hitoshura25/cvefixes huggingface dataset:
CVE-2023-45805 (Python, published 2023-10-20T19:15Z)
Description: value: pdm is a Python package and dependency manager supporting the latest PEP standards. It's possible to craft a malicious `pdm.lock` file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. A project `foo` can be targeted by creating the project `foo-2` and uploading the file `foo-2-2.tar.gz` to pypi.org. PyPI will see this as project `foo-2` version `2`, while PDM will see this as project `foo` version `2-2`. The version must only be `parseable as a version` and the filename must be a prefix of the project name, but it's not verified to match the version being installed. Version `2-2` is also not a valid normalized version per PEP 440. Matching the project name exactly (not just prefix) would fix the issue. When installing dependencies with PDM, what's actually installed could differ from what's listed in `pyproject.toml` (including arbitrary code execution on install). It could also be used for downgrade attacks by only changing the version. This issue has been addressed in commit `6853e2642df` which is included in release version `2.9.4`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pdm-project/pdm
Files changed:
src/pdm/models/repositories.py
Commit message: Merge pull request from GHSA-j44v-mmf2-xvm9

Signed-off-by: Frost Ming <me@frostming.com>

Vulnerable code:
from pdm.exceptions import CandidateInfoNotFound, CandidateNotFound, PackageWarning

Fixed code:
from pdm.exceptions import CandidateInfoNotFound, CandidateNotFound, PackageWarning, PdmException
        static_urls = self.environment.project.lockfile.static_urls
                if not static_urls and any("url" in f for f in can.hashes):
                    raise PdmException(
                        "Static URLs are not allowed in lockfile unless enabled by `pdm lock --static-urls`."
                    )
CVE-2024-24571 (PHP, published 2024-01-31T23:15Z)
Description: value: facileManager is a modular suite of web apps built with the sysadmin in mind. For the facileManager web application versions 4.5.0 and earlier, we have found that XSS was present in almost all of the input fields as there is insufficient input validation.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/WillyXJ/facileManager
Files changed:
server/fm-includes/version.php
server/fm-modules/facileManager/change.log
server/fm-modules/facileManager/classes/class_logins.php
server/fm-modules/facileManager/classes/class_users.php
server/fm-modules/facileManager/functions.php
server/fm-modules/facileManager/pages/admin-logs.php
Commit message: fM - #599 - Multiple security fixes


Vulnerable code:
$fm_version = '4.5.0';
			if (is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
		if ((!currentUserCan('manage_users') && $_SESSION['user']['id'] != $post['user_id']) || isset($post['user_login'])) {
			return _('You do not have permission to make these changes.');
		$data = str_replace('--', '-', $data);
$search_sql = $list = $log_search_query = $log_search_date_b = $log_search_date_e = null;
$list = null;

Fixed code:
$fm_version = '4.5.1';
4.5.1 (2024-01-30)
==================
* Server - [security] Fixed authenticated variable manipulation leading to SQL Injection. (Issue #599)
* Server - [security] Fixed privilege escalation via mass assignment. (Issue #599)
* Server - [security] Fixed systemic cross-site scripting (XSS). (Issue #599)

			if (isset($fmdb->last_result) && is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
		if ((!currentUserCan('manage_users') && ($_SESSION['user']['id'] != $post['user_id'] || isset($post['user_caps']))) 
			|| ($_SESSION['user']['id'] != $post['user_id'] && $post['user_id'] == getDefaultAdminID()) 
			|| isset($post['user_login'])
			|| (isset($post['user_caps']) && $_SESSION['user']['id'] == $post['user_id'] && $_SESSION['user']['id'] == getDefaultAdminID())) {
				return _('You do not have permission to make these changes.');
		$data = str_replace($replace . $replace, $replace, $data);
			$data = htmlspecialchars(strip_tags($data), ENT_NOQUOTES);
$search_sql = null;
CVE-2024-24573 (PHP, published 2024-01-31T23:15Z)
Description: value: facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/WillyXJ/facileManager
Files changed:
server/fm-includes/version.php
server/fm-modules/facileManager/change.log
server/fm-modules/facileManager/classes/class_logins.php
server/fm-modules/facileManager/classes/class_users.php
server/fm-modules/facileManager/functions.php
server/fm-modules/facileManager/pages/admin-logs.php
Commit message: fM - #599 - Multiple security fixes


Vulnerable code:
$fm_version = '4.5.0';
			if (is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
		if ((!currentUserCan('manage_users') && $_SESSION['user']['id'] != $post['user_id']) || isset($post['user_login'])) {
			return _('You do not have permission to make these changes.');
		$data = str_replace('--', '-', $data);
$search_sql = $list = $log_search_query = $log_search_date_b = $log_search_date_e = null;
$list = null;

Fixed code:
$fm_version = '4.5.1';
4.5.1 (2024-01-30)
==================
* Server - [security] Fixed authenticated variable manipulation leading to SQL Injection. (Issue #599)
* Server - [security] Fixed privilege escalation via mass assignment. (Issue #599)
* Server - [security] Fixed systemic cross-site scripting (XSS). (Issue #599)

			if (isset($fmdb->last_result) && is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
		if ((!currentUserCan('manage_users') && ($_SESSION['user']['id'] != $post['user_id'] || isset($post['user_caps']))) 
			|| ($_SESSION['user']['id'] != $post['user_id'] && $post['user_id'] == getDefaultAdminID()) 
			|| isset($post['user_login'])
			|| (isset($post['user_caps']) && $_SESSION['user']['id'] == $post['user_id'] && $_SESSION['user']['id'] == getDefaultAdminID())) {
				return _('You do not have permission to make these changes.');
		$data = str_replace($replace . $replace, $replace, $data);
			$data = htmlspecialchars(strip_tags($data), ENT_NOQUOTES);
$search_sql = null;
CVE-2022-0536 (JavaScript, published 2022-02-09T11:15Z)
Description: value: Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.


Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/follow-redirects/follow-redirects
Files changed:
index.js
test/test.js
Commit message: Drop confidential headers across schemes.


Vulnerable code:
    // Drop the confidential headers when redirecting to another domain
    if (!(redirectUrlParts.host === currentHost || isSubdomainOf(redirectUrlParts.host, currentHost))) {
function isSubdomainOf(subdomain, domain) {

Fixed code:
    // Drop confidential headers when redirecting to another scheme:domain
    if (redirectUrlParts.protocol !== currentUrlParts.protocol ||
       !isSameOrSubdomain(redirectUrlParts.host, currentHost)) {
function isSameOrSubdomain(subdomain, domain) {
  if (subdomain === domain) {
    return true;
  }

    it("drops the header when redirected to a different scheme", function () {
      app.get("/a", redirectsTo(302, "http://localhost:3601/b"));
      app.get("/b", function (req, res) {
        res.end(JSON.stringify(req.headers));
      });

      var opts = url.parse("https://localhost:3601/a");
      opts.ca = ca;
      opts.headers = {};
      opts.headers[header] = "the header value";

      // Intercept the scheme
      opts.beforeRedirect = function (options) {
        assert.equal(options.protocol, "http:");
        options.protocol = "https:";
      };

      return server.start(httpsOptions(app))
        .then(asPromise(function (resolve, reject) {
          https.get(opts, resolve).on("error", reject);
        }))
        .then(asPromise(function (resolve, reject, res) {
          res.pipe(concat({ encoding: "string" }, resolve)).on("error", reject);
        }))
        .then(function (str) {
          var body = JSON.parse(str);
          assert.equal(body[header.toLowerCase()], undefined);
        });
    });
CVE-2024-28849 (JavaScript, published 2024-03-14T17:15Z)
Description: value: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/follow-redirects/follow-redirects
Files changed:
index.js
test/test.js
Commit message: Drop Proxy-Authorization across hosts.


Vulnerable code:
    removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);

Fixed code:
    removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
    "Proxy-Authorization",
CVE-2016-6254 (C, published 2016-08-19T21:59Z)
Description: value: Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/collectd/collectd
Files changed:
src/network.c
Commit message: network plugin: Fix heap overflow in parse_packet().

Emilien Gaspar has identified a heap overflow in parse_packet(), the
function used by the network plugin to parse incoming network packets.

This is a vulnerability in collectd, though the scope is not clear at
this point. At the very least specially crafted network packets can be
used to crash the daemon. We can't rule out a potential remote code
execution though.

Fixes: CVE-2016-6254


Vulnerable code:

Fixed code:
			buffer_size -= (size_t) pkg_length;
			buffer_size -= (size_t) pkg_length;
			buffer_size -= (size_t) pkg_length;
CVE-2017-16820 (C, published 2017-11-14T21:29Z)
Description: value: The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/collectd/collectd
Files changed:
src/snmp.c
Commit message: snmp plugin: Fix double free of request PDU

snmp_sess_synch_response() always frees request PDU, in both case of request
error and success. If error condition occurs inside of `while (status == 0)`
loop, double free of `req` happens.

Issue: #2291
Signed-off-by: Florian Forster <octo@collectd.org>


Vulnerable code:
      /* snmp_synch_response already freed our PDU */
      req = NULL;
  if (req != NULL)
    snmp_free_pdu(req);
  req = NULL;

Fixed code:
      snmp_free_pdu(req);
    /* snmp_sess_synch_response always frees our req PDU */
CVE-2013-6441 (Other, published 2014-02-14T15:55Z)
Description: value: The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/lxc/lxc
Files changed:
templates/lxc-sshd.in
Commit message: sshd: Don't bind-mount /sbin/init read-write

lxc-sshd was mounting itself (the template script) as /sbin/init in the
container using a writable bind-mount.

This shouldn't be needed and could lead to quite a few problems should
one of those containers overwrite /sbin/init for some reason.

Instead simply move to a read-only bind-mount which should prevent any
accidental dammage.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>


Vulnerable code:
lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none bind 0 0

Fixed code:
lxc.mount.entry = @LXCTEMPLATEDIR@/lxc-sshd sbin/init none ro,bind 0 0
CVE-2015-1331 (C, published 2015-08-12T14:59Z)
Description: value: lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/lxc/lxc
Files changed:
src/lxc/lxclock.c
src/tests/locktests.c
Commit message: CVE-2015-1331: lxclock: use /run/lxc/lock rather than /run/lock/lxc

This prevents an unprivileged user to use LXC to create arbitrary file
on the filesystem.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>


Vulnerable code:
	 * "/run" + "/lock/lxc/$lxcpath/$lxcname + '\0' if root
	 * $XDG_RUNTIME_DIR + "/lock/lxc/$lxcpath/$lxcname + '\0' if non-root
	/* length of "/lock/lxc/" + $lxcpath + "/" + "." + $lxcname + '\0' */
	len = strlen("/lock/lxc/") + strlen(n) + strlen(p) + 3;
	ret = snprintf(dest, len, "%s/lock/lxc/%s", rundir, p);
		/* fall back to "/tmp/" + $(id -u) + "/lxc" + $lxcpath + "/" + "." + $lxcname + '\0'
		 * * maximum length of $(id -u) is 10 calculated by (log (2 ** (sizeof(uid_t) * 8) - 1) / log 10 + 1)
		 * * lxcpath always starts with '/'
		 */
		int l2 = 22 + strlen(n) + strlen(p);
		if (l2 > len) {
			char *d;
			d = realloc(dest, l2);
			if (!d) {
				free(dest);
				free(rundir);
				return NULL;
			}
			len = l2;
			dest = d;
		}
		ret = snprintf(dest, len, "/tmp/%d/lxc%s", geteuid(), p);
		if (ret < 0 || ret >= len) {
			free(dest);
			free(rundir);
			return NULL;
		}
		ret = mkdir_p(dest, 0755);
		if (ret < 0) {
			free(dest);
			free(rundir);
			return NULL;
		}
		ret = snprintf(dest, len, "/tmp/%d/lxc%s/.%s", geteuid(), p, n);
	} else
		ret = snprintf(dest, len, "%s/lock/lxc/%s/.%s", rundir, p, n);

	char *pathname = RUNTIME_PATH "/lock/lxc/var/lib/lxc/";

Fixed code:
	 * "/run" + "/lxc/lock/$lxcpath/$lxcname + '\0' if root
	 * $XDG_RUNTIME_DIR + "/lxc/lock/$lxcpath/$lxcname + '\0' if non-root
	/* length of "/lxc/lock/" + $lxcpath + "/" + "." + $lxcname + '\0' */
	len = strlen("/lxc/lock/") + strlen(n) + strlen(p) + 3;
	ret = snprintf(dest, len, "%s/lxc/lock/%s", rundir, p);
		free(dest);
		free(rundir);
		return NULL;
	}
	ret = snprintf(dest, len, "%s/lxc/lock/%s/.%s", rundir, p, n);
	char *pathname = RUNTIME_PATH "/lxc/lock/var/lib/lxc/";
CVE-2016-10124 (Other, published 2017-01-09T08:59Z)
Description: value: An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the container.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/lxc/lxc
Files changed:
doc/lxc-attach.sgml.in
Commit message: update lxc-attach manpage

- explain rationale behind allocation of pty
- briefly explain how a pty is allocated
- add a short note that describes the changed behavior for lxc-attach when the
  user is not placed in a writeable cgroup at login

Signed-off-by: Christian Brauner <christian.brauner@mailbox.org>


Vulnerable code:

Fixed code:
    <para>
    Previous versions of <command>lxc-attach</command> simply attached to the
    specified namespaces of a container and ran a shell or the specified
    command without allocating a pseudo terminal. This made them vulnerable to
    input faking via a TIOCSTI <command>ioctl</command> call after switching
    between userspace execution contexts with different privilegel levels. Newer
    versions of <command>lxc-attach</command> will try to allocate a pseudo
    terminal master/slave pair and attach any standard file descriptors which
    refer to a terminal to the slave side of the pseudo terminal before
    executing a shell or command. <command>lxc-attach</command> will first try
    to allocate a pseudo terminal in the container. Should this fail it will try
    to allocate a pseudo terminal on the host before finally giving up. Note,
    that if none of the standard file descriptors refer to a terminal
    <command>lxc-attach</command> will not try to allocate a pseudo terminal.
    Instead it will simply attach to the containers namespaces and run a shell
    or the specified command.
    </para>
    <para>
      Previous versions of <command>lxc-attach</command> suffered a bug whereby
      a user could attach to a containers namespace without being placed in a
      writeable cgroup for some critical subsystems. Newer versions of
      <command>lxc-attach</command> will check whether a user is in a writeable
      cgroup for those critical subsystems. <command>lxc-attach</command> might
      thus fail unexpectedly for some users (E.g. on systems where an
      unprivileged user is not placed in a writeable cgroup in critical
      subsystems on login.). However, this behavior is correct and more secure.
    </para>
CVE-2014-125033 (Ruby, published 2023-01-02T08:15Z)
Description: value: A vulnerability was found in rails-cv-app. It has been rated as problematic. Affected by this issue is some unknown functionality of the file app/controllers/uploaded_files_controller.rb. The manipulation with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The patch is identified as 0d20362af0a5f8a126f67c77833868908484a863. It is recommended to apply a patch to fix this issue. VDB-217178 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/bertrand-caron/rails-cv-app
Files changed:
app/controllers/uploaded_files_controller.rb
spec/controllers/helpers_controller_spec.rb
spec/controllers/uploaded_file_spec.rb
spec/factories/uploaded_file.rb
Commit message: HOTFIX : Another vulnerability picked up by Brakeman

- Potential Path Traversal attack (tested working !)
I could potentially explore the whole filesystem with root access
(Ex: filename: '../../../etc/passwd')
- Added (empty) specs to detect it


Vulnerable code:
    context 'with session cookie' do
      it 'corrects incorrect HTML' do
        post 'html_renderer', content: '<div>Hello', format: :html
        expect(response.body).to eq('<div>Hello</div>')
      end
    end

Fixed code:
    # WARNING : File.open is definitely vulnerable to Path Traversal Attacks
    # (https://www.owasp.org/index.php/Path_Traversal) 
    # The following line should take care of it, by only taking the past part of the path (aka filename)
    @uploaded_file.name = @uploaded_file.name.split(/\//)[-1]

#    context 'with session cookie' do
#      it 'corrects incorrect HTML' do
#        post 'html_renderer', content: '<div>Hello', format: :html
#        expect(response.body).to eq('<div>Hello</div>')
#      end
#    end
require 'spec_helper'

describe UploadedFilesController, type: :controller do
  it 'has a valid factory' do
    expect( FactoryGirl.create(:uploaded_file)).to be_valid
  end

  it 'does not accept relative paths in file name'
end
require 'faker'

FactoryGirl.define do
  factory :uploaded_file do |f|
    f.name 'hello.png'
  end

  factory :dangerous_file, class: UploadedFile do |f|
    f.name '../Hello.png'
  end
end