hitoshura25/cvefixes huggingface dataset:
CVE-2021-21237 (Unknown, published 2021-01-15T18:15Z)
Description: value: Git LFS is a command line extension for managing large files with Git. On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems. This is the result of an incomplete fix for CVE-2020-27955. This issue occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator. Other than avoiding untrusted repositories or using a different operating system, there is no workaround. This is fixed in v2.13.2.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/git-lfs/git-lfs
Files changed:
Commit message: Merge pull request from GHSA-cx3w-xqmc-84g5

release: v2.13.2

Vulnerable code:

Fixed code:
CVE-2018-17568 (Unknown, published 2018-09-26T22:29Z)
Description: value: utils/ut_rpc.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/viabtc/viabtc_exchange_server
Files changed:
Commit message: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows

Vulnerable code:

Fixed code:
CVE-2018-17569 (Unknown, published 2018-09-26T22:29Z)
Description: value: network/nw_buf.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/viabtc/viabtc_exchange_server
Files changed:
Commit message: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows

Vulnerable code:

Fixed code:
CVE-2018-17570 (Unknown, published 2018-09-26T22:29Z)
Description: value: utils/ut_ws_svr.c in ViaBTC Exchange Server before 2018-08-21 has an integer overflow leading to memory corruption.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/viabtc/viabtc_exchange_server
Files changed:
Commit message: Merge pull request #131 from benjaminchodroff/master

fix memory corruption and other 32bit overflows

Vulnerable code:

Fixed code:
CVE-2015-10093 (PHP, published 2023-03-06T07:15Z)
Description: value: A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/korobochkin/mark-user-as-spammer
Files changed:
plugin/plugin.php
Commit message: Prevent XSS with esc_url() in old WordPress versions and prepare for using URL as href attr. 4.2 pass URL to urlencode() and strip all "bad" symbols from URL.


Vulnerable code:
			. site_url( $url )

Fixed code:
		$url = site_url( $url );

		/*
		 * Always use esc_url() before output link!
		 * wp_nonce_url() already pass url to esc_html and script tags will be encoded but we need armor to protect URL from XSS
		 */
		$url = esc_url( $url );

			. $url
CVE-2024-35231 (Ruby, published 2024-05-27T17:15Z)
Description: value: rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data `profiler_runs` was not constrained to any limitation. This would lead to allocating resources on the server side with no limitation and a potential denial of service by remotely user-controlled data. Version 2.5.0 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rack/rack-contrib
Files changed:
lib/rack/contrib/profiler.rb
test/spec_rack_profiler.rb
Commit message: Specify a maximum number of runs to limit the request params -> DoS. (#191)



Vulnerable code:
        runs = (request.params['profiler_runs'] || @times).to_i
          runs.times { @app.call(env) }

Fixed code:
      @maximum_runs = options.fetch(:maximum_runs, 10)
    attr :maximum_runs

      # How many times to run the request within the profiler.
      # If the profiler_runs query parameter is set, use that.
      # Otherwise, use the :times option passed to `#initialize`.
      # If the profiler_runs query parameter is greater than the
      # :maximum option passed to `#initialize`, use the :maximum
      # option.
      def runs(request)
        if profiler_runs = request.params['profiler_runs']
          profiler_runs = profiler_runs.to_i
          if profiler_runs > @maximum_runs
            return @maximum_runs
          else
            return profiler_runs
          end
        else
          return @times
        end
      end

          runs(request).times { @app.call(env) }
    specify 'called more than the default maximum times via query params' do
      runs = 20
      req = Rack::MockRequest.env_for("/", :params => "profile=process_time&profiler_runs=#{runs}")
      body = profiler(app).call(req)[2]
      _(body.to_enum.to_a.join).must_match(/\[10 calls, 10 total\]/)
    end
CVE-2021-3706 (PHP, published 2021-09-15T07:15Z)
Description: value: adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/pi-hole/adminlte
Files changed:
scripts/pi-hole/php/password.php
Commit message: set httponly to true when calling setcookie. the ini_set option above doesn't actually seem to do anything... (but not removing it just in case

Signed-off-by: Adam Warner <me@adamwarner.co.uk>


Vulnerable code:
                setcookie('persistentlogin', $pwhash, time()+60*60*24*7);
                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7);

Fixed code:
                // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
                setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
                        // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly )
                        setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true );
CVE-2021-3811 (Unknown, published 2021-09-17T07:15Z)
Description: value: adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pi-hole/adminlte
Files changed:
Commit message: Merge pull request #1876 from pi-hole/tweak/xssprevention

Apply htmlentities in a couple of places to prevent xss

Vulnerable code:

Fixed code:
CVE-2021-3812 (Unknown, published 2021-09-17T07:15Z)
Description: value: adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pi-hole/adminlte
Files changed:
Commit message: Merge pull request #1876 from pi-hole/tweak/xssprevention

Apply htmlentities in a couple of places to prevent xss

Vulnerable code:

Fixed code:
CVE-2020-15102 (Unknown, published 2020-07-21T18:15Z)
Description: value: In PrestaShop Dashboard Productions before version 2.1.0, there is improper authorization which enables an attacker to change the configuration. The problem is fixed in 2.1.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/PrestaShop/dashproducts
Files changed:
Commit message: Merge pull request from GHSA-6292-4qpg-hvfg

Make sure the user is able to change the configuration in the dashboard only if he has the right to do it

Vulnerable code:

Fixed code:
CVE-2024-21665 (PHP, published 2024-01-11T01:15Z)
Description: value: ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pimcore/ecommerce-framework-bundle
Files changed:
src/Controller/AdminOrderController.php
src/Controller/ConfigController.php
src/Controller/FindologicController.php
src/Controller/IndexController.php
src/Controller/PricingController.php
src/Controller/VoucherController.php
Commit message: [Task]: Improve permission check (#149)

* add permission check

* add permission check

* add permission check

* replace with UserAwareController

* remov eextra break line

Vulnerable code:
class ConfigController extends UserAwareController
use Pimcore\Controller\FrontendController;
class FindologicController extends FrontendController
class IndexController extends UserAwareController
        $access = $this->getPimcoreUser()->isAllowed('bundle_ecommerce_pricing_rules');
        if (!$access) {
            throw new \Exception('this function requires "bundle_ecommerce_pricing_rules" permission!');
        }
use Pimcore\Controller\FrontendController;
class VoucherController extends FrontendController implements KernelControllerEventInterface

Fixed code:
        $this->checkPermission('bundle_ecommerce_back-office_order');

use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class ConfigController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('bundle_ecommerce_back-office_order');
    }

use Pimcore\Controller\KernelControllerEventInterface;
use Pimcore\Controller\UserAwareController;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class FindologicController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('bundle_ecommerce_back-office_order');
    }

use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class IndexController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('bundle_ecommerce_back-office_order');
    }

        $this->checkPermission('bundle_ecommerce_pricing_rules');
use Pimcore\Controller\UserAwareController;
class VoucherController extends UserAwareController implements KernelControllerEventInterface
        $this->checkPermission('bundle_ecommerce_pricing_rules');
CVE-2024-28056 (JSON, published 2024-04-15T18:15Z)
Description: value: Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aws-amplify/amplify-cli
Files changed:
packages/amplify-provider-awscloudformation/resources/update-idp-roles-cfn.json
Commit message: fix: set policy effect deny when removing auth (#13523)



Vulnerable code:

Fixed code:
              "                authParamsJson.Statement[0].Effect = 'Deny'",
              "                unauthParamsJson.Statement[0].Effect = 'Deny'",
CVE-2020-11932 (Python, published 2020-05-13T01:15Z)
Description: value: It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
Severity: LOW (CVSS v3 base score: 2.3)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/CanonicalLtd/subiquity
Files changed:
subiquity/models/filesystem.py
Commit message: write the dm_crypt key to a keyfile, not curtin config


Vulnerable code:

Fixed code:
import tempfile
    def serialize_key(self):
        if self.key:
            f = tempfile.NamedTemporaryFile(
                prefix='luks-key-', mode='w', delete=False)
            f.write(self.key)
            f.close()
            return {'keyfile': f.name}
        else:
            return {}
CVE-2018-20332 (Python, published 2018-12-21T09:29Z)
Description: value: An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathname. This is related to plugin/controllers/file.py in the e2openplugin-OpenWebif project.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/E2OpenPlugins/e2openplugin-OpenWebif
Files changed:
plugin/controllers/file.py
plugin/controllers/rest_fs_access.py
Commit message: move utilities library and actually use it


Vulnerable code:
			filename = request.args["file"][0].decode('utf-8', 'ignore').encode('utf-8')
			filename = re.sub("^/+", "/", os.path.realpath(filename))
MANY_SLASHES_PATTERN = r'[\/]+'
MANY_SLASHES_REGEX = re.compile(MANY_SLASHES_PATTERN)


Fixed code:
from utilities import lenient_force_utf_8, sanitise_filename_slashes

			filename = lenient_force_utf_8(request.args["file"][0])
			filename = sanitise_filename_slashes(os.path.realpath(filename))
from utilities import MANY_SLASHES_REGEX
CVE-2024-35176 (Ruby, published 2024-05-16T16:15Z)
Description: value:  REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ruby/rexml
Files changed:
Gemfile
lib/rexml/parsers/baseparser.rb
lib/rexml/source.rb
test/test_document.rb
Commit message: Read quoted attributes in chunks (#126)



Vulnerable code:
            unless match = @source.match(/(['"])(.*?)\1\s*/um, true)
              if match = @source.match(/(['"])/, true)
                message =
                  "Missing attribute value end quote: <#{name}>: <#{match[1]}>"
                raise REXML::ParseException.new(message, @source)
              else
                message = "Missing attribute value start quote: <#{name}>"
                raise REXML::ParseException.new(message, @source)
              end
            value = match[2]
    def read
    def read
        @scanner << readline
    def readline
      str = @source.readline(@line_break)

Fixed code:
  gem "test-unit-ruby-core"
            unless match = @source.match(/(['"])/, true)
              message = "Missing attribute value start quote: <#{name}>"
              raise REXML::ParseException.new(message, @source)
            end
            quote = match[1]
            value = @source.read_until(quote)
            unless value.chomp!(quote)
              message = "Missing attribute value end quote: <#{name}>: <#{quote}>"
              raise REXML::ParseException.new(message, @source)
            @source.match(/\s*/um, true)
    def read(term = nil)
    end

    def read_until(term)
      @scanner.scan_until(Regexp.union(term)) or @scanner.rest
    def read(term = nil)
        @scanner << readline(term)
    def read_until(term)
      pattern = Regexp.union(term)
      data = []
      begin
        until str = @scanner.scan_until(pattern)
          @scanner << readline(term)
        end
      rescue EOFError
        @scanner.rest
      else
        read if @scanner.eos? and !@source.eof?
        str
      end
    end

    def readline(term = nil)
      str = @source.readline(term || @line_break)
require 'core_assertions'

    include Test::Unit::CoreAssertions

    def test_gt_linear_performance
      seq = [10000, 50000, 100000, 150000, 200000]
      assert_linear_performance(seq) do |n|
        REXML::Document.new('<test testing="' + ">" * n + '"></test>')
      end
    end
CVE-2024-23822 (Perl, published 2024-01-29T16:15Z)
Description: value: Thruk is a multibackend monitoring webinterface.  Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as Path Traversal or Directory Traversal. Version 3.12 fixes the issue.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/sni/Thruk
Files changed:
plugins/plugins-available/panorama/lib/Thruk/Controller/panorama.pm
Commit message: panorama: validate input folder for image uploads


Vulnerable code:
    my $folder = $c->stash->{'usercontent_folder'}.'/'.$location;

Fixed code:
use Cwd ();
    my $folder = Cwd::abs_path($c->stash->{'usercontent_folder'}.'/'.$location);

    # make sure requested folder is below the usercontent folder
    if(CORE::index(Cwd::abs_path($c->stash->{'usercontent_folder'}), $folder) != 0) {
        # must be text/html result, otherwise extjs form result handler dies
        $c->stash->{text} = Thruk::Utils::Filter::json_encode({ 'msg' => 'Fileupload contains illegal folder.', success => Cpanel::JSON::XS::false });
        return;
    }