hitoshura25/cvefixes huggingface dataset:
CVE-2023-31286 (Other, published 2023-04-27T03:15Z)
Description: value: An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/serenity-is/Serenity
Files changed:
CHANGELOG.md
build/Package.Build.props
Commit message: :up: 6.7.0


Vulnerable code:
    <Version>6.6.6</Version>

Fixed code:
## 6.7.0 (2023-04-06)

Features:

  - **[WARNING!]** This release focuses on addressing potential security issues that were recently discovered by Fabian Densborn from SEC Consult. Serene/StartSharp users must either create a new project from the 6.7.0+ template or manually apply the relevant changes from this commit to their existing applications after updating Serenity packages to 6.7.0+: https://github.com/serenity-is/serene/commit/6dce8162f4382badd429a9f0f1470acb64e8c4fd
    
  - Serenity.is would like to express gratitude to Fabian Densborn for his discovery, analysis, and coordination, as well as the SEC Consult Vulnerability Lab (https://www.sec-consult.com) for responsibly reporting the identified issues and collaborating with us as we addressed them.
    
  - Added the option to use ClamAV (https://www.clamav.net/) as an antivirus scanner for temporary uploads. To enable it, add `services.ConfigureSection<Serenity.Extensions.ClamAVSettings>(Configuration);` and `services.AddSingleton<IUploadAVScanner, Serenity.Extensions.ClamAVUploadScanner>();` to your Startup.cs after upgrading to Serenity/Serenity.Extensions 6.7.0+. Consult ClamAV documentation on how to install it on your platform. This feature will be enabled by default once these changes have been made in Startup.cs. If you want to disable it for development purposes, set ClamAV:Enabled to false in your appsettings.Development.json (not recommended for production!).
    
  - Added extensionless and `.htm`/`.html` to the upload file extensions blacklist by default. An attacker can include malicious scripts in such an HTML file, send an administrative user a link to that file via email, and if the administrative user is already logged in to the site while clicking the link, the script can call services, perform actions, etc. on behalf of the user as the cookies are sent by the browser.
    
  - Ensured that the Forgot password page does not reveal information to identify whether a user with the entered email exists.
    
  - Ensured that reset password tokens can only be used once. They already expired in 3 hours, but if an attacker could see the link within that time frame (e.g., by eavesdropping), they could use it to change the password again.

    <Version>6.7.0</Version>
CVE-2018-1000884 (PHP, published 2018-12-20T21:29Z)
Description: value: Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password reset codes, attacker is able to change administrator password. This attack appear to be exploitable via Unauthenticated network connectivity. This vulnerability appears to have been fixed in After commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- release version 0.9.8-19.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/serghey-rodin/vesta
Files changed:
web/reset/index.php
Commit message: Timing attack fix from security experts https://arcturussecurity.com


Vulnerable code:
            if ($rkey == $_POST['code']) {

Fixed code:
            if (hash_equals($rkey, $POST[‘code’])) {
CVE-2019-9841 (PHP, published 2019-04-19T19:29Z)
Description: value: Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/serghey-rodin/vesta
Files changed:
web/file_manager/fm_api.php
Commit message: setting content type to fix possible XSS attack vector


Vulnerable code:

Fixed code:
header('Content-Type: application/json');
CVE-2020-10966 (PHP, published 2020-03-25T23:15Z)
Description: value: In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/serghey-rodin/vesta
Files changed:
web/reset/index.php
Commit message: Preventing manipulation with $_SERVER['HTTP_HOST']

Vulnerable code:
        $mailtext .= __('PASSWORD_RESET_REQUEST',$_SERVER['HTTP_HOST'],$user,$rkey,$_SERVER['HTTP_HOST'],$user,$rkey);

Fixed code:
        $mailtext .= __('PASSWORD_RESET_REQUEST',$hostname,$user,$rkey,$hostname,$user,$rkey);
CVE-2021-46850 (Other, published 2022-10-24T14:15Z)
Description: value: myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/serghey-rodin/vesta
Files changed:
bin/v-activate-vesta-license
Commit message: Checking licence format

Vulnerable code:

Fixed code:
is_user_format_valid "$license" "license"
CVE-2022-3967 (Shell, published 2022-11-13T08:15Z)
Description: value: A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/serghey-rodin/vesta
Files changed:
func/main.sh
Commit message: Fix for Sed Injection Vulnerability

Thanks to @hestiacp and @jaapmarcus for fix.

Vulnerable code:

Fixed code:

format_no_quotes() {
    exclude="['|\"]"
    if [[ "$1" =~ $exclude ]]; then
       check_result "$E_INVALID" "Invalid $2 contains qoutes (\" or ') :: $1"
    fi
    is_no_new_line_format "$1"
}

is_no_new_line_format() {
    test=$(echo "$1" | head -n1 );
    if [[ "$test" != "$1" ]]; then
      check_result "$E_INVALID" "invalid value :: $1"
    fi
}


                alias)          is_alias_format_valid "$arg" ;;
CVE-2023-41050 (Python, published 2023-09-06T18:15Z)
Description: value: AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 7.7)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/zopefoundation/AccessControl
Files changed:
CHANGES.rst
src/AccessControl/__init__.py
src/AccessControl/safe_formatter.py
src/AccessControl/tests/test_safe_formatter.py
Commit message: Merge pull request from GHSA-8xv7-89vj-q48c

* fix information disclosure via `format_map`

* Fix CHANGES.rst according to review

Co-authored-by: Jens Vagelpohl <jens@plyp.com>

* Add CVE

---------

Co-authored-by: Jens Vagelpohl <jens@plyp.com>
Co-authored-by: Michael Howitz <mh@gocept.com>

Vulnerable code:

Fixed code:
- Fix information disclosure through ``str.format_map``.
  (CVE-2023-41050)

from AccessControl.safe_formatter import safe_format_map
rules['format_map'] = safe_format_map
    def safe_format_map(self, kw):
        kwargs = _MagicFormatMapping((), kw)
        return self.vformat(self.value, (), kwargs)



def safe_format_map(inst, method):
    return SafeFormatter(inst).safe_format_map

    def test_format_map(self):
        from AccessControl.safe_formatter import SafeFormatter

        # Accessing basic Python types in a basic Python list is fine.
        foo = list(['bar'])
        self.assertEqual(SafeFormatter('{foo[0]}')
                         .safe_format_map(dict(foo=foo)),
                         'bar')
        # But for non-basic items or non-basic lists, we want run checks.
        folder = self._create_folder_with_mixed_contents()
        # We can get the public items just fine:
        self.assertEqual(SafeFormatter('{foo[0]}')
                         .safe_format_map(dict(foo=folder)),
                         '<Item public1>')
        self.assertEqual(SafeFormatter('{foo[2]}')
                         .safe_format_map(dict(foo=folder)),
                         '<Item public2>')
        # But not the private item:
        self.assertRaises(Unauthorized,
                          SafeFormatter('{foo[1]}').safe_format_map,
                          dict(foo=folder))
CVE-2017-15111 (Python, published 2018-01-20T00:29Z)
Description: value: keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/jdennis/keycloak-httpd-client-install
Files changed:
keycloak_httpd_client/keycloak_cli.py
Commit message: CVE-2017-15111 unsafe /tmp log file in --log-file option in keycloak_cli.py

keycloak_cli.py is essentially a set of utilities used by the
keycloak-httpd-client-install tool. It can be invoked on it's own,
mostly for testing or to execute just one part of the Keycloak REST
API. It's log file defaulted to /tmp/{prog_name}.log where prog_name
is the name of the program that invoked it. That default was changed
to {prog_name}.log so the log file is created in the current directory
instead of under /tmp. Use of the /var/log directory was avoided
because that requires root privileges.


Vulnerable code:
                        default='/tmp/{prog_name}.log'.format(

Fixed code:
                        default='{prog_name}.log'.format(
CVE-2019-7738 (Markdown, published 2019-02-11T21:29Z)
Description: value: C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/cooltey/C.P.Sub
Files changed:
README.md
Commit message: Update README.md


Vulnerable code:
<b>2016-11-30: v5.1</b><br>
<li>1.加入最後瀏覽時間，以阻擋過度瀏覽而導致文章消失的問題</li>
<li>2.修改一些小 Bug</li>
<li>3.加入 IP Checker ，但好像沒什麼用</li>
目前程式版本 Current Version：v5.21

Fixed code:
<b>2019-02-10: v5.3</b><br>
<li>1.修正 CSRF 問題並新增開關 CSRF 防護的功能</li>
<b>2019-2-10: v5.3</b><br>
<li>1. Added CSRF protection</li>

目前程式版本 Current Version：v5.3
CVE-2021-21244 (Java, published 2021-01-15T20:15Z)
Description: value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/CoreModule.java
Commit message: fix issue #88: Users able to edit build spec can execute arbitrary java
code

Vulnerable code:
				Configuration<?> configuration = Validation.byDefaultProvider().configure();

Fixed code:
import org.hibernate.validator.messageinterpolation.ParameterMessageInterpolator;
				Configuration<?> configuration = Validation
						.byDefaultProvider()
						.configure()
						.messageInterpolator(new ParameterMessageInterpolator());
CVE-2021-21245 (Java, published 2021-01-15T21:15Z)
Description: value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/util/FilenameUtils.java
server-core/src/main/java/io/onedev/server/web/component/markdown/InsertUrlPanel.java
server-core/src/main/java/io/onedev/server/web/component/markdown/MarkdownEditor.java
server-core/src/main/java/io/onedev/server/web/page/project/blob/ProjectBlobPage.java
Commit message: Fix the issue that uploaded file can be stored anywhere OneDev has write
permissions over

Vulnerable code:
						attachmentName = attachmentSupport.saveAttachment(upload.getClientFileName(), is);
					String fileName = URLDecoder.decode(request.getHeader("File-Name"), StandardCharsets.UTF_8.name());
			String blobPath = upload.getClientFileName();

Fixed code:
package io.onedev.server.util;

public class FilenameUtils extends org.apache.commons.io.FilenameUtils {

	public static String sanitizeFilename(String fileName) {
		return fileName.replace("..", "_").replace('/', '_').replace('\\', '_');
	}

}
import io.onedev.server.util.FilenameUtils;
						attachmentName = attachmentSupport.saveAttachment(
								FilenameUtils.sanitizeFilename(upload.getClientFileName()), is);
import io.onedev.server.util.FilenameUtils;
					String fileName = FilenameUtils.sanitizeFilename(
							URLDecoder.decode(request.getHeader("File-Name"), StandardCharsets.UTF_8.name()));
import io.onedev.server.util.FilenameUtils;
			String blobPath = FilenameUtils.sanitizeFilename(upload.getClientFileName());
CVE-2021-21248 (Java, published 2021-01-15T21:15Z)
Description: value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/model/support/inputspec/InputSpec.java
server-core/src/main/java/io/onedev/server/model/support/inputspec/textinput/TextInput.java
server-product/src/test/java/io/onedev/server/product/Test.java
Commit message: Escape pattern field of build job param to prevent security vulnerability


Vulnerable code:
	protected String escape(String string) {
		
	

Fixed code:
	public static String escape(String string) {
		pattern = InputSpec.escape(pattern);
CVE-2021-21249 (Java, published 2021-01-15T21:15Z)
Description: value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/migration/VersionedYamlDoc.java
Commit message: Fix security vulnerability issue caused by SnakeYaml deserialization

Vulnerable code:
import io.onedev.server.OneDev;
        
			Class<?> type = node.getType();
			if (type.getAnnotation(Editable.class) != null && !ClassUtils.isConcrete(type)) {
				ImplementationRegistry registry = OneDev.getInstance(ImplementationRegistry.class);
				for (Class<?> implementationClass: registry.getImplementations(node.getType())) {
					String implementationTag = new Tag("!" + implementationClass.getSimpleName()).getValue();
					if (implementationTag.equals(node.getTag().getValue()))
						return implementationClass;
			
			return super.getClassForNode(node);

Fixed code:
import io.onedev.server.OneDev;
			if (node instanceof VersionedYamlDoc) {
				return super.getClassForNode(node);
			} else {
				Class<?> type = node.getType();
				if (type.getAnnotation(Editable.class) == null) {
					// Do not deserialize unknown classes to avoid security vulnerabilities
					throw new IllegalStateException(String.format("Unexpected yaml node (type: %s, tag: %s)", 
							type, node.getTag()));
				} else {
					if (!ClassUtils.isConcrete(type)) {
						ImplementationRegistry registry = OneDev.getInstance(ImplementationRegistry.class);
						for (Class<?> implementationClass: registry.getImplementations(node.getType())) {
							String implementationTag = new Tag("!" + implementationClass.getSimpleName()).getValue();
							if (implementationTag.equals(node.getTag().getValue()))
								return implementationClass;
						}
					}
					return super.getClassForNode(node);
CVE-2021-21250 (Java, published 2021-01-15T21:15Z)
Description: value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-538 \u2014 Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Repository: https://github.com/theonedev/onedev
Files changed:
server-core/src/main/java/io/onedev/server/migration/XmlBuildSpecMigrator.java
Commit message: Fix XXE injection attack by disabling XML DTD handling

Vulnerable code:
			xmlDoc = new SAXReader().read(new StringReader(xml));
		} catch (DocumentException e) {

Fixed code:
import org.xml.sax.SAXException;
			SAXReader reader = new SAXReader();
			// Prevent XXE attack as the xml might be provided by malicious users
			reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
			xmlDoc = reader.read(new StringReader(xml));
		} catch (DocumentException | SAXException e) {