hitoshura25/cvefixes huggingface dataset:
CVE-2018-25055 (Other, published 2022-12-28T12:15Z)
Description: value: A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file packages/forms/solrProSearch.cfc of the component Search Handler. The manipulation of the argument suggestion leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is b8f3d61511c9b02b781ec442bfb803cbff8e08d5. It is recommended to upgrade the affected component. The identifier VDB-216961 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jeffcoughlin/farcrysolrpro
Files changed:
packages/forms/solrProSearch.cfc
Commit message: fixes #78 escape suggestion to avoid xss


Vulnerable code:
			<cfoutput>Did you mean <a href="#arguments.linkUrl#">#suggestion#</a>?</cfoutput>

Fixed code:
			<cfoutput>Did you mean <a href="#arguments.linkUrl#">#application.stPlugins.farcrysolrpro.oCustomFunctions.xmlSafeText(suggestion)#</a>?</cfoutput>
CVE-2022-31071 (Unknown, published 2022-06-15T23:15Z)
Description: value: Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octopoller 0.3.0. Two workarounds are available. Users can use the previous version of the gem, v0.1.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/octokit/octopoller.rb
Files changed:
Commit message: Merge pull request #25 from octokit/updates-release-steps-checks

Adds details on how to run a manual file integrity check

Vulnerable code:

Fixed code:
CVE-2019-10477 (PHP, published 2019-03-29T14:29Z)
Description: value: The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-19 \u2014 Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Repository: https://github.com/fusioninventory/fusioninventory-for-glpi
Files changed:
front/send_inventory.php
inc/toolbox.class.php
Commit message: Fix a security problem. Thanks to Julien Szlamowicz && Damien Picard from company synacktiv


Vulnerable code:
$function = $_GET['function'];
call_user_func(['PluginFusioninventoryToolbox', $function], $items_id, $itemtype);
      if (call_user_func([$itemtype, 'canView'])) {

Fixed code:
call_user_func(['PluginFusioninventoryToolbox', 'sendXML'], $items_id, $itemtype);
      if (preg_match("/^([a-zA-Z]+)\/(\d+)\/(\d+)\.xml$/", $items_id)
         && call_user_func([$itemtype, 'canView'])) {
CVE-2021-25913 (JavaScript, published 2021-02-08T22:15Z)
Description: value: Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/IonicaBizau/set-or-get.js
Files changed:
lib/index.js
Commit message: Security fix for Prototype Pollution

Vulnerable code:

Fixed code:
    if (field == '__proto__' || field == 'constructor' || field == 'prototype')
        throw new Error('Restricted setting magical attributes')
CVE-2021-23386 (JavaScript, published 2021-05-20T17:15Z)
Description: value: This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-909 \u2014 Missing Initialization of Resource
The product does not initialize a critical resource.
Repository: https://github.com/mafintosh/dns-packet
Files changed:
index.js
Commit message: do trim on encodingLength as well


Vulnerable code:
  return Buffer.byteLength(n) + 2

Fixed code:
  return Buffer.byteLength(n.replace(/^\.|\.$/gm, '')) + 2
CVE-2023-0301 (Java, published 2023-01-14T18:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/alfio-event/alf.io
Files changed:
src/main/java/alfio/util/MustacheCustomTag.java
src/test/java/alfio/util/MustacheCustomTagTest.java
Commit message: restrict protocols (#1150)



Vulnerable code:

Fixed code:
                var scheme = getScheme(destination);
                scheme.ifPresent(resolvedScheme -> {
                    if (!Set.of("http", "https").contains(resolvedScheme)) {
                        log.info("User tried to set an url with scheme {}, only http/https are accepted, href has been removed", resolvedScheme);
                        attributes.remove("href");
                    }
                });
                    // accept only http or https protocols if we have an absolute link, else we override with an empty string
    /**
     * return lowercase scheme if present
     */
    private static Optional<String> getScheme(String uri) {
        var s = StringUtils.trimToEmpty(uri).toLowerCase(Locale.ROOT);
        return s.indexOf(':') >= 0 ? Optional.of(StringUtils.substringBefore(s, ':')) : Optional.empty();
    }


    @Test
    public void acceptOnlyHttpOrHttpsProtocols() {
        assertEquals("<p><a href=\"http://google.com\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">google</a></p>\n", MustacheCustomTag.renderToHtmlCommonmarkEscaped("[google](http://google.com)"));
        assertEquals("<p><a href=\"https://google.com\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">google</a></p>\n", MustacheCustomTag.renderToHtmlCommonmarkEscaped("[google](https://google.com)"));
        assertEquals("<p><a>google</a></p>\n", MustacheCustomTag.renderToHtmlCommonmarkEscaped("[google](any:google.com)"));
        assertEquals("<p><a>google</a></p>\n", MustacheCustomTag.renderToHtmlCommonmarkEscaped("[google](other:google.com)"));
        assertEquals("<p><a>google</a></p>\n", MustacheCustomTag.renderToHtmlCommonmarkEscaped("[google](protocols:/google.com)"));
    }
CVE-2018-11757 (Python, published 2018-07-23T17:29Z)
Description: value: In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/apache/incubator-openwhisk-runtime-docker
Files changed:
core/actionProxy/actionproxy.py
tests/src/test/scala/runtime/actionContainers/ActionProxyContainerTests.scala
Commit message: Do not allow re-init of the action exec.

Disables re-initialization of the executable unless explicitly permitted
via an environment variable PROXY_ALLOW_REINIT == "1", which is generally
useful for local testing and development.


Vulnerable code:

Fixed code:
# disable re-initialization of the executable unless explicitly allowed via an environment
# variable PROXY_ALLOW_REINIT == "1" (this is generally useful for local testing and development)
proxy.rejectReinit = 'PROXY_ALLOW_REINIT' not in os.environ or os.environ['PROXY_ALLOW_REINIT'] != "1"
proxy.initialized = False
    if proxy.rejectReinit is True and proxy.initialized is True:
        msg = 'Cannot initialize the action more than once.'
        sys.stderr.write(msg + '\n')
        response = flask.jsonify({'error': msg})
        response.status_code = 403
        return complete(response)

        proxy.initialized = True
  testInitCannotBeCalledMoreThanOnce(codeNotReturningJson) // any code sample will do
CVE-2023-46138 (Python, published 2023-10-31T00:15Z)
Description: value: JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an email. Currently, the domain `mycompany.com` has not been registered. However, if it is registered in the future, it may affect the password reset functionality. This issue has been patched in version 3.8.0 by changing the default email domain to `example.com`. Those who cannot upgrade may change the default email domain to `example.com` manually.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/jumpserver/jumpserver
Files changed:
apps/common/tasks.py
apps/users/migrations/0046_auto_20230927_1456.py
Commit message: perf: 修改默认的邮箱地址


Vulnerable code:
    args[3] = [mail for mail in args[3] if mail != 'admin@mycomany.com']

    recipient_list = [mail for mail in recipient_list if mail != 'admin@mycomany.com']

Fixed code:
# Generated by Django 4.1.10 on 2023-09-27 06:56

from django.db import migrations


def migrate_user_default_email(apps, *args):
    user_cls = apps.get_model('users', 'User')
    user_cls.objects\
        .filter(email='admin@mycomany.com')\
        .update(email='admin@example.com')


class Migration(migrations.Migration):

    dependencies = [
        ('users', '0045_delete_usersession'),
    ]

    operations = [
        migrations.RunPython(migrate_user_default_email),
    ]
CVE-2021-23360 (JavaScript, published 2021-03-21T16:15Z)
Description: value: This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ssnau/killport
Files changed:
index.js
Commit message: fix a vulnerability issue if a provided port is not a number


Vulnerable code:

Fixed code:
    if (!/^\d+$/.test(port)) throw new Error('port must be a number.');
CVE-2022-25887 (Unknown, published 2022-08-30T05:15Z)
Description: value: The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/apostrophecms/sanitize-html
Files changed:
Commit message: Merge pull request #557 from apostrophecms/release-2.7.1

Release 2.7.1

Vulnerable code:

Fixed code:
CVE-2024-21501 (Markdown, published 2024-02-24T05:15Z)
Description: value: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/apostrophecms/sanitize-html
Files changed:
CHANGELOG.md
Commit message: Merge pull request #650 from dylanarmstrong/fix/ignore-source-maps

fix: ignore source maps when processing with postcss

Vulnerable code:

Fixed code:
 - Do not process source maps when processing style tags with PostCSS.
CVE-2018-20303 (Go, published 2018-12-20T00:29Z)
Description: value: In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gogs/gogs
Files changed:
gogs.go
pkg/tool/path.go
pkg/tool/path_test.go
templates/.VERSION
Commit message: pkg/tool: improve SanitizePath (#5558)


Vulnerable code:
const APP_VER = "0.11.81.1217"
	return strings.TrimLeft(path, "./")
0.11.81.1217

Fixed code:
const APP_VER = "0.11.82.1218"
	path = strings.TrimLeft(path, "/")
	path = strings.Replace(path, "../", "", -1)
	return path
			{"data/gogs/../../../../../../../../../data/sessions/a/9/a9f0ab6c3ef63dd8", "data/gogs/data/sessions/a/9/a9f0ab6c3ef63dd8"},
0.11.82.1218
CVE-2020-14958 (Go, published 2020-06-21T20:15Z)
Description: value: In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Repository: https://github.com/gogs/gogs
Files changed:
CHANGELOG.md
Makefile
internal/assets/public/public_gen.go
internal/db/user_mail.go
internal/route/user/setting.go
Commit message: email: check the owner when set as primary (#5988)

* email: check the owner when set as primary

Fixes a security issue reported by muxishuihan.

* Update CHANGELOG

Vulnerable code:
generate: $(ASSETS_GENERATED)
less: public/css/gogs.min.css
	info := bindataFileInfo{name: "css/gogs.min.css", size: 64378, mode: os.FileMode(0644), modTime: time.Unix(1584214336, 0)}
	info := bindataFileInfo{name: "css/gogs.min.css.map", size: 22926, mode: os.FileMode(0644), modTime: time.Unix(1584214336, 0)}
func MakeEmailPrimary(email *EmailAddress) error {
		if err := db.MakeEmailPrimary(&db.EmailAddress{ID: c.QueryInt64("id")}); err != nil {

Fixed code:
- [Security] Potential ability to set primary email on others' behalf from their verified emails.
generate: clean $(ASSETS_GENERATED)
less: clean public/css/gogs.min.css
	info := bindataFileInfo{name: "css/gogs.min.css", size: 64378, mode: os.FileMode(0644), modTime: time.Unix(1584215361, 0)}
	info := bindataFileInfo{name: "css/gogs.min.css.map", size: 22926, mode: os.FileMode(0644), modTime: time.Unix(1584215361, 0)}
func MakeEmailPrimary(userID int64, email *EmailAddress) error {
	if email.UID != userID {
		return errors.New("not the owner of the email")
	}

		if err := db.MakeEmailPrimary(c.UserID(), &db.EmailAddress{ID: c.QueryInt64("id")}); err != nil {
CVE-2022-1986 (Go, published 2022-06-09T17:15Z)
Description: value: OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/gogs/gogs
Files changed:
CHANGELOG.md
internal/db/repo_editor.go
internal/db/repo_editor_test.go
Commit message: repo_editor: check both styles of `os.PathSeparator` in all systems (#7005)



Vulnerable code:
		strings.Contains(path, ".git"+string(os.PathSeparator)) ||
		strings.Contains(path, ".git."+string(os.PathSeparator))
	"path/filepath"
		{path: filepath.Join(".", ".git"), wantVal: true},
		{path: filepath.Join(".", ".git", ""), wantVal: true},
		{path: filepath.Join(".", ".git", "hooks", "pre-commit"), wantVal: true},
		{path: filepath.Join(".git", "hooks"), wantVal: true},
		{path: filepath.Join("dir", ".git"), wantVal: true},

		{path: filepath.Join(".", ".git."), wantVal: true},
		{path: filepath.Join(".", ".git.", ""), wantVal: true},
		{path: filepath.Join(".", ".git.", "hooks", "pre-commit"), wantVal: true},
		{path: filepath.Join(".git.", "hooks"), wantVal: true},
		{path: filepath.Join("dir", ".git."), wantVal: true},

		{path: filepath.Join(".gitignore"), wantVal: false},
		{path: filepath.Join("dir", ".gitkeep"), wantVal: false},
		t.Run("", func(t *testing.T) {

Fixed code:
- _Security:_ OS Command Injection in file editor. [#7000](https://github.com/gogs/gogs/issues/7000)
		strings.Contains(path, ".git/") ||
		strings.Contains(path, `.git\`) ||
		strings.Contains(path, ".git./") ||
		strings.Contains(path, `.git.\`)
		{path: ".git", wantVal: true},
		{path: "./.git", wantVal: true},
		{path: ".git/hooks/pre-commit", wantVal: true},
		{path: ".git/hooks", wantVal: true},
		{path: "dir/.git", wantVal: true},

		{path: ".gitignore", wantVal: false},
		{path: "dir/.gitkeep", wantVal: false},

		// Windows-specific
		{path: `.git\`, wantVal: true},
		{path: `.git\hooks\pre-commit`, wantVal: true},
		{path: `.git\hooks`, wantVal: true},
		{path: `dir\.git`, wantVal: true},

		{path: `.\.git.`, wantVal: true},
		{path: `.\.git.\`, wantVal: true},
		{path: `.git.\hooks\pre-commit`, wantVal: true},
		{path: `.git.\hooks`, wantVal: true},
		{path: `dir\.git.`, wantVal: true},

		{path: "./.git.", wantVal: true},
		{path: "./.git./", wantVal: true},
		{path: ".git./hooks/pre-commit", wantVal: true},
		{path: ".git./hooks", wantVal: true},
		{path: "dir/.git.", wantVal: true},

		{path: `dir\.gitkeep`, wantVal: false},
		t.Run(test.path, func(t *testing.T) {
CVE-2022-1992 (Go, published 2022-06-09T17:15Z)
Description: value: Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gogs/gogs
Files changed:
CHANGELOG.md
internal/pathutil/pathutil.go
internal/pathutil/pathutil_test.go
Commit message: pathutil: check both styles of `os.PathSeparator` (#7020)



Vulnerable code:
// Clean cleans up given path and returns a relative path that goes straight down.
		path   string
		expVal string
			path:   "../../../readme.txt",
			expVal: "readme.txt",
			path:   "a/../../../readme.txt",
			expVal: "readme.txt",
			path:   "/../a/b/../c/../readme.txt",
			expVal: "a/readme.txt",
			path:   "/a/readme.txt",
			expVal: "a/readme.txt",
			path:   "/",
			expVal: "",
			path:   "/a/b/c/readme.txt",
			expVal: "a/b/c/readme.txt",
		t.Run("", func(t *testing.T) {
			assert.Equal(t, test.expVal, Clean(test.path))

Fixed code:
- _Security:_ Path Traversal in file editor on Windows. [#7001](https://github.com/gogs/gogs/issues/7001)
// Clean cleans up given path and returns a relative path that goes straight
// down to prevent path traversal.
	p = strings.ReplaceAll(p, `\`, "/")
		path    string
		wantVal string
			path:    "../../../readme.txt",
			wantVal: "readme.txt",
			path:    "a/../../../readme.txt",
			wantVal: "readme.txt",
			path:    "/../a/b/../c/../readme.txt",
			wantVal: "a/readme.txt",
			path:    "/a/readme.txt",
			wantVal: "a/readme.txt",
			path:    "/",
			wantVal: "",
			path:    "/a/b/c/readme.txt",
			wantVal: "a/b/c/readme.txt",
		},

		// Windows-specific
		{
			path:    `..\..\..\readme.txt`,
			wantVal: "readme.txt",
		},
		{
			path:    `a\..\..\..\readme.txt`,
			wantVal: "readme.txt",
		},
		{
			path:    `\..\a\b\..\c\..\readme.txt`,
			wantVal: "a/readme.txt",
		},
		{
			path:    `\a\readme.txt`,
			wantVal: "a/readme.txt",
		},
		{
			path:    `..\..\..\../README.md`,
			wantVal: "README.md",
		},
		{
			path:    `\`,
			wantVal: "",
		},

		{
			path:    `\a\b\c\readme.txt`,
			wantVal: `a/b/c/readme.txt`,
		t.Run(test.path, func(t *testing.T) {
			assert.Equal(t, test.wantVal, Clean(test.path))