hitoshura25/cvefixes huggingface dataset:
CVE-2020-28705 (PHP, published 2021-03-10T14:15Z)
Description: value: FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /pages/delete/3.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/daylightstudio/FUEL-CMS
Files changed:
fuel/modules/fuel/controllers/Module.php
Commit message: fix: issue #576 with expanded ability to delete pages


Vulnerable code:
		if ( ! empty($_POST['id']))
			$posted = explode('|', $this->input->post('id', TRUE));

Fixed code:
		if (! empty($_POST['id']))
			if (!empty($id))
			{
				$posted = array($id);
			}
			else
			{
				$posted = explode('|', $this->input->post('id', TRUE));
			}
CVE-2021-38290 (PHP, published 2021-08-09T11:15Z)
Description: value: A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/daylightstudio/FUEL-CMS
Files changed:
fuel/modules/fuel/config/fuel_constants.php
fuel/modules/fuel/libraries/Asset.php
index.php
Commit message: fix: issue #580 using $_SERVER[‘HTTP_HOST’]


Vulnerable code:
	$_base_path = $_SERVER['HTTP_HOST'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
			$path = $protocol.$_SERVER['HTTP_HOST'].$path;
				if (!empty($_SERVER['HTTP_HOST']) AND preg_match('#^'.$path.'$#', $_SERVER['HTTP_HOST']))

Fixed code:
	$_base_path = $_SERVER['SERVER_NAME'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
			$path = $protocol.$_SERVER['SERVER_NAME'].$path;
				if (!empty($_SERVER['SERVER_NAME']) AND preg_match('#^'.$path.'$#', $_SERVER['SERVER_NAME']))
CVE-2021-38721 (PHP, published 2021-09-09T15:15Z)
Description: value: FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/daylightstudio/FUEL-CMS
Files changed:
fuel/modules/fuel/controllers/Login.php
fuel/modules/fuel/language/english/fuel_lang.php
Commit message: fix: for issue #584


Vulnerable code:
class Login extends CI_Controller {
		parent::__construct();
			if (isset($user_data['failed_login_timer']) AND (time() - $user_data['failed_login_timer']) < (int)$this->fuel->config('seconds_to_unlock'))
			if (isset($user_data['failed_login_timer']) AND (time() - $user_data['failed_login_timer']) < (int)$this->fuel->config('seconds_to_unlock'))
			if ($this->input->post('email') && $this->input->post('password') && $this->input->post('password_confirm') && $this->input->post('_token'))
			if ( ! $this->fuel->config('dev_password'))


Fixed code:
require_once(FUEL_PATH.'/libraries/Fuel_base_controller.php');
class Login extends Fuel_base_controller {
		parent::__construct(false);
			// XSS key check
			if (!$this->_is_valid_csrf())
			{
				add_error(lang('error_csrf'));
			}

			elseif (isset($user_data['failed_login_timer']) AND (time() - $user_data['failed_login_timer']) < (int)$this->fuel->config('seconds_to_unlock'))
		$this->_prep_csrf();

			// XSS key check
			if (!$this->_is_valid_csrf())
			{
				add_error(lang('error_csrf'));
			}
			elseif (isset($user_data['failed_login_timer']) AND (time() - $user_data['failed_login_timer']) < (int)$this->fuel->config('seconds_to_unlock'))
		$this->_prep_csrf();
			// XSS key check
			if (!$this->_is_valid_csrf())
			{
				add_error(lang('error_csrf'));
			}
			elseif ($this->input->post('email') && $this->input->post('password') && $this->input->post('password_confirm') && $this->input->post('_token'))
		$this->_prep_csrf();
			// XSS key check
			if (!$this->_is_valid_csrf())
			{
				add_error(lang('error_csrf'));
			}
			elseif ( ! $this->fuel->config('dev_password'))
		$this->_prep_csrf();
$lang['error_csrf'] = 'Invalid submission.';
CVE-2017-16763 (Python, published 2017-11-10T09:29Z)
Description: value: An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/bbengfort/confire
Files changed:
confire/config.py
tests/test_conf.py
tests/test_descriptors.py
tests/test_environ.py
tests/test_paths.py
tests/test_safety.py
Commit message: use safe load instead of load


Vulnerable code:
                    config.configure(yaml.load(conf))
# tests.conf_tests
# ID: conf_tests.py [] benjamin@bengfort.com $
# tests.descriptors_tests
# ID: descriptors_tests.py [] benjamin@bengfort.com $
# tests.environ_tests
# ID: environ_tests.py [] benjamin@bengfort.com $
# tests.paths_tests
# ID: paths_tests.py [] benjamin@bengfort.com $

Fixed code:
                    config.configure(yaml.safe_load(conf))
# tests.test_conf
# ID: test_conf.py [] benjamin@bengfort.com $
# tests.test_descriptors
# ID: test_descriptors.py [] benjamin@bengfort.com $
# tests.test_environ
# ID: test_environ.py [] benjamin@bengfort.com $
# tests.test_paths
# ID: test_paths.py [] benjamin@bengfort.com $
# tests.test_safety
# Test that we're using safe methods
#
# Author:   Benjamin Bengfort <benjamin@bengfort.com>
# Created:  Fri Nov 10 12:22:35 2017 -0500
#
# Copyright (C) 2014 Bengfort.com
# For license information, see LICENSE.txt
#
# ID: test_safety.py [] benjamin@bengfort.com $

"""
Testing the paths descriptor
"""

##########################################################################
## Imports
##########################################################################

import os

from unittest import mock


# Cannot import from test_conf.py to ensure correct mock
TESTDATA = os.path.join(os.path.dirname(__file__), "testdata")
TESTCONF = os.path.join(TESTDATA, "testconf.yaml")


@mock.patch('confire.config.yaml')
def test_use_yaml_safe_load(mock_yaml):
    """
    Ensure we're using yaml.safe_load not yaml.load
    """
    from confire.config import Configuration
    Configuration.CONF_PATHS = [TESTCONF]
    Configuration.load()

    mock_yaml.safe_load.assert_called_once()
    mock_yaml.load.assert_not_called()
CVE-2022-23599 (Other, published 2022-01-28T22:15Z)
Description: value: Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.
Severity: LOW (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/plone/Products.ATContentTypes
Files changed:
Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt
news/1.bugfix
Commit message: Security fix: prevent cache poisoning with the Referer header.

See [security advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).


Vulnerable code:
       tal:attributes="href request/HTTP_REFERER"
       tal:condition="request/HTTP_REFERER"
       tal:attributes="href context/portal_url"
       tal:condition="not: request/HTTP_REFERER"

Fixed code:
  <tal:block define="referer request/HTTP_REFERER;
                     url_tool nocall:context/portal_url;
                     referer python:referer if referer and url_tool.isURLInPortal(referer) else '';">
       tal:attributes="href referer"
       tal:condition="referer"
       tal:attributes="href python:url_tool()"
       tal:condition="not: referer"
      </tal:block>
Security fix: prevent cache poisoning with the Referer header.
See `security advisory <https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh>`.
[maurits]
CVE-2022-23599 (Other, published 2022-01-28T22:15Z)
Description: value: Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.
Severity: LOW (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/plone/Products.ATContentTypes
Files changed:
Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt
news/1.bugfix
Commit message: Security fix: prevent cache poisoning with the Referer header.

See [security advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).


Vulnerable code:
       tal:attributes="href request/HTTP_REFERER"
       tal:condition="request/HTTP_REFERER"
       tal:attributes="href context/portal_url"
       tal:condition="not: request/HTTP_REFERER"

Fixed code:
  <tal:block define="referer request/HTTP_REFERER;
                     url_tool nocall:context/portal_url;
                     referer python:referer if referer and url_tool.isURLInPortal(referer) else '';">
       tal:attributes="href referer"
       tal:condition="referer"
       tal:attributes="href python:url_tool()"
       tal:condition="not: referer"
      </tal:block>
Security fix: prevent cache poisoning with the Referer header.
See `security advisory <https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh>`.
[maurits]
CVE-2021-29261 (JSON, published 2021-04-05T07:15Z)
Description: value: The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sveltejs/language-tools
Files changed:
packages/svelte-vscode/package.json
Commit message: (fix) make runtime/ls-path configurable in user settings only

Due to security reasons: If this could be set in the workspace, a malicious workspace could point this to an arbitrary executable.

Vulnerable code:
                    "description": "- You normally don't need this - Path to the node executable to use to spawn the language server. This is useful when you depend on native modules such as node-sass as without this they will run in the context of vscode, meaning node version mismatch is likely."
                    "description": "- You normally don't set this - Path to the language server executable. If you installed the \"svelte-language-server\" npm package, it's within there at \"bin/server.js\". Path can be either relative to your workspace root or absolute. Set this only if you want to use a custom version of the language server."

Fixed code:
                    "scope": "application",
                    "description": "- You normally don't need this - Path to the node executable to use to spawn the language server. This is useful when you depend on native modules such as node-sass as without this they will run in the context of vscode, meaning node version mismatch is likely. This setting can only be changed in user settings for security reasons."
                    "scope": "application",
                    "description": "- You normally don't set this - Path to the language server executable. If you installed the \"svelte-language-server\" npm package, it's within there at \"bin/server.js\". Path can be either relative to your workspace root or absolute. Set this only if you want to use a custom version of the language server. This setting can only be changed in user settings for security reasons."
CVE-2023-26145 (Python, published 2023-09-28T05:15Z)
Description: value: This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.**Note:**The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/dgilland/pydash
Files changed:
src/pydash/helpers.py
tests/test_objects.py
Commit message: fix: don't allow object paths that reference dunder-method attributes for functions like get()


Vulnerable code:

Fixed code:
        _raise_if_restricted_key(key)
def _raise_if_restricted_key(key):
    # Prevent access to dunder-methods since this could expose access to globals through leaky
    # attributes such as obj.__init__.__globals__.
    if len(key) > 4 and key.isascii() and key.startswith("__") and key.endswith("__"):
        raise KeyError(f"access to restricted key {key!r} is not allowed")


        _raise_if_restricted_key(key)
@parametrize(
    "obj,path",
    [
        (helpers.Object(), "__init__"),
        (helpers.Object(subobj=helpers.Object()), "subobj.__init__"),
        (namedtuple("a", ["a"])(a=1), "__len__"),
    ],
)
def test_get__raises_for_objects_when_path_restricted(obj, path):
    with pytest.raises(KeyError, match="access to restricted key"):
        _.get(obj, path)


@parametrize(
    "obj,path",
    [
        ({}, "__init__"),
        ([], "__contains__"),
    ],
)
def test_get__does_not_raise_for_dict_or_list_when_path_restricted(obj, path):
    assert _.get(obj, path) is None
CVE-2023-26145 (Python, published 2023-09-28T05:15Z)
Description: value: This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.**Note:**The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/dgilland/pydash
Files changed:
src/pydash/helpers.py
tests/test_objects.py
Commit message: fix: don't allow object paths that reference dunder-method attributes for functions like get()


Vulnerable code:

Fixed code:
        _raise_if_restricted_key(key)
def _raise_if_restricted_key(key):
    # Prevent access to dunder-methods since this could expose access to globals through leaky
    # attributes such as obj.__init__.__globals__.
    if len(key) > 4 and key.isascii() and key.startswith("__") and key.endswith("__"):
        raise KeyError(f"access to restricted key {key!r} is not allowed")


        _raise_if_restricted_key(key)
@parametrize(
    "obj,path",
    [
        (helpers.Object(), "__init__"),
        (helpers.Object(subobj=helpers.Object()), "subobj.__init__"),
        (namedtuple("a", ["a"])(a=1), "__len__"),
    ],
)
def test_get__raises_for_objects_when_path_restricted(obj, path):
    with pytest.raises(KeyError, match="access to restricted key"):
        _.get(obj, path)


@parametrize(
    "obj,path",
    [
        ({}, "__init__"),
        ([], "__contains__"),
    ],
)
def test_get__does_not_raise_for_dict_or_list_when_path_restricted(obj, path):
    assert _.get(obj, path) is None
CVE-2020-15271 (Unknown, published 2020-10-26T18:15Z)
Description: value: In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/d0c-s4vage/lookatme
Files changed:
Commit message: Merge pull request #110 from d0c-s4vage/feature/109-extension_warnings

Adds warnings about loading extensions

Vulnerable code:

Fixed code:
CVE-2024-30254 (Unknown, published 2024-04-04T19:15Z)
Description: value: MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files if the attacker can make the victim either run the language server within a specific crafted project or `mesonlsp --full`. Version 4.1.4 contains a patch for this issue. As a workaround, avoid running `mesonlsp --full` and set the language server option `others.neverDownloadAutomatically` to `true`.


Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/JCWasmx86/mesonlsp
Files changed:
Commit message: Merge branch 'fix_vuln'


Vulnerable code:

Fixed code:
CVE-2023-43662 (C#, published 2023-09-28T22:15Z)
Description: value: ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.
Severity: nan (CVSS v3 base score: 8.6)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/ShokoAnime/ShokoServer
Files changed:
Shoko.Server/API/v1/Implementations/ShokoServiceImplementationImage.cs
Commit message: Merge pull request from GHSA-mwcv-ghjq-8f2g

* Fix arbitrary file read WithPath endpoint

* Remove WithPath Endpoint from APIv1

It's unnecessary and a security issue

---------

Co-authored-by: da3dsoul <da3dsoul@gmail.com>

Vulnerable code:
    [HttpGet("WithPath/{serverImagePath}")]
    public object GetImageUsingPath(string serverImagePath)
    {
        if (!System.IO.File.Exists(serverImagePath))
        {
            logger.Trace("Could not find AniDB_Cover image: {0}", serverImagePath);
            return NotFound();
        }

        Response.ContentType = Mime.GetMimeMapping(serverImagePath);
        return System.IO.File.OpenRead(serverImagePath);
    }


Fixed code: