hitoshura25/cvefixes huggingface dataset:
CVE-2020-11054 (Python, published 2020-05-07T21:15Z)
Description: value: In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.
Severity: MEDIUM (CVSS v3 base score: 3.5)
Weakness: CWE-684 \u2014 Incorrect Provision of Specified Functionality
The code does not function according to its published specifications, potentially leading to incorrect usage.
Repository: https://github.com/qutebrowser/qutebrowser
Files changed:
qutebrowser/browser/browsertab.py
qutebrowser/browser/webengine/webenginetab.py
qutebrowser/browser/webkit/webkittab.py
Commit message: Security: Remember hosts with ignored cert errors for load status

Without this change, we only set a flag when a certificate error occurred.
However, when the same certificate error then happens a second time (e.g.
because of a reload or opening the same URL again), we then colored the URL as
success_https (i.e. green) again.

See #5403


Vulnerable code:
        self._has_ssl_errors = False
        self._has_ssl_errors = False
        if ok and not self._has_ssl_errors:
                self._set_load_status(usertypes.LoadStatus.success_https)
        self._has_ssl_errors = True

    @pyqtSlot()
    def _on_ssl_errors(self):
        self._has_ssl_errors = True

Fixed code:
    # Hosts for which a certificate error happened. Shared between all tabs.
    #
    # Note that we remember hosts here, without scheme/port:
    # QtWebEngine/Chromium also only remembers hostnames, and certificates are
    # for a given hostname anyways.
    _insecure_hosts = set()  # type: typing.Set[str]

        if ok:
                if self.url().host() in self._insecure_hosts:
                    self._set_load_status(usertypes.LoadStatus.warn)
                else:
                    self._set_load_status(usertypes.LoadStatus.success_https)
        self._insecure_hosts.add(url.host())

    @pyqtSlot('QNetworkReply*')
    def _on_ssl_errors(self, reply):
        self._insecure_hosts.add(reply.url().host())
CVE-2020-11054 (Other, published 2020-05-07T21:15Z)
Description: value: In qutebrowser versions less than 1.11.1, reloading a page with certificate errors shows a green URL. After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false, which is not recommended), this could still provide a false sense of security. This has been fixed in 1.11.1 and 1.12.0. All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested. Backported patches for older versions (greater than or equal to 1.4.0 and less than or equal to 1.10.2) are available, but no further releases are planned.
Severity: MEDIUM (CVSS v3 base score: 3.5)
Weakness: CWE-684 \u2014 Incorrect Provision of Specified Functionality
The code does not function according to its published specifications, potentially leading to incorrect usage.
Repository: https://github.com/qutebrowser/qutebrowser
Files changed:
doc/changelog.asciidoc
Commit message: Update changelog


Vulnerable code:
No changes yet.

Fixed code:
Security
~~~~~~~~

- After a certificate error was overridden by the user, qutebrowser displays
  the URL as yellow (`colors.statusbar.url.warn.fg`). However, when the
  affected website was subsequently loaded again, the URL was mistakenly
  displayed as green (`colors.statusbar.url.success_https`). While the user
  already has seen a certificate error prompt at this point (or set
  `content.ssl_strict` to `false` which is not recommended), this could still
  provide a false sense of security. This is now fixed.
CVE-2020-36636 (Java, published 2022-12-27T23:15Z)
Description: value: A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 702fbfdac7c4418f23bb5f6452482b4a88020061. It is recommended to upgrade the affected component. VDB-216918 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-adminui
Files changed:
omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java
Commit message: RA-1865: Fix possible xss in account setup (#57)



Vulnerable code:
			setJsonFormData(model, account, null);
			setJsonFormData(model, account, otherAccountData);
	private void setJsonFormData(PageModel model, Account account, OtherAccountData otherAccountData) throws IOException {
		simplePerson.put("familyName", account.getFamilyName());
		simplePerson.put("givenName", account.getGivenName());
		simplePerson.put("gender", account.getGender() != null ? account.getGender() : "");
				simpleUser.put("username", u.getUsername());

Fixed code:
			setJsonFormData(model, account, null, uu);
			setJsonFormData(model, account, otherAccountData, uu);
	private void setJsonFormData(PageModel model, Account account, OtherAccountData otherAccountData, UiUtils uu) throws IOException {
		simplePerson.put("familyName", uu.encodeHtml(account.getFamilyName()));
		simplePerson.put("givenName", uu.encodeHtml(account.getGivenName()));
		simplePerson.put("gender", uu.encodeHtml(account.getGender()) != null ? uu.encodeHtml(account.getGender()) : "");
				simpleUser.put("username", uu.encodeHtml(u.getUsername()));
CVE-2021-4291 (Other, published 2022-12-27T23:15Z)
Description: value: A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-adminui
Files changed:
omod/src/main/webapp/pages/metadata/locations/location.gsp
Commit message: RA-1424: escapeJs vulnerable to XSS. (#61)



Vulnerable code:
        parentLocationOptions.push([ label: ui.escapeJs(ui.format(it)), value: it.id ])

Fixed code:
        parentLocationOptions.push([ label: ui.encodeJavaScript(ui.format(it)), value: it.id ])
CVE-2021-4292 (Unknown, published 2022-12-27T23:15Z)
Description: value: A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 4f8565425b7c74128dec9ca46dfbb9a3c1c24911. It is recommended to upgrade the affected component. The identifier VDB-216917 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-adminui
Files changed:
Commit message: Merge pull request #58 from jmmacdo4/master

EMPT-74. Fix XSS vulnerability on the manage privilege page 

Vulnerable code:

Fixed code:
CVE-2019-25159 (PHP, published 2024-02-04T06:15Z)
Description: value: A vulnerability was found in mpedraza2020 Intranet del Monterroso up to 4.50.0. It has been classified as critical. This affects an unknown part of the file config/cargos.php. The manipulation of the argument dni_profe leads to sql injection. Upgrading to version 4.51.0 is able to address this issue. The identifier of the patch is 678190bee1dfd64b54a2b0e88abfd009e78adce8. It is recommended to upgrade the affected component. The identifier VDB-252717 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/mpedraza2020/IESMONTEROSOINTRANET
Files changed:
config/cargos.php
Commit message: SQL Injection in $_GET['dni_profe'] - "config/cargos.php"

Filters for SQL Injection in $_GET['dni_profe']

Vulnerable code:
		mysqli_query($db_con, "delete from departamentos where dni = '".$_GET['dni_profe']."'");

Fixed code:
		$dni_profe = preg_replace('([^A-Za-z0-9])', '', $_GET['dni_profe']);
		mysqli_query($db_con, "delete from departamentos where dni = '".$dni_profe."'");
CVE-2019-14806 (Python, published 2019-08-09T15:15Z)
Description: value: Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-331 \u2014 Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Repository: https://github.com/pallets/werkzeug
Files changed:
CHANGES.rst
src/werkzeug/debug/__init__.py
Commit message: unique debugger pin in Docker containers


Vulnerable code:

Fixed code:
-   When running the development server in Docker, the debugger security
    pin is now unique per container.
        # docker containers share the same machine id, get the
        # container id instead
        try:
            with open("/proc/self/cgroup") as f:
                value = f.readline()
        except IOError:
            pass
        else:
            value = value.strip().partition("/docker/")[2]

            if value:
                return value
CVE-2022-29361 (Unknown, published 2022-05-25T01:15Z)
Description: value: Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests included inside the body. NOTE: the vendor's position is that this behavior can only occur in unsupported configurations involving development mode and an HTTP server from outside the Werkzeug project
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/pallets/werkzeug
Files changed:
Commit message: Merge branch '2.0.x'


Vulnerable code:

Fixed code:
CVE-2023-23934 (Unknown, published 2023-02-14T20:15Z)
Description: value: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.
Severity: nan (CVSS v3 base score: 3.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/pallets/werkzeug
Files changed:
Commit message: Merge pull request from GHSA-px8h-6qxv-m22q

don't strip leading `=` when parsing cookie

Vulnerable code:

Fixed code:
CVE-2023-25577 (Unknown, published 2023-02-14T20:15Z)
Description: value: Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/pallets/werkzeug
Files changed:
Commit message: Merge pull request from GHSA-xg9f-g7g7-2323

limit the maximum number of multipart form parts

Vulnerable code:

Fixed code:
CVE-2023-46136 (Unknown, published 2023-10-25T18:17Z)
Description: value: Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/pallets/werkzeug
Files changed:
Commit message: Merge 3.0.x (#2801)



Vulnerable code:

Fixed code:
CVE-2024-34069 (Unknown, published 2024-05-06T15:15Z)
Description: value: Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pallets/werkzeug
Files changed:
Commit message: Merge pull request from GHSA-2g68-c3qc-8985

restrict debugger trusted hosts

Vulnerable code:

Fixed code:
CVE-2022-0336 (Other, published 2022-08-29T15:15Z)
Description: value: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/samba-team/samba
Files changed:
selftest/knownfail.d/ldap_spn
source4/dsdb/samdb/ldb_modules/samldb.c
Commit message: CVE-2022-0336: s4/dsdb/samldb: Don't return early when an SPN is re-added to an object

If an added SPN already exists on an object, we still want to check the
rest of the element values for conflicts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>


Vulnerable code:
samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN
			talloc_free(tmp_ctx);
			return LDB_SUCCESS;

Fixed code:
			continue;
CVE-2022-0336 (Other, published 2022-08-29T15:15Z)
Description: value: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/samba-team/samba
Files changed:
python/samba/tests/ldap_spn.py
selftest/knownfail.d/ldap_spn
Commit message: CVE-2022-0336: pytest: Add a test for an SPN conflict with a re-added SPN

This test currently fails, as re-adding an SPN means that later checks
do not run.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14950

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>


Vulnerable code:

Fixed code:
                elif isinstance(m.get(k), list):
                    m[k] = [x.format(dnsname=f"x.{REALM}") for x in m[k]]
        ("add a conflict, along with a re-added SPN",
         ('A', 'cifs/{dnsname}', '*', ok),
         ('B', 'cifs/heeble.example.net', 'B', ok),
         ('B', ['cifs/heeble.example.net', 'host/{dnsname}'], 'B', constraint),
        ),
samba.tests.ldap_spn.+LdapSpnSambaOnlyTest.test_spn_add_a_conflict_along_with_a_re_added_SPN
CVE-2022-23626 (PHP, published 2022-02-08T22:15Z)
Description: value: m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/m1k1o/blog
Files changed:
app/image.class.php
Commit message: check image create errors.


Vulnerable code:
		$imgt($new_image, $thumb_path);
		$imgt($old_image, $source_path);
		return true;

Fixed code:
		if ($old_image === false) return false;

		return $imgt($new_image, $thumb_path)
			&& $imgt($old_image, $source_path);
CVE-2019-5748 (Java, published 2019-01-09T17:29Z)
Description: value: In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/traccar/traccar
Files changed:
src/org/traccar/protocol/SpotProtocolDecoder.java
Commit message: Fix potential security issue


Vulnerable code:
 * Copyright 2017 - 2018 Anton Tananaev (anton@traccar.org)
            documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();

Fixed code:
 * Copyright 2017 - 2019 Anton Tananaev (anton@traccar.org)
            DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
            builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
            builderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
            builderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
            builderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
            builderFactory.setXIncludeAware(false);
            builderFactory.setExpandEntityReferences(false);
            documentBuilder = builderFactory.newDocumentBuilder();