hitoshura25/cvefixes huggingface dataset:
CVE-2020-19498 (C++, published 2021-07-21T18:15Z)
Description: value: Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impacts.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/strukturag/libheif
Files changed:
libheif/box.cc
libheif/heif_limits.h
Commit message: force fraction to a limited resolution to finally solve those pesky numerical edge cases


Vulnerable code:
static int32_t gcd(int a, int b)
{
  if (a == 0 && b == 0) {
    return 1;
  }

  if (a == 0) return b;
  if (b == 0) return a;

  int32_t h;

  do {
    h = a % b;
    a = b;
    b = h;
  } while (b != 0);

  return a;
}


  int32_t g = gcd(num, den);

  // these strange tests are for catching the case that we divide -2147483648 by -1,
  // which would exceed the maximum positive value by one.

  if (num == std::numeric_limits<int32_t>::min() && g == -1) {
    num++;
  }

  if (den == std::numeric_limits<int32_t>::min() && g == -1) {
    den++;
  }


  numerator = num / g;
  denominator = den / g;


  while (denominator > MAX_FRACTION_DENOMINATOR) {
    numerator >>= 1;
    denominator >>= 1;
static const int MAX_FRACTION_DENOMINATOR = 0x10000;

Fixed code:
  while (denominator > MAX_FRACTION_VALUE || denominator < -MAX_FRACTION_VALUE) {
    numerator /= 2;
    denominator /= 2;
  }

  while (numerator > MAX_FRACTION_VALUE || numerator < -MAX_FRACTION_VALUE) {
    numerator /= 2;
    denominator /= 2;
static const int MAX_FRACTION_VALUE = 0x10000;
CVE-2020-19499 (C++, published 2021-07-21T18:15Z)
Description: value: An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/strukturag/libheif
Files changed:
libheif/heif_context.cc
Commit message: Handle case where referenced "iref" box doesn't exist (fixes #138).


Vulnerable code:

Fixed code:
    if (!iref_box) {
      return Error(heif_error_Invalid_input,
                   heif_suberror_No_item_data,
                   "Derived image does not reference any other image items");
    }
CVE-2018-20954 (Python, published 2019-08-08T21:15Z)
Description: value: The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/mailpile/Mailpile
Files changed:
mailpile/crypto/gpgi.py
mailpile/plugins/crypto_gnupg.py
shared-data/default-theme/html/profiles/account-form.html
Commit message: First working (but rough) version to omit revoked and disabled keys from
Add account-Security and Privacy-Encryption pulldown.


Vulnerable code:
                'crypto/gpg/keylist/secret', '<address>')
        res = self._gnupg().list_secret_keys()
        {%- set pgp_keys = mailpile('crypto/gpg/keylist/secret').result %}

Fixed code:
        # *** FIXME JackDca 2018-09-21 - Above behaviour not seen in 2.1.18 if
        # --with-colons is used (but true for human-readable output) so this
        # code could be deleted.
                                    'crypto/gpg/keylist/secret', '[<check>]')
    HTTP_QUERY_VARS = {'check': 'True to omit disabled, expired, revoked keys'}
        args = list(self.args)
        if len(args) > 0:
            check = args[0]
        else:
            check = self.data.get('check', '')
        check = 'True' in check
        
        all = self._gnupg().list_secret_keys()
        if check:
            res = {fprint : all[fprint] for fprint in all
                if not (all[fprint]['revoked'] or all[fprint]['disabled'])}
        else:
            res = all
        {%- set pgp_keys = mailpile('crypto/gpg/keylist/secret','True').result %}
CVE-2017-15538 (PHP, published 2017-10-17T20:29Z)
Description: value: Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ILIAS-eLearning/ILIAS
Files changed:
Services/MediaObjects/classes/class.ilMediaItem.php
Commit message: fixed bug #0021435


Vulnerable code:
		$this->parameters[$a_name] = $a_value;

Fixed code:
		if ($this->checkParameter($a_name, $a_value))
		{
			$this->parameters[$a_name] = $a_value;
		}
	/**
	 * Check parameter (filter javascript related and other unsafe parameters/values)
	 *
	 * @param string $a_par parameter
	 * @param string $a_val value
	 * @return bool
	 */
	function checkParameter($a_par, $a_val)
	{
		// do not allow event attributes
		if (substr(strtolower(trim($a_par)), 0, 2) == "on")
		{
			return false;
		}
		// no javascript in value
		if (is_int(strpos(strtolower($a_val), "javascript")))
		{
			return false;
		}
		// do not allow to change the src attribute
		if (in_array(strtolower(trim($a_par)), array("src")))
		{
			return false;
		}

		return true;
	}
CVE-2023-32076 (Unknown, published 2023-05-10T18:15Z)
Description: value: in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings. RC files are widely used in other systems and security issues have been discovered in their implementations as well. Maintainers found in their conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, the maintainers decided to drop support for `in_totorc`. in-toto's `user_settings` module has been dropped altogether in commit 3a21d84f40811b7d191fa7bd17265c1f99599afd. Users may also sandbox functionary code as a security measure.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/in-toto/in-toto
Files changed:
Commit message: Merge pull request from GHSA-wc64-c5rv-32pf

Drop user_settings module

Vulnerable code:

Fixed code:
CVE-2015-0876 (PHP, published 2015-04-07T02:00Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sauruscms/Saurus-CMS-Community-Edition
Files changed:
classes/adminpage.inc.php
Commit message: Fix stored and reflected XSS vulnerabilities

as described in VN: JVN#18387086 / TN: JPCERT#95011159 advisory.


Vulnerable code:

Fixed code:
		$fdat_value = htmlspecialchars(xss_clean($fdat_value));
		$fdat_field = htmlspecialchars(xss_clean($fdat_field));
CVE-2021-4267 (PHP, published 2022-12-21T19:15Z)
Description: value: A vulnerability classified as problematic was found in tad_discuss. Affected by this vulnerability is an unknown functionality. The manipulation of the argument DiscussTitle leads to cross site scripting. The attack can be launched remotely. The name of the patch is af94d034ff8db642d05fd8788179eab05f433958. It is recommended to apply a patch to fix this issue. The identifier VDB-216469 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tad0616/tad_discuss
Files changed:
discuss.php
function.php
index.php
Commit message: DiscussTitle過濾特殊字元

DiscussContent若允許使用HTML，則無法避免使用onclick, onload, onerror造成XSS漏洞


Vulnerable code:
    $DiscussTitle = empty($_POST['DiscussTitle']) ? 'RE:' . $Discuss['DiscussTitle'] : $_POST['DiscussTitle'];
    $extra_tags['DISCUSS_TITLE'] = $_POST['DiscussTitle'];
        $extra_tags['BOARD_TITLE'] = $Board['BoardTitle'];
        $DiscussTitle = $isPublic ? $DiscussTitle : sprintf(_MD_TADDISCUS_ONLYTO, $onlyToName);

Fixed code:
        $discuss['DiscussTitle'] = $myts->htmlSpecialChars($discuss['DiscussTitle']);
    $myts = \MyTextSanitizer::getInstance();
        $DiscussTitle = $myts->htmlSpecialChars($DiscussTitle);
    $DiscussTitle = empty($_POST['DiscussTitle']) ? 'RE:' . $Discuss['DiscussTitle'] : $myts->addSlashes($_POST['DiscussTitle']);
    $extra_tags['DISCUSS_TITLE'] = $myts->htmlSpecialChars($_POST['DiscussTitle']);
        $extra_tags['BOARD_TITLE'] = $myts->htmlSpecialChars($Board['BoardTitle']);
    $myts = \MyTextSanitizer::getInstance();

        $DiscussTitle = $isPublic ? $myts->htmlSpecialChars($DiscussTitle) : sprintf(_MD_TADDISCUS_ONLYTO, $onlyToName);
CVE-2020-26294 (Go, published 2021-01-04T19:15Z)
Description: value: Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/go-vela/compiler
Files changed:
template/native/render.go
template/native/render_test.go
template/native/testdata/disallowed/tmpl_env.yml
template/native/testdata/disallowed/tmpl_expandenv.yml
Commit message: fix: disallow functions (#93)



Vulnerable code:
	t, err := template.New(s.Name).Funcs(sprig.TxtFuncMap()).Funcs(templateFuncMap).Parse(tmpl)

Fixed code:
	// modify Masterminds/sprig functions
	// to remove OS functions
	//
	// https://masterminds.github.io/sprig/os.html
	sf := sprig.TxtFuncMap()
	delete(sf, "env")
	delete(sf, "expandenv")
	t, err := template.New(s.Name).Funcs(sf).Funcs(templateFuncMap).Parse(tmpl)
	"reflect"

func TestNative_Render_DisallowedFunc_Env(t *testing.T) {
	// setup types
	want := yaml.StepSlice{}

	// run test
	tmpl, err := ioutil.ReadFile("testdata/disallowed/tmpl_env.yml")
	if err != nil {
		t.Errorf("Reading file returned err: %v", err)
	}

	got, err := Render(string(tmpl), &yaml.Step{})
	if err == nil {
		t.Errorf("Render should have returned err")
	}

	if !reflect.DeepEqual(got, want) {
		t.Errorf("Render is %v, want %v", got, want)
	}
}

func TestNative_Render_DisallowedFunc_ExpandEnv(t *testing.T) {
	// setup types
	want := yaml.StepSlice{}

	// run test
	tmpl, err := ioutil.ReadFile("testdata/disallowed/tmpl_expandenv.yml")
	if err != nil {
		t.Errorf("Reading file returned err: %v", err)
	}

	got, err := Render(string(tmpl), &yaml.Step{})
	if err == nil {
		t.Errorf("Render should have returned err")
	}

	if !reflect.DeepEqual(got, want) {
		t.Errorf("Render is %v, want %v", got, want)
	}
}
metadata:
  template: true

steps:
  - name: echo
    commands:
      - echo {{ env "VELA_SOURCE_CLIENT" }}
    image: alpine:latest
metadata:
  template: true

steps:
  - name: echo
    commands:
      - echo {{ expandenv "Your client id is set to $VELA_SOURCE_CLIENT" }}
    image: alpine:latest
CVE-2016-3693 (Ruby, published 2016-05-20T14:59Z)
Description: value: The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/svenfuchs/safemode
Files changed:
lib/safemode/blankslate.rb
test/test_jail.rb
Commit message: Remove `inspect` from allowed methods

The `inspect` method is pretty unsafe, as by default it includes
a lot of data from the object.


Vulnerable code:
    @@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
    @@allow_class_methods    = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected = ["new", "methods", "name", "inherited", "method_added", "inspect",

Fixed code:
    @@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
    @@allow_class_methods    = ['methods', 'new', 'name', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
    expected = ["class", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected = ["new", "methods", "name", "inherited", "method_added",
CVE-2016-3693 (Ruby, published 2016-05-20T14:59Z)
Description: value: The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/svenfuchs/safemode
Files changed:
lib/safemode/blankslate.rb
test/test_jail.rb
Commit message: Remove `inspect` from allowed methods

The `inspect` method is pretty unsafe, as by default it includes
a lot of data from the object.


Vulnerable code:
    @@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
    @@allow_class_methods    = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected = ["new", "methods", "name", "inherited", "method_added", "inspect",

Fixed code:
    @@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
    @@allow_class_methods    = ['methods', 'new', 'name', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
    expected = ["class", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected = ["new", "methods", "name", "inherited", "method_added",
CVE-2021-28855 (C, published 2021-04-14T17:15Z)
Description: value: In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/jsummers/deark
Files changed:
modules/pict.c
Commit message: pict: Fixed a bug with ICC profile extraction

Could cause a NULL pointer dereference.

Found by F. Çelik.


Vulnerable code:

Fixed code:

		if(!d->iccprofile_file) {
			de_warn(c, "Bad ICC profile segment");
			return;
		}
CVE-2021-28856 (C, published 2021-04-14T17:15Z)
Description: value: In Deark before v1.5.8, a specially crafted input file can cause a division by zero in (src/fmtutil.c) because of the value of pixelsize.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/jsummers/deark
Files changed:
src/fmtutil.c
Commit message: pict,macrsrc: Fixed a bug that could cause division by 0

Found by F. Çelik.


Vulnerable code:
	bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;

Fixed code:
	if(bi->pixelsize>0) {
		bi->pdwidth = (bi->rowbytes*8)/bi->pixelsize;
	}
CVE-2021-32693 (Unknown, published 2021-06-17T23:15Z)
Description: value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/symfony/security-http
Files changed:
Commit message: security #cve-2021-32693 [SecurityHttp] Fix "Authentication granted with multiple firewalls" (wouterj)

This PR was merged into the 5.3 branch.


Vulnerable code:

Fixed code:
CVE-2020-12827 (JavaScript, published 2020-06-17T14:15Z)
Description: value: MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/mjmlio/mjml
Files changed:
packages/mjml-core/src/index.js
Commit message: expose ignoreIncludes on mjml2html


Vulnerable code:

Fixed code:
    ignoreIncludes = false,
      ignoreIncludes,
CVE-2023-27587 (Rust, published 2023-03-13T22:15Z)
Description: value: ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, then it will include the full URL of the request. The request URL contains the Google Cloud API key. This has been patched in commit 8533b01. Upgrading should be accompanied by deleting the current GCP API key and issuing a new one. There are no known workarounds.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/rozbb/readtomyshoe
Files changed:
server/src/tts.rs
Commit message: Fixed leakage of GCP API key through TTS error message


Vulnerable code:

Fixed code:
/// Redacts the API key out of the TTS error message
fn redact_error(mut e: reqwest::Error) -> reqwest::Error {
    // The API key is specified by `?key=...`. Overwriting the query section of the URL will make
    // this go away
    e.url_mut().map(|u| u.set_query(Some("key=REDACTED")));
    e
}

        .map_err(redact_error)
CVE-2021-29437 (PHP, published 2021-04-13T20:15Z)
Description: value: ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user and gets login code from ScratchOAuth2. 4. 3rd party site gives code to user and instructs them to post it on their profile. 5. User posts code on their profile, not knowing it is a ScratchOAuth2 login code. 6. 3rd party site completes login with ScratchOAuth2. 7. 3rd party site has full access to anything the user could do if they directly logged in. See referenced GitHub security advisory for patch notes and workarounds.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Files changed:
i18n/en.json
i18n/qqq.json
includes/common/login.php
includes/special/SpecialScratchOAuth2.php
Commit message: SECURITY: Mitigate MITM (GHSA-gvpg-23fh-8g75)

Prepend an anti-phishing message to the code itself warning about source
Add instructions to delete the comment afterwards to protect privacy


Vulnerable code:
			'code', [], $codes['code']

Fixed code:
	"soa2-vercode-explanation2": "For added privacy, delete your comment immediately after logging in here.",
	"soa2-vercode": "Copy this paragraph (including both the code and this message). Only post this code if it came from {{SERVER}} | $1",
	"soa2-vercode-explanation2": "Instructions to delete the comment afterwards.",
	"soa2-vercode": "A message prepended to the actual code to prevent man-in-the-middle attacks. $1 is the code.",
			$code = wfMessage('soa2-vercode', $code)->text();
			'textarea', [], $codes['code']
		$out->addWikiMsg('soa2-vercode-explanation2');