hitoshura25/cvefixes huggingface dataset:
CVE-2020-36633 (PHP, published 2022-12-27T13:15Z)
Description: value: A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/eberhardt/moodle-block_sitenews
Files changed:
block_sitenews.php
renderer.php
Commit message: Add CSRF protection to item number setting


Vulnerable code:
        if ($updatemynumber >= 0 && $updatemynumber < 11) {

Fixed code:
        if ($updatemynumber >= 0 && $updatemynumber < 11 && confirm_sesskey()) {
        $select->method = 'post';
CVE-2020-28460 (JSON, published 2020-12-22T13:15Z)
Description: value: This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/evangelion1204/multi-ini
Files changed:
README.md
package.json
src/parser.js
test/data/prototype_pollution.ini
Commit message: Fixed 2nd issue with prototype pollution


Vulnerable code:
  "version": "2.1.1",
const REGEXP_IGNORE_KEYS = /__proto__/;
__proto__.path_polluted="polluted"

Fixed code:
### 2.1.2
* Fixed prototype pollution by ignoring `constructor`

### 2.1.1
* Fixed prototype pollution by ignoring `__proto__`

  "version": "2.1.2",
const REGEXP_IGNORE_KEYS = /__proto__|constructor|prototype/;
__proto__.path_polluted="polluted"
[constructor]
prototype.polluted = polluted
[prototype]
polluted = polluted
CVE-2024-29189 (Python, published 2024-03-26T03:15Z)
Description: value: PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ansys/pyansys-geometry
Files changed:
doc/changelog.d/1077.added.md
src/ansys/geometry/core/connection/product_instance.py
Commit message: feat: accept bandit advisories in-line for subprocess (#1077)

Co-authored-by: pyansys-ci-bot <pyansys.github.bot@ansys.com>

Vulnerable code:
import subprocess
    instance = ProductInstance(_start_program(args, env_copy).pid)
def _start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
    return subprocess.Popen(

Fixed code:
feat: accept bandit advisories in-line for subprocess

# Subprocess is needed to start the backend. But
# the input is controlled by the library. Excluding bandit check.
import subprocess  # nosec B404
    instance = ProductInstance(__start_program(args, env_copy).pid)
def __start_program(args: List[str], local_env: Dict[str, str]) -> subprocess.Popen:
    # private method and controlled input by library - excluding bandit check.
    return subprocess.Popen(  # nosec B603
CVE-2024-29189 (Python, published 2024-03-26T03:15Z)
Description: value: PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ansys/pyansys-geometry
Files changed:
doc/changelog.d/1076.fixed.md
src/ansys/geometry/core/connection/product_instance.py
Commit message: fix: prepare_and_start_backend is only available on Windows (#1076)

Co-authored-by: pyansys-ci-bot <pyansys.github.bot@ansys.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Vulnerable code:
        shell=os.name != "nt",

Fixed code:
fix: prepare_and_start_backend is only available on Windows
    if os.name != "nt":  # pragma: no cover
        raise RuntimeError("Method 'prepare_and_start_backend' is only available on Windows.")
CVE-2014-8483 (C++, published 2014-11-06T15:55Z)
Description: value: The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/quassel/quassel
Files changed:
src/core/cipher.cpp
Commit message: Check for invalid input in encrypted buffers

The ECB Blowfish decryption function assumed that encrypted input would
always come in blocks of 12 characters, as specified. However, buggy
clients or annoying people may not adhere to that assumption, causing
the core to crash while trying to process the invalid base64 input.

With this commit we make sure that we're not overstepping the bounds of
the input string while decoding it; instead we bail out early and display
the original input. Fixes #1314.

Thanks to Tucos for finding that one!


Vulnerable code:
    if (direction)

Fixed code:
        // ECB Blowfish encodes in blocks of 12 chars, so anything else is malformed input
        if ((temp.length() % 12) != 0)
            return cipherText;

    if (direction) {
        // Sanity check
        if ((temp2.length() % 8) != 0)
            return cipherText;

    }
CVE-2015-8547 (Unknown, published 2016-01-08T19:59Z)
Description: value: The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-17 \u2014 DEPRECATED: Code
This entry has been deprecated.  It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Repository: https://github.com/quassel/quassel
Files changed:
Commit message: Merge pull request #153 from elxa/fix-op-command-crashing-core

Fixes a crash of the core when executing "/op *" in a query.

Vulnerable code:

Fixed code:
CVE-2018-16153 (Unknown, published 2023-12-12T17:15Z)
Description: value: An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/opencast/opencast
Files changed:
Commit message: Merge pull request from GHSA-hcxx-mp6g-6gr9

Disable sending system digest credentials unless warranted

Vulnerable code:

Fixed code:
CVE-2020-5206 (Java, published 2020-01-30T22:15Z)
Description: value: In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
Severity: MEDIUM (CVSS v3 base score: 10)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/opencast/opencast
Files changed:
modules/kernel/src/main/java/org/opencastproject/kernel/security/SecurityServiceSpringImpl.java
Commit message: Authentication Bypass For Endpoints With Anonymous Access

Using a remember-me cookie with an arbitrary username can cause Opencast
to assume proper authentication for that user even if the remember-me
cookie was incorrect given that the attacked endpoint also allows
anonymous access.

This way, an attacker can, for example, fake a remember-me token, assume
the identity of the global system administrator and request non-public
content from the search service without ever providing any proper
authentication.

The reason for this problem is that using a remember-me cookie will
always cause the user in the request context to be populated, even if
the cookie is invalid by now. This is usually no problem, except in
combination with anonymous access where anonymous authentication is
granted and the request may continue.

In such a case, Opencast's security service would just check that a user
existed in the request context and assume proper authentication of this
user, never checking if it's actually anonymous authentication.

This patch adds this additional check, falling back to the anonymous
user in case of anonymous authentication.


Vulnerable code:
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
      if ((principal != null) && (principal instanceof UserDetails)) {
            logger.debug(
                    "Authenticated user '{}' could not be found in any of the current UserProviders. Continuing anyway...",
                    userDetails.getUsername());
        Set<JaxbRole> roles = new HashSet<JaxbRole>();

Fixed code:
import org.springframework.security.authentication.AnonymousAuthenticationToken;
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth instanceof AnonymousAuthenticationToken) {
      return SecurityUtil.createAnonymousUser(org);
    }

      if ((principal instanceof UserDetails)) {
            logger.debug("Authenticated user '{}' could not be found in any of the current UserProviders. "
                + "Continuing anyway...", userDetails.getUsername());
        Set<JaxbRole> roles = new HashSet<>();
CVE-2020-5230 (Java, published 2020-01-30T21:15Z)
Description: value: Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/opencast/opencast
Files changed:
modules/common/src/main/java/org/opencastproject/mediapackage/identifier/Id.java
modules/common/src/main/java/org/opencastproject/mediapackage/identifier/IdImpl.java
modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/endpoint/IngestRestService.java
Commit message: Limit Characters Allowed In Ids

Opencast allows almost arbitrary identifiers for media packages and
elements to be used. This can be problematic for operation and security
since such identifiers are sometimes used for file system operations
which may lead to attacker being able to escape working directories and
write files to other locations.

In addition, Opencast's `Id.toString(…)` vs `Id.compact(…)` behavior,
the latter trying to mitigate some of the file system problems, can
cause errors due to identifier mismatch since an identifier may
unintentionally change.

This patch limits the characters allowed to be used in identifiers to
ensure no unsafe operations are possible and no mismatch may happen.


Vulnerable code:
  public IdImpl(String id) {
    return id.replaceAll("/", "-").replaceAll("\\\\", "-");
        WorkflowInstance workflow = (wdID == null) ? ingestService.ingest(mp) : ingestService.ingest(mp, wdID,
                workflowProperties);

Fixed code:
  @Deprecated
import java.util.regex.Pattern;

  private static final Pattern pattern = Pattern.compile("[\\w-_.:;()]+");

  public IdImpl(final String id) {
    if (!pattern.matcher(id).matches()) {
      throw new IllegalArgumentException("Id must match " + pattern);
    }
    return toString();
        WorkflowInstance workflow = (wdID == null)
            ? ingestService.ingest(mp)
            : ingestService.ingest(mp, wdID, workflowProperties);
    } catch (IllegalArgumentException e) {
      return Response.status(Status.BAD_REQUEST).entity(e.getMessage()).build();
CVE-2020-5231 (XML, published 2020-01-30T22:15Z)
Description: value: In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/opencast/opencast
Files changed:
etc/security/mh_default_org.xml
Commit message: Remove ROLE_COURSE_ADMIN

Users with the role `ROLE_COURSE_ADMIN` can use the user-utils endpoint
to create new users not including the role ROLE_ADMIN. For example:

```sh
% curl -i -u admin:opencast 'https://example.opencast.org/user-utils/xy.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201

% curl -i -u xy:f 'https://example.opencast.org/user-utils/ab.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201
```

`ROLE_COURSE_ADMIN` is a non-standard role in Opencast which is
referenced neither in the documentation nor in any code (except for
tests) but only in the security configuration. From the name – implying
an admin for a specific course – users would never expect that this role
allows user creation.

This patch fixes the problem by dropping the default access rules for
`ROLE_COURSE_ADMIN`. Users which use and need this custom role can
easily configure this specific to their needs. There is no reason to
ship this by default.


Vulnerable code:
    <sec:intercept-url pattern="/admin-ng" method="GET" access="ROLE_ADMIN, ROLE_ADMIN_UI, ROLE_COURSE_ADMIN" />
    <sec:intercept-url pattern="/admin-ng/" method="GET" access="ROLE_ADMIN, ROLE_ADMIN_UI, ROLE_COURSE_ADMIN" />
    <sec:intercept-url pattern="/admin-ng/index.html" access="ROLE_ADMIN, ROLE_ADMIN_UI, ROLE_COURSE_ADMIN" />
    <sec:intercept-url pattern="/index.html" access="ROLE_ADMIN, ROLE_ADMIN_UI, ROLE_COURSE_ADMIN" />
    <sec:intercept-url pattern="/**" access="ROLE_ADMIN, ROLE_COURSE_ADMIN" />

Fixed code:
    <sec:intercept-url pattern="/admin-ng" method="GET" access="ROLE_ADMIN, ROLE_ADMIN_UI" />
    <sec:intercept-url pattern="/admin-ng/" method="GET" access="ROLE_ADMIN, ROLE_ADMIN_UI" />
    <sec:intercept-url pattern="/admin-ng/index.html" access="ROLE_ADMIN, ROLE_ADMIN_UI" />
    <sec:intercept-url pattern="/index.html" access="ROLE_ADMIN, ROLE_ADMIN_UI" />
    <sec:intercept-url pattern="/**" access="ROLE_ADMIN" />
CVE-2021-32623 (Other, published 2021-06-16T00:15Z)
Description: value: Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-776 \u2014 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Repository: https://github.com/opencast/opencast
Files changed:
assemblies/resources/bin/setenv
Commit message: Clarifies debug options in setenv file (#2735)

Co-authored-by: Lars Kiesow <lkiesow@uos.de>

Vulnerable code:
# export KARAF_DEBUG       # Enable debug mode

Fixed code:
#
# Debug options
# export KARAF_DEBUG       # Enable debug mode
# export JAVA_DEBUG_PORT   # Set debug port (defaults to 5005)
CVE-2021-43807 (XML, published 2021-12-14T18:15Z)
Description: value: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible. The vulnerability allows attackers to craft links or forms which may change the server state. This issue is fixed in Opencast 9.10 and 10.0. You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/opencast/opencast
Files changed:
modules/security-aai/pom.xml
pom.xml
Commit message: Update CXF

This updates CXF to version 3.4.3, fixing among other things
[CVE-2019-12419], [CVE-2019-12423], [CVE-2021-22696], [CVE-2019-12406],
[CVE-2020-13954], [CVE-2019-17573], [CVE-2020-1954].

The security issues should not be problematic for Opencast and we can
treat this as a regular update.


Vulnerable code:
                <ignoredUsedUndeclaredDependency>javax.annotation:javax.annotation-api</ignoredUsedUndeclaredDependency>
    <cxf.version>3.3.3</cxf.version>

Fixed code:
                <ignoredUsedUndeclaredDependency>jakarta.annotation:jakarta.annotation-api</ignoredUsedUndeclaredDependency>
    <cxf.version>3.4.3</cxf.version>
CVE-2021-43821 (Unknown, published 2021-12-14T20:15Z)
Description: value: Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.
Severity: MEDIUM (CVSS v3 base score: 7.7)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/opencast/opencast
Files changed:
Commit message: Merge pull request from GHSA-59g4-hpg3-3gcp

Ensure local files are not addable

Vulnerable code:

Fixed code:
CVE-2022-29237 (Java, published 2022-05-24T15:15Z)
Description: value: Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/opencast/opencast
Files changed:
modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java
Commit message: Merge pull request from GHSA-qm6v-cg9v-53j3

This patch fixes the issue that users can pass URLs from other tenants
to the ingest service which will check only against the other
organization but not against the one currently active. This allows users
to easily ingest media from other tenants.

Vulnerable code:
import java.util.LinkedList;
import java.util.stream.Collectors;
        List<String> clusterUrls = new LinkedList<>();
        try {
          // Note that we are not checking ports here.
          clusterUrls = organizationDirectoryService.getOrganization(uri.toURL()).getServers()
                          .keySet()
                          .stream()
                          .collect(Collectors.toUnmodifiableList());
        } catch (NotFoundException e) {
          logger.warn("Unable to determine cluster members, will not be able to authenticate any downloads from them", e);
        }

Fixed code:
        var clusterUrls = securityService.getOrganization().getServers().keySet();