hitoshura25/cvefixes huggingface dataset:
CVE-2019-25104 (C, published 2023-02-20T18:15Z)
Description: value: A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file code/game/ai_cast_script.c of the component Team Command Handler. The manipulation leads to denial of service. The identifier of the patch is f2cd18bc2e1cbca8c4b78bee9c392272bd5f42ac. It is recommended to apply a patch to fix this issue. The identifier VDB-221485 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/rtcwcoop/rtcwcoop
Files changed:
code/game/ai_cast_script.c
Commit message: fixed exploit where server crash by spamming team command

********************
ERROR: G_Alloc: failed on allocation of 27248 bytes
********************
----- Server Shutdown (Server crashed: G_Alloc: failed on allocation of 27248 bytes) -----

replaced G_Alloc -> trap_Alloc

anyway POOLSIZE for G_Alloc will fill up quickly just changing team in game menu


Vulnerable code:
	level.scriptAI = G_Alloc( len );
				curEvent->params = G_Alloc( strlen( params ) + 1 );
					curEvent->stack.items[curEvent->stack.numItems].params = G_Alloc( strlen( params ) + 1 );
		cs->castScriptEvents = G_Alloc( sizeof( cast_script_event_t ) * numEventItems );

Fixed code:
	level.scriptAI = trap_Alloc( len );
				curEvent->params = trap_Alloc( strlen( params ) + 1 );
					curEvent->stack.items[curEvent->stack.numItems].params = trap_Alloc( strlen( params ) + 1 );
		cs->castScriptEvents = trap_Alloc( sizeof( cast_script_event_t ) * numEventItems );
CVE-2021-27291 (Python, published 2021-03-17T13:15Z)
Description: value: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/pygments/pygments
Files changed:
CHANGES
pygments/lexers/archetype.py
pygments/lexers/factor.py
pygments/lexers/jvm.py
pygments/lexers/matlab.py
pygments/lexers/objective.py
pygments/lexers/templates.py
pygments/lexers/varnish.py
Commit message: Fix several exponential/cubic complexity regexes found by Ben Caller/Doyensec


Vulnerable code:
- Revert a private API change in the HTML formatter (#1655) -- please note that private APIs remain subject to change!
            (r'[+-]?(\d+)*\.\d+%?', Number.Float),
            (r'"""\s+(?:.|\n)*?\s+"""', String),
            (r'(\{\s+)(\S+)(\s+[^}]+\s+\}\s)',
            (r'".*``.*``.*"', String.Interpol),
            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(%config)(\s*\(\s*)(\w+)(\s*=\s*)(.*?)(\s*\)\s*)',
            (r'(%new)(\s*)(\()(\s*.*?\s*)(\))',
            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+[^=,%}]+?)?'
            (r'(\.\w+\b)(\s*=\s*)([^;]*)(\s*;)',

Fixed code:
- Revert a private API change in the HTML formatter (#1655) -- 
  please note that private APIs remain subject to change!
- Fix several exponential/cubic-complexity regexes found by
  Ben Caller/Doyensec (#1675)
            (r'[+-]?\d*\.\d+%?', Number.Float),
            (r'"""\s(?:.|\n)*?\s"""', String),
            (r'(\{\s+)(\S+)(\s[^}]+\s\}\s)',
            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(%config)(\s*\(\s*)(\w+)(\s*=)(.*?)(\)\s*)',
            (r'(%new)(\s*)(\()(.*?)(\))',
            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+)?'
            (r'(\.\w+\b)(\s*=\s*)([^;\s]*)(\s*;)',
CVE-2021-27292 (Python, published 2021-03-17T13:15Z)
Description: value: ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pygments/pygments
Files changed:
CHANGES
pygments/lexers/archetype.py
pygments/lexers/factor.py
pygments/lexers/jvm.py
pygments/lexers/matlab.py
pygments/lexers/objective.py
pygments/lexers/templates.py
pygments/lexers/varnish.py
Commit message: Fix several exponential/cubic complexity regexes found by Ben Caller/Doyensec


Vulnerable code:
- Revert a private API change in the HTML formatter (#1655) -- please note that private APIs remain subject to change!
            (r'[+-]?(\d+)*\.\d+%?', Number.Float),
            (r'"""\s+(?:.|\n)*?\s+"""', String),
            (r'(\{\s+)(\S+)(\s+[^}]+\s+\}\s)',
            (r'".*``.*``.*"', String.Interpol),
            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(.+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(%config)(\s*\(\s*)(\w+)(\s*=\s*)(.*?)(\s*\)\s*)',
            (r'(%new)(\s*)(\()(\s*.*?\s*)(\))',
            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+[^=,%}]+?)?'
            (r'(\.\w+\b)(\s*=\s*)([^;]*)(\s*;)',

Fixed code:
- Revert a private API change in the HTML formatter (#1655) -- 
  please note that private APIs remain subject to change!
- Fix several exponential/cubic-complexity regexes found by
  Ben Caller/Doyensec (#1675)
            (r'[+-]?\d*\.\d+%?', Number.Float),
            (r'"""\s(?:.|\n)*?\s"""', String),
            (r'(\{\s+)(\S+)(\s[^}]+\s\}\s)',
            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(\s*)(?:(\S+)(\s*)(=)(\s*))?(.+)(\()(.*)(\))(\s*)',
            (r'(%config)(\s*\(\s*)(\w+)(\s*=)(.*?)(\)\s*)',
            (r'(%new)(\s*)(\()(.*?)(\))',
            (r'(\$)(evoque|overlay)(\{(%)?)(\s*[#\w\-"\'.]+)?'
            (r'(\.\w+\b)(\s*=\s*)([^;\s]*)(\s*;)',
CVE-2021-3684 (Go, published 2023-03-24T20:15Z)
Description: value: A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/openshift/assisted-installer
Files changed:
src/assisted_installer_controller/assisted_installer_controller.go
src/ops/ops.go
Commit message: MGMT-7452: Remove token from assisted-installer-controller log (#338)



Vulnerable code:
	ClusterID             string `envconfig:"CLUSTER_ID" required:"true" `
	PullSecretToken       string `envconfig:"PULL_SECRET_TOKEN" required:"true"`
	o.log.Infof("Getting pull secret from %s", ignitionPath)

Fixed code:
	ClusterID             string `envconfig:"CLUSTER_ID" required:"true"`
	PullSecretToken       string `envconfig:"PULL_SECRET_TOKEN" required:"true" secret:"true"`
	o.log.Infof("Getting data from %s", ignitionPath)
CVE-2021-35265 (PHP, published 2021-08-03T12:15Z)
Description: value: A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/maxsite/cms
Files changed:
application/maxsite/common/core/format.php
application/maxsite/common/core/url.php
application/maxsite/plugins/global_cache/index.php
application/maxsite/plugins/sape/index.php
Commit message: Fix #414


Vulnerable code:
	$current_url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
		$url .= $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
		$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
	$cache_key = $_SERVER['REQUEST_URI'];
				$url = $_SERVER['REQUEST_URI']; // /?nono  /about/?momo

Fixed code:
	$current_url = mso_current_url(true);
	// $current_url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
		$url .= $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
		$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
	$url = getinfo('site_protocol') . $_SERVER['HTTP_HOST'] . mso_clean_str($_SERVER['REQUEST_URI']);
	
	//pr($url);
	$cache_key =  mso_clean_str($_SERVER['REQUEST_URI']); //$_SERVER['REQUEST_URI'];
				$url =  mso_clean_str($_SERVER['REQUEST_URI']); // $_SERVER['REQUEST_URI']; // /?nono  /about/?momo
CVE-2022-4456 (Unknown, published 2022-12-13T18:15Z)
Description: value: A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 15adb8e1ea1f1c3e3d152fc266071f621ef0c621. It is recommended to apply a patch to fix this issue. VDB-215446 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/falling-fruit/falling-fruit
Files changed:
Commit message: Merge branch 'fix-xss-vulnerabilities'


Vulnerable code:

Fixed code:
CVE-2023-5588 (Other, published 2023-10-15T22:15Z)
Description: value: A vulnerability was found in kphrx pleroma. It has been classified as problematic. This affects the function Pleroma.Emoji.Pack of the file lib/pleroma/emoji/pack.ex. The manipulation of the argument name leads to path traversal. The complexity of an attack is rather high. The exploitability is told to be difficult. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 2c795094535537a8607cc0d3b7f076a609636f40. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-242187.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/kphrx/pleroma
Files changed:
changelog.d/emoji-pack-sanitization.security
lib/pleroma/emoji/pack.ex
test/pleroma/emoji/pack_test.exs
Commit message: Resolve information disclosure vulnerability through emoji pack archive download endpoint

The pack name has been sanitized so an attacker cannot upload a media
file called pack.json with their own handcrafted list of emoji files as
arbitrary files on the filesystem and then call the emoji pack archive
download endpoint with a pack name crafted to the location of the media
file they uploaded which tricks Pleroma into generating a zip file of
the target files the attacker wants to download.

The attack only works if the Pleroma instance does not have the
AnonymizeFilename upload filter enabled, which is currently the default.

Reported by: graf@poast.org


Vulnerable code:

Fixed code:
Emoji pack loader sanitizes pack names
    name = Path.basename(name)

  test "load_pack/1 ignores path traversal in a forged pack name", %{pack: pack} do
    assert {:ok, ^pack} = Pack.load_pack("../../../../../dump_pack")
  end
CVE-2014-5016 (PHP, published 2014-07-21T14:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to application/views/admin/globalSettings_view.php, or (3) a crafted CSV file to the "Import CSV" functionality.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/participantsaction.php
application/views/admin/globalSettings_view.php
Commit message: Fixed issue: XSS reflection in CPDB and global settings


Vulnerable code:
        $iParticipantId = Yii::app()->request->getQuery('pid');
                    $warning_force_ssl = sprintf($clang->gT('Warning: Before turning on HTTPS,%s check if this link works.%s'),'<a href="https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'].'" title="'. $clang->gT('Test if your server has SSL enabled by clicking on this link.').'">','</a>')

Fixed code:
        $iParticipantId = strip_tags(Yii::app()->request->getQuery('pid'));
                    $warning_force_ssl = sprintf($clang->gT('Warning: Before turning on HTTPS,%s check if this link works.%s'),'<a href="https://'.$_SERVER['HTTP_HOST'].$this->createUrl("admin/globalsettings/sa").'" title="'. $clang->gT('Test if your server has SSL enabled by clicking on this link.').'">','</a>')
CVE-2014-5017 (PHP, published 2014-07-21T14:55Z)
Description: value: SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/participantsaction.php
Commit message: Fixed issue: Search parameter vulnerability in CPDB


Vulnerable code:
        $page = Yii::app()->request->getPost('page');
        $limit = Yii::app()->request->getPost('rows');
        $limit = isset($limit) ? $limit : 50; //Stop division by zero errors
        $sidx = !empty($sidx) ? $sidx : "lastname";
        $sord = !empty($sord) ? $sord : "asc";

Fixed code:
        $page = (int) Yii::app()->request->getPost('page');
        $limit = (int) Yii::app()->request->getPost('rows');
        $limit = empty($limit) ? $limit : 50; //Stop division by zero errors
        $sidx = in_array($sidx,$participantfields) ? $sidx : "lastname";
        $sord = ($sord=='desc') ? 'desc' : 'asc';
CVE-2014-5018 (PHP, published 2014-07-21T14:55Z)
Description: value: Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/helpers/common_helper.php
application/helpers/frontend_helper.php
Commit message: Fixed issue: Vulnerable parameter on survey resume


Vulnerable code:
        'default'=>'1',
// make sure the given string (which comes from a POST or GET variable)
// is safe to use in MySQL.  This does nothing if gpc_magic_quotes is on.
function autoEscape($str) {
    if (!get_magic_quotes_gpc()) {
        return addslashes ($str);
    }
    return $str;
}
        $query .="AND {{saved_control}}.identifier = '".autoEscape($_SESSION['survey_'.$surveyid]['holdname'])."' ";

Fixed code:
        $query .="AND {{saved_control}}.identifier = '".Yii::app()->db->quoteValue($_SESSION['survey_'.$surveyid]['holdname'])."' ";
CVE-2015-4628 (Other, published 2015-06-18T10:59Z)
Description: value: SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
docs/release_notes.txt
Commit message: Release 2.06+ Build 150618


Vulnerable code:

Fixed code:
Changes from 2.06+ (build 150612) to 2.06+ (build 150618) Jun 18, 2015
-Fixed issue #9679: Incorrect width of select2 with IE10 (Denis Chenu)
-Fixed issue #9680: Database update error when updating and having very old token tables (Carsten Schmitz)
-Fixed issue #9682: Unable to update with pgsql (Sam)
-Fixed issue #9683: XSS vulnerabilities (Carsten Schmitz)
-Fixed issue #9685: Simple quote are double encoded in dropdown (Denis Chenu)
-Fixed issue #9687: Crash when trying to edit global parameter for a survey (Denis Chenu)
-Fixed issue #9688: Update KCFinder to last stable (3.12) (Denis Chenu)
-Fixed issue #9689: Update CKEditor to 3.6.6.2 (Denis Chenu)
-Fixed issue: Blank survey parameters when no questions exist yet (Carsten Schmitz)
-Fixed issue: Can force Show both for group and question code in Global settings (Denis Chenu)
-Fixed issue: CSRF vulnerability in KCFinder (Denis Chenu)
-Fixed issue: SQL injection vulnerability in administration - discovered by 0keeTeam / QIHU 360 company, China (Carsten Schmitz)
#Updated translation: Basque by ikt
#Updated translation: Catalan by qualitatuvic
#Updated translation: Chinese (Hong Kong) (Traditional) by wksosam
#Updated translation: Chinese (Simplified) by jun9, yanglaw
#Updated translation: Chinese (Taiwan) (Traditional) by m27387, hsyin
#Updated translation: Danish by Tobm
#Updated translation: French (France) by arnaud21
#Updated translation: German by c_schmitz
#Updated translation: Japanese by yamatt, nomoto
#Updated translation: Norwegian (BokmÃ¥l) by pmonstad
#Updated translation: Polish by elisa
#Updated translation: Polish (Informal) by elisa
#Updated translation: Spanish (Argentina) by topiim
#Updated translation: Spanish (Spain) by aesteban
#Updated translation: Turkish by kayazeren
CVE-2018-1000053 (PHP, published 2018-02-09T23:29Z)
Description: value: LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be used to send a GET request to the affected endpoint.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/LimeSurvey/LimeSurvey
Files changed:
application/controllers/admin/themeoptions.php
application/models/TemplateConfiguration.php
Commit message: Fixed issue: no CRSF check for uninstall theme, reported by MUSTAFA HASAN



Vulnerable code:
    public function uninstall($templatename)
        $templatename = Yii::app()->request->getPost('templatename');        
            ['data' => ['image' =>  $previewTag]], 
        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/', array("templatename"=>$this->template_name));
            data-href="'.$sUninstallUrl.'"

Fixed code:
    public function uninstall()
        $templatename = Yii::app()->request->getPost('templatename');
        $templatename = Yii::app()->request->getPost('templatename');
            ['data' => ['image' =>  $previewTag]],
        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/');
            data-ajax-url="'.$sUninstallUrl.'"
            data-post=\'{ "templatename": "'.$this->template_name.'" }\'
            data-gridid = "yw0"