hitoshura25/cvefixes huggingface dataset:
CVE-2024-22419 (Python, published 2024-01-18T19:15Z)
Description: value: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur. This issue has been addressed in commit `55e18f6d1` which will be included in future releases. Users are advised to update when possible.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vyperlang/vyper
Files changed:
tests/functional/builtins/codegen/test_concat.py
vyper/builtins/functions.py
Commit message: fix: concat buffer bug (#3738)

the `concat()` builtin did not respect the `copy_bytes()` API, it
allocated a buffer in some cases which did not have enough padding.

patches GHSA-2q8v-3gqq-4f8p

---------

Co-authored-by: cyberthirst <cyberthirst.eth@gmail.com>

Vulnerable code:
        dst = IRnode.from_list(
            context.new_internal_variable(ret_typ),
            typ=ret_typ,
            location=MEMORY,
            annotation="concat destination",
        )

Fixed code:
def test_concat_buffer(get_contract):
    # GHSA-2q8v-3gqq-4f8p
    code = """
@internal
def bar() -> uint256:
    sss: String[2] = concat("a", "b")
    return 1


@external
def foo() -> int256:
    a: int256 = -1
    b: uint256 = self.bar()
    return a
    """
    c = get_contract(code)
    assert c.foo() == -1


def test_concat_buffer2(get_contract):
    # GHSA-2q8v-3gqq-4f8p
    code = """
i: immutable(int256)

@external
def __init__():
    i = -1
    s: String[2] = concat("a", "b")

@external
def foo() -> int256:
    return i
    """
    c = get_contract(code)
    assert c.foo() == -1


def test_concat_buffer3(get_contract):
    # GHSA-2q8v-3gqq-4f8p
    code = """
s: String[1]
s2: String[33]
s3: String[34]

@external
def __init__():
    self.s = "a"
    self.s2 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" # 33*'a'

@internal
def bar() -> uint256:
    self.s3 = concat(self.s, self.s2)
    return 1

@external
def foo() -> int256:
    i: int256 = -1
    b: uint256 = self.bar()
    return i
    """
    c = get_contract(code)
    assert c.foo() == -1


        # respect API of copy_bytes
        bufsize = dst_maxlen + 32
        buf = context.new_internal_variable(BytesT(bufsize))

        dst = IRnode.from_list(buf, typ=ret_typ, location=MEMORY, annotation="concat destination")
CVE-2024-32481 (Python, published 2024-04-25T17:15Z)
Description: value: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range `stmt.parse_For_range()`. The issue arises when `start` is signed, instead of using `sle`, `le` is used and `start` is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to `1` and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a `range(start, start + N)` where `start` is a signed integer with the possibility for `start` to be negative is affected. If a call goes through the loop while supplying a negative `start` the execution will revert. Version 0.4.0b1 fixes the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vyperlang/vyper
Files changed:
tests/parser/features/iteration/test_for_range.py
vyper/codegen/stmt.py
Commit message: Merge pull request from GHSA-6r8q-pfpv-7cgj

for loops of the form `for i in range(x, x+N)`, the range of the
iterator is not checked, leading to potential overflow. the following
example demonstrates the potential for overflow:

```
@external
def test() -> uint16:
    x:uint8 = 255
    a:uint8 = 0
    for i in range(x, x+2):
        a = i
    return convert(a,uint16)  # returns 256
```

this commit fixes the issue by adding a range check before entering the
loop body.

Vulnerable code:

Fixed code:
# test that we can get to the upper range of an integer
@pytest.mark.parametrize("typ", ["uint8", "int128", "uint256"])
def test_for_range_edge(get_contract, typ):
    code = f"""
@external
def test():
    found: bool = False
    x: {typ} = max_value({typ})
    for i in range(x, x + 1):
        if i == max_value({typ}):
            found = True

    assert found

    found = False
    x = max_value({typ}) - 1
    for i in range(x, x + 2):
        if i == max_value({typ}):
            found = True

    assert found
    """
    c = get_contract(code)
    c.test()


@pytest.mark.parametrize("typ", ["uint8", "int128", "uint256"])
def test_for_range_oob_check(get_contract, assert_tx_failed, typ):
    code = f"""
@external
def test():
    x: {typ} = max_value({typ})
    for i in range(x, x+2):
        pass
    """
    c = get_contract(code)
    assert_tx_failed(lambda: c.test())


    clamp,
            _, hi = start.typ.int_bounds
            start = clamp("le", start, hi + 1 - rounds)
CVE-2024-32648 (Unknown, published 2024-04-25T18:15Z)
Description: value: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vyperlang/vyper
Files changed:
Commit message: Merge pull request #2447 from charles-cooper/abi_refactor

rewrite internal calling convention

Vulnerable code:

Fixed code:
CVE-2024-34341 (Unknown, published 2024-05-07T16:15Z)
Description: value: Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/basecamp/trix
Files changed:
Commit message: Merge pull request #1149 from basecamp/paste-html-sanitize

Sanitize HTML content in data-trix-* attributes 

Vulnerable code:

Fixed code:
CVE-2024-34341 (Unknown, published 2024-05-07T16:15Z)
Description: value: Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application. Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/basecamp/trix
Files changed:
Commit message: Merge pull request #1147 from basecamp/sanitize-noscript

Sanitize noscript to prevent copy and paste XSS

Vulnerable code:

Fixed code:
CVE-2017-8920 (Other, published 2017-06-06T16:29Z)
Description: value: irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dgl/cgiirc
Files changed:
irc.cgi
Commit message: Validate R parameter in irc.cgi

This matches the check done in nph-irc.cgi.


Vulnerable code:

Fixed code:
   error('Communication socket name is invalid') if $cgi->{R} =~ /[^A-Za-z0-9]/;
CVE-2023-38695 (TypeScript, published 2023-08-04T18:15Z)
Description: value: cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.



Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/simonsmith/cypress-image-snapshot
Files changed:
cypress/e2e/matchImageSnapshot.cy.ts
cypress/e2e/nested/test/matchImageSnapshot.cy.ts
src/plugin.ts
Commit message: fix: sanitise snapshot filenames

Prevents potential for tests to create directories/images outside of the repository
root. Makes use of the Cypress screenshot path which has already been
sanitised

Fixes #15


Vulnerable code:
  // name of the screenshot without the Cypress suffixes for test failures
  const snapshotName = screenshotConfig.name.replace(/ \(attempt [0-9]+\)/, '')

Fixed code:
it('file name should ignore directories', () => {
  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')
  cy.get('h1').matchImageSnapshot('ignore/folders/image')
})


it('file name should ignore directories', () => {
  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')
})
  const snapshotName = path.basename(screenshotConfig.path, '.png')
CVE-2019-1010283 (Other, published 2019-07-17T21:15Z)
Description: value: Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss of Confidentiality. The component is: function data_on_connection() in src/callback.c. The attack vector is: network connectivity. The fixed version is: 12.0.1-4 and later.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/univention/univention-corporate-server
Files changed:
management/univention-directory-notifier/debian/changelog
management/univention-directory-notifier/src/callback.c
Commit message: Bug #48427 UDN: Forbid vulnerable GET_DN for VERSION >= 3

UDL using PROTOCOL_3 must no longer use GET_DN but WAIT_DN - if it is
still used this is a protocol violation. UDL simply will not get an
answer.

When UCRV 'notifier/protocol/version is set to 3, any old client still
using PROTOCOL_2 will get rejected while negotiating the protocol
version, so it is asserted that "version >= network_procotol_version".


Vulnerable code:
		} else if ( !strncmp(network_line, "GET_DN ", strlen("GET_DN ")) && msg_id != UINT32_MAX && network_client_get_version(fd) > 0) {

Fixed code:
univention-directory-notifier (12.0.1-11) unstable; urgency=low

  * Bug #48427: Forbid vulnerable GET_DN for VERSION >= 3

 -- Philipp Hahn <hahn@univention.de>  Wed, 13 Feb 2019 10:23:12 +0100

		} else if ( !strncmp(network_line, "GET_DN ", strlen("GET_DN ")) && msg_id != UINT32_MAX && version > PROTOCOL_UNKNOWN && version < PROTOCOL_3) {
CVE-2020-23489 (PHP, published 2020-11-16T18:15Z)
Description: value: The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/WWBN/AVideo
Files changed:
objects/import.json.php
Commit message: https://github.com/WWBN/AVideo/issues/3117
If fileURI is not a MP4 file return false

Vulnerable code:

Fixed code:
if(!preg_match("/.*\\.mp4$/i", $_POST['fileURI'])){
    return false;
}
CVE-2020-23490 (PHP, published 2020-11-16T18:15Z)
Description: value: There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/WWBN/AVideo
Files changed:
plugin/LiveLinks/proxy.php
Commit message: https://github.com/WWBN/AVideo/issues/3117
Make sure the livelink starts with http

Vulnerable code:
if (!filter_var($_GET['livelink'], FILTER_VALIDATE_URL) && preg_match("/^http.*/i", $_GET['livelink'])) {

Fixed code:
if (!filter_var($_GET['livelink'], FILTER_VALIDATE_URL) || !preg_match("/^http.*/i", $_GET['livelink'])) {
CVE-2022-27462 (PHP, published 2022-04-05T16:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WWBN/AVideo
Files changed:
objects/functions.php
Commit message: XSS vulnerability fix , thanks Max Boll 

Vulnerable code:
        return $device;
        return $device;
        return $_GET[$cookieName];
    return $_COOKIE[$cookieName];

Fixed code:
    $pattern = "/[0-9a-z_.-]/i";
        return preg_replace($pattern, '-', $device);
        return preg_replace($pattern, '', $device);
    return preg_replace($pattern, '', $_COOKIE[$cookieName]);
CVE-2022-27463 (PHP, published 2022-04-05T16:15Z)
Description: value: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/WWBN/AVideo
Files changed:
objects/login.json.php
Commit message: Open Redirect fix, thanks Max Boll


Vulnerable code:
if (!preg_match("|^" . $global['webSiteRootURL'] . "|", $_POST['redirectUri'])) {

Fixed code:
if(!isSameDomain($global['webSiteRootURL'], $_POST['redirectUri'])){
CVE-2023-32073 (PHP, published 2023-05-12T14:15Z)
Description: value: WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/WWBN/AVideo
Files changed:
plugin/CloneSite/cloneClient.json.php
Commit message: Authenticated Remote Code Execution fix


Vulnerable code:

Fixed code:
$objClone->cloneSiteURL = escapeshellarg($objClone->cloneSiteURL);
CVE-2023-3020 (PHP, published 2023-05-31T17:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mkucej/i-librarian-free
Files changed:
app/views/items.php
Commit message: reflected XSS vulnerability fix


Vulnerable code:
                $el->html("<b>{$this->type_to_readable[$type]}</b> &mdash; {$get['search_query'][$i]}");

Fixed code:
                $get_search_query = $this->sanitation->html($get['search_query'][$i]);

                $el->html("<b>{$this->type_to_readable[$type]}</b> &mdash; {$get_search_query}");
CVE-2023-3021 (PHP, published 2023-05-31T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mkucej/i-librarian-free
Files changed:
app/views/dashboard.php
Commit message: stored XSS vulnerability fix


Vulnerable code:
                {$active_session['user_agent']}

Fixed code:
            $user_agent = $this->sanitation->html($active_session['user_agent']);
                <small>{$user_agent}</small>
CVE-2010-2761 (Other, published 2010-12-06T20:12Z)
Description: value: The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/AndyA/CGI--Simple
Files changed:
lib/CGI/Simple.pm
t/050.simple.t
t/070.standard.t
Commit message: Randomise multipart boundary. Thanks to Yamada Masahiro.


Vulnerable code:
  $boundary = $boundary || '------- =_aaaaaaaaaa0';
  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_aaaaaaaaaa0"|,
like( $sv, qr/--------- =_aaaaaaaaaa0$CRLF/, 'multipart_init(), 2' );
  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_aaaaaaaaaa0"|,
like( $sv, qr/--------- =_aaaaaaaaaa0$CRLF/, 'multipart_init(), 2' );

Fixed code:
  if ( !$boundary ) {
    $boundary = '------- =_';
    my @chrs = ( '0' .. '9', 'A' .. 'Z', 'a' .. 'z' );
    for ( 1 .. 17 ) {
      $boundary .= $chrs[ rand( scalar @chrs ) ];
    }
  }

  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_[a-zA-Z0-9]{17}"|,
like( $sv, qr/--------- =_[a-zA-Z0-9]{17}$CRLF/,
  'multipart_init(), 2' );
  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_[a-zA-Z0-9]{17}"|,

like( $sv, qr/--------- =_[a-zA-Z0-9]{17}$CRLF/,
  'multipart_init(), 2' );
CVE-2021-32819 (TypeScript, published 2021-05-14T19:15Z)
Description: value: Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/squirrellyjs/squirrelly
Files changed:
src/file-handlers.ts
Commit message: Don't merge data.settings into the config option


Vulnerable code:
  settings?: {
    [key: string]: any
  }
  if (data.settings) {
    // Pull a few things from known locations
    if (data.settings.views) {
      Config.views = data.settings.views
    }
    if (data.settings['view cache']) {
      Config.cache = true
    }
  }


Fixed code:
CVE-2021-32819 (TypeScript, published 2021-05-14T19:15Z)
Description: value: Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/squirrellyjs/squirrelly
Files changed:
src/file-handlers.ts
Commit message: don't pass view options


Vulnerable code:
import { promiseImpl, copyProps } from './utils'
 * @param {String} [template] template source
    // Undocumented after Express 2, but still usable, esp. for
    // items that are unsafe to be passed along with data, like `root`
    var viewOpts = data.settings['view options']

    if (viewOpts) {
      copyProps(Config, viewOpts)
    }

Fixed code:
import { promiseImpl } from './utils'