hitoshura25/cvefixes huggingface dataset:
CVE-2023-32303 (Python, published 2023-05-12T21:15Z)
Description: value: Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.

Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/planetlabs/planet-client-python
Files changed:
planet/auth.py
tests/unit/test_auth.py
Commit message: enforce restricting secret file permissions to user read/write


Vulnerable code:
from typing import Optional
    def __init__(self, path):
        self.path = path
        with open(self.path, 'w') as fp:
    secret_path = str(tmp_path / '.test')

Fixed code:
import stat
from typing import Optional
    def __init__(self, path: typing.Union[str, pathlib.Path]):
        self.path = pathlib.Path(path)

        self.permissions = stat.S_IRUSR | stat.S_IWUSR  # user rw

        # in sdk versions <=2.0.0, secret file was created with the wrong
        # permissions, fix this automatically as well as catching the unlikely
        # cases where the permissions get changed externally
        self._enforce_permissions()

        def opener(path, flags):
            return os.open(path, flags, self.permissions)

        with open(self.path, 'w', opener=opener) as fp:

    def _enforce_permissions(self):
        '''if the file's permissions are not what they should be, fix them'''
        try:
            # in octal, permissions is the last three bits of the mode
            file_permissions = self.path.stat().st_mode & 0o777
            if file_permissions != self.permissions:
                LOGGER.debug(
                    f'{self.path} permissions are {oct(file_permissions)}, '
                    f'should be {oct(self.permissions)}. Fixing.')
                self.path.chmod(self.permissions)
        except FileNotFoundError:
            # just skip it if the secret file doesn't exist
            pass
    secret_path = tmp_path / '.test'


def test__SecretFile_permissions_doesnotexist(secret_path):
    '''No exception is raised if the file doesn't exist'''
    auth._SecretFile(secret_path)


def test__SecretFile_permissions_incorrect(secret_path):
    '''Incorrect permissions are fixed'''
    with open(secret_path, 'w') as fp:
        fp.write('{"existing": "exists"}')

    secret_path.chmod(0o666)

    auth._SecretFile(secret_path)
    assert secret_path.stat().st_mode & 0o777 == 0o600
CVE-2021-30502 (JSON, published 2021-04-25T03:15Z)
Description: value: The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted workspace configuration with replCommand.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dramforever/vscode-ghc-simple
Files changed:
package.json
src/bios/config.ts
Commit message: [bios] Add replCommand trust mechanism


Vulnerable code:
): Promise<Configuration> {

Fixed code:
                "ghcSimple.trustedReplCommandConfigs": {
                    "type": "object",
                    "default": {},
                    "scope": "application",
                    "markdownDescription": "Using a `#ghcSimple.replCommand#` configuration from an untrusted workspace can pose a security risk. Whenever such a configuration occurs, you will be notified and if you choose to trust it, it will be recorded here."
                },
const alreadyShown = new Set();

function handleReplCommandTrust(
    workspaceUri: vscode.Uri,
    replCommand: string
): boolean {
    if (workspaceUri.scheme !== 'file') return false;
    const config = vscode.workspace.getConfiguration('ghcSimple', null);
    const insp = config.inspect('trustedReplCommandConfigs').globalValue ?? {};
    if (insp[workspaceUri.fsPath] === replCommand) {
        return true;
    } else {
        if (! alreadyShown.has(workspaceUri.fsPath)) {
            alreadyShown.add(workspaceUri.fsPath);
            vscode.window.showWarningMessage(
                `This workspace ${workspaceUri.fsPath} wants to run "${replCommand}" to start GHCi.\n\nAllow if you understand this and trust it.`,
                'Allow', 'Ignore'
            ).then((value) => {
                alreadyShown.delete(workspaceUri.fsPath);
                if (value == 'Allow') {
                    const trusted = config.get('trustedReplCommandConfigs');
                    trusted[workspaceUri.fsPath] = replCommand;
                    config.update('trustedReplCommandConfigs', trusted, vscode.ConfigurationTarget.Global);
                }
            })
        }
        return false;
    }
}

): Promise<Configuration | null> {
    if (! handleReplCommandTrust(workspaceUri, replCommand))
        return null;
CVE-2011-4715 (Perl, published 2011-12-08T19:55Z)
Description: value: Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/liblime/LibLime-Koha
Files changed:
C4/Output.pm
Commit message: [#21464023] Security: arbitrary file inclusion

Poor input cleansing can allow a well-constructed cookie
to return the contents of arbitrary file system objects.


Vulnerable code:

Fixed code:
    $lang =~ s/[^\p{IsAlnum}\-_]//g;
CVE-2020-36407 (C, published 2021-07-01T03:15Z)
Description: value: libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AOMediaCodec/libavif
Files changed:
include/avif/internal.h
src/read.c
Commit message: Set max image size to 16384 * 16384

Fix https://crbug.com/oss-fuzz/24728 and
https://crbug.com/oss-fuzz/24734.


Vulnerable code:

Fixed code:
// A maximum image size to avoid out-of-memory errors or integer overflow in
// (32-bit) int or unsigned int arithmetic operations.
#define AVIF_MAX_IMAGE_SIZE (16384 * 16384)

    if (grid->outputWidth > AVIF_MAX_IMAGE_SIZE / grid->outputHeight) {
        return AVIF_FALSE;
    }
CVE-2020-26249 (HTML, published 2020-12-09T00:15Z)
Description: value: Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue.
Severity: LOW (CVSS v3 base score: 8.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cog-Creators/Red-Dashboard
Files changed:
reddash/app/home/templates/dashboard.html
Commit message: Fix unformatted HTML


Vulnerable code:
                                            <h5 class="card-title">${g.name}</h5>
                                            <p class="card-text">Owner: ${g.owner}</p>

Fixed code:
                    let counter = 0
                                            <h5 class="card-title" id="guild-counter-${counter}">Loading...</h5>
                                            <p class="card-text" id="owner-counter-${counter}">Owner: Loading...</p>
                        $(`#guild-counter-${counter}`).text(g.name)
                        $(`#owner-counter-${counter}`).text(g.owner)
                        counter += 1
CVE-2020-28457 (PHP, published 2020-12-15T16:15Z)
Description: value: This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/s-cart/s-cart
Files changed:
app/Plugins/Cms/Content/Admin/CmsCategoryController.php
app/Plugins/Cms/Content/Admin/CmsContentController.php
Commit message: Hot fix error xss


Vulnerable code:
        $sort_order = request('sort_order') ?? 'id_desc';
        $keyword = request('keyword') ?? '';
        $sort_order = request('sort_order') ?? 'id_desc';
        $keyword = request('keyword') ?? '';

Fixed code:
        $sort_order = sc_clean(request('sort_order') ?? 'id_desc');
        $keyword    = sc_clean(request('keyword') ?? '');
        $sort_order = sc_clean(request('sort_order') ?? 'id_desc');
        $keyword    = sc_clean(request('keyword') ?? '');
CVE-2024-35192 (Go, published 2024-05-20T21:15Z)
Description: value: Trivy is a security scanner. Prior to 0.51.2, if a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access. Systems are not affected if the default credential provider chain is unable to obtain valid credentials. This vulnerability only applies when scanning container images directly from a registry. This vulnerability is fixed in 0.51.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aquasecurity/trivy
Files changed:
pkg/fanal/image/registry/azure/azure.go
pkg/fanal/image/registry/azure/azure_test.go
pkg/fanal/image/registry/ecr/ecr.go
pkg/fanal/image/registry/ecr/ecr_test.go
pkg/fanal/image/registry/google/google.go
pkg/fanal/image/registry/google/google_test.go
Commit message: Merge pull request from GHSA-xcq4-m2r3-cmrj

* Update azure.go

* Update ecr.go

* Update google.go

* Update ecr_test.go

* Update azure_test.go

* Update google_test.go

Vulnerable code:
	azureURL = "azurecr.io"
const ecrURL = "amazonaws.com"
	if !strings.HasSuffix(domain, ecrURL) {
const gcrURL = "gcr.io"
const garURL = "docker.pkg.dev"
	if !strings.HasSuffix(domain, gcrURL) && !strings.HasSuffix(domain, garURL) {

Fixed code:
	azureURL = ".azurecr.io"
		{
			name:    "invalidURL",
			domain:  "not-azurecr.io",
			wantErr: "Azure registry: invalid url pattern",
		},
const ecrURLSuffix = ".amazonaws.com"
const ecrURLPartial = ".dkr.ecr"
	if !strings.HasSuffix(domain, ecrURLSuffix) && !strings.Contains(domain, ecrURLPartial)  {
		"InvalidDomain": {
			domain: "xxx.ecr.ap-northeast-1.not-amazonaws.com",
			wantErr: types.InvalidURLPattern,
		},
		"InvalidSubdomain": {
			domain: "xxx.s3.ap-northeast-1.amazonaws.com",
			wantErr: types.InvalidURLPattern,
		},
const gcrURLDomain = "gcr.io"
const gcrURLSuffix = ".gcr.io"
const garURLSuffix = "-docker.pkg.dev"
	if domain != gcrURLDomain && !strings.HasSuffix(domain, gcrURLSuffix) && !strings.HasSuffix(domain, garURLSuffix) {
		"InvalidDomain": {
			domain:  "not-gcr.io",
			wantErr: types.InvalidURLPattern,
		},
CVE-2023-3294 (Other, published 2023-06-16T12:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/saleor/react-storefront
Files changed:
apps/storefront/components/AccountLayout/AccountLayout.tsx
apps/storefront/pages/[channel]/[locale]/account/login.tsx
Commit message: Merge pull request from GHSA-wq85-q492-8vxv

* Fix open redirect

* Code REview

Vulnerable code:
  if (!authenticated && typeof window !== "undefined") {
    void router.push(paths.account.login.$url({ query: { next: router?.pathname } }));
  const isExternalUrl = /^\w+:\/\//.test(routerQueryNext);
  const redirectURL = !routerQueryNext || isExternalUrl ? paths.$url() : routerQueryNext;

Fixed code:
  if (!authenticated) {
    if (router.isReady && typeof window !== "undefined") {
      void router.replace(paths.account.login.$url({ query: { next: router?.asPath } }));
    }
    const redirectURL =
      (routerQueryNext && new URL(routerQueryNext, window.location.toString()).pathname) ||
      paths.$url();
CVE-2024-23687 (Unknown, published 2024-01-19T22:15Z)
Description: value: Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines.


Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/folio-org/mod-data-export-spring
Files changed:
Commit message: Merge pull request from GHSA-vf78-3q9f-92g3

MODEXPS-226 - Invalid system user credentials usage

Vulnerable code:

Fixed code:
CVE-2016-1181 (Markdown, published 2016-07-04T22:59Z)
Description: value: ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kawasima/struts1-forever
Files changed:
README.md
src/share/org/apache/struts/action/ActionServlet.java
Commit message: Fixed CVE-2016-1181 and CVE-2016-1182


Vulnerable code:
STRUTS
======
$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
Introduction (Original)
 * $Id$ 
 * 
 * 
 * 
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.MissingResourceException;
    
    
    
    
            // resources as they may not have been able to have been 
        }    
            
	    
                SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);

Fixed code:
# STRUTS
## Requirements
Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.

## Fixed vulnerabilities

- CVE-2014-0114
- CVE-2016-1181
- CVE-2016-1182

## Introduction (Original)
 * $Id$
 *
 *
 *
import java.util.*;




            // resources as they may not have been able to have been
        }


        HashSet suppressProperties = new HashSet();
        suppressProperties.add("class");
        suppressProperties.add("multipartRequestHandler");
        suppressProperties.add("resultValueMap");

                new SuppressPropertiesBeanIntrospector(suppressProperties));
CVE-2016-1182 (Markdown, published 2016-07-04T22:59Z)
Description: value: ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/kawasima/struts1-forever
Files changed:
README.md
src/share/org/apache/struts/action/ActionServlet.java
Commit message: Fixed CVE-2016-1181 and CVE-2016-1182


Vulnerable code:
STRUTS
======
$Id: README,v 1.18 2003/12/10 01:04:10 husted Exp $
Introduction (Original)
 * $Id$ 
 * 
 * 
 * 
import java.util.ArrayList;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.MissingResourceException;
    
    
    
    
            // resources as they may not have been able to have been 
        }    
            
	    
                SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);

Fixed code:
# STRUTS
## Requirements
Original Struts requires Java 1.4 or higher. But struts1-forever requires Java 1.5 or higher.
Because Commons-Beanutils 1.9.2 is used for preventing a dangerous population.

## Fixed vulnerabilities

- CVE-2014-0114
- CVE-2016-1181
- CVE-2016-1182

## Introduction (Original)
 * $Id$
 *
 *
 *
import java.util.*;




            // resources as they may not have been able to have been
        }


        HashSet suppressProperties = new HashSet();
        suppressProperties.add("class");
        suppressProperties.add("multipartRequestHandler");
        suppressProperties.add("resultValueMap");

                new SuppressPropertiesBeanIntrospector(suppressProperties));
CVE-2019-25016 (C, published 2021-01-28T20:15Z)
Description: value: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-459 \u2014 Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Repository: https://github.com/Duncaen/OpenDoas
Files changed:
doas.c
doas.conf.5
doas.h
env.c
Commit message: redo the environment inheritance to not inherit. it was intended to make life easier, but it can be surprising or even unsafe. instead, reset just about everything to the target user's values. ok deraadt martijn Thanks to Sander Bos in particular for pointing out some nasty edge cases.


Vulnerable code:
	envp = prepenv(rule);
.Ev DISPLAY ,
.Ev HOME ,
.Ev LOGNAME ,
.Ev MAIL ,
.Ev PATH ,
.Ev TERM ,
.Ev USER
.Ev USERNAME .
char **prepenv(const struct rule *);
createenv(const struct rule *rule)
prepenv(const struct rule *rule)
	static const char *safeset[] = {
		"DISPLAY", "HOME", "LOGNAME", "MAIL",
		"PATH", "TERM", "USER", "USERNAME",
		NULL
	};
	env = createenv(rule);

	/* if we started with blank, fill some defaults then apply rules */
	if (!(rule->options & KEEPENV))
		fillenv(env, safeset);

Fixed code:
	    LOGIN_SETPATH |
	envp = prepenv(rule, mypw, targpw);
		/* do this again after setusercontext reset it */
.Ev DISPLAY
.Ev TERM .
struct passwd;

char **prepenv(const struct rule *, const struct passwd *,
    const struct passwd *);
#include <pwd.h>
static void fillenv(struct env *env, const char **envlist);

static void
addnode(struct env *env, const char *key, const char *value)
{
	struct envnode *node;

	node = createnode(key, value);
	RB_INSERT(envtree, &env->root, node);
	env->count++;
}

createenv(const struct rule *rule, const struct passwd *mypw,
    const struct passwd *targpw)
	addnode(env, "DOAS_USER", mypw->pw_name);

	} else {
		static const char *copyset[] = {
			"DISPLAY", "TERM",
			NULL
		};

		addnode(env, "HOME", targpw->pw_dir);
		addnode(env, "LOGNAME", targpw->pw_name);
		addnode(env, "PATH", getenv("PATH"));
		addnode(env, "SHELL", targpw->pw_shell);
		addnode(env, "USER", targpw->pw_name);

		fillenv(env, copyset);
prepenv(const struct rule *rule, const struct passwd *mypw,
    const struct passwd *targpw)
	env = createenv(rule, mypw, targpw);
CVE-2019-25016 (C, published 2021-01-28T20:15Z)
Description: value: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-909 \u2014 Missing Initialization of Resource
The product does not initialize a critical resource.
Repository: https://github.com/Duncaen/OpenDoas
Files changed:
doas.c
doas.conf.5
doas.h
env.c
Commit message: redo the environment inheritance to not inherit. it was intended to make life easier, but it can be surprising or even unsafe. instead, reset just about everything to the target user's values. ok deraadt martijn Thanks to Sander Bos in particular for pointing out some nasty edge cases.


Vulnerable code:
	envp = prepenv(rule);
.Ev DISPLAY ,
.Ev HOME ,
.Ev LOGNAME ,
.Ev MAIL ,
.Ev PATH ,
.Ev TERM ,
.Ev USER
.Ev USERNAME .
char **prepenv(const struct rule *);
createenv(const struct rule *rule)
prepenv(const struct rule *rule)
	static const char *safeset[] = {
		"DISPLAY", "HOME", "LOGNAME", "MAIL",
		"PATH", "TERM", "USER", "USERNAME",
		NULL
	};
	env = createenv(rule);

	/* if we started with blank, fill some defaults then apply rules */
	if (!(rule->options & KEEPENV))
		fillenv(env, safeset);

Fixed code:
	    LOGIN_SETPATH |
	envp = prepenv(rule, mypw, targpw);
		/* do this again after setusercontext reset it */
.Ev DISPLAY
.Ev TERM .
struct passwd;

char **prepenv(const struct rule *, const struct passwd *,
    const struct passwd *);
#include <pwd.h>
static void fillenv(struct env *env, const char **envlist);

static void
addnode(struct env *env, const char *key, const char *value)
{
	struct envnode *node;

	node = createnode(key, value);
	RB_INSERT(envtree, &env->root, node);
	env->count++;
}

createenv(const struct rule *rule, const struct passwd *mypw,
    const struct passwd *targpw)
	addnode(env, "DOAS_USER", mypw->pw_name);

	} else {
		static const char *copyset[] = {
			"DISPLAY", "TERM",
			NULL
		};

		addnode(env, "HOME", targpw->pw_dir);
		addnode(env, "LOGNAME", targpw->pw_name);
		addnode(env, "PATH", getenv("PATH"));
		addnode(env, "SHELL", targpw->pw_shell);
		addnode(env, "USER", targpw->pw_name);

		fillenv(env, copyset);
prepenv(const struct rule *rule, const struct passwd *mypw,
    const struct passwd *targpw)
	env = createenv(rule, mypw, targpw);