSION)
CVE-2022-25761 (C, published 2022-08-23T05:15Z)
Description: value: The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/open62541/open62541
Files changed:
plugins/ua_config_default.c
tests/check_securechannel.c
Commit message: fix(plugin): Add default limits for chunks and message size

Based on a reported DoS vulnerability reported by Team82 (Claroty
Research).


Vulnerable code:
    0,     /* .protocolVersion */
    65535, /* .sendBufferSize, 64k per chunk */
    65535, /* .recvBufferSize, 64k per chunk */
    0,     /* .localMaxMessageSize, 0 -> unlimited */
    0,     /* .remoteMaxMessageSize, 0 -> unlimited */
    0,     /* .localMaxChunkCount, 0 -> unlimited */
    0      /* .remoteMaxChunkCount, 0 -> unlimited */
    testingConnection = createDummyConnection(65535, &sentData);

Fixed code:
    0,       /* .protocolVersion */
    2 << 16, /* .sendBufferSize, 64k per chunk */
    2 << 16, /* .recvBufferSize, 64k per chunk */
    2 << 29, /* .localMaxMessageSize, 512 MB */
    2 << 29, /* .remoteMaxMessageSize, 512 MB */
    2 << 14, /* .localMaxChunkCount, 16k */
    2 << 14  /* .remoteMaxChunkCount, 16k */
    testingConnection =
        createDummyConnection(UA_ConnectionConfig_default.sendBufferSize, &sentData);
CVE-2021-39157 (C++, published 2021-08-24T19:15Z)
Description: value: detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0). No workaround are available and all users should update to resolve this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/sonicdoe/detect-character-encoding
Files changed:
README.md
icuWrapper.cpp
test/index.js
Commit message: Return null if no charset matches

Fixes a segmentation fault if no charset matches. According to http://icu-project.org/apiref/icu4c/ucsdet_8h.html#aff2633b5055d472cff4108d94f97cf7d, ucsdet_detect() may return NULL if no charset matches.

Fixes: #15
Co-authored-by: chenzhip <letme2010@gmail.com>


Vulnerable code:

Fixed code:
detect-character-encoding may return `null` if no charset matches.

	if(charsetMatch == NULL) {
		info.GetReturnValue().Set(Nan::Null());
		ucsdet_close(charsetDetector);
		return;
	}

it('should return null if no charset matches', () => {
	assert.strictEqual(detectCharacterEncoding(Buffer.from([0xAB])), null);
});
CVE-2021-39176 (C++, published 2021-08-31T18:15Z)
Description: value: detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocated memory is not released. The problem has been patched in detect-character-encoding v0.3.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/sonicdoe/detect-character-encoding
Files changed:
icuWrapper.cpp
Commit message: Fix memory leak by properly closing `charsetDetector`


Vulnerable code:

Fixed code:
		ucsdet_close(charsetDetector);
		ucsdet_close(charsetDetector);
		ucsdet_close(charsetDetector);
		ucsdet_close(charsetDetector);
	ucsdet_close(charsetDetector);
CVE-2020-26244 (Unknown, published 2020-12-02T20:15Z)
Description: value: Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. The issues are: 1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. 2) JWA `none` algorithm was allowed in all flows. 3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. 4) iat claim was not checked for sanity (i.e. it could be in the future). These issues are patched in version 1.2.1.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/OpenIDC/pyoidc
Files changed:
Commit message: Merge pull request from GHSA-4fjv-pmhg-3rfg

Cve 2020 26244

Vulnerable code:

Fixed code:
CVE-2015-10085 (Unknown, published 2023-02-21T18:15Z)
Description: value: A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gopistolet/gopistolet
Files changed:
Commit message: Merge pull request #27 from gopistolet/ddos

Use ReadUntill to protect against ddos.

Vulnerable code:

Fixed code: