hitoshura25/cvefixes huggingface dataset:
CVE-2019-19617 (PHP, published 2019-12-06T03:15Z)
Description: value: phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/classes/Display/GitRevision.php
libraries/classes/Footer.php
Commit message: Escape Git information on the index page

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>


Vulnerable code:
            . '">' . $commit_hash . '</strong>';
                    . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH')
        if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH')) {
                . '" rel="noopener noreferrer" target="_blank">' . $branch . '</a>';
            $branch = sprintf(__('%1$s from %2$s branch'), $commit_hash, $branch);
                '<a target="_blank" rel="noopener noreferrer" href="' . $repobase . $fullrevision . '">'
                . $revision . '</a>',
                '<a target="_blank" rel="noopener noreferrer" href="' . $repobranchbase . $branch . '">'
                . $branch . '</a>'

Fixed code:
            . '">' . htmlspecialchars($commit_hash) . '</strong>';
                    . htmlspecialchars($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH'))
        $isRemoteBranch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH');
        if ($isRemoteBranch) {
                . '" rel="noopener noreferrer" target="_blank">' . htmlspecialchars($branch) . '</a>';
            $branch = sprintf(
                __('%1$s from %2$s branch'),
                $commit_hash,
                $isRemoteBranch ? $branch : htmlspecialchars($branch)
            );
                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobase . $fullrevision) . '">'
                . htmlspecialchars($revision) . '</a>',
                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobranchbase . $branch) . '">'
                . htmlspecialchars($branch) . '</a>'
CVE-2022-4736 (Ruby, published 2022-12-25T20:15Z)
Description: value: A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jschwindt/Venganzas-del-Pasado
Files changed:
.nvmrc
app/views/posts/archive.html.erb
app/views/posts/contributions.html.erb
app/views/posts/index.html.erb
app/views/torrents/index.html.erb
Commit message: Remove 'raw' to fix XSS

See: https://www.openbugbounty.org/reports/3022583/


Vulnerable code:
  <% the_title = "#{title_part}, <small>Página #{params[:page]}</small>" %>
<h2 class="title fancy is-4"><%= raw the_title %></h2>
  <% the_title = "Contribuciones de Programas de La Venganza será Terrible, <small>Página #{params[:page]}</small>" -%>
<h2 class="title fancy is-4"><%= raw the_title %></h2>
  <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina, <small>Página #{params[:page]}</small>" -%>
<h2 class="title fancy is-4"><%= raw the_title %></h2>
  <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina<small>, Página #{params[:page]}</small>" -%>
<h2 class="title"><%=raw the_title %></h2>

Fixed code:
v12.22.10
  <% the_title = "#{title_part} (página #{params[:page]})" -%>
<h2 class="title fancy is-4"><%= the_title %></h2>
  <% the_title = "Contribuciones de Programas de La Venganza será Terrible (página #{params[:page]})" -%>
<h2 class="title fancy is-4"><%= the_title %></h2>
  <% the_title = "Programas de La Venganza será Terrible de Alejandro Dolina (página #{params[:page]})" -%>
<h2 class="title fancy is-4"><%= the_title %></h2>
  <% the_title = "Torrents de La Venganza será Terrible de Alejandro Dolina (página #{params[:page]})" -%>
<h2 class="title"><%= the_title %></h2>
CVE-2024-32980 (Unknown, published 2024-05-08T15:15Z)
Description: value: Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/fermyon/spin
Files changed:
Commit message: Merge pull request from GHSA-f3h7-gpjj-wcvh

Stop using untrusted user input for determining outbound request permissions

Vulnerable code:

Fixed code:
CVE-2022-31506 (Python, published 2022-07-11T01:15Z)
Description: value: The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/cmusatyalab/opendiamond
Files changed:
opendiamond/dataretriever/augment_store.py
opendiamond/dataretriever/diamond_store.py
opendiamond/dataretriever/mixer_store.py
opendiamond/dataretriever/test_store.py
opendiamond/dataretriever/video_store.py
opendiamond/dataretriever/yfcc100m_mysql_store.py
Commit message: Fix path traversal issues in all dataretriever backends


Vulnerable code:
from werkzeug.utils import safe_join
    return os.path.join(DATAROOT, obj_path)
    return os.path.join(INDEXDIR, index)
    return os.path.join(DATAROOT, obj_path)
    return os.path.join(INDEXDIR, index)
    return os.path.join(DATAROOT, obj_path)
    return os.path.join(INDEXDIR, index)
    return os.path.join(DATAROOT, obj_path)
    return os.path.join(INDEXDIR, index)
    path = _get_obj_abosolute_path(dataset, rel_path)
def _get_obj_abosolute_path(dataset, rel_path):
    return os.path.join(DATAROOT, dataset, rel_path)
        src_uri = 'file://' + os.path.join(DATAROOT, dataset, rel_path)

Fixed code:
from werkzeug.security import safe_join
from werkzeug.security import safe_join
    return safe_join(DATAROOT, obj_path)
    return safe_join(INDEXDIR, index)
from werkzeug.security import safe_join
    return safe_join(DATAROOT, obj_path)
    return safe_join(INDEXDIR, index)
from werkzeug.security import safe_join

    return safe_join(DATAROOT, obj_path)
    return safe_join(INDEXDIR, index)
from werkzeug.security import safe_join
    return safe_join(DATAROOT, obj_path)
    return safe_join(INDEXDIR, index)
from werkzeug.security import safe_join
    path = _get_obj_absolute_path(dataset, rel_path)
def _get_obj_absolute_path(dataset, rel_path):
    return safe_join(DATAROOT, dataset, rel_path)
        src_uri = 'file://' + _get_obj_absolute_path(dataset, rel_path)
CVE-2020-11529 (PHP, published 2020-04-04T19:15Z)
Description: value: Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Grav.php
Commit message: Fix for user reported CVE path-based open redirect


Vulnerable code:
        //Check for code in route

Fixed code:
    * Fix for [user reported](https://twitter.com/OriginalSicksec) CVE path-based open redirect
        // Clean route for redirect
        $route = preg_replace("#^\/[\\\/]+\/#", '/', $route);

         // Check for code in route
CVE-2021-3818 (PHP, published 2021-09-27T13:15Z)
Description: value: grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-565 \u2014 Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Session.php
system/src/Grav/Framework/Session/Session.php
Commit message: Fixed `Session::setFlashCookieObject()` to use the same options as the main session cookie


Vulnerable code:
        setcookie($name, json_encode($object), time() + $time, '/');
            $object = json_decode($_COOKIE[$name], false);
            setcookie($name, '', time() - 3600, '/');
            return $object;
            $params = session_get_cookie_params();

            $cookie_options = array (
                'expires'  => time() - 42000,
                'path'     => $params['path'],
                'domain'   => $params['domain'],
                'secure'   => $params['secure'],
                'httponly' => $params['httponly'],
                'samesite' => $params['samesite']
            );

                $cookie_options
     * @return void
    protected function setCookie(): void
        $cookie_options = array (
            'expires'  => time() + $params['lifetime'],
        );
            $cookie_options

Fixed code:
    * Fixed `Session::setFlashCookieObject()` to use the same options as the main session cookie
use JsonException;
     * @throws JsonException
        setcookie($name, json_encode($object, JSON_THROW_ON_ERROR), $this->getCookieOptions($time));
     * @throws JsonException
            $cookie = $_COOKIE[$name];
            setcookie($name, '', $this->getCookieOptions(-42000));

            return json_decode($cookie, false, 512, JSON_THROW_ON_ERROR);
                $this->getCookieOptions(-42000)
     * Store something in cookie temporarily.
     *
     * @param int|null $lifetime
     * @return array
    public function getCookieOptions(int $lifetime = null): array
        return [
            'expires'  => time() + ($lifetime ?? $params['lifetime']),
        ];
    }
    /**
     * @return void
     */
    protected function setCookie(): void
    {
            $this->getCookieOptions()
CVE-2021-3904 (PHP, published 2021-10-27T22:15Z)
Description: value: grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
Commit message: Fixed XSS detection with `&colon;`


Vulnerable code:
        $string = html_entity_decode($string, ENT_NOQUOTES, 'UTF-8');

Fixed code:
    * Fixed XSS detection with `&colon;`
        $string = html_entity_decode($string, ENT_NOQUOTES | ENT_HTML5, 'UTF-8');
CVE-2021-3924 (PHP, published 2021-11-05T15:15Z)
Description: value: grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/router.php
Commit message: Fixed path traversal vulnerability when using `bin/grav server`


Vulnerable code:
if (is_file($_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR . $_SERVER['SCRIPT_NAME'])) {
    return false;

Fixed code:
    * Fixed path traversal vulnerability when using `bin/grav server`
$root = $_SERVER['DOCUMENT_ROOT'];
$path = $_SERVER['SCRIPT_NAME'];
if ($path !== '/index.php' && is_file($root . $path)) {
    if (!(
        // Block all direct access to files and folders beginning with a dot
        strpos($path, '/.') !== false
        // Block all direct access for these folders
        || preg_match('`^/(\.git|cache|bin|logs|backup|webserver-configs|tests)/`ui', $path)
        // Block access to specific file types for these system folders
        || preg_match('`^/(system|vendor)/(.*)\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$`ui', $path)
        // Block access to specific file types for these user folders
        || preg_match('`^/(user)/(.*)\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$`ui', $path)
        // Block all direct access to .md files
        || preg_match('`\.md$`ui', $path)
        // Block access to specific files in the root folder
        || preg_match('`^/(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$`ui', $path)
    )) {
        return false;
    }
CVE-2022-0268 (PHP, published 2022-01-25T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
composer.lock
system/src/Grav/Common/Security.php
Commit message: Fixed XSS check not detecting escaped `&#58`


Vulnerable code:
            "version": "1.4.0",
                "reference": "72b04d97b5e6e60a081f17c416fef35bd521120b"
                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/72b04d97b5e6e60a081f17c416fef35bd521120b",
                "reference": "72b04d97b5e6e60a081f17c416fef35bd521120b",
                "source": "https://github.com/phpstan/phpstan/tree/1.4.0"
            "time": "2022-01-14T15:58:47+00:00"
            'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . '):\S.*?#iUu',

Fixed code:
3. [](#bugfix)
    * Fixed XSS check not detecting escaped `&#58`
            "version": "1.4.1",
                "reference": "5bd02c86beb4c024dd4662b6443f5d5332a0ae12"
                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/5bd02c86beb4c024dd4662b6443f5d5332a0ae12",
                "reference": "5bd02c86beb4c024dd4662b6443f5d5332a0ae12",
                "source": "https://github.com/phpstan/phpstan/tree/1.4.1"
            "time": "2022-01-17T16:35:17+00:00"
            'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . ')(:|\&\#58)\S.*?#iUu',
CVE-2022-0743 (PHP, published 2022-02-28T23:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Severity: LOW (CVSS v3 base score: 4.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
Commit message: Fixed entity sanitization for XSS detection


Vulnerable code:
        $string = preg_replace('!(&#0+[0-9]+)!u', '$1;', $string);

Fixed code:
    * Fixed entity sanitization for XSS detection
        $string = preg_replace('!(&#[0-9]+)!u', '$1;', $string);
CVE-2022-0970 (PHP, published 2022-03-15T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Media/Traits/MediaUploadTrait.php
system/src/Grav/Common/Security.php
system/src/Grav/Framework/Form/FormFlashFile.php
Commit message: Added XSS check for uploaded SVG files before they get stored


Vulnerable code:
        $string = preg_replace('!(&#[0-9]+)!u', '$1;', $string);

Fixed code:
    * Added XSS check for uploaded SVG files before they get stored
        if ($uploadedFile instanceof FormFlashFile) {
            $uploadedFile->checkXss();
        }

    /**
     * @param string $filepath
     * @param array|null $options
     * @return string|null
     */
    public static function detectXssFromSvgFile(string $filepath, array $options = null): ?string
    {
        if (file_exists($filepath) && Grav::instance()['config']->get('security.sanitize_svg')) {
            $content = file_get_contents($filepath);

            return static::detectXss($content, $options);
        }

        return null;
    }

        $string = preg_replace('!(&#[0-9]+);?!u', '$1;', $string);
use Grav\Common\Security;
use Grav\Common\Utils;
    /**
     * @return void
     */
    public function checkXss(): void
    {
        $tmpFile = $this->getTmpFile();
        $mime = $this->getClientMediaType();
        if (Utils::contains($mime, 'svg', false)) {
            $response = Security::detectXssFromSvgFile($tmpFile);
            if ($response) {
                throw new RuntimeException(sprintf('SVG file XSS check failed on %s', $response));
            }
        }
    }
CVE-2022-1173 (PHP, published 2022-04-26T16:15Z)
Description: value: stored xss in GitHub repository getgrav/grav prior to 1.7.33.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
Commit message: Fixed XSS check not detecting onX events without quotes


Vulnerable code:
        $string = preg_replace('!\s!u', '', $string);
                if (preg_match($regex, $string) || preg_match($regex, $orig)) {

Fixed code:
    * Fixed XSS check not detecting onX events without quotes
        $string = preg_replace('!\s!u', ' ', $string);
        $stripped = preg_replace('!\s!u', '', $string);
                if (preg_match($regex, $string) || preg_match($regex, $stripped) || preg_match($regex, $orig)) {
CVE-2022-2073 (PHP, published 2022-06-29T19:15Z)
Description: value: Code Injection in GitHub repository getgrav/grav prior to 1.7.34.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Twig/Extension/GravExtension.php
Commit message: Fixed Twig `|filter()` allowing code execution


Vulnerable code:

Fixed code:
    * Fixed Twig `|filter()` allowing code execution
use CallbackFilterIterator;
use Twig\Error\RuntimeError;

            // Security fix
            new TwigFilter('filter', [$this, 'filterFilter'], ['needs_environment' => true]),

    /**
     * @param Environment $env
     * @param array $array
     * @param callable|string $arrow
     * @return array|CallbackFilterIterator
     * @throws RuntimeError
     */
    function filterFilter(Environment $env, $array, $arrow)
    {
        if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
            throw new RuntimeError('Twig |filter("' . $arrow . '") is not allowed.');
        }

        return \twig_array_filter($env, $array, $arrow);
    }
CVE-2023-34251 (PHP, published 2023-06-14T22:15Z)
Description: value: Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this issue.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Twig/Extension/GravExtension.php
Commit message: Fix for dangerous tags in |map filter


Vulnerable code:

Fixed code:
1. [](#bugfix)
   * * Fixed Twig `|map()` allowing code execution
            new TwigFilter('map', [$this, 'mapFilter'], ['needs_environment' => true]),

    /**
     * @param Environment $env
     * @param array $array
     * @param callable|string $arrow
     * @return array|CallbackFilterIterator
     * @throws RuntimeError
     */
    function mapFilter(Environment $env, $array, $arrow)
    {
        if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
            throw new RuntimeError('Twig |map("' . $arrow . '") is not allowed.');
        }

        return twig_array_map($env, $array, $arrow);
    }