hitoshura25/cvefixes huggingface dataset:
CVE-2024-31984 (XML, published 2024-04-10T20:15Z)
Description: value: XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. This allows any user who can edit the title of a space (all users by default) to execute any Groovy code in the XWiki installation which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1. As a workaround, manually apply the patch to the `Main.SolrSpaceFacet` page.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/xwiki/xwiki-platform
Files changed:
xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-test/pom.xml
Commit message: XWIKI-21471: Improve Maven profile filtering


Vulnerable code:
    <profile>
      <id>integration-tests</id>
      <modules>
        <module>xwiki-platform-search-solr-test-utils</module>
      </modules>
    </profile>

Fixed code:
    <module>xwiki-platform-search-solr-test-utils</module>
CVE-2022-4891 (Ruby, published 2023-01-17T20:15Z)
Description: value: A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/sisimai/rb-sisimai
Files changed:
lib/sisimai/string.rb
Commit message: Prevent Regex Denial of Service in Sisimai::String.to_plain


Vulnerable code:
          plain.gsub!(%r|<head>.+</head>|im, '')
          plain.gsub!(%r|<style.+?>.+</style>|im, '')

Fixed code:
          plain.gsub!(%r|<head>.*?</head>|im, '')
          plain.gsub!(%r|<style.*?>.*?</style>|im, '')
CVE-2019-25084 (JavaScript, published 2022-12-25T18:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. This issue affects the function addEventListener of the file extension/options.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 9de0c57df81db1178e0e79431d462f6d9842742e. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216767.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sindresorhus/hide-files-on-github
Files changed:
extension/api.js
extension/options.js
Commit message: Avoid self-XSS (#73)



Vulnerable code:
/* global HideFilesOnGitHub */
	regexField.setCustomValidity(text); /* Triggers :invalid */
			return setValidity(`Use <code>${line.replace(/^\/|\/$/g, '')}</code> instead of <code>${line}</code>. Slashes are not required.`);

Fixed code:

// Inlined partial `escape-goat` package
const escapeHTML = input => input
	.replace(/&/g, '&amp;')
	.replace(/"/g, '&quot;')
	.replace(/'/g, '&#39;')
	.replace(/</g, '&lt;')
	.replace(/>/g, '&gt;');

window.escapeTag = (input, ...parts) => {
	let output = input[0];
	for (let i = 0; i < parts.length; i++) {
		output = output + escapeHTML(parts[i]) + input[i + 1];
	}

	return output;
};
/* global HideFilesOnGitHub, escapeTag */
	regexField.setCustomValidity(errorMessage.textContent); /* Triggers :invalid */
			return setValidity(escapeTag`Use <code>${line.replace(/^\/|\/$/g, '')}</code> instead of <code>${line}</code>. Slashes are not required.`);
CVE-2023-38688 (Rust, published 2023-08-04T17:15Z)
Description: value: twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/Xithrius/twitch-tui
Files changed:
src/twitch/connection.rs
Commit message: Enable SSL for the Twitch IRC connection.


Vulnerable code:
        port: Some(6667),
        use_tls: Some(false),

Fixed code:
        port: Some(6697),
        use_tls: Some(true),
CVE-2024-29036 (Markdown, published 2024-03-20T21:15Z)
Description: value: Saleor Storefront is software for building e-commerce experiences. Prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783, when any user authenticates in the storefront, anonymous users are able to access their data. The session is leaked through cache and can be accessed by anyone. Users should upgrade to a version that incorporates commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 or later to receive a patch. A possible workaround is to temporarily disable authentication by changing the usage of `createSaleorAuthClient()`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/saleor/auth-sdk
Files changed:
README.md
Commit message: Update README


Vulnerable code:
const nextServerCookiesStorage = getNextServerCookiesStorage();
const saleorAuthClient = createSaleorAuthClient({
  saleorApiUrl: "…",
  refreshTokenStorage: nextServerCookiesStorage,
  accessTokenStorage: nextServerCookiesStorage,
});
    await saleorAuthClient.signIn(
For a full working example see the [Saleor Auth SDK example](https://github.com/saleor/example-auth-sdk/blob/5babda35969c35f423680b47d1446466b18b2461/app/ssr/page.tsx).

Fixed code:
const getServerAuthClient = () => {
  const nextServerCookiesStorage = getNextServerCookiesStorage();
  returncreateSaleorAuthClient({
    saleorApiUrl: "…",
    refreshTokenStorage: nextServerCookiesStorage,
    accessTokenStorage: nextServerCookiesStorage,
  });
};
    await getServerAuthClient().signIn(
For a full working example, see the [Saleor Auth SDK example](https://github.com/saleor/example-auth-sdk/tree/app/ssr/page.tsx).
CVE-2019-15785 (C, published 2019-08-29T13:15Z)
Description: value: FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/fontforge/fontforge
Files changed:
fontforge/views.h
fontforgeexe/fontview.c
fontforgeexe/prefs.c
fontforgeexe/scriptingdlg.c
gdraw/gtextfield.c
inc/gdraw.h
inc/ggadget.h
Commit message: Warn users before discarding their unsaved scripts (#3852)

* Warn users before discarding their unsaved scripts

This closes #3846.

Vulnerable code:
		  et_lastsubtype };

Fixed code:
    bool script_unsaved; // Whether or not there's an unsaved script in script dialog
bool warn_script_unsaved = true;
static int AskScriptChanged() {
    int ret;
    char *buts[4];

    buts[0] = _("_Yes");
    buts[1] = _("Yes, and don't _remind me again");
    buts[2] = _("_No");
    buts[3] = NULL;
    ret = gwwv_ask( _("Unsaved script"),(const char **) buts,0,2,_("You have an unsaved script in the «Execute Script» dialog. Do you intend to discard it?"));
    if (ret == 1) {
        warn_script_unsaved = false;
        SavePrefs(true);
    }
return( ret );
}

    } else if ( warn_script_unsaved && fv->script_unsaved && 
                AskScriptChanged()==2 ) {
        return false;
extern bool warn_script_unsaved; /* fontview.c */
	{ N_("WarnScriptUnsaved"), pr_bool, &warn_script_unsaved, NULL, NULL, '\0', NULL, 0, N_( "Whether or not to warn you if you have an unsaved script in the «Execute Script» dialog.") },
    } else if ( event->type==et_controlevent && event->u.control.subtype==et_textchanged ) {
    sd->fv->script_unsaved = !GTextFieldIsEmpty(GWidgetGetControl(sd->gw,CID_Script));
    } else if ( event->type==et_controlevent && event->u.control.subtype==et_save ) {
    sd->fv->script_unsaved = false;
static void GTextFieldSaved(GTextField *gt) {
    GEvent e;

    e.type = et_controlevent;
    e.w = gt->g.base;
    e.u.control.subtype = et_save;
    e.u.control.g = &gt->g;
    if ( gt->g.handle_controlevent != NULL )
	(gt->g.handle_controlevent)(&gt->g,&e);
    else
	GDrawPostEvent(&e);
}

bool GTextFieldIsEmpty(GGadget *g) {
    GTextField *gt = (GTextField *) g;
    return gt->text == NULL || *gt->text == '\0';
}

    GTextFieldSaved(gt);
		  et_save, et_lastsubtype };
bool GTextFieldIsEmpty(GGadget *g);
CVE-2022-24912 (Go, published 2022-07-29T10:15Z)
Description: value: The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/runatlantis/atlantis
Files changed:
server/controllers/events/gitlab_request_parser_validator.go
Commit message: fix: use constant time comparison of webhook secret in gitlab event validator (#2392)



Vulnerable code:
	secretStr := string(secret)
	if len(secret) != 0 && headerSecret != secretStr {

Fixed code:
	"crypto/subtle"
	if len(secret) != 0 && subtle.ConstantTimeCompare(secret, []byte(headerSecret)) != 1 {
CVE-2024-37160 (PHP, published 2024-06-07T14:15Z)
Description: value: Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages (except the dashboard). This vulnerability is fixed in 1.13.1.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/getformwork/formwork
Files changed:
site/templates/partials/meta.php
Commit message: Escape meta attributes to avoid XSS injection


Vulnerable code:
        <meta charset="<?= $meta->content() ?>">
        <meta http-equiv="<?= $meta->name() ?>" content="<?= $meta->content() ?>">
        <meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $meta->name() ?>" content="<?= $meta->content() ?>">

Fixed code:
        <meta charset="<?= $this->escapeAttr($meta->content()) ?>">
        <meta http-equiv="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
        <meta <?= $meta->prefix() === 'og' ? 'property' : 'name' ?>="<?= $this->escapeAttr($meta->name()) ?>" content="<?= $this->escapeAttr($meta->content()) ?>">
CVE-2020-7795 (JavaScript, published 2022-08-02T14:15Z)
Description: value: The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/hoperyy/get-npm-package-version
Files changed:
index.js
Commit message: feat: add defence to Command Injection

add defence to Command Injection

Vulnerable code:

Fixed code:
        if (/[`$&{}[;|]/g.test(packageName) || /[`$&{}[;|]/g.test(registry)) {
            return null
        }
CVE-2021-43838 (Unknown, published 2021-12-17T19:15Z)
Description: value: jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. jsx-slack v4.5.1 has patched to a regex for escaping blockquote characters. Users are advised to upgrade as soon as possible.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/yhatt/jsx-slack
Files changed:
Commit message: Merge pull request from GHSA-55xv-f85c-248q

Fix performance issues of tags in blockquote

Vulnerable code:

Fixed code:
CVE-2021-43843 (TypeScript, published 2021-12-20T22:15Z)
Description: value: jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReDoS) attack. If an attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 passes the test against ASCII characters but misses the case of multibyte characters. jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/yhatt/jsx-slack
Files changed:
src/mrkdwn/escape.ts
Commit message: Prevent catastrophic backtracking in blockquote escape replacer


Vulnerable code:
  /(<.*?>|:[-a-z0-9ÀÁÂÃÄÇÈÉÊËÍÎÏÑÓÔÕÖŒœÙÚÛÜŸßàáâãäçèéêëíîïñóôõöùúûüÿ_＿+＋'\u1100-\u11ff\u2e80-\u2fd5\u3005\u3041-\u3096\u30a0-\u30ff\u3130-\u318f\u3400-\u4db5\u4e00-\u9fcb\ua960-\ua97f\uac00-\ud7ff\uff10-\uff19\uff41-\uff5a\uff61-\uff9f]+:)/
      .replace(/^((?:<.*?>)*)(.{4})/gm, (matched, leading, character) =>
        character === '&gt;' ? `${leading}\u00ad&gt;` : matched
        /^((?:<.*?>)*)(＞)/gm,
        (_, leading, character) =>
          `${leading}${generateReplacerForEscape('\u00ad＞')(character)}`

Fixed code:
  /(<[^>]*>|:[-a-z0-9ÀÁÂÃÄÇÈÉÊËÍÎÏÑÓÔÕÖŒœÙÚÛÜŸßàáâãäçèéêëíîïñóôõöùúûüÿ_＿+＋'\u1100-\u11ff\u2e80-\u2fd5\u3005\u3041-\u3096\u30a0-\u30ff\u3130-\u318f\u3400-\u4db5\u4e00-\u9fcb\ua960-\ua97f\uac00-\ud7ff\uff10-\uff19\uff41-\uff5a\uff61-\uff9f]+:)/
      .replace(
        /^((?:<(?:[^>]|>(?=<))*>)?)(&gt;)/gm,
        (_, leadingTags, character) => `${leadingTags}\u00ad${character}`
        /^((?:<(?:[^>]|>(?=<))*>)?)(＞)/gm,
        (_, leadingTags, character) =>
          `${leadingTags}${generateReplacerForEscape('\u00ad＞')(character)}`
CVE-2017-17042 (Ruby, published 2017-11-28T20:29Z)
Description: value: lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/lsegal/yard
Files changed:
lib/yard/core_ext/file.rb
spec/core_ext/file_spec.rb
Commit message: Disallow relative paths that start with ../

Fixes a potential arbitrary file read vulnerability in yard server.
Thanks to ztz <ztz@ztz.me> for discovery of this security issue.


Vulnerable code:
    it "passes the initial directory" do
      expect(File.cleanpath('C/../../D')).to eq "../D"
      expect(File.cleanpath('../../A/B')).to eq '../../A/B'

Fixed code:
      elsif comp == RELATIVE_PARENTDIR && acc.empty?
        next acc
    it "does not allow relative path above root" do
      expect(File.cleanpath('A/../../../../../D')).to eq "D"
      expect(File.cleanpath('../../A/B')).to eq 'A/B'
CVE-2024-27285 (Unknown, published 2024-02-28T20:15Z)
Description: value: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.  This vulnerability is fixed in 0.9.36.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/lsegal/yard
Files changed:
Commit message: Merge pull request from GHSA-8mq4-9jjh-9xrc

Patch XSS and Open-Redirect in frames.erb

Vulnerable code:

Fixed code:
CVE-2024-27285 (Unknown, published 2024-02-28T20:15Z)
Description: value: YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file.  This vulnerability is fixed in 0.9.36.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/lsegal/yard
Files changed:
Commit message: Merge pull request #1538 from RedYetiDev/patch-2

Update frames.erb for better XSS check

Vulnerable code:

Fixed code:
CVE-2018-1000501 (PHP, published 2018-06-26T16:29Z)
Description: value: Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/InstantUpdate/CMS
Files changed:
iu-application/controllers/administration/auth.php
Commit message: fix(auth): Send password reset emails to user's email stored in the db

Vulnerable code:
		$this->email->to("$email");
?>

Fixed code:
		$this->email->to($u->email);
?>
CVE-2021-25986 (Other, published 2021-11-23T20:15Z)
Description: value: In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/django-wiki/django-wiki
Files changed:
docs/release_notes.rst
src/wiki/plugins/notifications/static/wiki/plugins/notifications/js/ui.js
Commit message: Security fix (XSS) - Build HTML elements for notifications safely


Vulnerable code:
          element = $('<div><a href="'+URL_NOTIFY_GOTO+n.pk+'/"><div>'+n.message+'</div><div class="since">'+n.occurrences_msg+' - ' + n.since + '</div></a></div>')
          element = $('<div><a href="'+URL_NOTIFY_GOTO+n.pk+'/"><div>'+n.message+'</div><div class="since">'+n.since+'</div></a></div>');

Fixed code:
0.7.9
-----

Security fixes
~~~~~~~~~~~~~~

* XSS vulnerability: Unescaped HTML in title propagated to notification (WhiteSource Vulnerability Research Team)


        var element_outer_div = $("<div />");
        var element_a = $("<a />", {href: URL_NOTIFY_GOTO + n.pk + "/"});
        var element_message_div;
        var element_since_div;
          element_message_div = $("<div />", {text: n.message});
          element_since_div = $("<div />", {text: n.occurrences_msg+' - ' + n.since, class: "since"});
          element_message_div = $("<div />", {text: n.message});
          element_since_div = $("<div />", {text: n.since, class: "since"});
        element_a.append(element_message_div).append(element_since_div);
        element = element_outer_div.append(element_a);