hitoshura25/cvefixes huggingface dataset:
CVE-2022-27818 (Rust, published 2022-04-07T02:15Z)
Description: value: SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/waycrate/swhkd
Files changed:
src/daemon.rs
src/server.rs
Commit message: [patch] CVE-2022-27818


Vulnerable code:
        if !config_file_path.exists() {
            log::error!("{:#?} doesn't exist", config_file_path);
            exit(1);
        }

    let mut stream = UnixStream::connect("/tmp/swhkd.sock")?;
    let uid = nix::unistd::Uid::from_raw(uid);
            log::error!("Failed to set UID: {:#?}", e);
    let sock_file_path = String::from("/tmp/swhkd.sock");

Fixed code:
    let sock_file_path =
        String::from(format!("/run/user/{}/swhkd.sock", env::var("PKEXEC_UID").unwrap()));
    let mut stream = UnixStream::connect(sock_file_path)?;
    let uid = Uid::from_raw(uid);
            log::error!("Failed to set EUID: {:#?}", e);
use nix::unistd;
    let sock_file_path = String::from(format!("/run/user/{}/swhkd.sock", unistd::Uid::current()));
CVE-2022-27819 (Rust, published 2022-04-07T02:15Z)
Description: value: SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/waycrate/swhkd
Files changed:
Cargo.lock
Cargo.toml
src/daemon.rs
Commit message: [patch] CVE-2022-27819


Vulnerable code:
version = "0.5.2"
checksum = "e54ea8bc3fb1ee042f5aace6e3c6e025d3874866da222930f70ce62aceba0bfa"
version = "0.9.7"
checksum = "c00d6d2ea26e8b151d99093005cb442fb9a37aeaca582a03ec70946f49ab5ed9"
version = "0.8.7"
checksum = "b5e5bed1f1c269533fa816a0a5492b3545209a205ca1a54842be180eb63a16a6"
version = "0.2.119"
checksum = "1bf2e165bb3457c8e098ea76f3e3bc9db55f87aa90d52d0e6be741470916aaa4"
version = "0.4.14"
checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
version = "0.8.1"
checksum = "7ba42135c6a5917b9db9cd7b293e5409e1c6b041e6f9825e92e55a894c63b6f8"
version = "1.0.15"
checksum = "864d3e96a899863136fc6e99f3d7cae289dafe43bf2c5ac19b70df7210c0a145"
version = "0.2.11"
checksum = "8380fe0152551244f0747b1bf41737e0f8a74f97a14ccefd1148187271634f3c"
version = "1.0.86"
checksum = "8a65b3f4ffa0092e9887669db0eae07941f023991ab58ea44da8fe8e2d511c6b"
sysinfo = "0.23.5"
itertools = "0.10.3"


Fixed code:
version = "0.5.4"
checksum = "5aaa7bd5fb665c6864b5f963dd9097905c54125909c7aa94c9e18507cdbe6c53"
version = "0.9.8"
checksum = "1145cf131a2c6ba0615079ab6a638f7e1973ac9c2634fcbeaaad6114246efe8c"
 "autocfg",
version = "0.8.8"
checksum = "0bf124c720b7686e3c2663cf54062ab0f68a88af2fb6a030e87e30bf721fcb38"
version = "0.2.121"
checksum = "efaa7b300f3b5fe8eb6bf21ce3895e1751d9665086af2d64b42f19701015ff4f"
version = "0.4.16"
checksum = "6389c490849ff5bc16be905ae24bc913a9c8892e19b2341dbc175e14c341c2b8"
version = "0.8.2"
checksum = "52da4364ffb0e4fe33a9841a98a3f3014fb964045ce4f7a45a398243c8d6b0c9"
version = "1.0.16"
checksum = "b4af2ec4714533fcdf07e886f17025ace8b997b9ce51204ee69b6da831c3da57"
version = "0.2.12"
checksum = "8ae183fc1b06c149f0c1793e1eb447c8b04bfe46d48e9e48bfb8d2d7ed64ecf0"
version = "1.0.89"
checksum = "ea297be220d52398dcc07ce15a209fce436d361735ac1db700cab3b6cdfb9f54"
itertools = "0.10.3"
sysinfo = "0.23.5"
        seteuid(env::var("PKEXEC_UID").unwrap().parse::<u32>().unwrap()); // Dropping privileges to invoking user.
    seteuid(0); // Escalating back to root after reading config file.

pub fn seteuid(uid: u32) {
    let uid = nix::unistd::Uid::from_raw(uid);
    match nix::unistd::seteuid(uid) {
        Ok(_) => log::debug!("Dropping privileges..."),
        Err(e) => {
            log::error!("Failed to set UID: {:#?}", e);
            exit(1);
        }
    }
}
CVE-2013-4789 (PHP, published 2013-08-09T21:55Z)
Description: value: SQL injection vulnerability in modules/rss/rss.php in Cotonti before 0.9.14 allows remote attackers to execute arbitrary SQL commands via the "c" parameter to index.php.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Cotonti/Cotonti
Files changed:
modules/rss/rss.php
Commit message: Fixed SQL injection vulnerability in RSS module


Vulnerable code:
	if (!empty($c))

Fixed code:
	if (!empty($c) && isset($structure['page'][$c]))
CVE-2022-2650 (Other, published 2022-11-24T17:15Z)
Description: value: Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/wger-project/wger
Files changed:
extras/docker/development/settings.py
requirements.txt
Commit message: Merge branch 'master' into add-django-axes

Vulnerable code:
 django-email-verification~=0.1.0

Fixed code:
+
 #
 # Django Rest Framework SimpleJWT
 #
 SIMPLE_JWT['ACCESS_TOKEN_LIFETIME'] = timedelta(minutes=env.int("ACCESS_TOKEN_LIFETIME", 15))
 SIMPLE_JWT['REFRESH_TOKEN_LIFETIME'] = timedelta(hours=env.int("REFRESH_TOKEN_LIFETIME", 24))
+SIMPLE_JWT['SIGNING_KEY'] = env.str("SIGNING_KEY", SECRET_KEY)
 django-email-verification~=0.3.1
CVE-2015-5243 (PHP, published 2018-08-20T21:29Z)
Description: value: phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/Gemorroj/phpwhois
Files changed:
src/whois.parser.php
Commit message: remove eval-s


Vulnerable code:
                eval("\$block" . getvarname($k) . "=\$v;");
        } else $k = strtolower($k);
                        $var = '$r' . getvarname($field);
                        if ($itm != '')
                            eval($var . '="' . str_replace('"', '\"', $itm) . '";');
                    if (!$scanall)
                    eval('$r' . $var . '=$itm;');
                if ($var != '[]') eval('$r' . $var . '=$block;');
                    eval('$r' . getvarname($field) . '=$itm;');

Fixed code:
                ${'block' . getvarname($k)} = $v;
        } else {
            $k = strtolower($k);
        }
                        if ($itm != '') {
                            ${'r' . getvarname($field)} = '="' . str_replace('"', '\"', $itm) . '";';
                        }
                    if (!$scanall) {
                    }

                    ${'r' . $var} = $itm;
                if ($var != '[]') {
                    ${'r' . $var} = $block;
                }
                    ${'r' . getvarname($field)} = $itm;
CVE-2022-25854 (JavaScript, published 2022-04-29T20:15Z)
Description: value: This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yairEO/tagify
Files changed:
src/tagify.js
Commit message: fixes #989 - fix XSS


Vulnerable code:
        _s.placeholder = input.getAttribute('placeholder') || _s.placeholder || ""

Fixed code:
        _s.placeholder = escapeHTML(input.getAttribute('placeholder') || _s.placeholder || "")
CVE-2022-41417 (Unknown, published 2023-01-18T14:15Z)
Description: value: BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/BlogEngine/BlogEngine.NET
Files changed:
Commit message: Merge pull request #247 from 0xLanks/fix-security-issues

Fixed security issues

Vulnerable code:

Fixed code:
CVE-2022-41418 (Unknown, published 2022-12-19T20:15Z)
Description: value: An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/BlogEngine/BlogEngine.NET
Files changed:
Commit message: Merge pull request #247 from 0xLanks/fix-security-issues

Fixed security issues

Vulnerable code:

Fixed code:
CVE-2023-36260 (PHP, published 2024-01-30T09:15Z)
Description: value: An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume selected. NOTE: this is not a report about code provided by the Craft CMS product; it is only a report about the Feed Me plugin. NOTE: a third-party report states that commit b5d6ede51848349bd91bc95fec288b6793f15e28 has "nothing to do with security."
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/craftcms/feed-me
Files changed:
CHANGELOG.md
src/controllers/FeedsController.php
Commit message: Fixed a PHP error that could occur when saving a feed using an Asset element type with no volume selected.


Vulnerable code:

Fixed code:
## Unreleased

- Fixed a PHP error that could occur when saving a feed using an Asset element type with no volume selected.

        if ($feed->getErrors()) {
            $this->setFailFlash(Craft::t('feed-me', 'Couldn’t save the feed.'));

            // Send the category group back to the template
            Craft::$app->getUrlManager()->setRouteParams([
                'feed' => $feed,
            ]);

            return null;
        }
CVE-2023-49098 (Ruby, published 2024-01-12T21:15Z)
Description: value: Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.
Severity: nan (CVSS v3 base score: 3.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/discourse/discourse-reactions
Files changed:
app/controllers/discourse_reactions/custom_reactions_controller.rb
spec/requests/custom_reactions_controller_spec.rb
Commit message: SECURITY: restrict custom reaction access (#263)

Co-authored-by: David Battersby <info@davidbattersby.com>

Vulnerable code:
    raise Discourse::NotFound unless guardian.can_see_profile?(user)
    raise Discourse::NotFound unless guardian.can_see_profile?(user)
    it "returns reactions given by a user" do
      sign_in(user_1)
      parsed = response.parsed_body
      expect(parsed[0]["user"]["id"]).to eq(user_2.id)
      expect(parsed[0]["post_id"]).to eq(post_2.id)
      expect(parsed[0]["post"]["user"]["id"]).to eq(user_1.id)
      expect(parsed[0]["reaction"]["id"]).to eq(reaction_1.id)
    it "does not return reactions for private messages" do
      parsed = response.parsed_body
      expect(response.parsed_body.map { |reaction| reaction["post_id"] }).not_to include(
        private_post.id,
      )
      parsed = response.parsed_body
      expect(response.parsed_body.map { |reaction| reaction["post_id"] }).not_to include(
        secure_post.id,
      )
      parsed = response.parsed_body
      expect(response.parsed_body.map { |reaction| reaction["post_id"] }).to include(secure_post.id)
    it "returns reactions received by a user" do
      sign_in(user_2)

Fixed code:
    raise Discourse::InvalidAccess unless guardian.can_see_notifications?(user)
    raise Discourse::InvalidAccess unless guardian.can_see_notifications?(user)
    it "returns reactions given by a user when current user is admin" do
      sign_in(admin)
      expect(response.status).to eq(200)
      parsed = response.parsed_body
      expect(parsed[2]["user"]["id"]).to eq(user_2.id)
      expect(parsed[2]["post_id"]).to eq(post_2.id)
      expect(parsed[2]["post"]["user"]["id"]).to eq(user_1.id)
      expect(parsed[2]["reaction"]["id"]).to eq(reaction_1.id)
    it "does not return reactions for private messages of other users" do
      expect(response.status).to eq(403)
    end
    it "returns reactions for private messages of current user" do
      expect(response.status).to eq(403)
      expect(response.status).to eq(403)
    it "returns reactions received by a user when current user is admin" do
      sign_in(admin)
    it "does not return reactions received by a user when current user is not an admin" do
      sign_in(user_1)

      get "/discourse-reactions/posts/reactions-received.json",
          params: {
            username: user_2.username,
          }

      expect(response.status).to eq(403)
    end
CVE-2024-31219 (Ruby, published 2024-04-15T18:15Z)
Description: value: Discourse-reactions is a plugin that allows user to add their reactions to the post. When whispers are enabled on a site via `whispers_allowed_groups` and reactions are made on whispers on public topics, the contents of the whisper and the reaction data are shown on the `/u/:username/activity/reactions` endpoint.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/discourse/discourse-reactions
Files changed:
app/controllers/discourse_reactions/custom_reactions_controller.rb
plugin.rb
spec/requests/custom_reactions_controller_spec.rb
Commit message: SECURITY: Hide whisper posts in reactions given endpoint (#286)

Users who were not allowed to whisper could see reactions
and whisper content of posts on public topics.

Vulnerable code:
        .joins(:reaction, :post)
        .joins("INNER JOIN topics t ON t.id = posts.topic_id AND t.deleted_at IS NULL")
    UserAction.filter_private_messages(builder, current_user.id, guardian)
    UserAction.filter_categories(builder, guardian)
# version: 0.3

Fixed code:
        .joins(
          "INNER JOIN discourse_reactions_reactions ON discourse_reactions_reactions.id = discourse_reactions_reaction_users.reaction_id",
        )
        .joins("INNER JOIN posts p ON p.id = discourse_reactions_reaction_users.post_id")
        .joins("INNER JOIN topics t ON t.id = p.topic_id AND t.deleted_at IS NULL")
        .joins("INNER JOIN posts p2 ON p2.topic_id = t.id AND p2.post_number = 1")
    UserAction.apply_common_filters(builder, current_user.id, guardian)
# version: 0.5
  fab!(:whisper_post) do
    Fabricate(:post, topic: Fabricate(:topic), post_type: Post.types[:whisper])
  end
  fab!(:laughing_reaction_whisper) do
    Fabricate(:reaction, post: whisper_post, reaction_value: "laughing")
  end
  fab!(:reaction_user_6) do
    Fabricate(:reaction_user, reaction: laughing_reaction_whisper, user: user_2, post: whisper_post)
  end
    it "does not return reactions for whispers if the user is not in whispers_allowed_groups" do
      sign_in(user_1)

      get "/discourse-reactions/posts/reactions.json", params: { username: user_2.username }

      parsed = response.parsed_body
      expect(response.parsed_body.map { |reaction| reaction["post_id"] }).not_to include(
        whisper_post.id,
      )

      SiteSetting.whispers_allowed_groups = Group::AUTO_GROUPS[:trust_level_0].to_s
      Group.refresh_automatic_groups!

      get "/discourse-reactions/posts/reactions.json", params: { username: user_2.username }

      parsed = response.parsed_body
      expect(response.parsed_body.map { |reaction| reaction["post_id"] }).to include(
        whisper_post.id,
      )
    end
CVE-2018-17294 (C, published 2018-09-21T07:29Z)
Description: value: The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/liblouis/liblouis
Files changed:
liblouis/lou_translateString.c
Commit message: Fix a buffer overflow

Fixes #635

Thanks to HongxuChen for reporting it


Vulnerable code:
	for (k = passIC + 2; k < passIC + 2 + passInstructions[passIC + 1]; k++)

Fixed code:
	for (k = passIC + 2;
			((k < passIC + 2 + passInstructions[passIC + 1]) && (kk < input->length));
			k++)
CVE-2024-22207 (JavaScript, published 2024-01-15T16:15Z)
Description: value: fastify-swagger-ui is a Fastify plugin for serving Swagger UI.  Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module.  The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-1188 \u2014 Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
Repository: https://github.com/fastify/fastify-swagger-ui
Files changed:
lib/routes.js
test/route.test.js
Commit message: Merge pull request from GHSA-62jr-84gf-wmg4

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Nick O'Leary <nick.oleary@gmail.com>

Vulnerable code:
  fastify.register(fastifyStatic, {
    root: opts.baseDir || path.join(__dirname, '..'),
    serve: false
  })
  // Handler for external documentation files passed via $ref
  fastify.route({
    url: '/*',
    method: 'GET',
    schema: { hide: true },
    ...hooks,
    handler: function (req, reply) {
      const file = req.params['*']
      reply.sendFile(file)
    }
  })

Fixed code:
  if (opts.baseDir) {
    fastify.register(fastifyStatic, {
      root: opts.baseDir,
      serve: false
    })
    // Handler for external documentation files passed via $ref
    fastify.route({
      url: '/*',
      method: 'GET',
      schema: { hide: true },
      ...hooks,
      handler: function (req, reply) {
        const file = req.params['*']
        reply.sendFile(file)
      }
    })
  }
test('/documentation/* should not return module files when baseDir not set', async (t) => {
  t.plan(1)
  const fastify = Fastify()
  await fastify.register(fastifySwagger, swaggerOption)
  await fastify.register(fastifySwaggerUi)

  const res = await fastify.inject({
    method: 'GET',
    url: '/documentation/README.md'
  })
  t.equal(res.statusCode, 404)
})
CVE-2022-29869 (C, published 2022-04-28T01:15Z)
Description: value: cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/piastry/cifs-utils
Files changed:
mount.cifs.c
Commit message: mount.cifs: fix verbose messages on option parsing

When verbose logging is enabled, invalid credentials file lines may be
dumped to stderr. This may lead to information disclosure in particular
conditions when the credentials file given is sensitive and contains '='
signs.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15026

Signed-off-by: Jeffrey Bencteux <jbe@improsec.com>
Reviewed-by: David Disseldorp <ddiss@suse.de>


Vulnerable code:
			if (parsed_info->verboseflag)
				fprintf(stderr, "domain=%s\n",
					temp_val);
					"incorrectly: %s\n",
					temp_val ? temp_val : "(null)");

Fixed code:
					"incorrectly\n");
CVE-2023-34411 (Rust, published 2023-06-05T04:15Z)
Description: value: The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/netvl/xml-rs
Files changed:
src/reader/lexer.rs
Commit message: Avoid panic when displaying unexpected token error

Avoid entering unreachable!() when displaying an error message for an
invalid `<!` token. This fixes a panic when processing a malformed
XML which contains such token in an unexpected place, like the
following:

`<!DOCTYPEs/%<!A`


Vulnerable code:

Fixed code:
                Token::MarkupDeclarationStart     => "<!",