hitoshura25/cvefixes huggingface dataset:
CVE-2024-35242 (PHP, published 2024-06-10T22:15Z)
Description: value: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories. Patches are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid cloning potentially compromised repositories.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/composer/composer
Files changed:
src/Composer/Package/Version/VersionGuesser.php
tests/Composer/Test/Package/Version/VersionGuesserTest.php
Commit message: Merge pull request from GHSA-v9qv-c7wm-wgmf



Vulnerable code:
                $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'git rev-list %candidate%..%branch%', $path);
            $result = $this->guessFeatureVersion($packageConfig, $version, $branches, 'hg log -r "not ancestors(\'%candidate%\') and ancestors(\'%branch%\')" --template "{node}\\n"', $path);
     * @param string[]                 $branches
     *
     * @phpstan-param non-empty-string $scmCmdline
    private function guessFeatureVersion(array $packageConfig, ?string $version, array $branches, string $scmCmdline, string $path): array
                    $cmdLine = str_replace(['%candidate%', '%branch%'], [$candidate, $branch], $scmCmdline);
                'cmd' => 'git rev-list arbitrary..feature',
                'cmd' => 'git rev-list latest-testing..feature',
                'cmd' => 'git rev-list remotes/origin/1.5..feature-branch',

Fixed code:
                $result = $this->guessFeatureVersion($packageConfig, $version, $branches, ['git', 'rev-list', '%candidate%..%branch%'], $path);
            $result = $this->guessFeatureVersion($packageConfig, $version, $branches, ['hg', 'log', '-r', 'not ancestors(\'%candidate%\') and ancestors(\'%branch%\')', '--template', '"{node}\\n"'], $path);
     * @param list<string>             $branches
     * @param list<string>             $scmCmdline
    private function guessFeatureVersion(array $packageConfig, ?string $version, array $branches, array $scmCmdline, string $path): array
                    $cmdLine = array_map(static function (string $component) use ($candidate, $branch) {
                        return str_replace(['%candidate%', '%branch%'], [$candidate, $branch], $component);
                    }, $scmCmdline);
                'cmd' => ['git', 'rev-list', 'arbitrary..feature'],
                'cmd' => ['git', 'rev-list', 'latest-testing..feature'],
                'cmd' => ['git', 'rev-list', 'remotes/origin/1.5..feature-branch'],
CVE-2015-1838 (Python, published 2017-04-13T14:59Z)
Description: value: modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-19 \u2014 Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Repository: https://github.com/saltstack/salt
Files changed:
salt/modules/serverdensity_device.py
Commit message: Move install.sh to cachedir for serverdensity_device


Vulnerable code:
    work_dir = '/tmp/'
        cmd='curl https://www.serverdensity.com/downloads/agent-install.sh -o install.sh',
    __salt__['cmd.run'](cmd='chmod +x install.sh', cwd=work_dir)
        cmd='./install.sh -a {account_url} -k {agent_key}'.format(
            account_url=account_url, agent_key=agent_key),

Fixed code:
import os
import tempfile
    work_dir = os.path.join(__opts__['cachedir'], 'tmp')
    if not os.path.isdir(work_dir):
        os.mkdir(work_dir)
    install_file = tempfile.NamedTemporaryFile(dir=work_dir,
                                                   suffix='.sh',
                                                   delete=False)
    install_filename = install_file.name
    install_file.close()
        cmd='curl https://www.serverdensity.com/downloads/agent-install.sh -o {0}'.format(install_filename),
    __salt__['cmd.run'](cmd='chmod +x {0}'.format(install_filename), cwd=work_dir)
        cmd='./{filename} -a {account_url} -k {agent_key}'.format(
            filename=install_filename, account_url=account_url, agent_key=agent_key),
CVE-2015-1839 (Python, published 2017-04-13T14:59Z)
Description: value: modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-19 \u2014 Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Repository: https://github.com/saltstack/salt
Files changed:
salt/modules/chef.py
Commit message: Create randomized logfile name in windows for chef.py


Vulnerable code:

        logfile = salt.utils.path_join(
            os.environ['TMP'],
            '{0}.log'.format(exe_name)
        )

Fixed code:
import tempfile
    '''
    Retrieve the logfile name
    '''
        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
                                                  prefix=exe_name,
                                                  suffix='.log',
                                                  delete=False)
        logfile = logfile_tmp.name
        logfile_tmp.close()
CVE-2015-1839 (Python, published 2017-04-13T14:59Z)
Description: value: modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-19 \u2014 Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Repository: https://github.com/saltstack/salt
Files changed:
salt/modules/chef.py
Commit message: Use cachedir


Vulnerable code:
        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],

Fixed code:
        tmp_dir = os.path.join(__opts__['cachedir'], 'tmp')
        if not os.path.isdir(tmp_dir):
            os.mkdir(tmp_dir)
        logfile_tmp = tempfile.NamedTemporaryFile(dir=tmp_dir,
CVE-2015-6918 (Unknown, published 2017-10-10T16:29Z)
Description: value: salt before 2015.5.5 leaks git usernames and passwords to the log.
Severity: LOW (CVSS v3 base score: 6.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/saltstack/salt
Files changed:
Commit message: Merge pull request #26486 from thusoy/git-confidential-auth

Git: Don't leak https user/pw to log

Vulnerable code:

Fixed code:
CVE-2017-14695 (Python, published 2017-10-24T17:29Z)
Description: value: Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/saltstack/salt
Files changed:
salt/utils/verify.py
tests/unit/utils/test_verify.py
Commit message: Don't allow path separators in minion ID


Vulnerable code:
def clean_id(id_):
    '''
    Returns if the passed id is clean.
    '''
    if re.search(r'\.\.\{sep}'.format(sep=os.sep), id_):
        return False
    return True


        return bool(clean_path(opts['pki_dir'], id_)) and clean_id(id_)
    except (AttributeError, KeyError, TypeError) as e:

Fixed code:
        if any(x in id_ for x in ('/', '\\', '\0')):
            return False
        return bool(clean_path(opts['pki_dir'], id_))
    except (AttributeError, KeyError, TypeError):
    def test_valid_id_pathsep(self):
        '''
        Path separators in id should make it invalid
        '''
        opts = {'pki_dir': '/tmp/whatever'}
        # We have to test both path separators because os.path.normpath will
        # convert forward slashes to backslashes on Windows.
        for pathsep in ('/', '\\'):
            self.assertFalse(valid_id(opts, pathsep.join(('..', 'foobar'))))
CVE-2017-14696 (Python, published 2017-10-24T17:29Z)
Description: value: SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/saltstack/salt
Files changed:
salt/crypt.py
salt/transport/tcp.py
salt/transport/zeromq.py
Commit message: Do not allow IDs with null bytes in decoded payloads


Vulnerable code:

Fixed code:
        if not isinstance(payload, dict):
            log.error('Sign-in attempt failed: %s', payload)
            raise tornado.gen.Return(False)
            try:
                id_ = payload['load'].get('id', '')
                if '\0' in id_:
                    log.error('Payload contains an id with a null byte: %s', payload)
                    stream.send(self.serial.dumps('bad load: id contains a null byte'))
                    raise tornado.gen.Return()
            except TypeError:
                log.error('Payload contains non-string id: %s', payload)
                stream.send(self.serial.dumps('bad load: id {0} is not a string'.format(id_)))
                raise tornado.gen.Return()

        try:
            id_ = payload['load'].get('id', '')
            if '\0' in id_:
                log.error('Payload contains an id with a null byte: %s', payload)
                stream.send(self.serial.dumps('bad load: id contains a null byte'))
                raise tornado.gen.Return()
        except TypeError:
            log.error('Payload contains non-string id: %s', payload)
            stream.send(self.serial.dumps('bad load: id {0} is not a string'.format(id_)))
            raise tornado.gen.Return()
CVE-2018-25100 (Perl, published 2024-03-24T01:15Z)
Description: value: The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. This affects Mojo::UserAgent::CookieJar.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mojolicious/mojo
Files changed:
Changes
lib/Mojo/Cookie/Response.pm
lib/Mojo/UserAgent/CookieJar.pm
Commit message: fix a security issue in Mojo::UserAgent::CookieJar


Vulnerable code:
7.66  2018-02-12
has [qw(domain expires httponly max_age origin path secure)];
=head2 origin

  my $origin = $cookie->origin;
  $cookie    = $cookie->origin('mojolicious.org');

Origin of the cookie.

    my $origin = $cookie->origin // '';
    next unless my $domain = lc($cookie->domain // $origin);
    @$jar = (grep({ _compare($_, $path, $name, $origin) } @$jar), $cookie);
    my $host   = lc $url->ihost;
    my $domain = lc($cookie->domain // $cookie->origin($host)->origin);
      next unless $cookie->domain || $host eq $cookie->origin;
  my ($cookie, $path, $name, $origin) = @_;
  return 1 if $cookie->path ne $path || $cookie->name ne $name;
  return ($cookie->origin // '') ne $origin;

Fixed code:
7.66  2018-02-13
  - This release contains fixes for security issues, everybody should upgrade!
  - Removed origin attribute of Mojo::Cookie::Response.
  - Added host_only attribute to Mojo::Cookie::Response.
has [qw(domain expires host_only httponly max_age path secure)];
=head2 host_only

  my $bool = $cookie->host_only;
  $cookie  = $cookie->host_only($bool);

Host-only flag, indicating that the canonicalized request-host is identical to
the cookie's L</"domain">.

    next unless my $domain = lc($cookie->domain // '');
    @$jar = (grep({ _compare($_, $path, $name, $domain) } @$jar), $cookie);
    my $host = lc $url->ihost;
    $cookie->domain($host)->host_only(1) unless $cookie->domain;
    my $domain = lc $cookie->domain;
      next if $cookie->host_only && $host ne $cookie->domain;
  my ($cookie, $path, $name, $domain) = @_;
  return
       $cookie->path ne $path
    || $cookie->name ne $name
    || $cookie->domain ne $domain;
CVE-2016-7797 (C, published 2017-03-24T15:59Z)
Description: value: Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/ClusterLabs/pacemaker
Files changed:
lrmd/tls_backend.c
Commit message: Fix: remote: cl#5269 - Notify other clients of a new connection only if the handshake has completed (bsc#967388)


Vulnerable code:
    /* Alert other clients of the new connection */
    notify_of_new_client(new_client);

Fixed code:

            /* Alert other clients of the new connection */
            notify_of_new_client(client);
CVE-2023-3227 (PHP, published 2023-06-14T06:15Z)
Description: value: Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-1220 \u2014 Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/modules/Cart/Api/Guest.php
Commit message: Validate add-on configs before adding to cart (#1313)

* Validate addon configs before adding to cart

* Fix spelling mistake

Vulnerable code:

Fixed code:

        if ($product->is_addon) {
            throw new \Box_Exception('Addon products cannot be added separately.');
        }

        $validAddons = json_decode($product->addons ?? '');
        if(empty($validAddons)){
            $validAddons = [];
        }

        foreach ($data['addons'] as $addon => $properties) {
            if($properties['selected'] && !in_array($addon, $validAddons)){
                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
            }
        }
CVE-2023-3228 (PHP, published 2023-06-14T06:15Z)
Description: value: Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
Severity: nan (CVSS v3 base score: 5.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/modules/Cart/Api/Guest.php
Commit message: Validate add-on configs before adding to cart (#1313)

* Validate addon configs before adding to cart

* Fix spelling mistake

Vulnerable code:

Fixed code:

        if ($product->is_addon) {
            throw new \Box_Exception('Addon products cannot be added separately.');
        }

        $validAddons = json_decode($product->addons ?? '');
        if(empty($validAddons)){
            $validAddons = [];
        }

        foreach ($data['addons'] as $addon => $properties) {
            if($properties['selected'] && !in_array($addon, $validAddons)){
                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
            }
        }
CVE-2023-3229 (PHP, published 2023-06-14T06:15Z)
Description: value: Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-840 \u2014 Business Logic Errors
Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/modules/Cart/Service.php
Commit message: Prevent checkouts with disabled products (#1308)



Vulnerable code:
            $item['domain']['owndomain_tld'] = (isset( $item['domain']['owndomain_tld'])) ? (str_contains($item['domain']['owndomain_tld'], '.') ? $item['domain']['owndomain_tld'] : '.' . $item['domain']['owndomain_tld']) : null;

Fixed code:
            $product = $this->di['db']->getExistingModelById('Product', $item['product_id']);
            if (is_null($product) || $product->status !== 'enabled') {
                throw new \Box_Exception("Unable to complete order. One or more of the selected products are invalid.");
            }

            $item['domain']['owndomain_tld'] = (isset($item['domain']['owndomain_tld'])) ? (str_contains($item['domain']['owndomain_tld'], '.') ? $item['domain']['owndomain_tld'] : '.' . $item['domain']['owndomain_tld']) : null;
CVE-2023-3230 (PHP, published 2023-06-14T06:15Z)
Description: value: Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/modules/Servicedownloadable/Api/Admin.php
src/modules/Servicedownloadable/Api/Client.php
tests/modules/Servicedownloadable/Api/ClientTest.php
Commit message: Fix logical error in Servicedownloadable module (#1311)

* Fix logical error in Servicedownloadable module

* Fix the tests now

Vulnerable code:
        if (!$s instanceof \Model_ServiceDownloadable) {
            ->will($this->returnValue(new \Model_ClientOrder()));

Fixed code:

        if (!$s instanceof \Model_ServiceDownloadable || $order->status !== 'active') {
        $mockOrder = new \Model_ClientOrder();
        $mockOrder->loadBean(New \DummyBean());
        $mockOrder->status = "active";

            ->will($this->returnValue($mockOrder));
CVE-2023-3393 (PHP, published 2023-06-23T19:15Z)
Description: value:  Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/library/Box/TwigExtensions.php
Commit message: Prevent twig from calling unsafe functions (#1337)

* Prevent twig from calling unsafe functions

* Just prevent anything that's not a closure

* Formatting

Vulnerable code:
            /**
             * 'trans' filter rewrite same filter from Symfony\Bridge\Twig\Extension\TranslationExtension
             * for compatible with outdated php-gettext library.
             *
             * TODO: Use Symfony\Component\Translation\Loader\MoFileLoader and remove php-gettext hardcoded library.
             */


            'autolink' => new TwigFilter('autolink', [$this, 'twig_autolink_filter']),










Fixed code:
            'autolink' => new TwigFilter('autolink', [$this, 'twig_autolink_filter']),

            // We override these default twig filters so we can explicitly disable it from calling certain functions that may leak data or allow commands to be executed on the system.
            'filter' => new TwigFilter('filter', [$this, 'filteredFilter']),
            'map' => new TwigFilter('map', [$this, 'filteredMap']),
            'reduce' => new TwigFilter('reduce', [$this, 'filteredReduce']),
            'sort' => new TwigFilter('sort', [$this, 'filteredSort']),

    public function filteredFilter($array, $arrow)
    {
        if (!$arrow instanceof Closure) {
            return;
        }

        return array_filter($array, $arrow, \ARRAY_FILTER_USE_BOTH);
    }

    public function filteredMap($array, $arrow)
    {
        if (!$arrow instanceof Closure) {
            return;
        }

        $r = [];
        foreach ($array as $k => $v) {
            $r[$k] = $arrow($v, $k);
        }

        return $r;
    }

    public function filteredReduce($array, $arrow, $initial = null)
    {
        if (!$arrow instanceof Closure) {
            return;
        }

        $accumulator = $initial;
        foreach ($array as $key => $value) {
            $accumulator = $arrow($accumulator, $value, $key);
        }

        return $accumulator;
    }

    public function filteredSort($array, $arrow)
    {
        if (!$arrow instanceof Closure) {
            return;
        }

        if ($array instanceof \Traversable) {
            $array = iterator_to_array($array);
        } elseif (!\is_array($array)) {
            return $array;
        }

        if (null !== $arrow) {
            uasort($array, $arrow);
        } else {
            asort($array);
        }

        return $array;
    }
CVE-2023-3493 (PHP, published 2023-06-30T22:15Z)
Description: value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
Severity: nan (CVSS v3 base score: 8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/di.php
Commit message: Apply the EscapeFormula CSV formatter (#1391)



Vulnerable code:
    $csv = League\Csv\Writer::createFromFileObject(new SplTempFileObject());


Fixed code:
    $csv = League\Csv\Writer::createFromFileObject(new SplTempFileObject);
    $csv->addFormatter(new League\Csv\EscapeFormula);