hitoshura25/cvefixes huggingface dataset:
CVE-2020-26254 (Ruby, published 2020-12-08T15:15Z)
Description: value: omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth's Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker's choice including email addresses of other users. Applications not using info.email for identification but are instead using the uid field are not impacted in the same manner. Note, these applications may still be negatively affected if the value of info.email is being used for other purposes. Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.
Severity: MEDIUM (CVSS v3 base score: 7.7)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/nhosoya/omniauth-apple
Files changed:
lib/omniauth/strategies/apple.rb
spec/omniauth/strategies/apple_spec.rb
Commit message: Use only verified email address to prevent fake email address

Co-authored-by: David Taylor <david@taylorhq.com>


Vulnerable code:
        user_info['email'] || id_info['email']

Fixed code:
        id_info['email']
    context 'with a spoofed email in the user payload' do
      before do
        request.params['user'] = {
          name: {
            firstName: 'first',
            lastName: 'last'
          },
          email: "spoofed@example.com"
        }.to_json
      end

      it 'should return the true email' do
        expect(subject.info[:email]).to eq('something@privatrerelay.appleid.com')
      end
    end
CVE-2017-9841 (PHP, published 2017-06-27T17:29Z)
Description: value: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/sebastianbergmann/phpunit
Files changed:
src/Util/PHP/Template/TestCaseMethod.tpl.dist
src/Util/PHP/eval-stdin.php
Commit message: Correct fix for #1956


Vulnerable code:
    rewind(STDOUT);
eval('?>' . file_get_contents('php://input'));

Fixed code:
    @rewind(STDOUT); /* @ as not every STDOUT target stream is rewindable */
eval('?>' . file_get_contents('php://stdin'));
CVE-2021-32691 (JavaScript, published 2021-06-16T22:15Z)
Description: value: Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ApollosProject/apollos-apps
Files changed:
packages/apollos-data-connector-rock/src/auth/__tests__/index.tests.js
packages/apollos-data-connector-rock/src/people/__tests__/__snapshots__/data-source.tests.js.snap
packages/apollos-data-connector-rock/src/people/data-source.js
Commit message: fix: turns off automerging new people (#1989)

* fix: turns off automerging new people

* fix

* tests and snaps

Vulnerable code:
      expect(result).toEqual('35');
      "BirthDay": 1,
      "BirthMonth": 2,
      "BirthYear": 2020,
      "FirstName": "Vincent",
      "Gender": 1,
exports[`Person creates a profile 2`] = `Object {}`;

  create = (profile) => {
    return this.post('/People', {
      ...rockUpdateFields,

Fixed code:
      context.dataSources.Person.create = jest.fn(() => 35);
      expect(result).toEqual(35);
      context.dataSources.Person.create = jest.fn(() => 1);
      "Gender": 0,
  create = async (profile) => {
    // auto-merge functionality is compromised
    // we are creating a new user and patching them with profile details
    const id = await this.post('/People', {
    await this.patch(`/People/${id}`, {
      ...rockUpdateFields,
    });
    return id;
CVE-2019-9002 (PHP, published 2019-02-22T07:29Z)
Description: value: An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the database_host parameter if the installer remains present in its original directory after installation is completed.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/pixeline/bugs
Files changed:
install/config-setup.php
install/index.php
Commit message: config-setup deleted after install ... safety concern


Vulnerable code:
	$install = new install();
					<input type="text" name="email_port" value="" placeholder="default: 25; gmail: 587" />
<?php
$timezones = timezone_identifiers_list();

echo 'select name="timezone" size="10">' . "\n";

foreach($timezones as $timezone)
{
  echo '<option';
  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
  echo '>' . $timezone . '</option>' . "\n";
}

echo '</select>' . "\n";
?>
						</select>
require './config-setup.php';
				//header('location: complete.php?Lng=fr');

Fixed code:
	$install = new install();
					<select name="email_port">
					<option value="25"> 25 (default)</option>
					<option value="587">587 (gmail)</option>
					<option value="465">465 (SSL / TLS)</option>
					<?php
						for ($x=1; $x<999; $x++) {
							echo '<option value="'.$x.'">'.$x.'</option>';
						}
					?>
					</select>
						<?php
						$timezones = timezone_identifiers_list();
						
						echo 'select name="timezone" size="10">' . "\n";
						
						foreach($timezones as $timezone)
						{
						  echo '<option';
//						  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
						  echo $timezone == date("e") ? ' selected' : '';
						  echo '>' . $timezone . '</option>' . "\n";
						}
						
						echo '</select>' . "\n";
						?>
					</select>
if (!file_exists('./config-setup.php')) {
	echo '<script>';
	echo 'alert("Install already has been proceessed");';
	echo 'document.location.href="../index.php";';
	echo '</script>';
	die();
} else {
	require './config-setup.php';
}
				//header('location: complete.php?Lng=fr');
				unlink ("./config-setup.php");
CVE-2023-46236 (PHP, published 2023-10-31T15:15Z)
Description: value: FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, a server-side-request-forgery (SSRF) vulnerability allowed an unauthenticated user to trigger a GET request as the server to an arbitrary endpoint and URL scheme. This also allows remote access to files visible to the Apache user group. Other impacts vary based on server configuration. Version 1.5.10 contains a patch.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/FOGProject/fogproject
Files changed:
packages/web/service/getversion.php
packages/web/status/kernelvers.php
Commit message: [getversion/kernelvers] Prevent unauthenticated clients from making arbitrary requests, thanks @0x41c



Vulnerable code:
$clientUpdate = (bool)FOGCore::getSetting('FOG_CLIENT_AUTOUPDATE');
        $clientUpdate ?
        $clientUpdate ?
exit;
$url = filter_input(INPUT_POST, 'url');
if ($url) {
        ->process($url);
    foreach ((array)$res as &$response) {
    $kernelvers('bzImage')
    $kernelvers('bzImage32')
);

Fixed code:
$clientUpdate = (bool) FOGCore::getSetting('FOG_CLIENT_AUTOUPDATE');
        $clientUpdate ? 
        $clientUpdate ? 

    // Prevent an unauthenticated user from making arbitrary requests.
    $unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
        || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';

    if ($unauthorized) {
        echo _('Unauthorized');
        exit;
    }

exit;

if (isset($_POST['url'])) {

    // Prevent an unauthenticated user from making arbitrary requests.
    $unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
        || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';

    if ($unauthorized) {
        echo _('Unauthorized');
        exit;
    }

        ->process(filter_input(INPUT_POST, 'url'));
    foreach ((array) $res as &$response) {
    

        $kernelvers('bzImage')
        $kernelvers('bzImage32')
);
CVE-2023-46237 (PHP, published 2023-10-31T15:15Z)
Description: value: FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/FOGProject/fogproject
Files changed:
packages/web/status/getfiles.php
Commit message: Add authentication check in getfiles to prevent file enumeration, thanks to @0x41c



Vulnerable code:

Fixed code:

// Prevent file enumeration by an unauthenticated user
$unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
    || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';

if ($unauthorized) {
    echo _('Unauthorized');
    exit;
}
CVE-2024-2029 (Go, published 2024-04-10T17:15Z)
Description: value: A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could lead to unauthorized access, data breaches, or other detrimental impacts, depending on the privileges of the process executing the code.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/mudler/localai
Files changed:
backend/go/transcribe/transcript.go
Commit message: Fix Command Injection Vulnerability (#1778)

* Added fix for command injection

* changed function name from sh to runCommand

Vulnerable code:
func sh(c string) (string, error) {
	cmd := exec.Command("/bin/sh", "-c", c)
	o, err := cmd.CombinedOutput()
	return string(o), err
// AudioToWav converts audio to wav for transcribe. It bashes out to ffmpeg
	out, err := sh(fmt.Sprintf("ffmpeg -i %s -format s16le -ar 16000 -ac 1 -acodec pcm_s16le %s", src, dst))


Fixed code:
func runCommand(command []string) (string, error) {
	cmd := exec.Command(command[0], command[1:]...)
	out, err := cmd.CombinedOutput()
	return string(out), err
// AudioToWav converts audio to wav for transcribe.
    command := []string{"ffmpeg", "-i", src, "-format", "s16le", "-ar", "16000", "-ac", "1", "-acodec", "pcm_s16le", dst}
	out, err := runCommand(command)
CVE-2024-5616 (Go, published 2024-07-06T09:15Z)
Description: value: A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mudler/localai
Files changed:
core/cli/run.go
core/config/application_config.go
core/http/app.go
go.mod
go.sum
Commit message: feat: fiber CSRF (#2482)

new config option - enables or disables the fiber csrf middleware

Signed-off-by: Dave Lee <dave@gray101.com>

Vulnerable code:

Fixed code:
	CSRF                 bool     `env:"LOCALAI_CSRF" help:"Enables fiber CSRF middleware" group:"api"`
		config.WithCsrf(r.CSRF),
	CSRF                                bool
func WithCsrf(b bool) AppOption {
	return func(o *ApplicationConfig) {
		o.CSRF = b
	}
}

	"github.com/gofiber/fiber/v2/middleware/csrf"
	if appConfig.CSRF {
		log.Debug().Msg("Enabling CSRF middleware. Tokens are now required for state-modifying requests")
		app.Use(csrf.New())
	}

	github.com/philhofer/fwd v1.1.2 // indirect
	github.com/tinylib/msgp v1.1.8 // indirect
github.com/philhofer/fwd v1.1.2 h1:bnDivRJ1EWPjUIRXV5KfORO897HTbpFAQddBdE8t7Gw=
github.com/philhofer/fwd v1.1.2/go.mod h1:qkPdfjR2SIEbspLqpe1tO4n5yICnr2DY7mqEx2tUTP0=
github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
CVE-2021-28280 (PHP, published 2021-04-29T15:15Z)
Description: value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/PHPFusion/PHPFusion
Files changed:
includes/classes/PHPFusion/Search/Search_Engine.php
Commit message: Prevent unwanted vars redirection.
Just to mitigate flooding of error logs, redirect if someone do malicious attempts on the search script.


Vulnerable code:
        $info = [
            'stype'        => htmlentities(self::$search_type),
            'stext'        => htmlentities(self::$search_text),
            'method'       => htmlentities(self::$search_method),
            'datelimit'    => self::$search_date_limit,
            'fields'       => self::$search_fields,
            'sort'         => self::$search_sort,
            'chars'        => htmlentities(self::$search_chars),
            'order'        => self::$search_order,
            'forum_id'     => self::$forum_id,
            'memory_limit' => self::$memory_limit,
            'composevars'  => self::$composevars,
            'rowstart'     => self::$rowstart,
            'search_param' => self::$search_param,
        ];

Fixed code:
        try {
            $info = [
                'stype'        => stripinput(self::$search_type),
                'stext'        => stripinput(self::$search_text),
                'method'       => stripinput(self::$search_method),
                'datelimit'    => self::$search_date_limit,
                'fields'       => self::$search_fields,
                'sort'         => self::$search_sort,
                'chars'        => stripinput(self::$search_chars),
                'order'        => self::$search_order,
                'forum_id'     => self::$forum_id,
                'memory_limit' => self::$memory_limit,
                'composevars'  => self::$composevars,
                'rowstart'     => self::$rowstart,
                'search_param' => self::$search_param,
            ];
        } catch (\Exception $e) {
            redirect(BASEDIR.fusion_get_settings('opening_page'));
        }
CVE-2021-28280 (PHP, published 2021-04-29T15:15Z)
Description: value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PHPFusion/PHPFusion
Files changed:
includes/classes/PHPFusion/Search/Search_Engine.php
Commit message: Prevent unwanted vars redirection.
Just to mitigate flooding of error logs, redirect if someone do malicious attempts on the search script.


Vulnerable code:
        $info = [
            'stype'        => htmlentities(self::$search_type),
            'stext'        => htmlentities(self::$search_text),
            'method'       => htmlentities(self::$search_method),
            'datelimit'    => self::$search_date_limit,
            'fields'       => self::$search_fields,
            'sort'         => self::$search_sort,
            'chars'        => htmlentities(self::$search_chars),
            'order'        => self::$search_order,
            'forum_id'     => self::$forum_id,
            'memory_limit' => self::$memory_limit,
            'composevars'  => self::$composevars,
            'rowstart'     => self::$rowstart,
            'search_param' => self::$search_param,
        ];

Fixed code:
        try {
            $info = [
                'stype'        => stripinput(self::$search_type),
                'stext'        => stripinput(self::$search_text),
                'method'       => stripinput(self::$search_method),
                'datelimit'    => self::$search_date_limit,
                'fields'       => self::$search_fields,
                'sort'         => self::$search_sort,
                'chars'        => stripinput(self::$search_chars),
                'order'        => self::$search_order,
                'forum_id'     => self::$forum_id,
                'memory_limit' => self::$memory_limit,
                'composevars'  => self::$composevars,
                'rowstart'     => self::$rowstart,
                'search_param' => self::$search_param,
            ];
        } catch (\Exception $e) {
            redirect(BASEDIR.fusion_get_settings('opening_page'));
        }
CVE-2021-28280 (PHP, published 2021-04-29T15:15Z)
Description: value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/PHPFusion/PHPFusion
Files changed:
includes/classes/PHPFusion/Search/Search_Engine.php
Commit message: Fixes broken rendering trying to parse against <script> input values.


Vulnerable code:
            'search_param' => htmlentities(self::$search_param),

Fixed code:
            'search_param' => self::$search_param,
CVE-2021-28280 (PHP, published 2021-04-29T15:15Z)
Description: value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PHPFusion/PHPFusion
Files changed:
includes/classes/PHPFusion/Search/Search_Engine.php
Commit message: Fixes broken rendering trying to parse against <script> input values.


Vulnerable code:
            'search_param' => htmlentities(self::$search_param),

Fixed code:
            'search_param' => self::$search_param,
CVE-2021-3172 (PHP, published 2023-02-17T18:15Z)
Description: value: An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/PHPFusion/PHPFusion
Files changed:
includes/core_functions_include.php
infusions/member_poll_panel/poll_classes.php
Commit message: #2351 - User IP fixes, and Poll Voting form token to 1 count per screen refresh.


Vulnerable code:
        $userdata = ["user_level" => 0, "user_rights" => "", "user_groups" => "", "user_theme" => 'Default'];
                $render['poll_table'][0]['openform'] = openform('voteform', 'post', clean_request(), ['enctype' => TRUE]).form_hidden('poll_id', '', $data['poll_id']);

Fixed code:
        $userdata = ["user_level" => 0, "user_rights" => "", "user_groups" => "", "user_theme" => 'Default', "user_ip"=>USER_IP];
                $render['poll_table'][0]['openform'] = openform('voteform', 'post', clean_request(), ['max_tokens'=>1]).form_hidden('poll_id', '', $data['poll_id']);