hitoshura25/cvefixes huggingface dataset:
CVE-2023-25569 (YAML, published 2023-02-20T16:15Z)
Description: value: Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.

Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/apolloconfig/apollo
Files changed:
apollo-portal/src/main/resources/application.yml
Commit message: config cookie same site to lax


Vulnerable code:

Fixed code:
  servlet:
    session:
      cookie:
        # prevent csrf
        same-site: Lax
CVE-2020-15151 (PHP, published 2020-08-20T01:17Z)
Description: value: OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.
Severity: MEDIUM (CVSS v3 base score: 8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
app/code/core/Mage/Adminhtml/Controller/Action.php
Commit message: Merge pull request from GHSA-crf2-xm6x-46p6



Vulnerable code:
            || $secretKey != Mage::getSingleton('adminhtml/url')->getSecretKey()) {

Fixed code:
            || !hash_equals(Mage::getSingleton('adminhtml/url')->getSecretKey(), $secretKey)) {
CVE-2020-15244 (PHP, published 2020-10-21T20:15Z)
Description: value: In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php
app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php
Commit message: Merge pull request from GHSA-jrgf-vfw2-hj26



Vulnerable code:
                $product->setRecurringProfile(unserialize($profile));

Fixed code:
        if (!$model->getIsUserDefined()) {
            $this->_fault('can_not_delete');
        }

                $product->setRecurringProfile(Mage::helper('core/unserializeArray')->unserialize($profile));
CVE-2020-26252 (Unknown, published 2021-01-20T22:15Z)
Description: value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
Commit message: Merge pull request from GHSA-99m6-r53j-4hh2

Fix for Layout XML RCE Vulnerability

Vulnerable code:

Fixed code:
CVE-2020-26252 (Unknown, published 2021-01-20T22:15Z)
Description: value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
Commit message: Merge pull request from GHSA-99m6-r53j-4hh2

Fix for Layout XML RCE Vulnerability

Vulnerable code:

Fixed code:
CVE-2020-26285 (Unknown, published 2021-01-21T14:15Z)
Description: value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
Commit message: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9

Vulnerable code:

Fixed code:
CVE-2020-26285 (Unknown, published 2021-01-21T14:15Z)
Description: value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
Commit message: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9

Vulnerable code:

Fixed code:
CVE-2020-26295 (Unknown, published 2021-01-21T14:15Z)
Description: value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
Commit message: Merge pull request from GHSA-52c6-6v3v-f3fg

CMS Editor code execution update

Vulnerable code:

Fixed code:
CVE-2020-26295 (Unknown, published 2021-01-21T14:15Z)
Description: value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
Commit message: Merge pull request from GHSA-52c6-6v3v-f3fg

CMS Editor code execution update

Vulnerable code:

Fixed code:
CVE-2015-10082 (C, published 2023-02-21T07:15Z)
Description: value: A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/UIKit0/libplist
Files changed:
src/xplist.c
Commit message: xplist: Fix limited but possible XXE security vulnerability with XML plists

By using a specifically crafted XML file an attacker could use plistutil
to issue a GET request to an arbitrary URL or disclose a local file.
The crafted XML file would be using a custom DTD with an external entity
reference pointing to the file. Practical abuse is limited but let's still
fix it nevertheless. Related to CVE-2013-0339 for libxml2 and CWE-827.
Reported by Loïc Bénis from calypt.com. Thanks!


Vulnerable code:
    xmlDocPtr plist_doc = xmlParseMemory(plist_xml, length);
    xmlNodePtr root_node = xmlDocGetRootElement(plist_doc);
    xml_to_node(root_node, plist);
    xmlFreeDoc(plist_doc);

Fixed code:
#include <libxml/xmlIO.h>
static xmlParserInputPtr plist_xml_external_entity_loader(const char *URL, const char *ID, xmlParserCtxtPtr ctxt)
{
    return NULL;
}

    /* CVE-2013-0339: disable external entity loading to prevent XXE vulnerability */
    xmlSetExternalEntityLoader(plist_xml_external_entity_loader);
    /* read XML from memory and disable network access for security reasons */
    xmlDocPtr plist_doc = xmlReadMemory(plist_xml, length, "plist_from_xml:memory", NULL, XML_PARSE_NONET);
    if (plist_doc) {
        xmlNodePtr root_node = xmlDocGetRootElement(plist_doc);

        xml_to_node(root_node, plist);
        xmlFreeDoc(plist_doc);
    }
CVE-2023-36811 (Unknown, published 2023-08-30T18:15Z)
Description: value: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune". There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/borgbackup/borg
Files changed:
Commit message: Merge pull request #7789 from ThomasWaldmann/archive-tam-verify-master

Archive tam verify security fix (master)

Vulnerable code:

Fixed code:
CVE-2021-4430 (JavaScript, published 2023-11-06T08:15Z)
Description: value: A vulnerability classified as problematic has been found in Ortus Solutions ColdBox Elixir 3.1.6. This affects an unknown part of the file src/defaultConfig.js of the component ENV Variable Handler. The manipulation leads to information disclosure. Upgrading to version 3.1.7 is able to address this issue. The identifier of the patch is a3aa62daea2e44c76d08d1eac63768cd928cd69e. It is recommended to upgrade the affected component. The identifier VDB-244485 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Ortus-Solutions/coldbox-elixir
Files changed:
src/config/index.js
src/config/ingredients/env.js
src/defaultConfig.js
Commit message: Fix security vulnerability that echoed out all ENV vars.

In a mistaken attempt to make defining ENV vars easier, Elixir
would define every ENV var using Webpack's `DefinePlugin`.
This was a mistake.  The entire ENV of the server generating the
bundle would be serialized into an object and delivered in the
JavaScript bundle.  This code has been removed.  You need to allow
ENV variables using the webpack's `DefinePlugin` or `EnvironmentPlugin`.
To make this easier, Elixir now has a `mix.env` method that forwards
all arguments on to `EnvironmentPlugin`.


Vulnerable code:



const webpack = require("webpack");
        new webpack.DefinePlugin({
            // stringify each value so webpack doesn't insert variables instead of strings
            "process.env": Object.keys(process.env).reduce((obj, key) => {
                obj[key] = JSON.stringify(process.env[key]);
                return obj;
            }, {})
        })

Fixed code:
ElixirConfig.addIngredient("env", require("./ingredients/env"));
const { EnvironmentPlugin } = require("webpack");

module.exports = function(keys) {
    return this.mergeConfig({
        plugins: [
            new EnvironmentPlugin(keys)
        ]
    });
};
CVE-2024-21503 (Python, published 2024-03-19T05:15Z)
Description: value: Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/psf/black
Files changed:
CHANGES.md
src/black/strings.py
tests/test_black.py
Commit message: Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)



Vulnerable code:
<!-- Changes that improve Black's performance. -->
FIRST_NON_WHITESPACE_RE: Final = re.compile(r"\s*\t+\s*(\S)")
        # Find the index of the first non-whitespace character after a string of
        # whitespace that includes at least one tab
        match = FIRST_NON_WHITESPACE_RE.match(line)
        if match:
            first_non_whitespace_idx = match.start(1)

            lines.append(
                line[:first_non_whitespace_idx].expandtabs()
                + line[first_non_whitespace_idx:]
            )
        else:

Fixed code:
This release is a milestone: it fixes Black's first CVE security vulnerability. If you
run Black on untrusted input, or if you habitually put thousands of leading tab
characters in your docstrings, you are strongly encouraged to upgrade immediately to fix
[CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503).

This release also fixes a bug in Black's AST safety check that allowed Black to make
incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

- Fix catastrophic performance on docstrings that contain large numbers of leading tab
  characters. This fixes
  [CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503).
  (#4278)
        stripped_line = line.lstrip()
        if not stripped_line or stripped_line == line:
        else:
            prefix_length = len(line) - len(stripped_line)
            prefix = line[:prefix_length].expandtabs()
            lines.append(prefix + stripped_line)
from black.strings import lines_with_leading_tabs_expanded
    def test_lines_with_leading_tabs_expanded(self) -> None:
        # See CVE-2024-21503. Mostly test that this completes in a reasonable
        # time.
        payload = "\t" * 10_000
        assert lines_with_leading_tabs_expanded(payload) == [payload]

        tab = " " * 8
        assert lines_with_leading_tabs_expanded("\tx") == [f"{tab}x"]
        assert lines_with_leading_tabs_expanded("\t\tx") == [f"{tab}{tab}x"]
        assert lines_with_leading_tabs_expanded("\tx\n  y") == [f"{tab}x", "  y"]
CVE-2015-10111 (PHP, published 2023-06-04T12:15Z)
Description: value: A vulnerability was found in Watu Quiz Plugin up to 2.6.7 on WordPress. It has been rated as critical. This issue affects the function watu_exams of the file controllers/exam.php of the component Exam Handler. The manipulation of the argument quiz leads to sql injection. The attack may be initiated remotely. Upgrading to version 2.6.8 is able to address this issue. The patch is named bf42e7cfd819a3e76cf3e1465697e89f4830590c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230651.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/watu
Files changed:
controllers/exam.php
controllers/show_exam.php
readme.txt
script.js
views/show_exam.html.php
watu.php
Commit message: Fixed security exploit

git-svn-id: https://plugins.svn.wordpress.org/watu/trunk@1290960 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
		$wpdb->get_results("DELETE FROM ".WATU_EXAMS." WHERE ID='$_REQUEST[quiz]'");
		$wpdb->get_results("DELETE FROM ".WATU_ANSWERS." WHERE question_id IN (SELECT ID FROM ".WATU_QUESTIONS." WHERE exam_id='$_REQUEST[quiz]')");
		$wpdb->get_results("DELETE FROM ".WATU_QUESTIONS." WHERE exam_id='$_REQUEST[quiz]'");
				$exam_id, $uid, $_SERVER['REMOTE_ADDR'], $achieved, $g_id, $grade, $_POST['start_time']));
= Changes in 2.6.7 =
<input type="hidden" name="start_time" value="<?php echo current_time('mysql'); ?>" />
Version: 2.6.7
			'2.3.2'

Fixed code:
		$wpdb->get_results($wpdb->prepare("DELETE FROM ".WATU_EXAMS." WHERE ID=%d", $_REQUEST['quiz']));
		$wpdb->get_results($wpdb->prepare("DELETE FROM ".WATU_ANSWERS." WHERE question_id IN (SELECT ID FROM ".WATU_QUESTIONS." WHERE exam_id=%d", $_REQUEST['quiz']));
		$wpdb->get_results($wpdb->prepare("DELETE FROM ".WATU_QUESTIONS." WHERE exam_id=%d", $_REQUEST['quiz']));
				$exam_id, $uid, $_SERVER['REMOTE_ADDR'], $achieved, $g_id, $grade, @$_POST['start_time']));
= Changes in 2.6.8 =
- Fixed security exploit
	data['start_time'] = jQuery('#watuStartTime').val();
<input type="hidden" id="watuStartTime" name="start_time" value="<?php echo current_time('mysql'); ?>" />
Version: 2.6.8
			'2.3.3'
CVE-2017-20175 (PHP, published 2023-02-05T20:15Z)
Description: value: A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.4.3 is able to address this issue. The patch is named 681324e4f518a8af4bd1f93867074c728eb9923d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220203.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/DaSchTour/matomo-mediawiki-extension
Files changed:
Piwik.hooks.php
Commit message: SECURITY: XSS when $wgPiwikTrackUsernames is true

With a specially-crafted username like 0'+(window.alert('You have been hacked'))+'0
the user receives the alert "You have been hacked". This commit escapes the
username.


Vulnerable code:
            $username = $wgUser->getName();
            $customJs .= PHP_EOL . "  _paq.push(['setUserId','{$username}']);";

Fixed code:
            $username = Xml::encodeJsVar( $wgUser->getName() );
            $customJs .= PHP_EOL . "  _paq.push([\"setUserId\",{$username}]);";