hitoshura25/cvefixes huggingface dataset:
CVE-2013-7176 (Other, published 2014-02-01T15:55Z)
Description: value: config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/fail2ban/fail2ban
Files changed:
config/filter.d/postfix.conf
testcases/files/logs/postfix
Commit message: ENH: Improve postfix regex and add more samples


Vulnerable code:
failregex = reject: RCPT from (.*)\[<HOST>\]: 554
            reject: RCPT from (.*)\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$

Fixed code:
[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


_daemon = postfix/smtpd

failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
# failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.65" }
Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.65]: 554 5.7.1 <bad.domain>: Helo command rejected: match bad.domain; from=<foo@good.domain> to=<foo@porcupine.org> proto=SMTP helo=<bad.domain>
# failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.43" }
Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.43]: 554 5.7.1 <foo@bad.domain>: Sender address rejected: match bad.domain; from=<foo@bad.domain> to=<foo@porcupine.org> proto=SMTP helo=<192.51.100.43>
CVE-2013-7177 (Other, published 2014-02-01T15:55Z)
Description: value: config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/fail2ban/fail2ban
Files changed:
config/filter.d/cyrus-imap.conf
testcases/files/logs/cyrus-imap
Commit message: ENH: Improve cyrus-imap regex and add sample log file


Vulnerable code:
failregex = : badlogin: .*\[<HOST>\] plaintext .*SASL\(-13\): authentication failure: checkpass failed$
	    : badlogin: .*\[<HOST>\] LOGIN \[SASL\(-13\): authentication failure: checkpass failed\]$
	    : badlogin: .*\[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
	    : badlogin: .*\[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$

Fixed code:
[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


_daemon = (?:cyrus/)?(?:imapd?|pop3d?)

failregex = ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] (?:plaintext|LOGIN) .* \[?SASL\(-13\): authentication failure: checkpass failed\]?$
	    ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
	    ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
# failJSON: { "time": "2005-01-04T21:51:05", "match": true , "host": "127.0.0.1" }
Jan 4 21:51:05 hostname cyrus/imap[5355]: badlogin: localhost.localdomain [127.0.0.1] plaintext cyrus@localdomain SASL(-13): authentication failure: checkpass failed
# failJSON: { "time": "2005-02-20T17:23:32", "match": true , "host": "198.51.100.23" }
Feb 20 17:23:32 domain cyrus/pop3[18635]: badlogin: localhost [198.51.100.23] plaintext administrator SASL(-13): authentication failure: checkpass failed
# failJSON: { "time": "2005-02-20T17:23:32", "match": true , "host": "1.2.3.4" }
Feb 20 17:23:32 cyrus/pop3[4297]: badlogin: example.com [1.2.3.4] plaintext mail0001 SASL(-13): authentication failure: checkpass failed
# failJSON: { "time": "2005-06-08T18:11:13", "match": true , "host": "198.51.100.45" }
Jun 8 18:11:13 lampserver imap[4480]: badlogin: example.com [198.51.100.45] DIGEST-MD5 [SASL(-13): authentication failure: client response doesn't match what we generated]
# failJSON: { "time": "2004-12-21T10:01:57", "match": true , "host": "198.51.100.57" }
Dec 21 10:01:57 hostname imapd[18454]: badlogin: example.com [198.51.100.57] CRAM-MD5 [SASL(-13): authentication failure: incorrect digest response]
CVE-2022-1365 (JSON, published 2022-04-15T23:15Z)
Description: value: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/lquixada/cross-fetch
Files changed:
.github/workflows/ci.yml
package.json
Commit message: chore: updated node-fetch version to 2.6.7 (#124)

* chore: updated node-fetch version to 2.6.7

* build: use node 16.x instead of 15.x

Vulnerable code:
        node-version: [10.x, 12.x, 14.x, 15.x]
    "node-fetch": "2.6.5"

Fixed code:
        node-version: [10.x, 12.x, 14.x, 16.x]
    "node-fetch": "2.6.7"
CVE-2019-12530 (PHP, published 2019-06-02T17:29Z)
Description: value: Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/stdonato/glpi-dashboard
Files changed:
front/sh/df.php
front/sh/issue.php
front/sh/load.php
front/sh/media.php
front/sh/mem.php
front/sh/traf.php
front/sh/uptime.php
Commit message: 0.9.8.rc1


Vulnerable code:
//header('Content-Type: application/json; charset=UTF-8');
// /bin/cat /proc/loadavg | /usr/bin/awk '{print $1","$2","$3}'
//$load = $perc;	
//$ver = explode(" ",implode(" ",plugin_version_dashboard()));


$totalSeconds1 = shell_exec("/usr/bin/cut -d. -f1 /proc/uptime");
//header('Content-Type: application/json; charset=UTF-8');
echo ($formatUptime);

Fixed code:
Session::checkLoginUser();
Session::checkRight("profile", READ);

Session::checkLoginUser();
Session::checkRight("profile", READ);
Session::checkLoginUser();
Session::checkRight("profile", READ);
Session::checkLoginUser();
Session::checkRight("profile", READ);

Session::checkLoginUser();
Session::checkRight("profile", READ);

Session::checkLoginUser();
Session::checkRight("profile", READ);

$uptime = shell_exec('uptime |cut -d" " -f4-8');

echo $uptime;

/*$totalSeconds1 = shell_exec("/usr/bin/cut -d'.' -f1 /proc/uptime");

echo ($formatUptime);*/

?>
CVE-2012-2129 (PHP, published 2012-08-27T21:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/splitbrain/dokuwiki
Files changed:
inc/html.php
Commit message: escape target error message (SECURITY) FS#2487 FS#2488

The error message when a non-existant editor was tried to load wasn't
escaped correctly, allowing to introduce arbitrary JavaScript to the
output, leading to a XSS vulnerability.

Note: the reported second XCRF vulnerability is the same bug, the xploit
code simply uses JavaScript to extract a valid CSRF token from the site


Vulnerable code:
        msg('No editor for edit target ' . $param['target'] . ' found.', -1);

Fixed code:
        msg('No editor for edit target ' . hsc($param['target']) . ' found.', -1);
CVE-2017-18123 (PHP, published 2018-02-03T15:29Z)
Description: value: The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/splitbrain/dokuwiki
Files changed:
lib/exe/ajax.php
Commit message: filter special chars from ajax call parameter. fixes #2019


Vulnerable code:
    $call = $INPUT->post->str('call');
    $call = $INPUT->get->str('call');

Fixed code:
    $call = $INPUT->post->filter('utf8_stripspecials')->str('call');
    $call = $INPUT->get->filter('utf8_stripspecials')->str('call');
CVE-2022-3123 (PHP, published 2022-09-05T10:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/splitbrain/dokuwiki
Files changed:
inc/Ui/PageDiff.php
Commit message: SECURITY fix difftype handling. #3761


Vulnerable code:
            $this->preference['difftype'] = $INPUT->str('difftype');
            if (isset($mode)) $this->preference['difftype'] = $mode;
        echo '<table class="diff diff_'.$this->preference['difftype'] .'">';

Fixed code:
        $mode = '';
            $mode = $INPUT->str('difftype');
        if(in_array($mode, ['inline','sidebyside'])) $this->preference['difftype'] = $mode;
        echo '<table class="diff diff_'.hsc($this->preference['difftype']) .'">';
CVE-2009-10001 (PHP, published 2023-01-13T18:15Z)
Description: value: A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2. This vulnerability affects unknown code of the file example-form.php. The manipulation of the argument captcha with the input %3Cscript%3Ealert(1)%3C/script%3E leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.3 is able to address this issue. The name of the patch is c84fb6b153bebaf228feee0cbf50728d27ae3f80. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218296.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jianlinwei/cool-php-captcha
Files changed:
example-form.php
Commit message: FIXED issue #2: Solves XSS en example-form.php

For example:
http://127.0.0.1/example-form.php?captcha=%3Cscript%3Ealert(1)%3C/script%3E


Vulnerable code:
            <td>{$_REQUEST['captcha']}</td>

Fixed code:
    $request_captcha = htmlspecialchars($_REQUEST['captcha']);

            <td>$request_captcha</td>
CVE-2014-4742 (PHP, published 2014-07-09T14:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kajona/kajonacms
Files changed:
module_system/system/class_link.php
Commit message: BUG / SECURITY: module_system | class_link -> fixed some rare conditions where a possible xss injection was possible for the systemid-param


Vulnerable code:
        $strParsedSystemid = "";
        $arrParams = self::parseParamsString($strParams, $strParsedSystemid);
        if($strSystemid == "" && validateSystemid($strParsedSystemid))
            $strSystemid = $strParsedSystemid;
                $strSystemid = $arrEntry[1];

Fixed code:
        if($strSystemid != "") {
            $strParams .= "&systemid=".$strSystemid;
            $strSystemid = "";
        }

        $arrParams = self::parseParamsString($strParams, $strSystemid);
                //encoded and sanitized systemid param TODO: add cve number or other identifier
                $strSystemid = urlencode($arrEntry[1]);
                if(!validateSystemid($strSystemid))
                    $strSystemid = "";
CVE-2014-4743 (Other, published 2014-07-09T14:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in templates/default/tpl/module_search/ in the Search module (module_search) in Kajona before 4.5 allow remote attackers to inject arbitrary web script or HTML via the search parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kajona/kajonacms
Files changed:
module_search/templates/default/tpl/module_search/search_ajax.tpl
module_search/templates/default/tpl/module_search/search_ajax_small.tpl
Commit message: BUG / SECURITY: module_search | portal-js -> fixed a possible xss injection, the search param is now included htmlencoded an no longer as plaintext


Vulnerable code:
                    $("#spanSearchterm").html($(data).find("searchterm").text());
                    $("#spanSearchamount").html($(data).find("nrofresults").text());
                    $("#spanSearchtermSmall").html($(data).find("searchterm").text());
                    $("#spanSearchamountSmall").html($(data).find("nrofresults").text());

Fixed code:
                    $("#spanSearchterm").html($(data).find("searchterm").html());
                    $("#spanSearchamount").html($(data).find("nrofresults").html());
                    $("#spanSearchtermSmall").html($(data).find("searchterm").html());
                    $("#spanSearchamountSmall").html($(data).find("nrofresults").html());
CVE-2015-0917 (PHP, published 2015-01-08T15:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kajona/kajonacms
Files changed:
module_system/admin/class_admin_controller.php
module_system/system/class_abstract_controller.php
Commit message: BUG: / SECURITY: Fixed a possible xss injection when handling non-existent action-names. fixes SROEADV-2015-01.


Vulnerable code:
        if($strAction == "") {
            $strAction = $this->getAction();
        }
        else {
        $this->strAction = $this->getParam("action");
        if($this->strAction == "") {
            $this->strAction = "list";
        $this->strAction = $strAction;

Fixed code:
        if($strAction != "") {
        $strAction = $this->getAction();

        $this->setAction($this->getParam("action"));
        if($this->getAction() == "") {
            $this->setAction("list");
        $this->strAction = htmlspecialchars(trim($strAction), ENT_QUOTES, "UTF-8", false);
CVE-2021-41096 (Java, published 2021-09-27T20:15Z)
Description: value: Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for release builds and 426 onwards for nightly builds. As a workaround, one may disable an advance security feature if not required.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/mayankmetha/Rucky
Files changed:
app/src/main/java/com/mayank/rucky/activity/ConfigActivity.java
app/src/main/java/com/mayank/rucky/utils/Constants.java
app/src/main/java/com/mayank/rucky/utils/Randoms.java
Commit message: Fix security vulnerabilities


Vulnerable code:
            ipButton.setVisibility(View.GONE);
            ipStatusDivider.setVisibility(View.GONE);
    //keystore
    public static final String PREF_GEN_KEY = "genKeyDone";
    public static final String KEYSTORE_PROVIDER_ANDROID_KEYSTORE = "AndroidKeyStore";
    public static final String RUCKY_KEYSTORE = "RuckyKeystore";
    public static final String RUCKY_KEYSTORE2 = "RuckyKeystore2";

import java.util.Random;
    Random random;
        random = new Random();

Fixed code:
            ipButton.setVisibility(View.INVISIBLE);
            ipStatusDivider.setVisibility(View.INVISIBLE);
import java.security.SecureRandom;
    SecureRandom random;
        random = new SecureRandom();
CVE-2021-21385 (Unknown, published 2021-03-24T21:15Z)
Description: value: Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/openMF/mifos-mobile
Files changed:
Commit message: Merge pull request from GHSA-9657-33wf-rmvx

Remove insecure TrustManager & HostnameVerifier.

Vulnerable code:

Fixed code:
CVE-2021-21385 (Unknown, published 2021-03-24T21:15Z)
Description: value: Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: CWE-297 \u2014 Improper Validation of Certificate with Host Mismatch
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Repository: https://github.com/openMF/mifos-mobile
Files changed:
Commit message: Merge pull request from GHSA-9657-33wf-rmvx

Remove insecure TrustManager & HostnameVerifier.

Vulnerable code:

Fixed code:
CVE-2015-3171 (Python, published 2017-07-25T18:29Z)
Description: value: sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/sosreport/sos
Files changed:
sos/sosreport.py
Commit message: [sosreport] fix archive permissions regression

Restore the umask save/restore around archive creation and ensure
the effective umask is 077 at the time of archive creation.

Fixes #425.

Signed-off-by: Bryn M. Reeves <bmr@redhat.com>


Vulnerable code:

Fixed code:
            old_umask = os.umask(0o077)
            finally:
                os.umask(old_umask)
CVE-2024-29862 (Other, published 2024-03-21T04:15Z)
Description: value: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/chirpstack/chirpstack-mqtt-forwarder
Files changed:
packaging/vendor/kerlink/klkgw/files/chirpstack-mqtt-forwarder.init
Commit message: Fix Kerlink firewall rule security issue.

This limits accepting incoming TCP packets from the --sport for
ESTABLISHED connections only.


Vulnerable code:
    local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"

Fixed code:
    local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
CVE-2012-1910 (YAML, published 2012-08-06T16:55Z)
Description: value: Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/bitcoin/bitcoin
Files changed:
bitcoin-qt.pro
contrib/gitian-descriptors/qt-win32.yml
Commit message: Fix Win32 RPC Crashes.


Vulnerable code:
windows:LIBS += -lws2_32 -lshlwapi
windows:DEFINES += WIN32

Fixed code:
windows:LIBS += -lmingwthrd -lws2_32 -lshlwapi
windows:DEFINES += _MT WIN32
  sed 's/QMAKE_LIBS_QT_ENTRY     = -lmingw32 -lqtmain/QMAKE_LIBS_QT_ENTRY     = -lqtmain/' -i mkspecs/unsupported/win32-g++-cross/qmake.conf