hitoshura25/cvefixes huggingface dataset:
CVE-2018-14357 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://gitlab.com/muttmua/mutt
Files changed:
imap/command.c
imap/imap.c
imap/imap_private.h
imap/util.c
Commit message: Properly quote IMAP mailbox names when (un)subscribing.

When handling automatic subscription (via $imap_check_subscribed), or
manual subscribe/unsubscribe commands, mutt generating a "mailboxes"
command but failed to properly escape backquotes.

Thanks to Jeriko One for the detailed bug report and patch, which this
commit is based upon.


Vulnerable code:
  /* escape \ and " */
  imap_quote_string(errstr, sizeof (errstr), list.name);
    snprintf (mbox, sizeof (mbox), "%smailboxes \"%s\"",
              subscribe ? "" : "un", path);
void imap_quote_string (char* dest, size_t slen, const char* src);
/* imap_quote_string: quote string according to IMAP rules:
 *   surround string with quotes, escape " and \ with \ */
void imap_quote_string (char *dest, size_t dlen, const char *src)
  static const char quote[] = "\"\\";
    if (strchr (quote, *s))

Fixed code:
  /* escape \ and ". Also escape ` because the resulting
   * string will be passed to mutt_parse_rc_line. */
  imap_quote_string_and_backquotes (errstr, sizeof (errstr), list.name);
  int mblen;
    mblen = snprintf (mbox, sizeof (mbox), "%smailboxes ",
                      subscribe ? "" : "un");
    imap_quote_string_and_backquotes (mbox + mblen, sizeof(mbox) - mblen,
                                      path);
void imap_quote_string (char* dest, size_t dlen, const char* src);
void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src);
static void _imap_quote_string (char *dest, size_t dlen, const char *src,
                                const char *to_quote)
    if (strchr (to_quote, *s))
/* imap_quote_string: quote string according to IMAP rules:
 *   surround string with quotes, escape " and \ with \ */
void imap_quote_string (char *dest, size_t dlen, const char *src)
{
  _imap_quote_string (dest, dlen, src, "\"\\");
}

/* imap_quote_string_and_backquotes: quote string according to IMAP rules:
 *   surround string with quotes, escape " and \ with \.
 * Additionally, escape backquotes with \ to protect against code injection
 * when using the resulting string in mutt_parse_rc_line().
 */
void imap_quote_string_and_backquotes (char *dest, size_t dlen, const char *src)
{
  _imap_quote_string (dest, dlen, src, "\"\\`");
}
CVE-2018-14358 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long RFC822.SIZE field.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://gitlab.com/muttmua/mutt
Files changed:
imap/message.c
Commit message: Don't overflow tmp in msg_parse_fetch.

Ensure INTERNALDATE and RFC822.SIZE field sizes fit temp buffer.

Thanks to Jeriko One for the bug report and patch, which this patch is
based upon.


Vulnerable code:
      while (*s && *s != '\"')
      while (isdigit ((unsigned char) *s))

Fixed code:
  size_t dlen;
      dlen = sizeof(tmp) - 1;
      while (*s && *s != '\"' && dlen)
      {
        dlen--;
      }
      dlen = sizeof(tmp) - 1;
      while (isdigit ((unsigned char) *s) && dlen)
      {
        dlen--;
      }
CVE-2018-14359 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They have a buffer overflow via base64 data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://gitlab.com/muttmua/mutt
Files changed:
base64.c
imap/auth_cram.c
imap/auth_gss.c
protos.h
Commit message: Check outbuf length in mutt_from_base64()

The obuf can be overflowed in auth_cram.c, and possibly auth_gss.c.

Thanks to Jeriko One for the bug report.


Vulnerable code:
int mutt_from_base64 (char *out, const char *in)
  if ((len = mutt_from_base64 (obuf, idata->buf + 2)) == -1)
    request_buf.length = mutt_from_base64 (buf2, idata->buf + 2);
  request_buf.length = mutt_from_base64 (buf2, idata->buf + 2);
int mutt_from_base64 (char*, const char*);

Fixed code:
int mutt_from_base64 (char *out, const char *in, size_t olen)
    if (len == olen)
      return len;
      if (len == olen)
        return len;
        if (len == olen)
          return len;
  if ((len = mutt_from_base64 (obuf, idata->buf + 2, sizeof(obuf) - 1)) == -1)
    request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2));
  request_buf.length = mutt_from_base64 (buf2, idata->buf + 2, sizeof(buf2));
int mutt_from_base64 (char*, const char*, size_t);
CVE-2018-14362 (C, published 2018-07-17T17:29Z)
Description: value: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://gitlab.com/muttmua/mutt
Files changed:
pop.c
Commit message: Sanitize POP bcache paths.

Protect against bcache directory path traversal for UID values.

Thanks for Jeriko One for the bug report and patch, which this commit
is based upon.


Vulnerable code:
  return mutt_bcache_del (bcache, id);
      bcached = mutt_bcache_exists (pop_data->bcache, ctx->hdrs[i]->data) == 0;
  if ((msg->fp = mutt_bcache_get (pop_data->bcache, h->data)))
    if (!(msg->fp = mutt_bcache_put (pop_data->bcache, h->data, 1)))
    mutt_bcache_commit (pop_data->bcache, h->data);
	  mutt_bcache_del (pop_data->bcache, ctx->hdrs[i]->data);

Fixed code:
/**
 * cache_id - Make a message-cache-compatible id
 * @param id POP message id
 * @retval ptr Sanitised string
 *
 * The POP message id may contain '/' and other awkward characters.
 *
 * @note This function returns a pointer to a static buffer.
 */
static const char *cache_id(const char *id)
{
  static char clean[SHORT_STRING];

  strfcpy (clean, id, sizeof(clean));
  mutt_sanitize_filename (clean, 1);

  return clean;
}

  return mutt_bcache_del (bcache, cache_id (id));
      bcached = mutt_bcache_exists (pop_data->bcache, cache_id (ctx->hdrs[i]->data)) == 0;
  if ((msg->fp = mutt_bcache_get (pop_data->bcache, cache_id (h->data))))
    if (!(msg->fp = mutt_bcache_put (pop_data->bcache, cache_id (h->data), 1)))
    mutt_bcache_commit (pop_data->bcache, cache_id (h->data));
	  mutt_bcache_del (pop_data->bcache, cache_id (ctx->hdrs[i]->data));
CVE-2022-0571 (PHP, published 2022-02-14T12:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phoronix-test-suite/phoronix-test-suite
Files changed:
pts-core/phoromatic/phoromatic_functions.php
Commit message: phoromatic: Reject HTML encoded character input and other strings that likely have no use within the context of Phoromatic inputs


Vulnerable code:
	foreach(array('<', 'document.write', '../', 'onerror', 'onload', 'alert(') as $invalid_string)

Fixed code:
	foreach(array('<', '>', 'document.write', '../', 'onerror', 'onload', 'alert(', 'String.', 'confirm(', 'focus=', '&lt', '&gt', '&#') as $invalid_string)
CVE-2022-40704 (PHP, published 2023-01-17T19:15Z)
Description: value: A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phoronix-test-suite/phoronix-test-suite
Files changed:
pts-core/phoromatic/phoromatic_functions.php
Commit message: phoromatic: Explicitly check both $_GET abd $_POST in phoromatic_quit_if_invalid_input_found()

Fixes: https://github.com/phoronix-test-suite/phoronix-test-suite/issues/650#issuecomment-1193116678


Vulnerable code:
			if(isset($_REQUEST[$key]) && !empty($_REQUEST[$key]))
				foreach(pts_arrays::to_array($_REQUEST[$key]) as $val_to_check)

Fixed code:
			if(isset($_GET[$key]) && !empty($_GET[$key]))
				foreach(pts_arrays::to_array($_GET[$key]) as $val_to_check)
				{
					if(stripos($val_to_check, $invalid_string) !== false)
					{
						echo '<strong>Exited due to invalid input ( ' . $invalid_string . ') attempted:</strong> ' . htmlspecialchars($val_to_check);
						exit;
					}
				}
			}
			if(isset($_POST[$key]) && !empty($_POST[$key]))
			{
				foreach(pts_arrays::to_array($_POST[$key]) as $val_to_check)
CVE-2016-5735 (C, published 2017-05-23T04:29Z)
Description: value: Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/pornel/pngquant
Files changed:
rwpng.c
Commit message: Fix integer overflow in rwpng.h (CVE-2016-5735)

Reported by Choi Jaeseung 
Found with Sparrow (http://ropas.snu.ac.kr/sparrow)

Vulnerable code:
    // For overflow safety reject images that won't fit in 32-bit
    if (mainprog_ptr->width > INT_MAX/mainprog_ptr->height) {
        png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
        return PNG_OUT_OF_MEMORY_ERROR;  /* not quite true, but whatever */
    }


Fixed code:
    // For overflow safety reject images that won't fit in 32-bit
    if (rowbytes > INT_MAX/mainprog_ptr->height) {
        png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
        return PNG_OUT_OF_MEMORY_ERROR;
    }
CVE-2020-5292 (Unknown, published 2020-03-31T19:15Z)
Description: value: Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users' and administrators' password hashes, modify data, or drop tables. The unescaped parameter is "searchUsers" when sending a POST request to "/tickets/showKanban" with a valid session. In the code, the parameter is named "users" in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Leantime/leantime
Files changed:
Commit message: Merge pull request #181 from Leantime/issue179-sql-bind-injection

fix: use PDO injection for IN clause for tickets query for users filter

Vulnerable code:

Fixed code:
CVE-2023-45826 (Unknown, published 2023-10-19T19:15Z)
Description: value: Leantime is an open source project management system. A 'userId' variable in `app/domain/files/repositories/class.files.php` is not parameterized. An authenticated attacker can send a carefully crafted POST request to `/api/jsonrpc` to exploit an SQL injection vulnerability. Confidentiality is impacted as it allows for dumping information from the database. This issue has been addressed in version 2.4-beta-4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Leantime/leantime
Files changed:
Commit message: Merge pull request #1906 from Leantime/bugFixes

Bug fixes

Vulnerable code:

Fixed code:
CVE-2020-5294 (Unknown, published 2020-04-16T22:15Z)
Description: value: PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/ps_socialfollow
Files changed:
Commit message: Merge pull request from GHSA-774w-fg8p-7c8w

Check if fields are URL

Vulnerable code:

Fixed code:
CVE-2024-40624 (PHP, published 2024-07-15T20:15Z)
Description: value: TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to viewforum.php. This issue has been addressed in commit `ed37e6e52` which is expected to be included in release version 2.4.4. Users are advised to upgrade as soon as the new release is available. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/torrentpier/torrentpier
Files changed:
library/includes/functions.php
src/Legacy/Common/User.php
Commit message: Merge commit from fork



Vulnerable code:
    static $pattern = '#^a:\d+:{[i:;\d]+}$#';

    $tracks = !empty($_COOKIE[$c_name]) ? @unserialize($_COOKIE[$c_name]) : false;
        bb_setcookie($cookie_name, serialize($tracking_ary));
        $sd_resv = !empty($_COOKIE[COOKIE_DATA]) ? unserialize($_COOKIE[COOKIE_DATA], ['allowed_classes' => false]) : [];
            $c_sdata_curr = ($this->sessiondata) ? serialize($this->sessiondata) : '';

Fixed code:
    $tracks = !empty($_COOKIE[$c_name]) ? json_decode($_COOKIE[$c_name], true) : false;
        bb_setcookie($cookie_name, json_encode($tracking_ary));
        $sd_resv = !empty($_COOKIE[COOKIE_DATA]) ? json_decode($_COOKIE[COOKIE_DATA], true) : [];
            $c_sdata_curr = ($this->sessiondata) ? json_encode($this->sessiondata) : '';
CVE-2019-20922 (JavaScript, published 2020-09-30T18:15Z)
Description: value: Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/handlebars-lang/handlebars.js
Files changed:
spec/helpers.js
spec/tokenizer.js
src/handlebars.l
Commit message: fix: non-eager matching raw-block-contents

In 4.4.4 the block-contents was matched with an eager match, which means
that with multiple raw-blocks of the same kind, the block was spanned
over the first ending-tag until the last one.
This commit replaces this by a non-eager match.

closes #1579


Vulnerable code:
    it('helper for nested raw block works if nested raw blocks are broken', function() {
<raw>[^\x00]+/("{{{{")          { return 'CONTENT'; }

Fixed code:
    xit('helper for nested raw block works if nested raw blocks are broken', function() {
      // This test was introduced in 4.4.4, but it was not the actual problem that lead to the patch release
      // The test is deactivated, because in 3.x this template cases an exception and it also does not work in 4.4.3
      // If anyone can make this template work without breaking everything else, then go for it,
      // but for now, this is just a known bug, that will be documented.
    it('helper for nested raw block closes after first matching close', function() {
      runWithIdentityHelper('{{{{identity}}}}abc{{{{/identity}}}} {{{{identity}}}}abc{{{{/identity}}}}', 'abc abc');
    });


  it('tokenizes raw blocks', function() {
    var result = tokenize('{{{{a}}}} abc {{{{/a}}}} aaa {{{{a}}}} abc {{{{/a}}}}');
    shouldMatchTokens(result, ['OPEN_RAW_BLOCK', 'ID', 'CLOSE_RAW_BLOCK', 'CONTENT', 'END_RAW_BLOCK', 'CONTENT', 'OPEN_RAW_BLOCK', 'ID', 'CLOSE_RAW_BLOCK', 'CONTENT', 'END_RAW_BLOCK']);
  });
<raw>[^\x00]+?/("{{{{")          { return 'CONTENT'; }
CVE-2021-23369 (JavaScript, published 2021-04-12T14:15Z)
Description: value: The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/handlebars-lang/handlebars.js
Files changed:
lib/handlebars/runtime.js
spec/security.js
Commit message: fix: check prototype property access in strict-mode (#1736)


Vulnerable code:
      return obj[name];

Fixed code:
      return container.lookupProperty(obj, name);
      describe('in strict-mode', function() {
        checkProtoPropertyAccess({ strict: true });
      });
CVE-2022-0084 (Unknown, published 2022-08-26T18:15Z)
Description: value: A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/xnio/xnio
Files changed:
Commit message: Merge pull request #291 from OrangeDog/patch-1



Vulnerable code:

Fixed code:
CVE-2017-11365 (PHP, published 2019-05-23T18:29Z)
Description: value: Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/symfony/symfony
Files changed:
src/Symfony/Component/Security/Core/Tests/Validator/Constraints/UserPasswordValidatorTest.php
src/Symfony/Component/Security/Core/Validator/Constraints/UserPasswordValidator.php
Commit message: [Security] validate empty passwords again


Vulnerable code:

Fixed code:
    /**
     * @dataProvider emptyPasswordData
     */
    public function testEmptyPasswordsAreNotValid($password)
    {
        $constraint = new UserPassword(array(
            'message' => 'myMessage',
        ));

        $this->validator->validate($password, $constraint);

        $this->buildViolation('myMessage')
            ->assertRaised();
    }

    public function emptyPasswordData()
    {
        return array(
            array(null),
            array(''),
        );
    }

            $this->context->addViolation($constraint->message);