hitoshura25/cvefixes huggingface dataset:
CVE-2024-29183 (Other, published 2024-04-19T16:15Z)
Description: value: OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a reflected XSS in the /login page due to a reflection of the redirect parameter. This allows an attacker to execute arbitrary javascript with the permissions of a user after the user logins with their account.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/baidu/openrasp
Files changed:
rasp-vue/src/components/Login.vue
Commit message: fix open redirect issue in Login page


Vulnerable code:
        if (this.$route.query.redirect) {

Fixed code:
    validateRedirect(urlstring) {
      let url = new URL(urlstring)
      return url.protocol == location.protocol && url.host == location.host && url.port == location.port
    },
        if (this.$route.query.redirect && this.validateRedirect(this.$route.query.redirect)) {
CVE-2023-36829 (Python, published 2023-07-06T23:15Z)
Description: value: Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/getsentry/sentry
Files changed:
src/sentry/api/base.py
tests/sentry/api/test_base.py
Commit message: Fix GHSA-4xqm-4p72-87h6 (#52276)



Vulnerable code:
            if origin.endswith(basehost):
        request = self.make_request(method="GET")
        request.META["HTTP_ORIGIN"] = "http://acme.example.com"
        request.META["HTTP_AUTHORIZATION"] = b"Basic " + base64.b64encode(
            apikey.key.encode("utf-8")
        )
        response = _dummy_endpoint(request)
        response.render()
        assert "Access-Control-Allow-Credentials" not in response

Fixed code:
            if origin.endswith(("://" + basehost, "." + basehost)):
        for http_origin in ["http://acme.example.com", "http://fakeacme.com"]:
            request = self.make_request(method="GET")
            request.META["HTTP_ORIGIN"] = http_origin
            request.META["HTTP_AUTHORIZATION"] = b"Basic " + base64.b64encode(
                apikey.key.encode("utf-8")
            )
            response = _dummy_endpoint(request)
            response.render()
            assert "Access-Control-Allow-Credentials" not in response
CVE-2023-39349 (Python, published 2023-08-07T19:15Z)
Description: value: Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/getsentry/sentry
Files changed:
src/sentry/api/authentication.py
src/sentry/api/endpoints/api_tokens.py
tests/sentry/api/endpoints/test_api_tokens.py
Commit message: SessionNoAuthTokenAuthentication custom authenticator (#53850)

<!-- Describe your PR here. -->



<!--

  Sentry employees and contractors can delete or ignore the following.

-->

### Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated
in the State of Delaware in 2015 as Functional Software, Inc. and is
gonna need some rights from me in order to utilize my contributions in
this here PR. So here's the deal: I retain all rights, title and
interest in and to my contributions, and by keeping this boilerplate
intact I confirm that Sentry can use, modify, copy, and redistribute my
contributions, under Sentry's choice of terms.

Vulnerable code:
from rest_framework.authentication import BasicAuthentication, get_authorization_header
from rest_framework.authentication import SessionAuthentication
    authentication_classes = (SessionAuthentication,)

Fixed code:
from rest_framework.authentication import (
    BasicAuthentication,
    SessionAuthentication,
    get_authorization_header,
)
class SessionNoAuthTokenAuthentication(SessionAuthentication):
    def authenticate(self, request: Request):
        auth = get_authorization_header(request)
        if auth:
            return None
        return super().authenticate(request)


from sentry.api.authentication import SessionNoAuthTokenAuthentication
    authentication_classes = (SessionNoAuthTokenAuthentication,)
    def test_deny_token_access(self):
        token = ApiToken.objects.create(user=self.user, scope_list=[])

        url = reverse("sentry-api-0-api-tokens")
        response = self.client.get(url, format="json", HTTP_AUTHORIZATION=f"Bearer {token.token}")
        assert response.status_code == 403, response.content
CVE-2023-39349 (Python, published 2023-08-07T19:15Z)
Description: value: Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/getsentry/sentry
Files changed:
src/sentry/api/authentication.py
src/sentry/api/endpoints/api_tokens.py
tests/sentry/api/endpoints/test_api_tokens.py
Commit message: SessionNoAuthTokenAuthentication custom authenticator (#53850)

<!-- Describe your PR here. -->



<!--

  Sentry employees and contractors can delete or ignore the following.

-->

### Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated
in the State of Delaware in 2015 as Functional Software, Inc. and is
gonna need some rights from me in order to utilize my contributions in
this here PR. So here's the deal: I retain all rights, title and
interest in and to my contributions, and by keeping this boilerplate
intact I confirm that Sentry can use, modify, copy, and redistribute my
contributions, under Sentry's choice of terms.

Vulnerable code:
from rest_framework.authentication import BasicAuthentication, get_authorization_header
from rest_framework.authentication import SessionAuthentication
    authentication_classes = (SessionAuthentication,)

Fixed code:
from rest_framework.authentication import (
    BasicAuthentication,
    SessionAuthentication,
    get_authorization_header,
)
class SessionNoAuthTokenAuthentication(SessionAuthentication):
    def authenticate(self, request: Request):
        auth = get_authorization_header(request)
        if auth:
            return None
        return super().authenticate(request)


from sentry.api.authentication import SessionNoAuthTokenAuthentication
    authentication_classes = (SessionNoAuthTokenAuthentication,)
    def test_deny_token_access(self):
        token = ApiToken.objects.create(user=self.user, scope_list=[])

        url = reverse("sentry-api-0-api-tokens")
        response = self.client.get(url, format="json", HTTP_AUTHORIZATION=f"Bearer {token.token}")
        assert response.status_code == 403, response.content
CVE-2024-32474 (Python, published 2024-04-18T20:15Z)
Description: value: Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getsentry/sentry
Files changed:
src/sentry/api/endpoints/auth_index.py
Commit message: chore(auth): explicitly log challenge and response for debugging (#69148)



Vulnerable code:
                "validator": validator,

Fixed code:
CVE-2019-10788 (JavaScript, published 2020-02-04T21:15Z)
Description: value: im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Turistforeningen/node-im-metadata
Files changed:
index.js
Commit message: fix: check path argument before processing (#10)

hotfix to re mediate command injection

Vulnerable code:
  var cmd = module.exports.cmd(path, opts);
  opts.timeout = opts.timeout || 5000;

  exec(cmd, opts, function(e, stdout, stderr) {
    if (e) { return cb(e); }
    return cb(null, module.exports.parse(path, stdout, opts));

Fixed code:
  if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(path))) {
    console.log('Input Validation failed, Suspicious Characters found');
  } else {
    var cmd = module.exports.cmd(path, opts);
    opts.timeout = opts.timeout || 5000;
    exec(cmd, opts, function(e, stdout, stderr) {
      if (e) { return cb(e); }
      return cb(null, module.exports.parse(path, stdout, opts));
}
CVE-2017-18635 (HTML, published 2019-09-25T23:15Z)
Description: value: An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/novnc/noVNC
Files changed:
app/ui.js
tests/input.html
tests/vnc_perf.html
tests/vnc_playback.html
vnc_auto.html
Commit message: Use textContent instead of innerHTML

Previously, setting `innerHTML` was used to display the statuses.  These
could include content communicated from the remote VNC server, allowing
the remove VNC server to inject HTML into the noVNC page.

This commit switches all uses of `innerHTML` to use `textContent`, which
is not vulnerable to the HTML injection.


Vulnerable code:
            document.getElementById('noVNC_fallback_errormsg').innerHTML = msg;
                    document.getElementById("noVNC_transition_text").innerHTML = _("Connecting...");
                    document.getElementById("noVNC_transition_text").innerHTML = _("Disconnecting...");
            statusElem.innerHTML = text;
            cell.innerHTML += msg_cnt + ": " + str + newline;
            cell.innerHTML += str + "\n";
            document.getElementById('VNC_status').innerHTML = mesg;
            cell.innerHTML += str + "\n";
            document.getElementById('VNC_status').innerHTML = mesg;
            html += msg;
            status(html, "warn");
            document.getElementById('noVNC_status').innerHTML = text;

Fixed code:
            document.getElementById('noVNC_fallback_errormsg').textContent = msg;
                    document.getElementById("noVNC_transition_text").textContent = _("Connecting...");
                    document.getElementById("noVNC_transition_text").textContent = _("Disconnecting...");
            statusElem.textContent = text;
            cell.textContent += msg_cnt + ": " + str + newline;
            cell.textContent += str + "\n";
            document.getElementById('VNC_status').textContent = mesg;
            cell.textContent += str + "\n";
            document.getElementById('VNC_status').textContent = mesg;
            html += '<label></label>'

            // bypass status() because it sets text content
            document.getElementById('noVNC_status_bar').setAttribute("class", "noVNC_status_warn");
            document.getElementById('noVNC_status').innerHTML = html;
            document.getElementById('noVNC_status').querySelector('label').textContent = msg;
            document.getElementById('noVNC_status').textContent = text;
CVE-2020-26222 (Unknown, published 2020-11-13T16:15Z)
Description: value: Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/dependabot/dependabot-core
Files changed:
Commit message: Merge pull request #2727 from dependabot/v0.125.1-release-notes

v0.125.1

Vulnerable code:

Fixed code:
CVE-2022-26049 (Unknown, published 2022-09-11T14:15Z)
Description: value: This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/diffplug/goomph
Files changed:
Commit message: [SECURITY] Fix Zip Slip Vulnerability (#198)



Vulnerable code:

Fixed code:
CVE-2016-15034 (PHP, published 2023-07-10T18:15Z)
Description: value: A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_search.php. The manipulation leads to sql injection. Upgrading to version 3.2-20180305 is able to address this issue. The patch is identified as 750a9b35af182950c952faf6ddfdcc50a2b25f8b. It is recommended to upgrade the affected component. VDB-233366 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dynacase-labs/dynacase-webdesk
Files changed:
dynacase-webdesk-ui/Actions/WEBDESK/freedomrss_search.php
Commit message: fix(security): Correct SQL injection in freedomrss_search.php (refs #6439)


Vulnerable code:
    $filter[0] = "(title ~* '" . pg_escape_string($str) . "')";
    if ($sys == 1) $filter[2] = "(owner = " . pg_escape_string($user) . " or gui_sysrss = 'yes')";
    else $filter[2] = "(owner = " . pg_escape_string($user) . ")";
?>

Fixed code:
    $filter[0] = "(title ~* " . pg_escape_literal($str) . ")";
    if ($sys == 1) $filter[2] = "(owner = " . pg_escape_literal($user) . " or gui_sysrss = 'yes')";
    else $filter[2] = "(owner = " . pg_escape_literal($user) . ")";
CVE-2023-28628 (Unknown, published 2023-03-27T21:15Z)
Description: value: lambdaisland/uri is a pure Clojure/ClojureScript URI library. In versions prior to 1.14.120 `authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to but distinct from CVE-2020-8910. The regex in question doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output. ex. a payload of `https://example.com\\@google.com` would return that the host is `google.com`, but the correct host should be `example.com`. Given that the library returns the wrong authority this may be abused to bypass host restrictions depending on how the library is used in an application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/lambdaisland/uri
Files changed:
Commit message: Merge pull request from GHSA-cp4w-6x4w-v2h5

Treat a backslash in the authority section as part of the path

Vulnerable code:

Fixed code:
CVE-2014-7205 (JavaScript, published 2014-10-08T17:55Z)
Description: value: Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/hapijs/bassmaster
Files changed:
lib/batch.js
Commit message: Remove eval statement


Vulnerable code:
                var value = null;

                try {
                    eval('value = ref.' + parts[i].value + ';');
                }
                catch (e) {
                    error = new Error(e.message);
                }

Fixed code:
                var value = ref[parts[i].value]||null;
CVE-2014-2853 (PHP, published 2014-04-29T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wikimedia/mediawiki-core
Files changed:
includes/actions/InfoAction.php
Commit message: SECURITY: escape sortKey in pageInfo

DEFAULTSORT isn't escaped before being added to the action=info table.

Bug: 63251
Change-Id: I087bfde8cbc69c3507f68ee3cb6e22aba0ffa7db


Vulnerable code:

Fixed code:
		$sortKey = htmlspecialchars( $sortKey );
CVE-2024-35232 (Unknown, published 2024-05-24T21:15Z)
Description: value: github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/huandu/facebook
Files changed:
Commit message: Merge pull request from GHSA-3f65-m234-9mxr

Exclude access_token from error message

Vulnerable code:

Fixed code: