hitoshura25/cvefixes huggingface dataset:
CVE-2015-2951 (PHP, published 2015-06-05T10:59Z)
Description: value: JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/F21/jwt
Files changed:
JWT/JWT.php
README.md
Commit message: Fixed security issue: JVN#06120222


Vulnerable code:
    public static function decode($jwt, $key = null, $verify = true)
        if ($verify) {
            if (!JWT::verifySignature($sig, "$headb64.$payloadb64", $key, $header->alg)) {
    private static function verifySignature($signature, $input, $key, $algo = 'HS256')
    private static function sign($input, $key, $algo = 'HS256')


Fixed code:
    public static function decode($jwt, $key = null, $algo = null)
        if (isset($key)) {

            if (!JWT::verifySignature($sig, "$headb64.$payloadb64", $key, $algo)) {
    private static function verifySignature($signature, $input, $key, $algo)
    private static function sign($input, $key, $algo)
**Important security notice**

Thanks to Toshiharu Sugiyama!

Please upgrade to 2.0 as soon as possible as previous versions are susceptible to verification bypass attacks if the same public key is used for signing when using asymmetric and symmetric algorithms.

This is a release breaks backwards compatibility because you now need to pass in the decoding algorithm when decoding in order to verify the JWT.

For more information see: JVN#06120222 at jpcert.or.jp
CVE-2017-16003 (JavaScript, published 2018-05-29T20:29Z)
Description: value: windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/felixrieseberg/windows-build-tools
Files changed:
src/constants.js
Commit message: :wrench: Use HTTPS - Thanks to @grander


Vulnerable code:
  installerUrl: 'http://download.microsoft.com/download/5/f/7/5f7acaeb-8363-451f-9425-68a90f98b238/visualcppbuildtools_full.exe',

Fixed code:
  installerUrl: 'https://download.microsoft.com/download/5/f/7/5f7acaeb-8363-451f-9425-68a90f98b238/visualcppbuildtools_full.exe',
CVE-2021-4308 (Unknown, published 2023-01-08T10:15Z)
Description: value: A vulnerability was found in WebPA up to 3.1.1. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version 3.1.2 is able to address this issue. The identifier of the patch is 8836c4f549181e885a68e0e7ca561fdbcbd04bf0. It is recommended to upgrade the affected component. The identifier VDB-217637 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/WebPA/WebPA
Files changed:
Commit message: Merge pull request #87 from Sephster/fix-sql-injection-attack

Security Fix

Vulnerable code:

Fixed code:
CVE-2023-31544 (Java, published 2023-05-16T21:15Z)
Description: value: A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/alkacon/opencms-core
Files changed:
src-gwt/org/opencms/ade/galleries/client/ui/CmsResultItemWidget.java
Commit message: Fixed XSS issue in gallery result view (github issue #652).

Vulnerable code:
        StringBuffer result = new StringBuffer();
        result.append("<p><b>").append(CmsClientStringUtil.shortenString(infoBean.getTitle(), 70)).append("</b></p>");
                result.append("<p>").append(additionalInfo.getName()).append(":&nbsp;");
                // shorten the value to max 45 characters
                result.append(CmsClientStringUtil.shortenString(additionalInfo.getValue(), 45)).append("</p>");
        return result.toString();

Fixed code:
import com.google.gwt.dom.client.Element;
import com.google.gwt.user.client.DOM;
    private static Element appendDom(Element parent, String name) {

        Element child = DOM.createElement(name);
        parent.appendChild(child);
        return child;
    }

        Element root = DOM.createElement("div");
        appendDom(appendDom(root, "p"), "b").setInnerText(CmsClientStringUtil.shortenString(infoBean.getTitle(), 70));
                appendDom(root, "p").setInnerText(
                    additionalInfo.getName()
                        + ":\u00a0"
                        + CmsClientStringUtil.shortenString(additionalInfo.getValue(), 45));
        return root.getInnerHTML();
CVE-2012-5622 (Ruby, published 2012-12-18T01:55Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in OpenShift 0.0.5 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/openshift/origin-server
Files changed:
openshift-console/app/controllers/application_controller.rb
Commit message: BZ878754 No CSRF attack protection in console


Vulnerable code:

Fixed code:

  protected
    def handle_unverified_request
      raise Console::AccessDenied, "Request authenticity token does not match session #{session.inspect}"
    end
CVE-2012-5646 (PHP, published 2013-02-24T21:55Z)
Description: value: node-util/www/html/restorer.php in the Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to execute arbitrary commands via a crafted uuid in the PATH_INFO.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openshift/origin-server
Files changed:
node-util/www/html/restorer.php
Commit message: Fix for Bug 880699

restorer.php security patch


Vulnerable code:
shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");

sleep(2);
$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
header("Location: $url");


Fixed code:
if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
    sleep(2);
    $host = $_SERVER['HTTP_HOST'];
    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
    header("Location: $proto$host$url");
} else {
    // someone is trying to attack
    error_log("Invalid uuid $uuid given to restorer.php");
    header('HTTP/1.0 403 Forbidden');
}
CVE-2012-5647 (PHP, published 2013-02-24T21:55Z)
Description: value: Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openshift/origin-server
Files changed:
node-util/www/html/restorer.php
Commit message: Fix for Bug 880699

restorer.php security patch


Vulnerable code:
shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");

sleep(2);
$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
header("Location: $url");


Fixed code:
if (preg_match('/[0-9a-fA-F]{32}/', $uuid)) {
    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
    sleep(2);
    $host = $_SERVER['HTTP_HOST'];
    $proto = "http" . ( isset($_SERVER['HTTPS']) ? 's' : '' ) . '://';
    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
    header("Location: $proto$host$url");
} else {
    // someone is trying to attack
    error_log("Invalid uuid $uuid given to restorer.php");
    header('HTTP/1.0 403 Forbidden');
}
CVE-2013-4561 (Other, published 2022-06-30T19:15Z)
Description: value: In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/openshift/origin-server
Files changed:
plugins/msg-node/mcollective/facts/openshift-facts
Commit message: Bug 1022889 - AVC message is seen when mcolletive facts update cron job is running.

Looking back at the history showed that the switch to writing to /tmp/facts.log
was actually a mistake.  I'm reverting that change which will address this bug.


Vulnerable code:
oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /tmp/facts.log

Fixed code:
oo-exec-ruby ${PREFIX}/usr/libexec/mcollective/update_yaml.rb ${PREFIX}/etc/mcollective/facts.yaml &> /dev/null
CVE-2013-0234 (PHP, published 2014-02-02T20:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Elgg/Elgg
Files changed:
README.md
mod/twitter/languages/en.php
version.php
Commit message: Merged 1.8.13 release into master

Conflicts:
	README.md
	mod/twitter/languages/en.php
	version.php


Vulnerable code:
 Copyright (c) 2008-2012, see COPYRIGHT.txt
 	'twitter:username' => 'Enter your twitter username.',
 	'twitter:num' => 'The number of tweets to show.',
 	'twitter:notset' => 'This Twitter widget is not yet set to go. To display your latest tweets, click on - edit - and fill in your details',
 $version = 2011110700;

Fixed code:
+Copyright (c) 2008-2013, see COPYRIGHT.txt
 	'twitter:username' => 'Your twitter username',
 	'twitter:num' => 'Number of tweets to show*',
 	'twitter:notset' => 'This widget needs to be configured. To display your latest tweets, click the customize icon and fill in your Twitter username.',
 	'twitter:invalid' => 'This widget is configured with an invalid Twitter username. Click the customize icon to correct it.',
 	'twitter:apibug' => "*Due to a bug in the Twitter 1.0 API, you may see fewer tweets than you ask for.",
+$version = 2013012600;
CVE-2021-3850 (PHP, published 2022-01-25T15:15Z)
Description: value: Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/adodb/adodb
Files changed:
drivers/adodb-postgres64.inc.php
Commit message: Prevent auth bypass with PostgreSQL connections

Thanks to Emmet Leahy of Sorcery Ltd for reporting this vulnerability
(CVE-2021-3850).

This is a minimalistic approach to patch the issue, to reduce the risk
of causing regressions in the legacy stable branch.

Fixes #793


Vulnerable code:
	if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted

Fixed code:
CVE-2024-31216 (Unknown, published 2024-05-15T16:15Z)
Description: value: The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit. Prior to version 1.2.5, when source-controller was configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access to the Azure Blob Storage until the token expires. This vulnerability was fixed in source-controller v1.2.5. There is no workaround for this vulnerability except for using a different auth mechanism such as Azure Workload Identity.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fluxcd/source-controller
Files changed:
Commit message: Merge pull request #1430 from fluxcd/sanitze-bucker-errors

Sanitize URLs for bucket fetch error messages

Vulnerable code:

Fixed code:
CVE-2018-25070 (C#, published 2023-01-07T11:15Z)
Description: value: A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/polterguy/phosphorusfive
Files changed:
plugins/extras/p5.mysql/NonQuery.cs
Commit message: Sanity checking column names in [p5.mysql.load-from]

To avoid a maliciously malformed CSV file from creating SQL injection …


Vulnerable code:
        {
            foreach (var idxHeader in headers) {

Fixed code:
        {
            foreach (var idxHeader in headers) {
                
                // Sanity checking column name
                foreach (var idxChar in idxHeader) {
                    if ("0123456789_-abcdefghijklmnopqrstuvwxyz".IndexOf (idxChar.ToString ().ToLower (CultureInfo.InvariantCulture), StringComparison.InvariantCulture) == -1)
                        throw new System.Security.SecurityException ("Unsupported and insecure column name found in your CSV file.");
                }
CVE-2021-4280 (Other, published 2022-12-25T20:15Z)
Description: value: A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch is 0cad44aa4a3eb0ecdba071c10eaff16023d8b35f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216780.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/stylerw/styler_praat_scripts
Files changed:
file_segmenter.praat
nasal_earbud_extract.praat
Commit message: Improved File Segmenter

It should now be less vulnerable to certain characters in Textgrids (e.g. /) crashing everything.


Vulnerable code:
        integer tier_number 2
			            	out_filename$ = "'out_dir$''namebase$'_'seg_label$'"
			            	out_filename$ = "'out_dir$''soundname$'_'seg_label$'"
			            aff = 1
			            while fileReadable ("'name$'.wav")
							#out_filename$ = "'out_dir$''soundname$'-'seg_label$'-'k'"
			            endwhile
			#fileappend "'resultfile$'" 'result_row$'

Fixed code:
        integer tier_number 3
			            	writename$ = "'namebase$'_'seg_label$'"
			            	writename$ = "'soundname$'_'seg_label$'"
						# Although you should use ASCII when making textgrids, this bit removes some instacrashes
						writename$ = replace$ (writename$, " ", "_", 0)
						writename$ = replace$ (writename$, "/", "_", 0)
						out_filename$ = "'out_dir$''writename$'"
			        aff = 1

						#writeInfo: name$
			        while fileReadable ("'name$'.wav")
			        endwhile
			fileappend "'resultfile$'" 'result_row$'
CVE-2022-0219 (Java, published 2022-01-20T17:15Z)
Description: value: Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/skylot/jadx
Files changed:
jadx-core/src/main/java/jadx/core/export/ExportGradleProject.java
Commit message: fix: use secure xml parser for process manifest


Vulnerable code:
import javax.xml.parsers.DocumentBuilderFactory;
			DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();

Fixed code:
import jadx.core.xmlgen.XmlSecurity;
			DocumentBuilder builder = XmlSecurity.getSecureDbf().newDocumentBuilder();
CVE-2022-0432 (JavaScript, published 2022-02-02T22:15Z)
Description: value: Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/mastodon/mastodon
Files changed:
public/embed.js
Commit message: Fixed prototype pollution bug and only allow trusted origin (#17420)



Vulnerable code:
      if (data.type !== 'setHeight' || !iframes[data.id]) {

Fixed code:
      if (data.type !== 'setHeight' || !iframes[data.id] || window.location.origin !== e.origin || data.id.toString() === '__proto__') {
CVE-2023-36459 (Ruby, published 2023-07-06T19:15Z)
Description: value: Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and 4.1.3, an attacker using carefully crafted oEmbed data can bypass the HTML sanitization performed by Mastodon and include arbitrary HTML in oEmbed preview cards. This introduces a vector for cross-site scripting (XSS) payloads that can be rendered in the user's browser when a preview card for a malicious link is clicked through. Versions 3.5.9, 4.0.5, and 4.1.3 contain a patch for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mastodon/mastodon
Files changed:
app/serializers/rest/preview_card_serializer.rb
lib/sanitize_ext/sanitize_config.rb
Commit message: Merge pull request from GHSA-ccm4-vgcc-73hp

* Tighten allowed HTML in oEmbed-based preview cards

* Sanitize preview cards at render time

* Add `sandbox` attribute to preview card iframes

Vulnerable code:
    MASTODON_OEMBED ||= freeze_config merge(
      RELAXED,
      elements: RELAXED[:elements] + %w(audio embed iframe source video),
      attributes: merge(
        RELAXED[:attributes],
        'div' => [:data]
      ),
      protocols: merge(
        RELAXED[:protocols],
        'source' => { 'src' => HTTP_PROTOCOLS }
      )

Fixed code:

  def html
    Sanitize.fragment(object.html, Sanitize::Config::MASTODON_OEMBED)
  end
    MASTODON_OEMBED ||= freeze_config(
      elements: %w(audio embed iframe source video),
      attributes: {
      },
      protocols: {
        'source' => { 'src' => HTTP_PROTOCOLS },
      },

      add_attributes: {
        'iframe' => { 'sandbox' => 'allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-forms' },
      }