hitoshura25/cvefixes huggingface dataset:
CVE-2023-46301 (Objective-C, published 2023-10-22T04:15Z)
Description: value: iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/gnachman/iTerm2
Files changed:
sources/PTYSession.m
Commit message: Fix ReportUpload vulnerability


Vulnerable code:
            [self writeTaskNoBroadcast:@"abort\n" encoding:NSISOLatin1StringEncoding forceEncoding:YES reporting:NO];

Fixed code:
            // Send a Control-C to cancel the command. The protocol calls to send "abort\n" but this
            // introduces a security risk because reports must not contain newlines.
            [self writeTaskNoBroadcast:[NSString stringWithLongCharacter:3]
                              encoding:NSISOLatin1StringEncoding
                         forceEncoding:YES
                             reporting:NO];
CVE-2022-2514 (Python, published 2022-07-25T14:15Z)
Description: value: The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/beancount/fava
Files changed:
src/fava/application.py
src/fava/core/file.py
src/fava/template_filters.py
src/fava/templates/_layout.html
src/fava/templates/errors.html
src/fava/templates/help.html
Commit message: avoid use of |safe filter in templates

Explicitly mark those few places where we need to pass in data that
should not be escaped on the Python side.


Vulnerable code:
        help_html=render_template_string(
            html,
            beancount_version=beancount_version,
            fava_version=fava_version,
    def render_entries(self, entries: Entries) -> Generator[str, None, None]:
                    yield get_entry_slice(entry)[0] + "\n"
                    yield _format_entry(
                        entry,
                        self.ledger.fava_options.currency_column,
                        indent,
import flask
def format_errormsg(message: str) -> str:
        return message
    url = flask.url_for("account", name=account)
    return (
      {{ content|safe }}
      <td class="pre">{{ error.message|format_errormsg|safe }}</td>
    {{ help_html|safe }}

Fixed code:
from markupsafe import Markup
        help_html=Markup(
            render_template_string(
                html,
                beancount_version=beancount_version,
                fava_version=fava_version,
            )
from markupsafe import Markup
    def render_entries(
        self, entries: Entries
    ) -> Generator[Markup, None, None]:
                    yield Markup(get_entry_slice(entry)[0] + "\n")
                    yield Markup(
                        _format_entry(
                            entry,
                            self.ledger.fava_options.currency_column,
                            indent,
                        )
from flask import url_for
from markupsafe import Markup
def format_errormsg(message: str) -> Markup:
        return Markup(message)
    url = url_for("account", name=account)
    return Markup(
      {{ content }}
      <td class="pre">{{ error.message|format_errormsg }}</td>
    {{ help_html }}
CVE-2022-2523 (Other, published 2022-07-25T14:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/beancount/fava
Files changed:
frontend/src/modals/EntryContext.svelte
frontend/src/query/Query.svelte
Commit message: fix xss issue in query filter


Vulnerable code:
                {@html inventory.join("<br>")}
                {@html inventory.join("<br>")}
          {@html error}

Fixed code:
                {#each inventory as amount}
                  {amount}
                  <br />
                {/each}
                {#each inventory as amount}
                  {amount}
                  <br />
                {/each}
          {error}
CVE-2022-4642 (Other, published 2022-12-21T22:15Z)
Description: value: A vulnerability was found in tatoeba2. It has been classified as problematic. This affects an unknown part of the component Profile Name Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version prod_2022-10-30 is able to address this issue. The name of the patch is 91110777fc8ddf1b4a2cf4e66e67db69b9700361. It is recommended to upgrade the affected component. The identifier VDB-216501 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Tatoeba/tatoeba2
Files changed:
src/Template/Email/html/new_private_message.ctp
src/Template/PrivateMessages/folder.ctp
src/Template/PrivateMessages/show.ctp
Commit message: Sanitize private message title

This fixes an XSS vulnerability.

Refs #3002


Vulnerable code:
    "<strong>Title:</strong> $title",
                        <h3><?= $this->safeForAngular($messageTitle) ?></h3>
                    <?= $this->safeForAngular($message->title) ?>

Fixed code:
    "<strong>Title:</strong> ".h($title),
                        <h3><?= h($this->safeForAngular($messageTitle)) ?></h3>
                    <?= h($this->safeForAngular($message->title)) ?>
CVE-2022-1543 (Java, published 2022-04-29T18:15Z)
Description: value: Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/erudika/scoold
Files changed:
src/main/java/com/erudika/scoold/controllers/ProfileController.java
src/main/java/com/erudika/scoold/core/Profile.java
src/main/java/com/erudika/scoold/utils/ScooldUtils.java
Commit message: fixed profile name not limited in length


Vulnerable code:
			showUser.setName(name);
		this.originalName = originalName;
			authUser.setName(u.getName());

Fixed code:
			showUser.setName(StringUtils.abbreviate(name, 256));
		this.originalName = StringUtils.abbreviate(originalName, 256);
			authUser.setName(StringUtils.abbreviate(u.getName(), 256));
CVE-2020-26261 (Unknown, published 2020-12-09T17:15Z)
Description: value: jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Severity: LOW (CVSS v3 base score: 7.9)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/jupyterhub/systemdspawner
Files changed:
Commit message: Merge pull request from GHSA-cg54-gpgr-4rm6

use EnvironmentFile to pass environment variables to systemd units

Vulnerable code:

Fixed code:
CVE-2016-15029 (PHP, published 2023-03-21T11:15Z)
Description: value: A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.php. The manipulation of the argument link/search leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.10.0 is able to address this issue. The patch is identified as 67e87f0f0c1ac238fcd050f4c3db298229bc9679. It is recommended to upgrade the affected component. VDB-223402 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Ydalb/mapicoin
Files changed:
webroot/stats.php
Commit message: fix(stats.php): security issue (XSS)


Vulnerable code:
                    <a href="https://mapicoin.fr/?u=<?= $link ?>"><?= $search['search'] ?></a>

Fixed code:
                    <a href="https://mapicoin.fr/?u=<?= htmlentities($link, ENT_QUOTES, "UTF-8"); ?>"><?= htmlentities($search['search'], ENT_QUOTES, "UTF-8") ?></a>
CVE-2014-9114 (C, published 2017-03-31T16:59Z)
Description: value: Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/karelzak/util-linux
Files changed:
libblkid/src/read.c
libblkid/src/save.c
misc-utils/blkid.8
misc-utils/blkid.c
Commit message: libblkid: care about unsafe chars in cache

The high-level libblkid API uses /run/blkid/blkid.tab cache to
store probing results. The cache format is

   <device NAME="value" ...>devname</device>

and unfortunately the cache code does not escape quotation marks:

   # mkfs.ext4 -L 'AAA"BBB'

   # cat /run/blkid/blkid.tab
   ...
   <device ... LABEL="AAA"BBB" ...>/dev/sdb1</device>

such string is later incorrectly parsed and blkid(8) returns
nonsenses. And for use-cases like

   # eval $(blkid -o export /dev/sdb1)

it's also insecure.

Note that mount, udevd and blkid -p are based on low-level libblkid
API, it bypass the cache and directly read data from the devices.

The current udevd upstream does not depend on blkid(8) output at all,
it's directly linked with the library and all unsafe chars are encoded by
\x<hex> notation.

   # mkfs.ext4 -L 'X"`/tmp/foo` "' /dev/sdb1
   # udevadm info --export-db | grep LABEL
   ...
   E: ID_FS_LABEL=X__/tmp/foo___
   E: ID_FS_LABEL_ENC=X\x22\x60\x2ftmp\x2ffoo\x60\x20\x22

Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
		end = strchr(*value + 1, '"');
		if (!end) {
		end++;
		fprintf(file, " %s=\"%s\"", tag->bit_name,tag->bit_val);
is automatically enabled when I/O Limits (\fB-i\fR option) are requested
		safe_print(value, valsz, NULL);
		safe_print(value, valsz, "\"");

Fixed code:
		char *p = end = *value + 1;

		/* convert 'foo\"bar'  to 'foo"bar' */
		while (*p) {
			if (*p == '\\') {
				p++;
				*end = *p;
			} else {
				*end = *p;
				if (*p == '"')
					break;
			}
			p++;
			end++;
		}

		if (*end != '"') {
		end = ++p;

static void save_quoted(const char *data, FILE *file)
{
	const char *p;

	fputc('"', file);
	for (p = data; p && *p; p++) {
		if ((unsigned char) *p == 0x22 ||		/* " */
		    (unsigned char) *p == 0x5c)			/* \ */
			fputc('\\', file);

		fputc(*p, file);
	}
	fputc('"', file);
}


		fputc(' ', file);			/* space between tags */
		fputs(tag->bit_name, file);		/* tag NAME */
		fputc('=', file);			/* separator between NAME and VALUE */
		save_quoted(tag->bit_val, file);	/* tag "VALUE" */
is automatically enabled when I/O Limits (\fB-i\fR option) are requested.

The non-printing characters are encoded by ^ and M- notation and all
potentially unsafe characters are escaped.
		safe_print(value, valsz, " \\\"'$`<>");
		safe_print(value, valsz, "\"\\");
CVE-2015-5224 (C, published 2017-08-23T15:29Z)
Description: value: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/karelzak/util-linux
Files changed:
include/fileutils.h
lib/fileutils.c
login-utils/chfn.c
login-utils/chsh.c
login-utils/setpwnam.c
login-utils/setpwnam.h
login-utils/vipw.c
Commit message: chsh, chfn, vipw: fix filenames collision

The utils when compiled WITHOUT libuser then mkostemp()ing
"/etc/%s.XXXXXX" where the filename prefix is argv[0] basename.

An attacker could repeatedly execute the util with modified argv[0]
and after many many attempts mkostemp() may generate suffix which
makes sense. The result maybe temporary file with name like rc.status
ld.so.preload or krb5.keytab, etc.

Note that distros usually use libuser based ch{sh,fn} or stuff from
shadow-utils.

It's probably very minor security bug.

Addresses: CVE-2015-5224
Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
extern int xmkstemp(char **tmpname, char *dir);
static inline FILE *xfmkstemp(char **tmpname, char *dir)
	fd = xmkstemp(tmpname, dir);
int xmkstemp(char **tmpname, char *dir)
	char *tmpenv;
	if (dir != NULL)
		tmpenv = dir;
	else
		tmpenv = getenv("TMPDIR");

	if (tmpenv)
		rc = asprintf(&localtmp, "%s/%s.XXXXXX", tmpenv,
			  program_invocation_short_name);
	else
		rc = asprintf(&localtmp, "%s/%s.XXXXXX", _PATH_TMP,
			  program_invocation_short_name);
	f = xfmkstemp(&tmpname, NULL);
	if (setpwnam(ctl->pw) < 0) {
	if (setpwnam(pw) < 0)
int setpwnam(struct passwd *pwd)
	char *atomic_dir = "/etc";
	if ((fp = xfmkstemp(&tmpname, atomic_dir)) == NULL)
extern int setpwnam (struct passwd *pwd);
	char *dir = "/etc";
	if ((fd = xfmkstemp(&tmpname, dir)) == NULL) {

Fixed code:
extern int xmkstemp(char **tmpname, const char *dir, const char *prefix);
static inline FILE *xfmkstemp(char **tmpname, const char *dir, const char *prefix)
	fd = xmkstemp(tmpname, dir, prefix);
int xmkstemp(char **tmpname, const char *dir, const char *prefix)
	const char *tmpenv;
	tmpenv = dir ? dir : getenv("TMPDIR");
	if (!tmpenv)
		tmpenv = _PATH_TMP;
	rc = asprintf(&localtmp, "%s/%s.XXXXXX", tmpenv, prefix);
	f = xfmkstemp(&tmpname, NULL, "test");
	if (setpwnam(ctl->pw, ".chfn") < 0) {
	if (setpwnam(pw, ".chsh") < 0)
int setpwnam(struct passwd *pwd, const char *prefix)
	if ((fp = xfmkstemp(&tmpname, "/etc", prefix)) == NULL)
#ifndef UTIL_LINUX_SETPWNAM_H
#define UTIL_LINUX_SETPWNAM_H
extern int setpwnam (struct passwd *pwd, const char *prefix);

#endif /* UTIL_LINUX_SETPWNAM_H */
	if ((fd = xfmkstemp(&tmpname, "/etc", ".vipw")) == NULL) {
CVE-2017-2616 (C, published 2018-07-27T19:29Z)
Description: value: A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
Severity: MEDIUM (CVSS v3 base score: 4.7)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/karelzak/util-linux
Files changed:
login-utils/su-common.c
Commit message: su: properly clear child PID

Reported-by: Tobias Stöckmann <tobias@stoeckmann.org>
Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
  if (caught_signal)
      sleep (2);
      kill (child, SIGKILL);
      fprintf (stderr, _(" ...killed.\n"));

Fixed code:

	  /* child is gone, don't use the PID anymore */
	  child = (pid_t) -1;
  if (caught_signal && child != (pid_t)-1)
      if (child != (pid_t)-1)
	{
	  sleep (2);
	  kill (child, SIGKILL);
	  fprintf (stderr, _(" ...killed.\n"));
	}
CVE-2018-7738 (Other, published 2018-03-07T02:29Z)
Description: value: In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/karelzak/util-linux
Files changed:
bash-completion/umount
Commit message: bash-completion: (umount) use findmnt, escape a space in paths

 # mount /dev/sdc1 /mnt/test/foo\ bar
 # umount <tab>

has to return "/mnt/test/foo\ bar".

Changes:

 * don't use mount | awk output, we have findmnt
 * force compgen use \n as entries separator

Addresses: https://github.com/karelzak/util-linux/issues/539
Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
	local DEVS_MPOINTS
	DEVS_MPOINTS="$(mount | awk '{print $1, $3}')"
	COMPREPLY=( $(compgen -W "$DEVS_MPOINTS" -- $cur) )
	return 0

Fixed code:

	local oldifs=$IFS
	IFS=$'\n'
	COMPREPLY=( $( compgen -W '$(findmnt -lno TARGET | sed "s/\([[:blank:]]\)/\\\\\1/g")' -- "$cur" ) )
	IFS=$oldifs
CVE-2021-37600 (C, published 2021-07-30T14:15Z)
Description: value: An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/karelzak/util-linux
Files changed:
sys-utils/ipcutils.c
Commit message: sys-utils/ipcutils: be careful when call calloc() for uint64 nmembs

Fix: https://github.com/karelzak/util-linux/issues/1395
Signed-off-by: Karel Zak <kzak@redhat.com>


Vulnerable code:
	if (!p || !p->sem_nsems || p->sem_perm.id < 0)

Fixed code:
	if (!p || !p->sem_nsems || p->sem_nsems > SIZE_MAX || p->sem_perm.id < 0)
CVE-2021-4262 (Unknown, published 2022-12-19T14:15Z)
Description: value: A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/mgallegos/laravel-jqgrid
Files changed:
Commit message: Merge pull request #72 from wuwx/patch-2

preventing sql injection

Vulnerable code:

Fixed code:
CVE-2023-2629 (PHP, published 2023-05-10T16:15Z)
Description: value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/CustomerList/Exporter/AbstractExporter.php
Commit message: Escaped csv formulas (#453)



Vulnerable code:

Fixed code:
use Pimcore\Model\Element\Service;
            $row[self::COLUMNS] = Service::escapeCsvRecord($row[self::COLUMNS]);
            $row[self::SEGMENT_IDS] = Service::escapeCsvRecord($row[self::SEGMENT_IDS]);
CVE-2023-2756 (PHP, published 2023-05-17T11:15Z)
Description: value: SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/Controller/Admin/SegmentAssignmentController.php
Commit message: [Bug]: Fix Inheritable Segment query (#460)

* refactor query

* Apply php-cs-fixer changes

* fix changes were based on another vers

* Update SegmentAssignmentController.php

* task: also return empty when $`id` is not set

---------

Co-authored-by: kingjia90 <kingjia90@users.noreply.github.com>

Vulnerable code:
        $id = $request->get('id') ?? '';
        $type = $request->get('type') ?? '';
        $parentIdStatement = sprintf('SELECT `%s` FROM `%s` WHERE `%s` = :value', $type === 'object' ? 'o_parentId' : 'parentId', $type.'s', $type === 'object' ? 'o_id' : 'id');

Fixed code:
        $id = $request->get('id');
        $type = $request->get('type');
        if (!$type || !$id) {
            return $this->adminJson(['data' => []]);
        }
        $parentIdStatement = sprintf('SELECT :parentIdField FROM %s WHERE :idField = :value', $db->quoteIdentifier($type . 's'));
            'parentIdField' => $type === 'object' ? 'o_parentId' : 'parentId',
            'idField' => $type === 'object' ? 'o_id' : 'id',