hitoshura25/cvefixes huggingface dataset:
CVE-2018-1002206 (Unknown, published 2018-07-25T17:29Z)
Description: value: SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/adamhathcock/sharpcompress
Files changed:
Commit message: Merge pull request #374 from odinn1984/feat/fail_on_outside_target_files

fix: prevent extracting archived files outside of target path

Vulnerable code:

Fixed code:
CVE-2022-1782 (Java, published 2022-05-18T15:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/erudika/para
Files changed:
para-core/src/main/java/com/erudika/para/core/utils/Utils.java
para-server/src/test/java/com/erudika/para/core/utils/UtilsTest.java
Commit message: added option to escape HTML when compiling Mustache templates


Vulnerable code:
	public static String compileMustache(Map<String, Object> context, String template) {
			Mustache.compiler().escapeHTML(false).emptyStringIsFalse(true).compile(template).execute(context, writer);
import com.erudika.para.core.utils.Config;
import com.erudika.para.core.utils.Utils;
import com.erudika.para.core.annotations.Locked;
import static com.erudika.para.core.utils.Utils.*;

Fixed code:
	public static String compileMustache(Map<String, Object> context, String template, boolean escapeHtml) {
			Mustache.compiler().escapeHTML(escapeHtml).emptyStringIsFalse(true).compile(template).execute(context, writer);
	/**
	 * @see #compileMustache(java.util.Map, java.lang.String, boolean)
	 * @param context a map of fields and values
	 * @param template a Mustache template
	 * @return the compiled template string
	 */
	public static String compileMustache(Map<String, Object> context, String template) {
		return compileMustache(context, template, false);
	}

import com.erudika.para.core.annotations.Locked;
import static com.erudika.para.core.utils.Utils.*;
		map.put("test", "<b>string</b>");
		assertEquals("<html>&lt;b&gt;string&lt;/b&gt;</html>", compileMustache(map, "<html>{{test}}</html>", true));
CVE-2022-0087 (Other, published 2022-01-12T00:15Z)
Description: value: keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/keystonejs/keystone
Files changed:
.changeset/quiet-wasps-draw.md
packages/auth/src/index.ts
packages/auth/src/lib/useFromRedirect.ts
packages/auth/src/pages/InitPage.tsx
packages/auth/src/pages/SigninPage.tsx
Commit message: Do not add `from` parameter to URL on signin page when it matches the default redirect

Additionally extract redirect logic for ease of reuse


Vulnerable code:
      return { kind: 'redirect', to: `/signin?from=${encodeURIComponent(req!.url!)}` };
              router.push((router.query.from as string | undefined) || '/');
    return router.push((router.query.from as string | undefined) || '/');
        router.push((router.query.from as string | undefined) || '/');
  }, [rawKeystone.authenticatedItem, enableWelcome, router]);
import { useState, Fragment, FormEvent, useRef, useEffect } from 'react';
      router.push((router.query.from as string | undefined) || '/');
  }, [rawKeystone.authenticatedItem, router]);
            router.push((router.query.from as string | undefined) || '/');

Fixed code:
---
'@keystone-6/auth': patch
---

When redirecting to the homepage,  the `from` query parameter unnecessarily displayed `=/`.
This patch fixes that so it is only provided as a query parameter when needed.
      let to = pathname === '/' ? '/signin' : `/signin?from=${encodeURIComponent(req!.url!)}`;
      return { kind: 'redirect', to };
import { useMemo } from 'react';
import { useRouter } from '@keystone-6/core/admin-ui/router';

export const useRedirect = () => {
  const router = useRouter();
  const redirect = useMemo(
    () =>
      !Array.isArray(router.query.from) && router.query.from?.startsWith('/')
        ? router.query.from
        : '/',
    [router]
  );

  return redirect;
};
import { useRedirect } from '../lib/useFromRedirect';
  const redirect = useRedirect();

              router.push(redirect);
    return router.push(redirect);
  const redirect = useRedirect();
        router.push(redirect);
  }, [rawKeystone.authenticatedItem, enableWelcome, router, redirect]);
import { useState, Fragment, FormEvent, useRef, useEffect, useMemo } from 'react';
import { useRedirect } from '../lib/useFromRedirect';
  const redirect = useRedirect();
  // This useEffect specifically handles ending up on the signin page from a SPA navigation
      router.push(redirect);
  }, [rawKeystone.authenticatedItem, router, redirect]);
            router.push(redirect);
CVE-2021-36753 (Rust, published 2021-07-15T20:15Z)
Description: value: sharkdp BAT before 0.18.2 executes less.exe from the current working directory.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-427 \u2014 Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Repository: https://github.com/sharkdp/bat
Files changed:
Cargo.lock
Cargo.toml
src/less.rs
src/output.rs
Commit message: Fix for Windows: do not run binaries from CWD

This fixes a bug on Windows where `Command::new` would also run
executables from the current working directory, possibly resulting in
accidental runs of programs called `less`.


Vulnerable code:
    let cmd = Command::new(less_path).arg("--version").output().ok()?;
        let mut p = Command::new(&pager.bin);

Fixed code:
version = 3

 "grep-cli",
[[package]]
name = "grep-cli"
version = "0.1.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2dd110c34bb4460d0de5062413b773e385cbf8a85a63fc535590110a09e79e8a"
dependencies = [
 "atty",
 "bstr",
 "globset",
 "lazy_static",
 "log",
 "regex",
 "same-file",
 "termcolor",
 "winapi-util",
]

[[package]]
name = "termcolor"
version = "1.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2dfed899f0eb03f32ee8c6a0aabdb8a7949659e3466561fc0adf54e26d88c5f4"
dependencies = [
 "winapi-util",
]

grep-cli = "0.1.6"
    let resolved_path = grep_cli::resolve_binary(less_path.as_ref()).ok()?;

    let cmd = Command::new(resolved_path).arg("--version").output().ok()?;
        let resolved_path = match grep_cli::resolve_binary(&pager.bin) {
            Ok(path) => path,
            Err(_) => {
                return Ok(OutputType::stdout());
            }
        };

        let mut p = Command::new(resolved_path);
CVE-2014-125091 (PHP, published 2023-03-04T22:15Z)
Description: value: A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/cp-polls
Files changed:
cp-admin-int-message-list.inc.php
Commit message: Update to avoid sql vulnerabilities.

git-svn-id: https://plugins.svn.wordpress.org/cp-polls/trunk@1031343 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
    $wpdb->query('UPDATE `'.$wpdb->prefix.$this->table_messages.'` SET paid='.esc_sql($_GET["status"]).' WHERE id='.$_GET['lu']);           

Fixed code:
    $wpdb->query('UPDATE `'.$wpdb->prefix.$this->table_messages.'` SET paid='.esc_sql($_GET["status"]).' WHERE id='.intval($_GET['lu']));
CVE-2021-21354 (Python, published 2021-03-08T19:15Z)
Description: value: Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com/". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: "https://pollbot.services.mozilla.com//evil.com/". Affected versions will redirect to that website when you inject a payload like "//evil.com/". This is fixed in version 1.4.4.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/mozilla/PollBot
Files changed:
pollbot/middlewares.py
tests/test_views.py
Commit message: Remove leading slashes in 404 redirections

When reaching http://server//page/ the server should not redirect to ``/page`` instead of ``//page``.


Vulnerable code:
            return web.HTTPFound(request.path.rstrip('/'))

Fixed code:
            return web.HTTPFound('/' + request.path.strip('/'))
async def test_redirects_strip_leading_slashes(cli):
    resp = await check_response(cli, "//page/", status=302, allow_redirects=False)
    assert resp.headers['Location'] == "/page"
CVE-2024-31457 (Go, published 2024-04-09T18:15Z)
Description: value: gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. gin-vue-admin pseudoversion 0.0.0-20240407133540-7bc7c3051067, corresponding to version 2.6.1, has a code injection vulnerability in the backend. In the Plugin System -> Plugin Template feature, an attacker can perform directory traversal by manipulating the `plugName` parameter. They can create specific folders such as `api`, `config`, `global`, `model`, `router`, `service`, and `main.go` function within the specified traversal directory. Moreover, the Go files within these folders can have arbitrary code inserted based on a specific PoC parameter. The main reason for the existence of this vulnerability is the controllability of the PlugName field within the struct. Pseudoversion 0.0.0-20240409100909-b1b7427c6ea6, corresponding to commit b1b7427c6ea6c7a027fa188c6be557f3795e732b, contains a patch for the issue. As a workaround, one may manually use a filtering method available in the GitHub Security Advisory to rectify the directory traversal problem.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/flipped-aurora/gin-vue-admin
Files changed:
server/api/v1/system/sys_auto_code.go
Commit message: fixed:修复GHSA-gv3w-m57p-3wc4


Vulnerable code:

Fixed code:
	"path/filepath"
	if strings.Contains(a.PlugName, string(filepath.Separator)) {
		response.FailWithMessage("插件名称不能包含"+string(filepath.Separator), c)
		return
	}
CVE-2016-9954 (Other, published 2017-04-21T20:59Z)
Description: value: The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression with a repeating pattern.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/ashinn/irregex
Files changed:
benchmarks/re-benchmarks.txt
irregex.scm
Commit message: Fix exponential explosion in backtrack compilation

The trick is to define * in terms of +, instead of vice versa, because
if you do it the other way around you must compile the remaining regex
twice, and if that remainder uses +, it will compile its remainder
twice, and so forth, resulting in 2^n compilations.


Vulnerable code:
               (letrec
                   ((body
                     (lp (sre-sequence (cdr sre))
                         n
                         flags
                         (lambda (cnk init src str i end matches fail)
                           (body cnk init src str i end matches
                                 (lambda ()
                                   (next cnk init src str i end matches fail)
                                   ))))))
             (lp (sre-sequence (cdr sre))
                 n
                 flags
                 (rec (list '* (sre-sequence (cdr sre))))))

Fixed code:

Exponential memory use while building match procedure	($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($($(${-2,16}+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)	foo	b	1	1
;; 0.9.6: 2016/12/05 - fixed exponential memory use of + in compilation
;;                     of backtracking matcher.
               (let ((body (rec (list '+ (sre-sequence (cdr sre))))))
             (cond
              ((sre-empty? (sre-sequence (cdr sre)))
               (error "invalid sre: empty +" sre))
              (else
               (letrec
                   ((body
                     (lp (sre-sequence (cdr sre))
                         n
                         flags
                         (lambda (cnk init src str i end matches fail)
                           (body cnk init src str i end matches
                                 (lambda ()
                                   (next cnk init src str i end matches fail)
                                   ))))))
                 body))))
CVE-2014-3990 (PHP, published 2018-03-20T21:29Z)
Description: value: The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/opencart-ce/opencart-ce
Files changed:
upload/system/library/cart.php
Commit message: Protection from object injection in cart

https://github.com/opencart/opencart/issues/1534


Vulnerable code:
		if (!$option) {
		if ((int)$qty && ((int)$qty > 0)) {

Fixed code:
		if (!$option || !is_array($option)) {
		if ((int)$qty && ((int)$qty > 0) && isset($this->session->data['cart'][$key])) {
CVE-2014-3990 (PHP, published 2018-03-20T21:29Z)
Description: value: The Cart::getProducts method in system/library/cart.php in OpenCart 1.5.6.4 and earlier allows remote attackers to conduct server-side request forgery (SSRF) attacks or possibly conduct XML External Entity (XXE) attacks and execute arbitrary code via a crafted serialized PHP object, related to the quantity parameter in an update request.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/opencart-ce/opencart-ce
Files changed:
upload/system/library/cart.php
Commit message: Protection from object injection in cart

https://github.com/opencart/opencart/issues/1534


Vulnerable code:
		if (!$option) {
		if ((int)$qty && ((int)$qty > 0)) {

Fixed code:
		if (!$option || !is_array($option)) {
		if ((int)$qty && ((int)$qty > 0) && isset($this->session->data['cart'][$key])) {
CVE-2013-0807 (PHP, published 2014-03-28T15:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a new_section action to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/oyejorge/gpEasy-CMS
Files changed:
include/tool/editing_page.php
Commit message: new_section vulnerability fixed


Vulnerable code:

		echo '<input type="hidden" name="section" value="'.$_GET['section'].'" />';

Fixed code:
		echo '<input type="hidden" name="section" value="'.htmlspecialchars($_GET['section']).'" />';
CVE-2019-12105 (Other, published 2019-09-10T17:15Z)
Description: value: In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inet_http_server, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. The maintainer indicated the ability to run an open server will not be removed but an additional warning was added to the documentation
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/Supervisor/supervisor
Files changed:
docs/configuration.rst
supervisor/skel/sample.conf
Commit message: Add an explicit security warning about inet_http_server.
References #1245


Vulnerable code:
  in the machine, use ``:9001`` or ``*:9001``.

Fixed code:
.. warning::

  The inet HTTP server is not enabled by default.  If you choose to enable it,
  please read the following security warning.  The inet HTTP server is intended
  for use within a trusted environment only.  It should only be bound to localhost
  or only accessible from within an isolated, trusted network.  The inet HTTP server
  does not support any form of encryption.  The inet HTTP server does not use
  authentication by default (see the ``username=`` and ``password=`` options).
  The inet HTTP server can be controlled remotely from :program:`supervisorctl`.
  It also serves a web interface that allows subprocesses to be started or stopped,
  and subprocess logs to be viewed.  **Never expose the inet HTTP server to the
  public internet.**

  in the machine, use ``:9001`` or ``*:9001``.  Please read the security
  warning above.
;
; Security Warning:
;  The inet HTTP server is not enabled by default.  The inet HTTP server is
;  enabled by uncommenting the [inet_http_server] section below.  The inet
;  HTTP server is intended for use within a trusted environment only.  It
;  should only be bound to localhost or only accessible from within an
;  isolated, trusted network.  The inet HTTP server does not support any
;  form of encryption.  The inet HTTP server does not use authentication
;  by default (see the username= and password= options to add authentication).
;  Never expose the inet HTTP server to the public internet.