hitoshura25/cvefixes huggingface dataset:
CVE-2018-16407 (Other, published 2018-09-03T19:29Z)
Description: value: An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://gitlab.com/mayan-edms/mayan-edms
Files changed:
HISTORY.rst
mayan/apps/tags/widgets.py
Commit message: Add explicit casting of escaped tag labels to prevent exploit of cross site scripting. Thanks to Lokesh (@lokesh1095) for the report and proposed solutions. Closes GitLab issue #496.

Signed-off-by: Roberto Rosario <roberto.rosario.gonzalez@gmail.com>


Vulnerable code:
            name=name, value=value, label=label, selected=selected,
            index=index, subindex=subindex, attrs=attrs

Fixed code:
3.0.3 (2018-08-17)
==================
- Add explicit casting of escaped tag labels to prevent exploit
  of cross site scripting. Thanks to Lokesh (@lokesh1095) for
  the report and proposed solutions. Closes GitLab issue #496.

from django.utils.html import conditional_escape
            name=name, value=value, label='{}'.format(conditional_escape(label)),
            selected=selected, index=index, subindex=subindex, attrs=attrs
CVE-2022-21797 (Python, published 2022-09-26T05:15Z)
Description: value: The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/joblib/joblib
Files changed:
CHANGES.rst
joblib/parallel.py
Commit message: FIX make sure pre_dispatch cannot do arbitrary code execution (#1321)



Vulnerable code:
            default and the workers should never starve.
                pre_dispatch = eval(pre_dispatch)

Fixed code:
- Fix a security issue where ``eval(pre_dispatch)`` could potentially run
  arbitrary code. Now only basic numerics are supported.
  https://github.com/joblib/joblib/pull/1321

            default and the workers should never starve. Note that only basic
            arithmetics are allowed here and no modules can be used in this
            expression.
                pre_dispatch = eval(
                    pre_dispatch,
                    {"n_jobs": n_jobs, "__builtins__": {}},  # globals
                    {}  # locals
                )
CVE-2018-7206 (Python, published 2018-02-18T03:29Z)
Description: value: An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jupyterhub/oauthenticator
Files changed:
oauthenticator/gitlab.py
Commit message: Security fix: fix gitlab group whitelist check

check group membership of users

previously, group_whitelist allowed any user who could access the groups in the whitelist,
rather than checking their membership of the groups.

Admin users received the correct behavior already


Vulnerable code:
from .common import next_page_from_links
        if is_admin:
            # For admins, /groups returns *all* groups. As a workaround
            # we check if we are a member of each group in the whitelist
            for group in map(url_escape, self.gitlab_group_whitelist):
                url = "%s/groups/%s/members/%d" % (GITLAB_API, group, user_id)
                req = HTTPRequest(url, method="GET", headers=headers)
                resp = yield http_client.fetch(req, raise_error=False)
                if resp.code == 200:
                    return True  # user _is_ in group
        else:
            # For regular users we get all the groups to which they have access
            # and check if any of these are in the whitelisted groups
            next_page = url_concat("%s/groups" % GITLAB_API,
                                   dict(all_available=True))
            while next_page:
                req = HTTPRequest(next_page, method="GET", headers=headers)
                resp = yield http_client.fetch(req)
                resp_json = json.loads(resp.body.decode('utf8', 'replace'))
                next_page = next_page_from_links(resp)
                user_groups = set(entry["path"] for entry in resp_json)
                # check if any of the organizations seen thus far are in whitelist
                if len(self.gitlab_group_whitelist & user_groups) > 0:
                    return True
            return False


Fixed code:
        # Check if we are a member of each group in the whitelist
        for group in map(url_escape, self.gitlab_group_whitelist):
            url = "%s/groups/%s/members/%d" % (GITLAB_API, group, user_id)
            req = HTTPRequest(url, method="GET", headers=headers)
            resp = yield http_client.fetch(req, raise_error=False)
            if resp.code == 200:
                return True  # user _is_ in group
        return False
CVE-2020-26250 (Unknown, published 2020-12-01T21:15Z)
Description: value: OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed." you are likely affected. Updating oauthenticator to 0.12.2 is recommended. A workaround is to replace the deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...`. If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, per the referenced documentation.
Severity: LOW (CVSS v3 base score: 6.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/jupyterhub/oauthenticator
Files changed:
Commit message: Merge pull request from GHSA-384w-5v3f-q499

fix conflict with deprecations in jupyterhub 1.2

Vulnerable code:

Fixed code:
CVE-2024-29033 (Unknown, published 2024-03-20T21:15Z)
Description: value: OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jupyterhub/oauthenticator
Files changed:
Commit message: Merge pull request from GHSA-55m3-44xf-hg4h

GoogleOAuthenticator.hosted_domain: check against hd, not email's domain

Vulnerable code:

Fixed code:
CVE-2024-37300 (Unknown, published 2024-06-12T16:15Z)
Description: value: OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jupyterhub/oauthenticator
Files changed:
Commit message: Merge pull request from GHSA-gprj-3p75-f996

globus: apply identity_provider restriction in `check_blocked_users`

Vulnerable code:

Fixed code:
CVE-2018-7652 (Perl, published 2018-03-04T01:29Z)
Description: value: lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dotse/zonemaster-gui
Files changed:
lib/Zonemaster/GUI/Dancer/Export.pm
Commit message: Escape HTML


Vulnerable code:
			push( @test_results, { is_module => 0, message => $result->{message}, class => "alert alert-$result->{level}" } );

Fixed code:
			push( @test_results, { is_module => 0, message => HTML::Entities::encode($result->{message}), class => "alert alert-$result->{level}" } );
CVE-2023-34237 (Python, published 2023-06-07T20:15Z)
Description: value: SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the vulnerabilities requires access to the web interface. Remote exploitation is possible if users[exposed their setup to the internet or other untrusted networks without setting a username/password. By default SABnzbd is only accessible from `localhost`, with no authentication required for the web interface. This issue has been patched in commits `e3a722` and `422b4f` which have been included in the 4.0.2 release. Users are advised to upgrade. Users unable to upgrade should ensure that a username and password have been set if their instance is web accessible.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sabnzbd/sabnzbd
Files changed:
sabnzbd/newsunpack.py
sabnzbd/notifier.py
Commit message: Notification Script did not get environment variables

Vulnerable code:
    elif not nzo:
        # No modification
        return None
        env = {"notification_parameters": test.get("nscript_parameters")}
        env = {"notification_parameters": sabnzbd.cfg.nscript_parameters()}
                p = build_and_run_command([script_path, gtype, title, msg], env=create_env(extra_env_fields=env))
                logging.info("Failed script %s, Traceback: ", script, exc_info=True)

Fixed code:
        env_params = {"notification_parameters": test.get("nscript_parameters")}
        env_params = {"notification_parameters": sabnzbd.cfg.nscript_parameters()}
                p = build_and_run_command([script_path, gtype, title, msg], env=create_env(extra_env_fields=env_params))
                logging.info("Failed to run script %s", script, exc_info=True)
                logging.debug("Script output: %s", output)
CVE-2023-34237 (Python, published 2023-06-07T20:15Z)
Description: value: SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the vulnerabilities requires access to the web interface. Remote exploitation is possible if users[exposed their setup to the internet or other untrusted networks without setting a username/password. By default SABnzbd is only accessible from `localhost`, with no authentication required for the web interface. This issue has been patched in commits `e3a722` and `422b4f` which have been included in the 4.0.2 release. Users are advised to upgrade. Users unable to upgrade should ensure that a username and password have been set if their instance is web accessible.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sabnzbd/sabnzbd
Files changed:
sabnzbd/notifier.py
Commit message: Move Notification Script Parameters to environment variable

Fixes #2549

Vulnerable code:
        nscript_parameters = test.get("nscript_parameters")
        nscript_parameters = sabnzbd.cfg.nscript_parameters()
    nscript_parameters = nscript_parameters.split()
                p = build_and_run_command([script_path, gtype, title, msg] + nscript_parameters, env=create_env())

Fixed code:
        env = {"notification_parameters": test.get("nscript_parameters")}
        env = {"notification_parameters": sabnzbd.cfg.nscript_parameters()}

                p = build_and_run_command([script_path, gtype, title, msg], env=create_env(extra_env_fields=env))
CVE-2024-35180 (Python, published 2024-05-21T13:15Z)
Description: value: OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ome/omero-web
Files changed:
omeroweb/webgateway/views.py
Commit message: Check that the JSONP callback is a valid function


Vulnerable code:

Fixed code:
# Regular expression that represents the characters in ASCII that are
# allowed in a valid JavaScript variable name.  Function names adhere to
# the same rules.
# See:
#   https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names
VALID_JS_VARIABLE = re.compile(r"^[a-zA-Z_$][0-9a-zA-Z_$]*$")


                if not VALID_JS_VARIABLE.match(c):
                    return HttpResponseBadRequest("Invalid callback")
CVE-2023-27130 (PHP, published 2023-03-16T15:15Z)
Description: value: Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/typecho/typecho
Files changed:
var/Widget/Archive.php
var/Widget/Menu.php
Commit message: fix #1535


Vulnerable code:
            $filterKeywords = $this->request->filter('search')->s;
        $currentUrl = $this->request->makeUriByRequest();
        $defaultChildeNode = [null, null, null, 'administrator', false, null];
                $childNode += $defaultChildeNode;
        $this->currentUrl = $currentUrl;

Fixed code:
            $filterKeywords = $this->request->filter('search')->get('s');
        $currentUrl = $this->request->getRequestUrl();
        $defaultChildNode = [null, null, null, 'administrator', false, null];
                $childNode += $defaultChildNode;
        $this->currentUrl = Common::safeUrl($currentUrl);
CVE-2024-27088 (JavaScript, published 2024-02-26T17:15Z)
Description: value: es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the script to stall. The vulnerability is patched in v0.10.63.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/medikoo/es5-ext
Files changed:
function/#/copy.js
Commit message: fix: Do not rely on problematic regex

Addresses #201


Vulnerable code:
  , validFunction = require("../valid-function")
  , re            = /^\s*function\s*([\0-')-\uffff]+)*\s*\(([\0-(*-\uffff]*)\)\s*\{/;
	var match = String(validFunction(this)).match(re), fn;
	fn = new Function(
			match[1].trim() +
			match[2] +

Fixed code:
  , validFunction = require("../valid-function");
	validFunction(this);
	var args = [];
	for (var i = 0; i < this.length; ++i) args.push("arg" + (i + 1));
	var fn = new Function(
			(this.name || "") +
			args.join(", ") +
CVE-2021-4287 (Unknown, published 2022-12-27T11:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/ReFirmLabs/binwalk
Files changed:
Commit message: Merge pull request #556 from ReFirmLabs/unpriv_user_exec

Symlink directory traversal security fix

Vulnerable code:

Fixed code:
CVE-2022-25914 (Markdown, published 2022-09-08T05:15Z)
Description: value: The package com.google.cloud.tools:jib-core before 0.22.0 are vulnerable to Remote Code Execution (RCE) via the isDockerInstalled function, due to attempting to execute input.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/GoogleContainerTools/jib
Files changed:
jib-core/src/main/java/com/google/cloud/tools/jib/docker/CliDockerClient.java
jib-core/src/test/java/com/google/cloud/tools/jib/docker/CliDockerClientTest.java
jib-gradle-plugin/README.md
jib-maven-plugin/README.md
Commit message: Check if file exists when executable path is passed in through jib dockerClient.executable (#3744)

* Check if file exists when executable path is passed in through jib.dockerClient.executable

Vulnerable code:
   * Checks if Docker is installed on the user's system and accessible by running the default {@code
   * docker} command.
    return isDockerInstalled(DEFAULT_DOCKER_CLIENT);
   * Checks if Docker is installed on the user's system and accessible by running the given {@code
   * docker} executable.
    try {
      new ProcessBuilder(dockerExecutable.toString()).start();
      return true;

    } catch (IOException ex) {
      return false;
    }
`executable` | `File` | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon.
`executable` | string | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon.

Fixed code:
   * Checks if Docker is installed on the user's system by running the `docker` command.
    try {
      new ProcessBuilder(DEFAULT_DOCKER_CLIENT.toString()).start();
      return true;
    } catch (IOException ex) {
      return false;
    }
   * Checks if Docker is installed on the user's system and by verifying if the executable path
   * provided has the appropriate permissions.
    return Files.exists(dockerExecutable);
import com.google.common.io.Resources;
import java.net.URISyntaxException;
  @Test
  public void testIsDockerInstalled_pass() throws URISyntaxException {
    Assert.assertTrue(
        CliDockerClient.isDockerInstalled(
            Paths.get(Resources.getResource("core/docker/emptyFile").toURI())));
  }

`executable` | `File` | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon. **Please note**: Users are responsible for ensuring that the Docker path passed in is valid and has the right permissions to be executed.
`executable` | string | `docker` | Sets the path to the Docker executable that is called to load the image into the Docker daemon. **Please note**: Users are responsible for ensuring that the Docker path passed in is valid and has the right permissions to be executed.