hitoshura25/cvefixes huggingface dataset:
CVE-2020-5298 (Other, published 2020-06-03T22:15Z)
Description: value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octobercms/october
Files changed:
modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm
Commit message: escape import CSV column names


Vulnerable code:
                                <?= $column ?>

Fixed code:
                                <?= e($column) ?>
CVE-2020-5299 (PHP, published 2020-06-03T22:15Z)
Description: value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 1. Have found a vulnerability in the victims spreadsheet software of choice. 2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim. 3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software. Issue has been patched in Build 466 (v1.0.466).
Severity: MEDIUM (CVSS v3 base score: 5.1)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/octobercms/october
Files changed:
modules/backend/behaviors/ImportExportController.php
modules/backend/models/ExportModel.php
Commit message: Temporary workaround until the L6 upgrade can be merged in to use league/csv >= 9.1


Vulnerable code:

Fixed code:
use October\Rain\Parse\League\EscapeFormula as CsvEscapeFormula;
        // Temporary until upgrading to league/csv >= 9.1.0 (will be $csv->addFormatter($formatter))
        $formatter = new CsvEscapeFormula();


            // Temporary until upgrading to league/csv >= 9.1.0
            $record = $formatter($record);

use October\Rain\Parse\League\EscapeFormula as CsvEscapeFormula;
        // Temporary until upgrading to league/csv >= 9.1.0 (will be $csv->addFormatter($formatter))
        $formatter = new CsvEscapeFormula();


            // Temporary until upgrading to league/csv >= 9.1.0
            $data = $formatter($data);
CVE-2023-44383 (PHP, published 2023-11-29T20:15Z)
Description: value: October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octobercms/october
Files changed:
config/media.php
Commit message: Sync upstream (3.5)


Vulnerable code:

Fixed code:
   /*
    |--------------------------------------------------------------------------
    | Clean Vector Files
    |--------------------------------------------------------------------------
    |
    | When a vector file (SVG) file is uploaded, automatically process its
    | contents to remove scripts and other potentially dangerous content.
    |
    */

    'clean_vectors' => true,
CVE-2017-20165 (JavaScript, published 2023-01-09T10:15Z)
Description: value: A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/debug-js/debug
Files changed:
src/node.js
Commit message: remove ReDoS regexp in %o formatter (#504)



Vulnerable code:
    .replace(/\s*\n\s*/g, ' ');

Fixed code:
    .split('\n').map(function(str) {
      return str.trim()
    }).join(' ');
CVE-2022-2653 (JavaScript, published 2022-08-04T10:15Z)
Description: value: With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file in the system.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/plankanban/planka
Files changed:
server/api/controllers/attachments/download-thumbnail.js
server/config/routes.js
Commit message: fix: Fix path traversal vulnerability


Vulnerable code:
    filename: {
      type: 'string',
      required: true,
    },
      inputs.filename,
    this.res.type(attachment.filename);
  'GET /attachments/:id/download/thumbnails/:filename': {

Fixed code:
      'cover-256.jpg',
    this.res.type('image/jpeg');
  'GET /attachments/:id/download/thumbnails/cover-256.jpg': {
CVE-2017-20179 (Ruby, published 2023-02-21T21:15Z)
Description: value: A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourController of the file app/controllers/tour_controller.rb. The manipulation leads to an unknown weakness. The attack may be initiated remotely. Upgrading to version 2.3.2 is able to address this issue. The patch is named 6ef04f8b5972d5f16f8b86f8b53f62fac68d5498. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221507.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/instedd/pollit
Files changed:
app/controllers/tour_controller.rb
Commit message: Fix possible remote execution code exploit in TourController


Vulnerable code:
    render (params[:page] ||= 'start')
end

Fixed code:
    render (params[:page].to_s ||= 'start')
end
CVE-2014-8681 (Go, published 2014-11-21T15:59Z)
Description: value: SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/gogits/gogs
Files changed:
gogs.go
models/issue.go
models/repo.go
models/user.go
routers/api/v1/repos.go
templates/.VERSION
Commit message: Safe work


Vulnerable code:
const APP_VER = "0.5.6.1024 Beta"
			sess.And("label_ids like '%$" + label + "|%'")
	opt.Keyword = strings.TrimSpace(opt.Keyword)
	if len(opt.Keyword) == 0 {
		return repos, nil
	}

	opt.Keyword = strings.Split(opt.Keyword, " ")[0]
	// Prevent SQL inject.
	opt.Keyword = strings.TrimSpace(opt.Keyword)
	if len(opt.Keyword) == 0 {
		return us, nil
	}

	opt.Keyword = strings.Split(opt.Keyword, " ")[0]
0.5.6.1024 Beta

Fixed code:
const APP_VER = "0.5.6.1025 Beta"
			// Prevent SQL inject.
			if com.StrTo(label).MustInt() > 0 {
				sess.And("label_ids like '%$" + label + "|%'")
			}
	Private bool
}

// FilterSQLInject tries to prevent SQL injection.
func FilterSQLInject(key string) string {
	key = strings.TrimSpace(key)
	key = strings.Split(key, " ")[0]
	key = strings.Replace(key, ",", "", -1)
	return key
	opt.Keyword = FilterSQLInject(opt.Keyword)
	if !opt.Private {
		sess.And("is_private=false")
	}
	opt.Keyword = FilterSQLInject(opt.Keyword)
	// Check visibility.
	if ctx.IsSigned && opt.Uid > 0 {
		if ctx.User.Id == opt.Uid {
			opt.Private = true
		} else {
			u, err := models.GetUserById(opt.Uid)
			if err != nil {
				ctx.JSON(500, map[string]interface{}{
					"ok":    false,
					"error": err.Error(),
				})
				return
			}
			if u.IsOrganization() && u.IsOrgOwner(ctx.User.Id) {
				opt.Private = true
			}
			// FIXME: how about collaborators?
		}
	}

0.5.6.1025 Beta
CVE-2014-8682 (Go, published 2014-11-21T15:59Z)
Description: value: Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/gogits/gogs
Files changed:
cmd/web.go
conf/app.ini
gogs.go
models/repo.go
models/user.go
modules/setting/setting.go
templates/.VERSION
Commit message: fix session API broken and SQL pretection


Vulnerable code:
	if sessionVer.LessThan(git.MustParseVersion("0.0.3")) {
; session id hash func, Either "sha1", "sha256" or "md5" default is sha1
SESSION_ID_HASHFUNC = sha1
; Session hash key, default is use random string
SESSION_ID_HASHKEY =
const APP_VER = "0.5.6.1102 Beta"
	sess.And("lower_name like '%" + opt.Keyword + "%'").Find(&repos)
	err = x.Limit(opt.Limit).Where("type=0").And("lower_name like '%" + opt.Keyword + "%'").Find(&us)
	SessionConfig.SessionIDHashFunc = Cfg.MustValueRange("session", "SESSION_ID_HASHFUNC",
		"sha1", []string{"sha1", "sha256", "md5"})
	SessionConfig.SessionIDHashKey = Cfg.MustValue("session", "SESSION_ID_HASHKEY", string(com.RandomCreateBytes(16)))
0.5.6.1102 Beta

Fixed code:
	if sessionVer.LessThan(git.MustParseVersion("0.0.5")) {
const APP_VER = "0.5.6.1104 Beta"
	sess.And("lower_name like ?", "%"+opt.Keyword+"%").Find(&repos)
	err = x.Limit(opt.Limit).Where("type=0").And("lower_name like ?", "%"+opt.Keyword+"%").Find(&us)
0.5.6.1104 Beta
CVE-2021-25980 (Scala, published 2021-11-11T07:15Z)
Description: value: In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/debiki/talkyard
Files changed:
appsv/server/debiki/Globals.scala
appsv/server/talkyard/server/api/GetController.scala
Commit message: Bump get query limit from 29 to 50. Disallow access via IP.


Vulnerable code:
        }
    throwUnimplementedIf(pageRefs.size >= 30,
          "TyE603MRT4", "Currently at most 30 at a time")

Fixed code:
        /* Not really needed. Better to use a real domain name.
        } */
    throwUnimplementedIf(pageRefs.size > 50,
          "TyE603MRT4", "Currently at most 50 at a time")
CVE-2021-25981 (Scala, published 2022-01-03T07:15Z)
Description: value: In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/debiki/talkyard
Files changed:
appsv/server/ed/server/http/PlainApiActions.scala
appsv/server/ed/server/pubsub/SubscriberController.scala
appsv/server/ed/server/security/package.scala
client/app-slim/Server.ts
client/app-slim/start-page.ts
Commit message: Use fancy sids, not silly sids, by default.


Vulnerable code:
        val tryFancySid = site.isFeatureEnabled("ffTryNewSid", globals.config.featureFlags)
        val onlyFancySid = site.isFeatureEnabled("ffUseNewSid", globals.config.featureFlags)
        val doUseFancySid = onlyFancySid || tryFancySid
        if (doUseFancySid) {
      val tryFancySid = site.isFeatureEnabled("ffTryNewSid", globals.config.featureFlags)
      val onlyFancySid = site.isFeatureEnabled("ffUseNewSid", globals.config.featureFlags)
      val doUseFancySid = onlyFancySid || tryFancySid
      if (doUseFancySid) {
    val tryFancySid = site.isFeatureEnabled("ffTryNewSid", globals.config.featureFlags)
    val useFancySid = site.isFeatureEnabled("ffUseNewSid", globals.config.featureFlags)
    if (tryFancySid || useFancySid) {
    val useOnlyFancySid = site.isFeatureEnabled("ffUseNewSid", globals.config.featureFlags)
    val tryFancySid = site.isFeatureEnabled("ffTryNewSid", globals.config.featureFlags)
    if (useOnlyFancySid || (tryFancySid && hasFancySid)) {
          debiki2.store_isFeatFlagOn(store, 'ffUseNewSid') ? 'TyCoSid123' : 'dwCoSid';
  if (debiki2.store_isFeatFlagOn(store, 'ffUseNewSid')) {

Fixed code:
        val useOldSid = site.isFeatureEnabled("ffUseOldSid", globals.config.featureFlags)
        if (!useOldSid) {
      val useOldSid = site.isFeatureEnabled("ffUseOldSid", globals.config.featureFlags)
      if (!useOldSid) {
    val useOldSid = site.isFeatureEnabled("ffUseOldSid", globals.config.featureFlags)
    if (!useOldSid) {
    val useOldSid = site.isFeatureEnabled("ffUseOldSid", globals.config.featureFlags)
    if (!useOldSid) {
          !debiki2.store_isFeatFlagOn(store, 'ffUseOldSid') ? 'TyCoSid123' : 'dwCoSid';
  const useNewSid = !debiki2.store_isFeatFlagOn(store, 'ffUseOldSid');
  if (useNewSid) {
CVE-2021-23406 (TypeScript, published 2021-08-24T08:15Z)
Description: value: This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TooTallNate/node-degenerator
Files changed:
src/index.ts
test/test.ts
Commit message: Fix `filename` option


Vulnerable code:
import { VM } from 'vm2';
		const fn = vm.run(`${compiled};${returnName}`);
		it('should prevent privilege escalation of untrusted code', async() => {
					[],
			} catch(_err) {
			assert.equal(err.message,'process is not defined')
			return fn().then(val => {

Fixed code:
import { VM, VMScript } from 'vm2';
		const script = new VMScript(`${compiled};${returnName}`, {
			filename: options.filename,
		});
		const fn = vm.run(script);
		it('should prevent privilege escalation of untrusted code', async () => {
					[]
			} catch (_err) {
			assert.equal(err.message, 'process is not defined');
			return fn().then((val) => {
		it('should support "filename" option', async () => {
			function u() {
				throw new Error('fail');
			}
			let err;
			const fn = compile(`${u}`, 'u', [''], {
				filename: '/foo/bar/baz.js',
			});
			try {
				await fn();
			} catch (_err) {
				err = _err;
			}
			assert.strictEqual(err.message, 'fail');
			assert(err.stack.includes('at u (/foo/bar/baz.js:'));
		});
CVE-2021-23406 (TypeScript, published 2021-08-24T08:15Z)
Description: value: This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TooTallNate/node-degenerator
Files changed:
src/index.ts
test/test.ts
Commit message: Fix return `undefined`


Vulnerable code:
				if (typeof p.then === 'function') {
		it('should be compile if branches', () => {

Fixed code:
				if (typeof p?.then === 'function') {
		it('should compile if branches', () => {
		it('should allow to return synchronous undefined', () => {
			function u() {}
			const fn = compile(`${u}`, 'u', ['']);
			return fn().then(val => {
				assert.strictEqual(val, undefined);
			});
		});
CVE-2022-24065 (Unknown, published 2022-06-08T08:15Z)
Description: value: The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/cookiecutter/cookiecutter
Files changed:
Commit message: Merge pull request #1689 from cookiecutter/sanitize-mercurial-checkout

Sanitize Mercurial branch information before checkout.

Vulnerable code:

Fixed code:
CVE-2022-35980 (Markdown, published 2022-08-12T18:15Z)
Description: value: OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security (DLS), field level security (FLS), and/or field masking will not be filtered when the query's search pattern matches an aliased index. OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied. This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. OpenSearch 2.2.0, which is compatible with OpenSearch Security 2.2.0.0, contains the fix for this issue. There is no recommended work around.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/opensearch-project/security
Files changed:
release-notes/opensearch-security.release-notes-2.2.0.0.md
Commit message: Update release notes for 2.2.0.0 release (#1984)

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Vulnerable code:
### Test Fix
* Abstract waitForInit to minimize duplication and improve test reliability ([#1935](https://github.com/opensearch-project/security/pull/1935))

Fixed code:
### Enhancements
* Adds a basic sanity test to run against a remote cluster ([#1958](https://github.com/opensearch-project/security/pull/1958))
### Bug Fixes

* Use Collections.synchronizedSet and Collections.synchronizedMap for roles, securityRoles and attributes in User ([#1970](https://github.com/opensearch-project/security/pull/1970))

* Add release notes for 2.2.0.0 release ([#1974](https://github.com/opensearch-project/security/pull/1974))
* Staging for version increment automation ([#1932](https://github.com/opensearch-project/security/pull/1932))
* Fix breaking API change introduced in Lucene 9.3.0 ([#1988](https://github.com/opensearch-project/security/pull/1988))
* Update indices resolution to be clearer ([#1999](https://github.com/opensearch-project/security/pull/1999))

### Refactoring

* Abstract waitForInit to minimize duplication and improve test reliability ([#1935](https://github.com/opensearch-project/security/pull/1935))