hitoshura25/cvefixes huggingface dataset:
CVE-2008-5619 (Markdown, published 2008-12-17T02:30Z)
Description: value: html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/PHPMailer/PHPMailer
Files changed:
README.md
Commit message: Add security notices


Vulnerable code:

Fixed code:
## Security

Please follow responsible disclosure - report any security problems found to the maintainers privately.

PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=) an SMTP injection bug.

PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file.
CVE-2020-36326 (PHP, published 2021-04-28T03:15Z)
Description: value: PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/PHPMailer/PHPMailer
Files changed:
src/PHPMailer.php
test/PHPMailerTest.php
Commit message: Proposed fix for #2069


Vulnerable code:
            if (!static::isPermittedPath($lang_file) || !file_exists($lang_file)) {
            if (!static::isPermittedPath($path) || !@is_file($path) || !is_readable($path)) {
            if (!static::isPermittedPath($path) || !file_exists($path) || !is_readable($path)) {
            if (!static::isPermittedPath($path) || !@is_file($path) || !is_readable($path)) {

Fixed code:
    /**
     * Check whether a file path is safe, accessible, and readable.
     *
     * @param string $path A relative or absolute path to a file
     *
     * @return bool
     */
    protected static function fileIsAccessible($path)
    {
        $readable = file_exists($path);
        //If not a UNC path (expected to start with \\), check read permission, see #2069
        if (strpos($path, '\\\\') !== 0) {
            $readable = $readable && is_readable($path);
        }
        return static::isPermittedPath($path) && $readable;
    }

            if (!static::fileIsAccessible($lang_file)) {
            if (!static::fileIsAccessible($path)) {
            if (!static::fileIsAccessible($path)) {
            if (!static::fileIsAccessible($path)) {
        //Test using non-existent UNC path
        self::assertFalse($this->Mail->addAttachment('\\\\nowhere\nothing'));
CVE-2023-28430 (Unknown, published 2023-03-27T22:15Z)
Description: value: OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} – the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript’s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/OneSignal/react-native-onesignal
Files changed:
Commit message: Merge pull request #1497 from OneSignal/zapier-fix

Update Zapier.yml

Vulnerable code:

Fixed code:
CVE-2023-28430 (Unknown, published 2023-03-27T22:15Z)
Description: value: OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} – the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript’s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/OneSignal/react-native-onesignal
Files changed:
Commit message: Merge pull request #1474 from OneSignal/actions/add_release_drafter

Adding the release drafter action

Vulnerable code:

Fixed code:
CVE-2024-26133 (Unknown, published 2024-02-21T17:15Z)
Description: value: EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances that use custom projections are affected by this vulnerability. User passwords may become accessible to those who have access to the chunk files on disk, and users who have read access to system streams. Only users in the `$admins` group can access system streams by default. ESDB 23.10.1, 22.10.5, 21.10.11, and 20.10.6 contain a patch for this issue. Users should upgrade EventStoreDB, reset the passwords for current and previous members of `$admins` and `$ops` groups, and, if a password was reused in any other system, reset it in those systems to a unique password to follow best practices. If an upgrade cannot be done immediately, reset the passwords for current and previous members of `$admins` and `$ops` groups. Avoid creating custom projections until the patch has been applied.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/EventStore/EventStore
Files changed:
Commit message: Merge pull request #4162 from EventStore/hayley-jean/update-changelog-cve

Update changelog for security release

Vulnerable code:

Fixed code:
CVE-2022-39397 (Rust, published 2022-11-22T21:15Z)
Description: value: aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/tu6ge/oss-rs
Files changed:
src/auth.rs
Commit message: fix(auth): Prevent secret exposure


Vulnerable code:
pub trait AuthToHeaderMap {
pub trait AuthSignString {
pub trait AuthHeader {
    pub fn from_auth(
    pub fn key_string(&self) -> String {
    pub fn secret_string(&self) -> String {
    /// let auth = AuthBuilder::default()
    ///     .build();
    pub fn build(self) -> Auth {

Fixed code:
pub(crate) trait AuthToHeaderMap {
pub(crate) trait AuthSignString {
pub(crate) trait AuthHeader {

    pub(crate) fn from_auth(
    #[cfg(test)]
    pub(crate) fn key_string(&self) -> String {
    #[cfg(test)]
    pub(crate) fn secret_string(&self) -> String {
    /// use aliyun_oss_client::auth::AuthGetHeader;
    /// let headers = AuthBuilder::default()
    ///     .get_headers();
    #[allow(dead_code)]
    pub(crate) fn build(self) -> Auth {
CVE-2017-10807 (C, published 2017-07-04T15:29Z)
Description: value: JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/jabberd2/jabberd2
Files changed:
c2s/main.c
sx/sasl.c
Commit message: Fixed offered SASL mechanism check


Vulnerable code:
        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech)) {

Fixed code:
            log_debug(ZONE, "sx sasl callback: check mech (mech=%s)", mechbuf);

        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech) || (ctx->cb)(sx_sasl_cb_CHECK_MECH, (void*)mech, NULL, s, ctx->cbarg) != sx_sasl_ret_OK) {
CVE-2019-13127 (JavaScript, published 2019-07-01T15:15Z)
Description: value: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/jgraph/mxgraph
Files changed:
javascript/examples/grapheditor/www/js/Dialogs.js
Commit message: Added validation of input color codes

Vulnerable code:
		ColorDialog.addRecentColor(color, 12);
		if (color != 'none' && color.charAt(0) != '#')
			color = '#' + color;
		applyFunction(color);

Fixed code:
		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
		if (colorValid)
			ColorDialog.addRecentColor(color, 12);
			
			if (color != 'none' && color.charAt(0) != '#')
			{
				color = '#' + color;
			}

			applyFunction(color);
CVE-2019-13127 (JavaScript, published 2019-07-01T15:15Z)
Description: value: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jgraph/mxgraph
Files changed:
javascript/examples/grapheditor/www/js/Dialogs.js
Commit message: Added validation of input color codes

Vulnerable code:
		ColorDialog.addRecentColor(color, 12);
		if (color != 'none' && color.charAt(0) != '#')
			color = '#' + color;
		applyFunction(color);

Fixed code:
		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
		if (colorValid)
			ColorDialog.addRecentColor(color, 12);
			
			if (color != 'none' && color.charAt(0) != '#')
			{
				color = '#' + color;
			}

			applyFunction(color);
CVE-2015-10104 (PHP, published 2023-04-30T21:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/wp-plugins/icons-for-features
Files changed:
classes/class-icons-for-features-admin.php
icons-for-features.php
readme.txt
Commit message: V1.0.1 - Security Fix for _query_arg vulnerability.

git-svn-id: https://plugins.svn.wordpress.org/icons-for-features/trunk@1142181 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
			wp_safe_redirect( $redirect_url );
 * Version: 1.0.0
 * Tested up to: 3.8.1
Tested up to: 3.8.1
Stable tag: 1.0.0

Fixed code:
			wp_safe_redirect( esc_url( $redirect_url ) );
 * Version: 1.0.1
 * Tested up to: 4.1.1
Tested up to: 4.1.1
Stable tag: 1.0.1
= 1.0.1 =
* 2015-04-22
* Security Fix for remove_query_arg vulnerability

= 1.0.1 =
* 2015-04-22
* Fix for remove_query_arg vulnerability
CVE-2022-1544 (Unknown, published 2022-05-01T12:15Z)
Description: value: Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/luyadev/yii-helpers
Files changed:
Commit message: Merge pull request #7 from luyadev/csv-sanitizer

Csv sanitizer

Vulnerable code:

Fixed code:
CVE-2022-23079 (Ruby, published 2022-06-22T13:15Z)
Description: value: In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/motor-admin/motor-admin
Files changed:
app/controllers/api/admin_users_controller.rb
app/controllers/application_controller.rb
Commit message: do not use request host in for devise


Vulnerable code:
      Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }
    Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }

Fixed code:
      Devise::Mailer.default_url_options = { host: ENV['HOST'], protocol: request.protocol, port: request.port }
    Devise::Mailer.default_url_options = { host: ENV['HOST'], protocol: request.protocol, port: request.port }
CVE-2020-28268 (Unknown, published 2020-11-15T23:15Z)
Description: value: Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/hlfshell/controlled-merge
Files changed:
Commit message: merge :Merge pull request #3 from hlfshell/fix/security_vuln

Fix: Security Vulnerability - check attr

Vulnerable code:

Fixed code:
CVE-2017-6837 (C++, published 2017-03-20T16:59Z)
Description: value: WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/antlarr/audiofile
Files changed:
libaudiofile/WAVE.cpp
Commit message: Always check the number of coefficients

When building the library with NDEBUG, asserts are eliminated
so it's better to always check that the number of coefficients
is inside the array range.

This fixes the 00191-audiofile-indexoob issue in #41


Vulnerable code:

Fixed code:
			if (numCoefficients < 7 || numCoefficients > 255)
			{
				_af_error(AF_BAD_HEADER,
						"Bad number of coefficients");
				return AF_FAIL;
			}
CVE-2017-6838 (C, published 2017-03-20T16:59Z)
Description: value: Integer overflow in sfcommands/sfconvert.c in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/antlarr/audiofile
Files changed:
sfcommands/sfconvert.c
Commit message: Check for multiplication overflow in sfconvert

Checks that a multiplication doesn't overflow when
calculating the buffer size, and if it overflows,
reduce the buffer size instead of failing.

This fixes the 00192-audiofile-signintoverflow-sfconvert case
in #41


Vulnerable code:
	const int kBufferFrameCount = 65536;
	void *buffer = malloc(kBufferFrameCount * frameSize);

Fixed code:
int firstBitSet(int x)
{
        int position=0;
        while (x!=0)
        {
                x>>=1;
                ++position;
        }
        return position;
}

#ifndef __has_builtin
#define __has_builtin(x) 0
#endif

int multiplyCheckOverflow(int a, int b, int *result)
{
#if (defined __GNUC__ && __GNUC__ >= 5) || ( __clang__ && __has_builtin(__builtin_mul_overflow))
	return __builtin_mul_overflow(a, b, result);
#else
	if (firstBitSet(a)+firstBitSet(b)>31) // int is signed, so we can't use 32 bits
		return true;
	*result = a * b;
	return false;
#endif
}

	int kBufferFrameCount = 65536;
	int bufferSize;
	while (multiplyCheckOverflow(kBufferFrameCount, frameSize, &bufferSize))
		kBufferFrameCount /= 2;
	void *buffer = malloc(bufferSize);
CVE-2018-25071 (PHP, published 2023-01-07T12:15Z)
Description: value: A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this issue. The patch is identified as c25ff7fe83a2cda1fcb365b182365adc3ffae332. It is recommended to upgrade the affected component. VDB-217610 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/roxlukas/lmeve
Files changed:
wwwroot/ccpwgl/proxy.php
Commit message: Security update
fixed a possible SQL injection

Vulnerable code:
$addr=$_GET['fetch'];

Fixed code:
$addr = secureGETstr('fetch');
CVE-2023-30628 (YAML, published 2023-04-24T22:15Z)
Description: value: Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,
the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/kiwitcms/enterprise
Files changed:
.github/workflows/changelog.yml
Commit message: Pass untrusted input via intermediate ENV vars in CI jobs


Vulnerable code:
        echo "INFO: source branch is: ${{ github.head_ref }}"
        if [[ ! "${{ github.head_ref }}" =~ ^prepare/v.+$ ]]; then

Fixed code:
      env:
        HEAD_REF: ${{ github.head_ref }}
        echo "INFO: source branch is: $HEAD_REF"
        if [[ ! "$HEAD_REF" =~ ^prepare/v.+$ ]]; then