hitoshura25/cvefixes huggingface dataset:
CVE-2022-24953 (PHP, published 2022-02-17T05:15Z)
Description: value: The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/pear/Crypt_GPG
Files changed:
Crypt/GPG.php
Crypt/GPGAbstract.php
Commit message: Insert the end-of-options marker before operation arguments.

This marker stops the parsing of additional options during external
calls to GPG. This behavior is unintended but its security impact is
dependent on the environment and the GPG version in use.


Vulnerable code:
        $operation = '--delete-key ' . escapeshellarg($fingerprint);
        $operation = '--delete-secret-key ' . escapeshellarg($fingerprint);
        $operation = '--list-keys ' . escapeshellarg($keyId);
        $operation .= ' ' . escapeshellarg($fingerprint);
            $operation = '--utf8-strings --list-secret-keys ' . escapeshellarg($keyId);
            $operation = '--utf8-strings --list-public-keys ' . escapeshellarg($keyId);

Fixed code:
        $operation = '--delete-key -- ' . escapeshellarg($fingerprint);
        $operation = '--delete-secret-key -- ' . escapeshellarg($fingerprint);
        $operation = '--list-keys -- ' . escapeshellarg($keyId);
        $operation .= ' -- ' . escapeshellarg($fingerprint);
            $operation = '--utf8-strings --list-secret-keys -- ' . escapeshellarg($keyId);
            $operation = '--utf8-strings --list-public-keys -- ' . escapeshellarg($keyId);
CVE-2018-13982 (PHP, published 2018-09-18T21:29Z)
Description: value: Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/smarty-php/smarty
Files changed:
libs/sysplugins/smarty_security.php
Commit message: - bugfix  regarding Security Vulnerability did not solve the problem under Linux


Vulnerable code:
        while (true) {
                throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));

Fixed code:
        if (!preg_match('#[\\\\/][.][.][\\\\/]#',$directory)) {
            while (true) {
                break;
            }
        // give up
        throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
CVE-2018-13982 (PHP, published 2018-09-18T21:29Z)
Description: value: Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/smarty-php/smarty
Files changed:
change_log.txt
libs/Smarty.class.php
Commit message: Release version 3.1.32


Vulnerable code:
﻿===== 3.1.32 - dev ===
 * @copyright 2017 New Digital Group, Inc.
 * @copyright 2017 Uwe Tews
 * @author    Uwe Tews
 * @version   3.1.32-dev
    const SMARTY_VERSION = '3.1.32-dev-46';

Fixed code:
﻿===== 3.1.32 ===== (24.04.2018)
 * @copyright 2018 New Digital Group, Inc.
 * @copyright 2018 Uwe Tews
 * @author    Uwe Tews   <uwe dot tews at gmail dot com>
 * @version   3.1.32
    const SMARTY_VERSION = '3.1.32';
CVE-2021-21408 (PHP, published 2022-01-10T20:15Z)
Description: value: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/smarty-php/smarty
Files changed:
CHANGELOG.md
lexer/smarty_internal_templateparser.y
libs/sysplugins/smarty_internal_templateparser.php
tests/UnitTests/SecurityTests/SecurityTest.php
Commit message: Merge pull request from GHSA-4h9c-v5vg-5m6m

* Prevent evasion of the static_classes security policy.

* Updated deprecated exception expectations.

Vulnerable code:
/**
 * test not trusted PHP function
  * @runInSeparateProcess
  * @preserveGlobalState disabled
  */
    public function testNotTrustedStaticClass()
    {

Fixed code:
### Security
- Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408

    if ($this->security && $this->security->static_classes !== array()) {
        $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
    }
	    if ($this->security && $this->security->static_classes !== array()) {
		    $this->compiler->trigger_template_error('dynamic static class not allowed by security setting');
	    }
	/**
	 * test not trusted PHP function
	 * @runInSeparateProcess
	 * @preserveGlobalState disabled
	 */
	public function testNotTrustedStaticClass()
	{
	/**
	 * test not trusted PHP function
	 */
	public function testNotTrustedStaticClassEval()
	{
		$this->expectException('SmartyException');
		$this->expectExceptionMessage('dynamic static class not allowed by security setting');
		$this->smarty->security_policy->static_classes = array('null');
		$this->smarty->fetch('string:{$test = "mysecuritystaticclass"}{$test::square(5)}');
	}

	/**
	 * test not trusted PHP function
	 */
	public function testNotTrustedStaticClassSmartyVar()
	{
		$this->expectException('SmartyException');
		$this->expectExceptionMessage('dynamic static class not allowed by security setting');
		$this->smarty->security_policy->static_classes = array('null');
		$this->smarty->fetch('string:{$smarty.template_object::square(5)}');
	}
CVE-2022-29221 (Unknown, published 2022-05-24T15:15Z)
Description: value: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/smarty-php/smarty
Files changed:
Commit message: Merge branch 'security/blockfunctioninjection'


Vulnerable code:

Fixed code:
CVE-2023-28447 (Unknown, published 2023-03-28T21:15Z)
Description: value: Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/smarty-php/smarty
Files changed:
Commit message: Merge branch 'js_escape_security_fix'


Vulnerable code:

Fixed code:
CVE-2022-35921 (JavaScript, published 2022-08-01T22:15Z)
Description: value: fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/FriendsOfFlarum/byobu
Files changed:
js/src/forum/extend/User.js
js/src/forum/helpers/canStartPrivateDiscussion.js
js/src/forum/pages/PrivateDiscussionsUserPage.js
src/Discussion/Screener.php
Commit message: fix: prevent starting a PD with users blocking them (#175)



Vulnerable code:
    if (
      app.session.user &&
      app.session.user.id() !== user.id() &&
      app.forum.attribute('canStartPrivateDiscussion') &&
      (user.blocksPd() === false || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && user.cannotBeDirectMessaged()))
    ) {
    if (app.session.user && app.forum.attribute('canStartPrivateDiscussion')) {
                return $user->getPreference('blocksPd', false);

Fixed code:
import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
    if (canStartPrivateDiscussion(user)) {
import app from 'flarum/forum/app';

export default function canStartPrivateDiscussion(recipient) {
  return (
    app.session.user &&
    app.session.user.id() !== recipient.id() &&
    app.forum.attribute('canStartPrivateDiscussion') &&
    (!recipient.blocksPd() || (app.forum.attribute('canStartPrivateDiscussionWithBlockers') && recipient.cannotBeDirectMessaged()))
  );
}
import canStartPrivateDiscussion from '../helpers/canStartPrivateDiscussion';
    if (canStartPrivateDiscussion(this.user)) {
                return boolval($user->blocks_byobu_pd);
CVE-2022-4942 (JavaScript, published 2023-04-20T06:15Z)
Description: value: A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The patch is identified as 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mportuga/eslint-detailed-reporter
Files changed:
lib/template-generator.js
Commit message: fix(template-generator): fix xss problem in issue message

- use `_.escape` for html escape instead of `formatSourceCode`
- escape issue message when rendering issues\
   e.g. rule 'vue/no-lone-template' produces
   message '`<template>` require directive.'


Vulnerable code:
		message: message.message,
/**
 * Formats the source code before adding it to the HTML
 * @param {string} sourceCode Source code string
 * @returns {string} Source code string which will not cause issues in the HTML
 */
function formatSourceCode(sourceCode) {
	return sourceCode.replace(/</g, '&#60;').replace(/>/g, '&#62;');
}

			const sourceCode = formatSourceCode(result.source || fs.readFileSync(result.filePath, 'utf8'));
};

Fixed code:
		message: _.escape(message.message),
			const sourceCode = _.escape(result.source || fs.readFileSync(result.filePath, 'utf8'));
};
CVE-2024-39687 (Unknown, published 2024-07-05T18:15Z)
Description: value: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dahlia/fedify
Files changed:
Commit message: Merge pull request from GHSA-p9cg-vqcc-grcx

Address a SSRF vulnerability in the built-in document loader

Vulnerable code:

Fixed code:
CVE-2020-23014 (Python, published 2021-01-26T18:15Z)
Description: value: APfell 1.4 is vulnerable to authenticated reflected cross-site scripting (XSS) in /apiui/command_ through the payloadtypes_callback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/its-a-feature/Apfell
Files changed:
apfell-docker/app/routes/api_routes.py
Commit message: fixed an 'Authenticated Cross-Site Scripting' bug on the command help page reported by 'Mohamed A. Baset' of 'Seekurity SA de C.V.' at 'Seekurity.com' on April 17,2020


Vulnerable code:
from app import apfell, links, use_ssl
        print(data)

Fixed code:
from app import apfell, links, use_ssl, db_objects
import app.database_models.model as db_model
        query = await db_model.payloadtype_query()
        try:
            payloadtype = await db_objects.get(query, ptype=data)
        except Exception as e:
            data = ""
CVE-2019-15522 (C, published 2020-03-20T21:15Z)
Description: value: An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/LINBIT/csync2
Files changed:
daemon.c
Commit message: fail HELLO command when SSL is required


Vulnerable code:

Fixed code:
				peer = NULL;
CVE-2022-21687 (Go, published 2022-02-01T12:15Z)
Description: value: gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/github/gh-ost
Files changed:
build.sh
go/cmd/gh-ost/main.go
Commit message: Security: fix vulnerability where `-database` parameter accepts arbitrary DSN strings

(cherry picked from commit 4dab3d5a689c6a5727174980071c7f9a563193f1)


Vulnerable code:
  if ! go version | egrep -q 'go(1\.1[56])' ; then

Fixed code:
  if ! go version | egrep -q 'go1\.(1[5-9]|[2-9][0-9]{1})' ; then
	"net/url"

	if err := flag.Set("database", url.QueryEscape(migrationContext.DatabaseName)); err != nil {
		migrationContext.Log.Fatale(err)
	}
CVE-2018-25080 (PHP, published 2023-02-04T08:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.32 is able to address this issue. The identifier of the patch is 31818a441b095bdc4838602dbb17b8377d1e5cce. It is recommended to upgrade the affected component. The identifier VDB-220061 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/serbanghita/Mobile-Detect
Files changed:
examples/session_example.php
Commit message: XSS vulnerability (#741)

* escaped PHP_SELF

Vulnerable code:
    <p>You can go to page <a href="<?php echo $_SERVER['PHP_SELF']; ?>?page=two">two</a>.</p>
    <p>You can go back to page <a href="<?php echo $_SERVER['PHP_SELF']; ?>">one</a>.</p>
        <a href="<?php echo $_SERVER['PHP_SELF']; ?>?layoutType=<?php echo $_layoutType; ?>"><?php echo strtoupper($_layoutType); ?></a>

Fixed code:
    <p>You can go to page <a href="<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>?page=two">two</a>.</p>
    <p>You can go back to page <a href="<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>">one</a>.</p>
        <a href="<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>?layoutType=<?php echo $_layoutType; ?>"><?php echo strtoupper($_layoutType); ?></a>
CVE-2019-16766 (Other, published 2019-11-29T17:15Z)
Description: value: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/labd/wagtail-2fa
Files changed:
CHANGES
Commit message: Update changelog for 1.3.0 release


Vulnerable code:

Fixed code:
1.3.0 (2019.11.26)
==================
 - Add OtpRequiredMixin to enforce OTP checks in views
 - Resolve possible vulnerabilities:
    - [CWE-290](http://cwe.mitre.org/data/definitions/290.html)
    - [CWE-20](http://cwe.mitre.org/data/definitions/20.html)
CVE-2019-16766 (Python, published 2019-11-29T17:15Z)
Description: value: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/labd/wagtail-2fa
Files changed:
src/wagtail_2fa/middleware.py
tests/test_middleware.py
Commit message: Allow a limited list of paths when user has device

This prevents users from adding or listing devices while they are not
yet verified and already have a registered device.


Vulnerable code:
        if request.path in self._allowed_paths:
    @property
    def _allowed_paths(self):
        """Return the paths the user may visit when not verified via otp

        This result cannot be cached since we want to be compatible with the
        django-hosts package. Django-hosts alters the urlconf based on the
        hostname in the request, so the urls might exist for admin.<domain> but
        not for www.<domain>.
        for route_name in self._allowed_url_names:
    allowed_paths = VerifyUserMiddleware()._allowed_paths
    allowed_paths = VerifyUserMiddleware()._allowed_paths

Fixed code:
        "wagtail_2fa_auth",
        "wagtailadmin_login",
        "wagtailadmin_logout",
    ]
    _allowed_url_names_no_device = [
        user_has_device = django_otp.user_has_device(user, confirmed=True)
        if request.path in self._get_allowed_paths(user_has_device):
    def _get_allowed_paths(self, has_device):
        """Return the paths the user may visit when not verified via otp.
        If the user already has a registered device, return a limited set of
        paths to prevent them from adding or listing devices to prevent them
        from adding or listing devices.
        allowed_url_names = self._allowed_url_names
        if not has_device:
            allowed_url_names = self._allowed_url_names_no_device

        for route_name in allowed_url_names:
    allowed_paths = VerifyUserMiddleware()._get_allowed_paths(has_device=False)
    allowed_paths = VerifyUserMiddleware()._get_allowed_paths(has_device=False)