hitoshura25/cvefixes huggingface dataset:
CVE-2018-9109 (PHP, published 2018-03-28T06:29Z)
Description: value: Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
Severity: HIGH (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinder.class.php
Commit message: [php:security] fix directory traversal vulnerability

Fixed vulnerability that can delete arbitrary files with zipdl command.

Fixed it because there was a possibility that files that can be deleted
may be deleted by the execution account of the web server.

Reviewed-by: Ravindra Rajaram <ravindra.rajaram@ca.com> and Kevin Kotas <kevin.kotas@ca.com>


Vulnerable code:
			if (!is_readable($path)) {

Fixed code:
			// checking the validity of the file parameter
			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
			}
			if (!is_writable($path)) {
CVE-2018-9110 (PHP, published 2018-03-28T14:29Z)
Description: value: Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
Severity: HIGH (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinder.class.php
Commit message: [php:security] re-fix directory traversal vulnerability for windows server

rel. commit 157f471d7e48f190f74e66eb5bc73360b5352fd3


Vulnerable code:
			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {

Fixed code:
			if (strpos(str_replace('/', DIRECTORY_SEPARATOR, $file), DIRECTORY_SEPARATOR) !== false) {
CVE-2019-6257 (PHP, published 2019-01-14T08:29Z)
Description: value: A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php.
Severity: MEDIUM (CVSS v3 base score: 7.7)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinder.class.php
Commit message: [php:core:security] fix SSRF vulnerability of `get_remote_contents()`

We express special gratitude to Do Ha Anh of Viettel Cyber Security
Center, the reporter of this vulnerability.


Vulnerable code:
            $host = strtolower($info['host']);
            // do not support non dot URL
            // disallow including "localhost"
            if (strpos($host, 'localhost') !== false) {
            // check IPv4 local loopback
            if (preg_match('/^(?:127|0177|0x7f)\.[0-9a-fx.]+$/', $host)) {

Fixed code:
            $host = trim(strtolower($info['host']), '.');
            // do not support non dot host
            // do not support URL-encoded host
            if (strpos($host, '%') !== false) {
            // disallow including "localhost" and "localdomain"
            if (preg_match('/\b(?:localhost|localdomain)\b/', $host)) {
            // check IPv4 local loopback, private network and link local
            if (preg_match('/^0x[0-9a-f]+|[0-9]+(?:\.(?:0x[0-9a-f]+|[0-9]+)){1,3}$/', $host, $m)) {
                $long = (int)sprintf('%u', ip2long($host));
                if (!$long) {
                    return false;
                }
                $local = (int)sprintf('%u', ip2long('127.255.255.255')) >> 24;
                $prv1 = (int)sprintf('%u', ip2long('10.255.255.255')) >> 24;
                $prv2 = (int)sprintf('%u', ip2long('172.31.255.255')) >> 20;
                $prv3 = (int)sprintf('%u', ip2long('192.168.255.255')) >> 16;
                $link = (int)sprintf('%u', ip2long('169.254.255.255')) >> 16;

                if ($long >> 24 === $local || $long >> 24 === $prv1 || $long >> 20 === $prv2 || $long >> 16 === $prv3 || $long >> 16 === $link) {
                    return false;
                }
            }
            // dose not support 'user' and 'pass' for security reasons
            $url = $info['scheme'].'://'.$host.(!empty($info['port'])? (':'.$info['port']) : '').$info['path'].(!empty($info['query'])? ('?'.$info['query']) : '').(!empty($info['fragment'])? ('#'.$info['fragment']) : '');
        if (!$fp) {
            return false;
        }
CVE-2021-23394 (PHP, published 2021-06-13T11:15Z)
Description: value: The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinderVolumeDriver.class.php
Commit message: [VD:abstract] add `'phar:*' => 'text/x-php'` into 'staticMineMap'

rel. #3295


Vulnerable code:

Fixed code:
            'phar:*' => 'text/x-php',
CVE-2022-26960 (PHP, published 2022-03-21T17:15Z)
Description: value: connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinderVolumeDriver.class.php
php/elFinderVolumeLocalFileSystem.class.php
Commit message: [security:CVE-2022-26960] fix a path traversal issue

Fixed a paste traversal vulnerability. The problem was getting out of
the configured directory and allowing the hosting server's file system
to read and write "arbitrary" files.

Special thanks to Gaetan Ferry (Synacktiv) for reporting this issue.


Vulnerable code:
        // 'Here'
        if ($path === '' || $path === '.' . $separator) return $base;


Fixed code:
        // normalize `//` to `/`
        $path = preg_replace('#' . $sepquoted . '+#', $separator, $path); // '#/+#'

        // remove `./`
        $path = preg_replace('#(?<=^|' . $sepquoted . ')\.' . $sepquoted . '#', '', $path); // '#(?<=^|/)\./#'

        // 'Here'
        if ($path === '') return $base;

        // join $base to $path if $path start `../`

        // discard the surplus `../`
        $path = str_replace('..' . $separator, '', $path);

            $path = $this->_normpath($path);
CVE-2023-35840 (PHP, published 2023-06-19T01:15Z)
Description: value: _joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinderVolumeLocalFileSystem.class.php
Commit message: [VD:LocalFileSystem] Security fixes, directory traversal vulnerability
fixes

This issue was found by Michał Majchrowicz & Livio Victoriano AFINE
Team. We give them a special thanks.


Vulnerable code:

Fixed code:
                $dir = str_replace('/', DIRECTORY_SEPARATOR, $dir);
            if (strpos($dir, '..' . DIRECTORY_SEPARATOR) !== false || substr($dir, -2) == '..') {
                $dir = $this->root;
            }
CVE-1999-0731 (C++, published 1999-06-23T04:00Z)
Description: value: The KDE klock program allows local users to unlock a session using malformed input.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/KDE/kde1-kdebase
Files changed:
kscreensaver/saver.cpp
Commit message: Fix for password entry/dialog deletion race.


Vulnerable code:

Fixed code:
            timer.stop();
CVE-2020-11016 (Markdown, published 2020-04-30T23:15Z)
Description: value: IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/certtools/intelmq-manager
Files changed:
CHANGELOG.md
NEWS.md
intelmq-manager/php/controller.php
Commit message: SEC: fix RCE bug in controller.php

@bernhard-herzog (@Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.


Vulnerable code:

            $arguments .= "message send '" . escapeshellarg(filter_input(INPUT_POST, "msg")) . "'";

Fixed code:
Bernhard Herzog (Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.
- Fix handling of POST variable `msg` of the message-sending functionality available in the Inspect-tool.
**Never ever run intelmq-manager on a public webserver without SSL and proper authentication**.

Bernhard Herzog (Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.

            $arguments .= "message send " . escapeshellarg(filter_input(INPUT_POST, "msg"));
CVE-2022-27651 (Go, published 2022-04-04T20:15Z)
Description: value: A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/containers/buildah
Files changed:
chroot/run.go
run_linux.go
Commit message: do not set the inheritable capabilities

The kernel never sets the inheritable capabilities for a process, they
are only set by userspace.  Emulate the same behavior.

Closes: CVE-2022-27651

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>


Vulnerable code:
		capability.INHERITABLE: spec.Process.Capabilities.Inheritable,
		if err := g.AddProcessCapabilityInheritable(cap); err != nil {
			return errors.Wrapf(err, "error adding %q to the inheritable capability set", cap)
		}
		if err := g.DropProcessCapabilityInheritable(cap); err != nil {
			return errors.Wrapf(err, "error removing %q from the inheritable capability set", cap)
		}

Fixed code:
		capability.INHERITABLE: []string{},
CVE-2021-29369 (JSON, published 2021-05-03T12:15Z)
Description: value: The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/rkesters/gnuplot
Files changed:
package-lock.json
package.json
src/index.ts
src/test.ts
Commit message: validate filename


Vulnerable code:
      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
      "dev": true

Fixed code:
      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ="
    "filename-reserved-regex": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/filename-reserved-regex/-/filename-reserved-regex-2.0.0.tgz",
      "integrity": "sha1-q/c9+rc10EVECr/qLZHzieu/oik="
    },
    "filenamify": {
      "version": "4.2.0",
      "resolved": "https://registry.npmjs.org/filenamify/-/filenamify-4.2.0.tgz",
      "integrity": "sha512-pkgE+4p7N1n7QieOopmn3TqJaefjdWXwEkj2XLZJLKfOgcQKkn11ahvGNgTD8mLggexLiDFQxeTs14xVU22XPA==",
      "requires": {
        "filename-reserved-regex": "^2.0.0",
        "strip-outer": "^1.0.1",
        "trim-repeated": "^1.0.0"
      }
    },
    "strip-outer": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/strip-outer/-/strip-outer-1.0.1.tgz",
      "integrity": "sha512-k55yxKHwaXnpYGsOzg4Vl8+tDrWylxDEpknGjhTiZB8dFRU5rTo9CAzeycivxV3s+zlTKwrs6WxMxR95n26kwg==",
      "requires": {
        "escape-string-regexp": "^1.0.2"
      }
    },
    "trim-repeated": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/trim-repeated/-/trim-repeated-1.0.0.tgz",
      "integrity": "sha1-42RqLqTokTEr9+rObPsFOAvAHCE=",
      "requires": {
        "escape-string-regexp": "^1.0.2"
      }
    },
    "filenamify": "^4.2.0",
import validFilename from "filenamify";

  const f = validFilename.path(options.filename);
  if (f !== options.filename) {
    throw new Error(`invalid filename of '${options.filename}' -- ${f}`);
  }
import { fail } from "assert";
    it("bad filename ", async () => {
      let passed = false;
      try {
        const ploted = await plot({
          data: [3, 1, 2, 3, 4],
          filename: __dirname + "/test/output1.png & frog > frog.txt",
          format: "png",
        });
      } catch (e) {
        should(e.message).contain("invalid filename of");
        passed = true;
      }
      if (!passed) {
        fail();
      }
    });
CVE-2022-35861 (Other, published 2022-07-17T17:15Z)
Description: value: pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pyenv/pyenv
Files changed:
libexec/pyenv-version-file-read
test/version-file-read.bats
Commit message: CVE-2022-35861: Fixed relative path traversal due to using version string in path (#2412)



Vulnerable code:
      [[ -z $version || $version == \#* ]] && continue
      printf "%s%s" "$sep" "$version"
      sep=:

Fixed code:
    if [[ -z $version || $version == \#* ]]; then
      # Skip empty lines and comments
      continue
    elif [ "$version" = ".." ] || [[ $version == */* ]]; then
      # The version string is used to construct a path and we skip dubious values.
      # This prevents issues such as path traversal (CVE-2022-35861).
      continue
    fi
    printf "%s%s" "$sep" "$version"
    sep=:

@test "skips relative path traversal" {
  cat > my-version <<IN
3.9.3
3.8.9
  ..
./*
2.7.16
IN
  run pyenv-version-file-read my-version
  assert_success "3.9.3:3.8.9:2.7.16"
}
CVE-2018-16391 (C, published 2018-09-03T14:29Z)
Description: value: Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-cac.c
src/libopensc/card-epass2003.c
src/libopensc/card-muscle.c
src/libopensc/card-tcos.c
src/libopensc/pkcs15-esteid.c
src/libopensc/pkcs15-gemsafeV1.c
src/libopensc/pkcs15-sc-hsm.c
src/libopensc/sc.c
src/tools/cryptoflex-tool.c
src/tools/egk-tool.c
src/tools/util.c
Commit message: fixed out of bounds writes

Thanks to Eric Sesterhenn from X41 D-SEC GmbH
for reporting the problems.


Vulnerable code:
		memcpy(serial->value, priv->cac_id, priv->cac_id_len);
	if (2 == cipher_len)
		u8* oid= fs->cache.array[x].objectId.id;
			count+=2;
		int j, len=apdu.resp[i+1];
			memcpy(file->name, d, len);
			file->namelen = len;
	buff[r] = '\0';
	while (ibuf[ind] == 0x01) {
		/* save EF_C_DevAut for further use */
		ptr = realloc(priv->EF_C_DevAut, len);
		if (ptr) {
			memcpy(ptr, efbin, len);
			priv->EF_C_DevAut = ptr;
			priv->EF_C_DevAut_len = len;
	if (sec_attr == NULL) {
	bufsize = file->size;
	bufsize = file->size;
	len = file ? file->size : 4096;
		strcat(line, buf);
		strcat(line, " ");

Fixed code:
		memcpy(serial->value, priv->cac_id, serial->len);
	if (2 == cipher_len || *out_len < cipher_len - 2)
			len = plain->resplen;
		u8* oid = fs->cache.array[x].objectId.id;
		if (bufLen < 2)
			break;
			count += 2;
			bufLen -= 2;
		size_t j, len=apdu.resp[i+1];
			file->namelen = MIN(sizeof file->name, len);
			memcpy(file->name, d, file->namelen);
	buff[MIN((size_t) r, (sizeof buff)-1)] = '\0';
	while (ibuf[ind] == 0x01 && i < gemsafe_cert_max) {
		if (len > 0) {
			/* save EF_C_DevAut for further use */
			ptr = realloc(priv->EF_C_DevAut, len);
			if (ptr) {
				memcpy(ptr, efbin, len);
				priv->EF_C_DevAut = ptr;
				priv->EF_C_DevAut_len = len;
			}
	if (sec_attr == NULL || sec_attr_len) {
#include "libopensc/internal.h"
	bufsize = MIN(file->size, sizeof buf);
	bufsize = MIN(file->size, sizeof buf);
	len = file && file->size > 0 ? file->size : 4096;
		strncat(line, buf, sizeof line);
		strncat(line, " ", sizeof line);
	line[(sizeof line)-1] = '\0'; /* make sure it's NUL terminated */