hitoshura25/cvefixes huggingface dataset:
CVE-2023-4651 (PHP, published 2023-08-31T01:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/instantsoft/icms2
Files changed:
system/core/uploader.php
system/libs/files.helper.php
Commit message: Fix SSRF Blind in the image upload

Vulnerable code:
function file_save_from_url($url, $destination){
    if (!function_exists('curl_init')){ return false; }
    if(strpos($url, 'https') === 0){


Fixed code:

        if (
            // Валидный URL с PATH
            filter_var($link, FILTER_VALIDATE_URL, FILTER_FLAG_PATH_REQUIRED) !== $link ||
            // По IP адресу не разрешаем
            preg_match('#^(?:(?:https?):\/\/)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*#ui', $link)
            ) {

            return [
                'success' => false,
                'error'   => 'Not allowed',
                'name'    => '',
                'path'    => ''
            ];
        }

        curl_setopt($curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS | CURLPROTO_HTTP);
    // По IP адресу не разрешаем
    if (preg_match('#^(?:(?:https?):\/\/)([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*#ui', $url)) {
        return null;
    }

    curl_setopt($curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS | CURLPROTO_HTTP);
function file_save_from_url($url, $destination) {
    if (!function_exists('curl_init')) {
        return false;
    }
    if (strpos($url, 'https') === 0) {
    curl_setopt($curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS | CURLPROTO_HTTP);
CVE-2023-4654 (PHP, published 2023-08-31T01:15Z)
Description: value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
Severity: nan (CVSS v3 base score: 3.5)
Weakness: CWE-614 \u2014 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
Repository: https://github.com/instantsoft/icms2
Files changed:
system/core/config.php
system/core/user.php
Commit message: Add session regenerate after login & logout. Secure cookie if HTTPS.
close #1473

Vulnerable code:
        $this->set('document_root', rtrim(PATH, $this->root));
                'secure'   => false,

Fixed code:
        $this->set('document_root', preg_replace('#(.*)('.preg_quote($this->root).')$#u', '$1', PATH . DIRECTORY_SEPARATOR));
        self::sessionRegenerate();

        self::sessionRegenerate();

        self::sessionRegenerate();

    public static function sessionRegenerate() {

        session_regenerate_id(false);

        $id = session_id();

        session_write_close();

        session_id($id);

        session_start();
    }

                'secure'   => cmsConfig::isSecureProtocol(),
CVE-2023-4655 (JavaScript, published 2023-08-31T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/instantsoft/icms2
Files changed:
templates/modern/js/files.js
Commit message: Fix file field xss

Vulnerable code:
            $(this).next('.custom-file-label').html($(this).val().replace('C:\\fakepath\\', ''));

Fixed code:
            $(this).next('.custom-file-label').text($(this).val().replace('C:\\fakepath\\', ''));
CVE-2023-49087 (PHP, published 2023-11-30T06:15Z)
Description: value: xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/simplesamlphp/xml-security
Files changed:
src/XML/SignedElementTrait.php
Commit message: Merge pull request from GHSA-ww7x-3gxh-qm6r



Vulnerable code:
    private function validateReference(): SignedElementInterface
        /** @var \SimpleSAML\XMLSecurity\XML\ds\Signature $this->signature */
        $signedInfo = $this->signature->getSignedInfo();
        $ref = $this->validateReference();

Fixed code:
use SimpleSAML\XMLSecurity\XML\ds\SignedInfo;
     * @param \SimpleSAML\XMLSecurity\XML\ds\SignedInfo $signedInfo
    private function validateReference(SignedInfo $signedInfo): SignedElementInterface

        // the canonicalized ds:SignedInfo element (plaintext)
        $ref = $this->validateReference(
            SignedInfo::fromXML(DOMDocumentFactory::fromString($c14nSignedInfo)->documentElement),
        );
CVE-2022-4967 (C, published 2024-05-14T11:57Z)
Description: value: strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136).
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/strongswan/strongswan
Files changed:
src/libtls/tls_peer.c
src/libtls/tls_server.c
Commit message: libtls: Enforce client/server identity when looking for public key

The client already enforces that the server identity is contained in the
received certificate.  But on the server, the referenced commit changed
the lookup from the configured (or adopted if %any was configured) client
identity to the subject DN of the received client certificate.  So any
client with a trusted certificate was accepted.

Fixes: d2fc9b0961c6 ("tls-server: Mutual authentication support for TLS 1.3")
Closes strongswan/strongswan#873


Vulnerable code:
public_key_t *tls_find_public_key(auth_cfg_t *peer_auth);
	public = tls_find_public_key(this->server_auth);
	public = tls_find_public_key(this->server_auth);
	public = tls_find_public_key(this->server_auth);
	public = tls_find_public_key(this->server_auth);
public_key_t *tls_find_public_key(auth_cfg_t *peer_auth)
											KEY_ANY, cert->get_subject(cert),
											peer_auth, TRUE);
	public = tls_find_public_key(this->peer_auth);

Fixed code:
public_key_t *tls_find_public_key(auth_cfg_t *peer_auth, identification_t *id);
	public = tls_find_public_key(this->server_auth, this->server);
	public = tls_find_public_key(this->server_auth, this->server);
	public = tls_find_public_key(this->server_auth, this->server);
	public = tls_find_public_key(this->server_auth, this->server);
public_key_t *tls_find_public_key(auth_cfg_t *peer_auth, identification_t *id)
												KEY_ANY, id, peer_auth, TRUE);
	public = tls_find_public_key(this->peer_auth, this->peer);
CVE-2023-45813 (Unknown, published 2023-10-18T21:15Z)
Description: value: Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/DedSecInside/TorBot
Files changed:
Commit message: remove unused validators file


Vulnerable code:
import validators


def validate_email(email):
    if not isinstance(email, str):
        return False
    return validators.email(email)


def validate_link(link):
    if not isinstance(link, str):
        return False
    return validators.url(link)

Fixed code:
CVE-2013-0342 (Other, published 2019-12-09T21:15Z)
Description: value: The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packets by predicting the next ID, a different vulnerability than CVE-2013-0294.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/pyradius/pyrad
Files changed:
CHANGES.txt
pyrad/packet.py
Commit message: Use a better random generator.


Vulnerable code:
CurrentID = random.randrange(1, 255)
            data.append(random.randrange(0, 256))
        return random.randrange(0, 256)

Fixed code:
2.1 - Unreleased
------------------

* Use a different random generator to improve the security of generated
  packet ids and authenticators.


# Use cryptographic-safe random generator as provided by the OS.
random_generator = random.SystemRandom()

CurrentID = random_generator.randrange(1, 255)
            data.append(random_generator.randrange(0, 256))
        return random_generator.randrange(0, 256)
CVE-2021-3945 (HTML, published 2021-11-13T09:15Z)
Description: value: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/django-helpdesk/django-helpdesk
Files changed:
helpdesk/templates/helpdesk/ticket_list.html
Commit message: Add function `htmlEntities`

`htmlentities()` is a function which converts special characters. This allows you to show to display the string without the browser reading it as HTML.

Vulnerable code:

                                    row.title + '</a></div>';

Fixed code:
        
        function htmlEntities(str) {
            return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
        }
        
                                    htmlEntities(row.title) + '</a></div>';
CVE-2021-3950 (Python, published 2021-11-19T12:15Z)
Description: value: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/django-helpdesk/django-helpdesk
Files changed:
helpdesk/lib.py
Commit message: Add `att.full_clean()` before saving

Fix issue https://github.com/django-helpdesk/django-helpdesk/issues/983
Also, fix bug stored XSS disclosure: https://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e/

Vulnerable code:

Fixed code:
            att.full_clean()
CVE-2021-3994 (Python, published 2021-12-01T11:15Z)
Description: value: django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/django-helpdesk/django-helpdesk
Files changed:
helpdesk/models.py
Commit message: Update pattern


Vulnerable code:
    pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\[\s\S\]]*?)\)'

Fixed code:
    pattern = fr'([\[\s\S\]]*?)\(([\s\S]*?):([\s\S]*?)\)'
CVE-2017-1000211 (Other, published 2017-11-17T15:29Z)
Description: value: Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ThomasDickey/lynx-snapshots
Files changed:
CHANGES
PACKAGE/debian/lynx-dev.lintian-overrides
src/HTML.c
Commit message: snapshot of project "lynx", label v2-8-9dev_15b


Vulnerable code:
lynx-dev: rc-version-greater-than-expected-version 2.8.9dev.15 > 2.8.9 (consider using 2.8.9~dev.15)
 * $LynxId: HTML.c,v 1.173 2017/07/04 20:05:01 tom Exp $
	HTChunkPuts(&me->title, s);
	HTChunkPuts(&me->style_block, s);
	HTChunkPuts(&me->script, s);
	HTChunkPuts(&me->object, s);
	HTChunkPuts(&me->textarea, s);
	HTChunkPuts(&me->option, s);
	HTChunkPuts(&me->math, s);

Fixed code:
-- $LynxId: CHANGES,v 1.911 2017/07/05 22:23:00 tom Exp $
* add a check to ensure that HTML_put_string() will not append a chunk onto
  itself (report by Ned Williamson) -TD
lynx-dev: rc-version-greater-than-expected-version
 * $LynxId: HTML.c,v 1.174 2017/07/05 22:48:09 tom Exp $
    HTChunk *target = NULL;

	target = &me->title;
	target = &me->style_block;
	target = &me->script;
	target = &me->object;
	target = &me->textarea;
	target = &me->option;
	target = &me->math;

    if (target != NULL) {
	if (target->data == s) {
	    CTRACE((tfp, "BUG: appending chunk to itself: `%.*s'\n",
		    target->size, target->data));
	} else {
	    HTChunkPuts(target, s);
	}
    }
CVE-2020-28441 (JavaScript, published 2022-07-25T14:15Z)
Description: value: This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/loge5/conf-cfg-ini
Files changed:
conf-cfg-ini.js
conf-cfg-ini.spec.js
Commit message: fix: prevent prototype pollution attack


Vulnerable code:
            if(typeof result[currentSection] === 'undefined'){

Fixed code:
    var protectedKeys = ['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__', '__proto__'];
            if(typeof result[currentSection] === 'undefined' && !protectedKeys.includes(currentSection)){
        if (protectedKeys.includes(currentSection) || protectedKeys.includes(key)) {
            continue;
        }
    it('decode should prevent prototype pollution attacks', function () {
        var config = new Config();
        config.options.lineEnding = "\n";
        config.options.assignIdentifier = ":";
        var result = config.decode("[__proto__]\nfoo:bar\n");
        should.not.exist(result.__proto__.foo);
        result = config.decode("[Section]\n__proto__:bar\n");
        expect(result.Section.__proto__).to.not.equal("bar");
    });
CVE-2023-47635 (JavaScript, published 2024-02-20T18:15Z)
Description: value: Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. As a workaround, disable the templates functionality or remove all available templates.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/decidim/decidim
Files changed:
decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb
decidim-templates/app/packs/src/decidim/templates/admin/choose_template.js
Commit message: Simplify the code related to questionnaire templates previews (#11743)



Vulnerable code:
        skip_before_action :verify_authenticity_token, only: :preview

    fetch(`${previewURL}?${params.toString()}`, {
      method: "GET",
      headers: { "Content-Type": "application/json" }
    }).then((response) => response.text()).then((data) => {
      const script = document.createElement("script");
      script.type = "text/javascript";
      script.innerHTML = data;
      document.getElementsByTagName("head")[0].appendChild(script);
    }).catch((error) => {
      console.error(error); // eslint-disable-line no-console

Fixed code:
    Rails.ajax({
      url: `${previewURL}?${params.toString()}`,
      type: "GET",
      error: (data) => (console.error(data))
CVE-2021-21289 (Unknown, published 2021-02-02T19:15Z)
Description: value: Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.
Severity: HIGH (CVSS v3 base score: 8.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sparklemotion/mechanize
Files changed:
Commit message: Merge pull request #548 from kyoshidajp/fix_command_injection

Prevent OS command injection

Vulnerable code:

Fixed code:
CVE-2022-31033 (Unknown, published 2022-06-09T20:15Z)
Description: value: The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/sparklemotion/mechanize
Files changed:
Commit message: Merge pull request #600 from sparklemotion/flavorjones-redirect-headers

fix: clear credentials when redirecting to a different port

Vulnerable code:

Fixed code:
CVE-2018-16359 (Go, published 2018-09-02T22:29Z)
Description: value: Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the renameat system call, which allows attackers to rename files on the host OS.
Severity: HIGH (CVSS v3 base score: 6.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/google/gvisor
Files changed:
runsc/boot/filter/config.go
Commit message: Clean up syscall filters

Removed syscalls that are only used by whitelistfs
which has its own set of filters.

PiperOrigin-RevId: 209967259
Change-Id: Idb2e1b9d0201043d7cd25d96894f354729dbd089


Vulnerable code:
	syscall.SYS_FCHMOD:        {},
	syscall.SYS_NEWFSTATAT:      {},
	syscall.SYS_READLINKAT:      {},
	syscall.SYS_RENAMEAT:        {},
	syscall.SYS_UTIMENSAT:       {},

Fixed code: