hitoshura25/cvefixes huggingface dataset:
CVE-2020-35847 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
modules/Cockpit/Controller/Auth.php
Commit message: fix possible security issue for login


Vulnerable code:
            $user['md5email'] = md5($user['email']);

Fixed code:
            if (!\is_string($data['user']) || !\is_string($data['password'])) {
                return ['success' => false, 'error' => 'Pre-condition failed'];
            }

            if (!\is_string($token)) {
                return false;
            }

            $user = [
                'md5email' => md5($user['email']),
                'user' => $user['name'],
                'name' => $user['user'],
            ];
            if (!\is_string($token)) {
                return false;
            }
CVE-2020-35848 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
lib/MongoLite/Database.php
Commit message: remove $fn, $func, $f as field filter ... add $where as an alternative (MongoLite)


Vulnerable code:
                    if (\is_callable($value)) {

                        // need implementation
            case '$func' :
            case '$fn' :
            case '$f' :
                if (\is_string($b) || !\is_callable($b))
                    throw new \InvalidArgumentException('Function should be callable');
                $r = $b($a);
                break;


Fixed code:
    protected static $closures = [];

    public static function closureCall($uid, $doc) {
        return call_user_func_array(self::$closures[$uid], [$doc]);
    }

                    if (\is_string($value) || !\is_callable($value)) {
                        throw new \InvalidArgumentException($key.' Function should be callable');
                    $uid = \uniqid('mongoliteCallable').bin2hex(random_bytes(5));

                    self::$closures[$uid] = $value;

                    $fn[] = '\\MongoLite\\UtilArrayQuery::closureCall("'.$uid.'", $document)';
CVE-2020-35848 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
lib/MongoLite/Database.php
Commit message: don't allow callable strings for $func (MongoLite)


Vulnerable code:
                if (! \is_callable($b))

Fixed code:
                if (\is_string($b) || !\is_callable($b))
CVE-2020-35848 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
modules/Cockpit/Controller/Auth.php
Commit message: fix possible security issue for login


Vulnerable code:
            $user['md5email'] = md5($user['email']);

Fixed code:
            if (!\is_string($data['user']) || !\is_string($data['password'])) {
                return ['success' => false, 'error' => 'Pre-condition failed'];
            }

            if (!\is_string($token)) {
                return false;
            }

            $user = [
                'md5email' => md5($user['email']),
                'user' => $user['name'],
                'name' => $user['user'],
            ];
            if (!\is_string($token)) {
                return false;
            }
CVE-2021-32857 (PHP, published 2023-02-21T15:15Z)
Description: value: Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/agentejo/cockpit
Files changed:
modules/Cockpit/module/auth.php
Commit message: prevent session fixation attacks


Vulnerable code:

Fixed code:
            // prevent session fixation attacks
            session_regenerate_id(true);

        // prevent session fixation attacks
        session_regenerate_id(true);
CVE-2023-25015 (Ruby, published 2023-02-02T04:15Z)
Description: value: Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ankane/clockwork_web
Files changed:
CHANGELOG.md
app/controllers/clockwork_web/home_controller.rb
Commit message: Fixed CSRF vulnerability with Rails < 5.2


Vulnerable code:

Fixed code:
## 0.1.2 (unreleased)

- Fixed CSRF vulnerability with Rails < 5.2 - [more info](https://github.com/ankane/clockwork_web/issues/4)

    protect_from_forgery with: :exception
CVE-2023-22452 (Python, published 2023-01-02T20:15Z)
Description: value: kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/Kenny2github/kenny2automate
Files changed:
kenny2automate/server/__init__.py
Commit message: SECURITY: Prevent changing other servers' settings


Vulnerable code:

Fixed code:
        if set(param['channel_id'] for param in params) \
                - set(channel.id for channel in guild.channels): # is not empty
            raise web.HTTPBadRequest
CVE-2023-50251 (PHP, published 2023-12-12T21:15Z)
Description: value: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/dompdf/php-svg-lib
Files changed:
src/Svg/Tag/UseTag.php
Commit message: Prevent circular reference in use elements


Vulnerable code:

Fixed code:
    protected $instances = 0;
        $this->instances++;
        if ($this->instances > 1) {
            //TODO: log circular reference error state
            return;
        }

        if ($this->instances > 0) {
            return;
        }
        if ($this->instances > 1) {
            //TODO: log circular reference error state
            return;
        }

        $this->instances--;
        if ($this->instances > 0) {
            return;
        }
CVE-2023-50252 (PHP, published 2023-12-12T21:15Z)
Description: value: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue. 
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-15 \u2014 External Control of System or Configuration Setting
One or more system settings or configuration elements can be externally controlled by a user.
Repository: https://github.com/dompdf/php-svg-lib
Files changed:
src/Svg/Tag/UseTag.php
Commit message: Do not merge additional USE element attributes


Vulnerable code:
        $attributesToNotMerge = ['x', 'y', 'width', 'height'];

Fixed code:
        $attributesToNotMerge = ['x', 'y', 'width', 'height', 'href', 'xlink:href', 'id'];
CVE-2023-50252 (PHP, published 2023-12-12T21:15Z)
Description: value: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue. 
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/dompdf/php-svg-lib
Files changed:
src/Svg/Tag/UseTag.php
Commit message: Do not merge additional USE element attributes


Vulnerable code:
        $attributesToNotMerge = ['x', 'y', 'width', 'height'];

Fixed code:
        $attributesToNotMerge = ['x', 'y', 'width', 'height', 'href', 'xlink:href', 'id'];
CVE-2024-25117 (PHP, published 2024-02-21T17:15Z)
Description: value: php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the `Style::fromStyleSheets` might be reused. Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even remote code execution, if they do not double check the value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dompdf/php-svg-lib
Files changed:
src/Svg/Tag/Image.php
Commit message: Remove invalid condition around image href validation


Vulnerable code:
        if ($from === "font-family") {
            $scheme = \strtolower(parse_url($this->href, PHP_URL_SCHEME) ?: "");
            if (
                $scheme === "phar" || \strtolower(\substr($this->href, 0, 7)) === "phar://"
                || ($this->document->allowExternalReferences === false && $scheme !== "data")
            ) {
                return;
            }

Fixed code:
        $scheme = \strtolower(parse_url($this->href, PHP_URL_SCHEME) ?: "");
        if (
            $scheme === "phar" || \strtolower(\substr($this->href, 0, 7)) === "phar://"
            || ($this->document->allowExternalReferences === false && $scheme !== "data")
        ) {
            return;
CVE-2021-4281 (YAML, published 2022-12-26T20:15Z)
Description: value: A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/BraveUX/for-the-badge
Files changed:
.github/workflows/combine-prs.yml
Commit message: Fix potential injection vulnerability

See https://github.com/hrvey/combine-prs-workflow/releases/tag/1.2.0

Vulnerable code:
          echo "${{steps.fetch-branch-names.outputs.result}}"
            const prString = `${{ steps.fetch-branch-names.outputs.prs-string }}`;

Fixed code:
          echo "$BRANCHES_TO_COMBINE"
        env:
          PRS_STRING: ${{ steps.fetch-branch-names.outputs.prs-string }}
            const prString = process.env.PRS_STRING;
CVE-2024-36123 (PHP, published 2024-06-03T15:15Z)
Description: value: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/StarCitizenTools/mediawiki-skins-Citizen
Files changed:
includes/Components/CitizenComponentPageHeading.php
Commit message: fix(components): 🐛 escape the contents of MediaWiki:Tagline

Co-authored-by: BlankEclair <blankeclair@waifu.club>


Vulnerable code:
							$tagline = $localizer->msg( 'tagline' )->text();
					$tagline = $localizer->msg( 'tagline' )->text();

Fixed code:
							$tagline = $localizer->msg( 'tagline' )->parse();
					$tagline = $localizer->msg( 'tagline' )->parse();
CVE-2024-25123 (Python, published 2024-02-15T22:15Z)
Description: value: MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: `index.py`, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The `filename` variable is joined with other variables to form a file path in `_file`. However, `filename` is a route parameter that can capture path type values i.e. values including slashes (\). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to `filename` and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Open-MSS/MSS
Files changed:
mslib/index.py
mslib/mscolab/server.py
Commit message: Merge pull request from GHSA-pf2h-qjcr-qvq2



Vulnerable code:
        _file = os.path.join(STATIC_LOCATION, 'code', filename)
    return send_from_directory(fs.path.join(base_path, name), filename)

Fixed code:
import werkzeug
        _file = werkzeug.security.safe_join(STATIC_LOCATION, "code", filename)
        if _file is None:
            abort(404)
            if not os.path.isfile(_file):
                abort(404)
import werkzeug

    return send_from_directory(base_path, werkzeug.security.safe_join("", name, filename))
CVE-2021-41317 (JavaScript, published 2021-09-17T16:15Z)
Description: value: XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/mandatoryprogrammer/xsshunter-express
Files changed:
api.js
Commit message: Better path checking


Vulnerable code:
        if(!AUTHENTICATION_REQUIRED_ROUTES.includes(req.path)) {

Fixed code:
        // Check if the path being accessed required authentication
        var requires_authentication = false;
        AUTHENTICATION_REQUIRED_ROUTES.map(authenticated_route => {
            if(req.path.toLowerCase().startsWith(authenticated_route)) {
                requires_authentication = true;
            }
        });

        if(!requires_authentication) {
CVE-2022-22984 (TypeScript, published 2022-11-30T13:15Z)
Description: value: The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/snyk/snyk-docker-plugin
Files changed:
.snyk
lib/docker.ts
lib/sub-process.ts
package.json
Commit message: fix: quote spawn args


Vulnerable code:
version: v1.7.1
ignore: {}
    const opts: string[] = ["pull", targetImage];
      opts.push(`--platform=${options.platform}`);
    return subProcess.execute("docker", opts);
  args?: string[],

Fixed code:
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
  'snyk:lic:npm:shescape:MPL-2.0':
    - '*':
        reason: None Given
        expires: 2122-12-29T08:08:41.608Z
        created: 2022-11-29T08:08:41.611Z
    const args: string[] = ["pull", targetImage];
      args.push(`--platform=${options.platform}`);
    return subProcess.execute("docker", args);
import { quoteAll } from "shescape";
  args: string[],
  args = quoteAll(args, spawnOptions);
    "shescape": "1.6.1",