hitoshura25/cvefixes huggingface dataset:
CVE-2022-0950 (PHP, published 2022-03-15T09:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Controller/AttachmentController.class.php
server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug


Vulnerable code:
        if(D("Attachment")->isDangerFilename($_FILES['editormd-image-file']['name'])){
        if(D("Attachment")->isDangerFilename($uploadFile['name'])){
            $this->sendError(10100,'不支持此文件类型');
		if($this->isDangerFilename($uploadFile['name'])){


Fixed code:
        if(!D("Attachment")->isAllowedFilename($_FILES['editormd-image-file']['name'])){
            $message = "不支持上传该文件类型。如有需要请联系网站管理员" ;
            echo json_encode(array("message"=>$message,"success"=>0));
        if(!D("Attachment")->isAllowedFilename($uploadFile['name'])){
            $this->sendError(10101,'不支持上传该文件类型。如有需要请联系网站管理员');
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
	// 准备弃用。因为一个个ban太麻烦了。准备改用白名单机制
	// 判断上传的文件扩展名是否处于白名单内
	public function isAllowedFilename($filename){
		$allow_array = array(
			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
			'.mov','.webmv','.m3u8a','.flac','.mkv',
			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',
			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',
			'.cer','.ppt','.pub','.properties','.json','.css',
			) ;

		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
		if(in_array( $ext , $allow_array ) ){
			return true ;
		}
		return false;
	}
CVE-2022-0951 (PHP, published 2022-03-15T09:15Z)
Description: value: File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Controller/AttachmentController.class.php
server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug


Vulnerable code:
        if(D("Attachment")->isDangerFilename($_FILES['editormd-image-file']['name'])){
        if(D("Attachment")->isDangerFilename($uploadFile['name'])){
            $this->sendError(10100,'不支持此文件类型');
		if($this->isDangerFilename($uploadFile['name'])){


Fixed code:
        if(!D("Attachment")->isAllowedFilename($_FILES['editormd-image-file']['name'])){
            $message = "不支持上传该文件类型。如有需要请联系网站管理员" ;
            echo json_encode(array("message"=>$message,"success"=>0));
        if(!D("Attachment")->isAllowedFilename($uploadFile['name'])){
            $this->sendError(10101,'不支持上传该文件类型。如有需要请联系网站管理员');
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
	// 准备弃用。因为一个个ban太麻烦了。准备改用白名单机制
	// 判断上传的文件扩展名是否处于白名单内
	public function isAllowedFilename($filename){
		$allow_array = array(
			'.jpg','.jpeg','.png','.bmp','.gif','.ico','.webp',
			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
			'.mov','.webmv','.m3u8a','.flac','.mkv',
			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps','.wpt',
			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',
			'.cer','.ppt','.pub','.properties','.json','.css',
			) ;

		$ext = strtolower(substr($filename,strripos($filename,'.')) ); //获取文件扩展名（转为小写后）
		if(in_array( $ext , $allow_array ) ){
			return true ;
		}
		return false;
	}
CVE-2022-0956 (PHP, published 2022-03-15T13:15Z)
Description: value: Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug


Vulnerable code:
			'.ppt','.pptx','.xls','.xlsx','.txt','.md','.psd','.csv',

Fixed code:
			'.ppt','.pptx','.xls','.xlsx','.txt','.psd','.csv',
CVE-2022-0957 (Unknown, published 2022-03-15T13:15Z)
Description: value: Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
Commit message: Merge pull request #1632 from ajaysenr/master

Update AttachmentModel.class.php

Vulnerable code:

Fixed code:
CVE-2022-0960 (PHP, published 2022-03-14T15:15Z)
Description: value: Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: file upload bug


Vulnerable code:
			'.mp3','.wav','.m4a','.ogg','.webma','.mp4','.flv',
			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso','.bz2','.epub',
			'.doc','.docx','.odt','.rtf','.docm','.dotm','.dot','.dotx','.wps',
			'.cer','.ppt','.pub','.properties','.json','.css',

Fixed code:
			'.mp3','.wav','.mp4',
			'.zip','.tar','.gz','.tgz','.ipa','.apk','.rar','.iso',
			'.doc','.docx','.wps',
			'.cer','.ppt','.pub','.json','.css',
CVE-2022-0962 (PHP, published 2022-03-14T16:15Z)
Description: value: Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: Upload file vulnerability


Vulnerable code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;

Fixed code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0964 (PHP, published 2022-03-15T16:15Z)
Description: value: Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: Upload file vulnerability


Vulnerable code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;

Fixed code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0965 (PHP, published 2022-03-15T16:15Z)
Description: value: Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: Upload file vulnerability


Vulnerable code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;

Fixed code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0966 (PHP, published 2022-03-15T16:15Z)
Description: value: Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: Upload file vulnerability


Vulnerable code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;

Fixed code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-0967 (PHP, published 2022-03-15T16:15Z)
Description: value: Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Model/AttachmentModel.class.php
Commit message: Upload file vulnerability


Vulnerable code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
		if( !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4',
			'.mov','.webmv','.flac','.mkv',
			'.pdf','.ofd','.swf','.epub','.xps',
			'.doc','.docx','.wps',
			) ;

Fixed code:
	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0 , $check_filename = true  ){
		if( $check_filename && !$this->isAllowedFilename($_files[$file_key]['name']) ){
			'.mp3','.wav','.mp4','.mov','.flac','.mkv',
			'.pdf','.epub','.xps','.doc','.docx','.wps',
		) ;
CVE-2022-1034 (PHP, published 2022-03-22T08:15Z)
Description: value: There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/star7th/showdoc
Files changed:
server/Application/Api/Controller/AdminUpdateController.class.php
web_src/src/components/admin/about/Index.vue
Commit message: Security update / 安全性更新


Vulnerable code:
        $new_version = I("new_version") ;
        $file_url = I("file_url") ;
      url: '',
      file_url: ''
          this.file_url = data.data.file_url
      this.request('/api/adminUpdate/download', {
        new_version: this.new_version,
        file_url: this.file_url
      }).then(

Fixed code:
        //获取当前版本
        $text = file_get_contents("../composer.json");
        $composer = json_decode($text, true);
        $version = $composer['version'] ;
        $url = "https://www.showdoc.cc/server/api/open/checkUpdate";
        $res = http_post($url , array("version"=>$version));
        $res_array = json_decode($res,true);
        $new_version =$res_array['data']['new_version'] ;
        $file_url =$res_array['data']['file_url'] ;

        if(!$file_url){
            $this->sendError(10101,'检测更新时异常');
            return ;
        }

      url: ''
      this.request('/api/adminUpdate/download', {}).then(
CVE-2021-32823 (Ruby, published 2021-06-24T00:15Z)
Description: value: In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/dmendel/bindata
Files changed:
ChangeLog.rdoc
lib/bindata/bits.rb
lib/bindata/int.rb
Commit message: Improved creation time of Bits and Integers


Vulnerable code:
          max = (1 << (nbits - 1)) - 1
          min = -(max + 1)
          min = 0
          max = (1 << nbits) - 1
        clamp = "(val < #{min}) ? #{min} : (val > #{max}) ? #{max} : val"
          max = (1 << (nbits - 1)) - 1
          min = -(max + 1)
          max = (1 << nbits) - 1
          min = 0
        "val = (val < #{min}) ? #{min} : (val > #{max}) ? #{max} : val"

Fixed code:
== Version 2.4.10 (2021-05-18)

* Improve speed of dynamic object creation.  Reported by Charlie Ablett.

          max = "max = (1 << (#{nbits} - 1)) - 1"
          min = "min = -(max + 1)"
          min = "min = 0"
          max = "max = (1 << #{nbits}) - 1"
        clamp = "(#{max}; #{min}; val = (val < min) ? min : (val > max) ? max : val)"
          max = "max = (1 << (#{nbits} - 1)) - 1"
          min = "min = -(max + 1)"
          max = "max = (1 << #{nbits}) - 1"
          min = "min = 0"
        clamp = "(#{max}; #{min}; val = (val < min) ? min : (val > max) ? max : val)"

        "val = #{clamp}"
CVE-2022-1711 (Java, published 2022-05-17T13:15Z)
Description: value: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/jgraph/drawio
Files changed:
src/main/java/com/mxgraph/online/ProxyServlet.java
Commit message: Adds isLinkLocalAddress() to address checks

Vulnerable code:

Fixed code:
						&& !address.isLinkLocalAddress()
CVE-2022-1721 (Java, published 2022-05-16T15:15Z)
Description: value: Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jgraph/drawio
Files changed:
src/main/java/com/mxgraph/online/WellKnownServlet.java
Commit message: Limit wellknown servlet to serve single file

Vulnerable code:
 * Servlet to fake a .well-known directory

        if (uri.toLowerCase().contains(".json"))
        {
        	response.setContentType("application/json");
        }

        // Serve whatever was requested from .well-known
        try (InputStream in = getServletContext().getResourceAsStream(uri))
            if (in == null)
            	response.sendError(404);
                return;
            
            byte[] buffer = new byte[8192];
            int count;
            while ((count = in.read(buffer)) > 0)
            	response.getOutputStream().write(buffer, 0, count);
            
            response.getOutputStream().flush();
            response.getOutputStream().close();

Fixed code:
 * Servlet to fake a .well-known directory, GAE does not directly support . prefixed directories
        
        // Currently, there is only one file that this servlet serves. This is only
        // needed if you want OneDrive integration. 
        if (uri != null && uri.equals("/well-known/microsoft-identity-association.json"))
            if (uri.toLowerCase().contains(".json"))
                response.setContentType("application/json");
            // Serve whatever was requested from .well-known
            try (InputStream in = getServletContext().getResourceAsStream(uri))
                if (in == null)
                {
                    response.sendError(404);
                    return;
                }
                
                byte[] buffer = new byte[8192];
                int count;

                while ((count = in.read(buffer)) > 0)
                {
                    response.getOutputStream().write(buffer, 0, count);
                }
                
                response.getOutputStream().flush();
                response.getOutputStream().close();
        }
        else
        {
            response.sendError(404);
            return;
CVE-2022-1722 (Java, published 2022-05-16T15:15Z)
Description: value: SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/jgraph/drawio
Files changed:
src/main/java/com/mxgraph/online/ProxyServlet.java
Commit message: Adds isLinkLocalAddress() to address checks

Vulnerable code:

Fixed code:
						&& !address.isLinkLocalAddress()
CVE-2022-3133 (Unknown, published 2022-09-09T18:15Z)
Description: value: OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/jgraph/drawio
Files changed:
Commit message: Merge branch 'dev' of https://github.com/jgraph/drawio into dev


Vulnerable code:

Fixed code:
CVE-2022-46163 (Ruby, published 2023-01-10T21:15Z)
Description: value: Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be extracted via Ransack query injection. Every deployment of travel-support-program below the patched version is affected. The travel-support-program uses the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The `*_start`, `*_end` or `*_cont` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force (A match is indicated by the returned JSON not being empty). A single bank account number can be extracted with <200 requests, a password hash can be extracted with ~1200 requests, all within a few minutes. The problem has been patched in commit d22916275c51500b4004933ff1b0a69bc807b2b7. In order to work around this issue, you can also cherry pick that patch, however it will not work without the Rails 5.0 migration that was done in #150, which in turn had quite a few pull requests it depended on.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/openSUSE/travel-support-program
Files changed:
app/models/application_record.rb
app/models/reimbursement.rb
Commit message: Allow specific ransack queries


Vulnerable code:

Fixed code:

  def self.ransackable_attributes(_)
    super & %w[end_date start_date name description event_id state]
  end

  def self.ransackable_associations(_)
    []
  end

  def self.ransackable_associations(_)
    %w[request]
  end