hitoshura25/cvefixes huggingface dataset:
CVE-2017-14923 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Filemanager/js/NodeEditDialog.js
tine20/Filemanager/js/nodeActions.js
tine20/Tinebase/js/widgets/container/TreePanel.js
Commit message: node delte might fail

Change-Id: Ifa3694efacc0e0ac71792b0d67999c946b4f4712


Vulnerable code:

                if (typeof currNodeData.name == 'object') {
                    nodeName += currNodeData.name.name + '<br />';
                }
                else {
                    nodeName += currNodeData.name + '<br />';
                }
            text: Ext.util.Format.htmlEncode(attr.name),
            qtip: Tine.Tinebase.common.doubleEncode(attr.name),

Fixed code:
                                    htmlEncode: true,
                nodeName += Tine.Tinebase.EncodingHelper.encode(typeof currNodeData.name == 'object' ?
                    currNodeData.name.name :
                    currNodeData.name) + '<br />';
            text: attr.name,
            qtip: attr.name,
        attr.text = Tine.Tinebase.EncodingHelper.encode(attr.text);
        attr.qtip = Tine.Tinebase.EncodingHelper.encode(attr.qtip);
CVE-2018-25082 (Python, published 2023-03-21T18:15Z)
Description: value: A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/zwczou/weixin-python
Files changed:
weixin/msg.py
weixin/pay.py
Commit message: 安全修复：防范XML外部实体注入漏洞（XXE）
参考：https://pay.weixin.qq.com/wiki/doc/api/jsapi.php?chapter=23_5


Vulnerable code:
        root = etree.fromstring(content)
        root = etree.fromstring(content.encode("utf-8"))

Fixed code:
        root = etree.fromstring(content,
                                parser=etree.XMLParser(resolve_entities=False))
        root = etree.fromstring(content.encode("utf-8"),
                                parser=etree.XMLParser(resolve_entities=False))
CVE-2011-4969 (Unknown, published 2013-03-08T22:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jquery/jquery
Files changed:
Commit message: Merge pull request #474 from dmethvin/fix-9521-xss-hash

Fixes #9521. Prioritize #id over <tag> to avoid XSS via location.hash.

Vulnerable code:

Fixed code:
CVE-2019-11358 (JavaScript, published 2019-04-20T00:29Z)
Description: value: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/jquery/jquery
Files changed:
src/core.js
test/unit/core.js
Commit message: Core: Prevent Object.prototype pollution for $.extend( true, ... )

Closes gh-4333

Vulnerable code:
				if ( target === copy ) {

Fixed code:
				// Prevent Object.prototype pollution
				if ( name === "__proto__" || target === copy ) {
QUnit.test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
	assert.expect( 1 );

	jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
	assert.ok( !( "devMode" in {} ), "Object.prototype not polluted" );
} );
CVE-2020-15269 (Ruby, published 2020-10-20T21:15Z)
Description: value: In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/spree/spree
Files changed:
api/app/controllers/spree/api/v2/base_controller.rb
api/lib/spree/api/testing_support/v2/base.rb
api/spec/requests/spree/api/v2/errors_spec.rb
Commit message: ensure doorkeeper_token is valid when authenticating requests in v2


Vulnerable code:
          @spree_current_user ||= Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id) if doorkeeper_token
[200, 201, 400, 404, 403, 422].each do |status_code|

Fixed code:
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
[200, 201, 400, 401, 404, 403, 422].each do |status_code|

  context 'expired token failure' do
    let(:user) { create(:user) }
    let(:headers) { headers_bearer }

    include_context 'API v2 tokens'

    before do
      token.expires_in = -1
      token.save
      get '/api/v2/storefront/account', headers: headers
    end

    it_behaves_like 'returns 401 HTTP status'
  end
CVE-2020-19611 (Other, published 2021-12-07T16:15Z)
Description: value: Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/RackTables/racktables
Files changed:
ChangeLog
wwwroot/index.php
Commit message: fix an XSS issue in an error message

The issue was reported by Diego Di Nardo.


Vulnerable code:
				throw new RackTablesError ("Invalid navigation data for '${pageno}-${tabno}-${op}'", RackTablesError::INTERNAL);

Fixed code:
	bugfix: fix an XSS issue in an error message
			// This could be a malformed request rather than an internal error, but spelling
			// that in proper detail would require finer checks.
				throw new RackTablesError ('This request has no ophandler function.', RackTablesError::INTERNAL);
CVE-2021-23419 (JavaScript, published 2021-08-08T08:15Z)
Description: value: This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/samholmes/node-open-graph
Files changed:
index.js
Commit message: Patch: Filter out blacklisted keys in og property name


Vulnerable code:

Fixed code:
var keyBlacklist = [
	'__proto__',
	'constructor',
	'prototype'
]
			if (keyBlacklist.includes(key)) continue
CVE-2019-13239 (PHP, published 2019-07-04T15:15Z)
Description: value: inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
inc/user.class.php
Commit message: avoid xss attack on user picture


Vulnerable code:

Fixed code:
      // avoid xss (picture field is autogenerated)
      if (isset($input['picture'])) {
         $input['picture'] = 'NULL';
      }

      // avoid xss (picture field is autogenerated)
      if (isset($input['picture'])) {
         $input['picture'] = 'NULL';
      }


      // prevent xss
      $picture = Html::cleanInputText($picture);

      // prevent xss
      $picture = Html::cleanInputText($picture);
CVE-2019-13240 (PHP, published 2019-07-10T14:15Z)
Description: value: An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/glpi-project/glpi
Files changed:
inc/user.class.php
Commit message: Password token date was not removed


Vulnerable code:
                  'password_forget_token_date' => null,

Fixed code:
                  'password_forget_token_date' => 'NULL',
CVE-2019-13240 (PHP, published 2019-07-10T14:15Z)
Description: value: An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/glpi-project/glpi
Files changed:
inc/user.class.php
Commit message: Fix password forget token check; fixes #5386

Vulnerable code:
            new \QueryExpression('NOW() < ADDDATE(password_forget_token_date, INTERVAL 1 DAY))')

Fixed code:
            new \QueryExpression('NOW() < ADDDATE(' . $DB->quoteName('password_forget_token_date') . ', INTERVAL 1 DAY)')
CVE-2020-11062 (PHP, published 2020-05-12T20:15Z)
Description: value: In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
ajax/autocompletion.php
ajax/getDropdownConnect.php
ajax/getDropdownFindNum.php
ajax/getDropdownNetpoint.php
ajax/getDropdownNumber.php
ajax/getDropdownUsers.php
ajax/getDropdownValue.php
Commit message: Use correct content-type for autocompletion url


Vulnerable code:
header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");

Fixed code:
header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
CVE-2020-15108 (PHP, published 2020-07-17T21:15Z)
Description: value: In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
inc/calendar.class.php
inc/commondbtm.class.php
tests/functionnal/Calendar.php
tests/functionnal/Computer.php
Commit message: Merge pull request from GHSA-qv6w-68gq-wx2v

CVE-2020-15108

Add test to reproduce error
Add test on calendar duplication

Vulnerable code:
      $input = $this->fields;
      $input = $this->fields;
      $this->integer((int)$computer->add($fields))->isGreaterThan(0);
      $this->integer((int)$printer->add($pfields))->isGreaterThan(0);
      $this->boolean($computer->update($in))->isTrue();
      $this->boolean($computer->update($in2))->isTrue();
      $this->boolean($computer->update($in))->isTrue();

Fixed code:
      $input = Toolbox::addslashes_deep($this->fields);
      $input = Toolbox::addslashes_deep($this->fields);

      //change name, and clone again
      $this->boolean($calendar->update(['id' => $id, 'name' => "Je s\'apelle Groot"]))->isTrue();

      $calendar = new \Calendar();
      $this->boolean($calendar->getFromDB($id))->isTrue();

      $this->boolean($calendar->duplicate())->isTrue();
      $other_id = $calendar->fields['id'];
      $this->integer($other_id)->isGreaterThan($id);
      $this->boolean($calendar->getFromDB($other_id))->isTrue();
      //should have been duplicated too.
      $this->checkXmas($calendar);

   protected function getUniqueString() {
      $string = parent::getUniqueString();
      $string .= "with a ' inside!";
      return $string;
   }

      $this->integer((int)$computer->add(\Toolbox::addslashes_deep($fields)))->isGreaterThan(0);
      $this->integer((int)$printer->add(\Toolbox::addslashes_deep($pfields)))->isGreaterThan(0);
      $this->boolean($computer->update(\Toolbox::addslashes_deep($in)))->isTrue();
      $this->boolean($computer->update(\Toolbox::addslashes_deep($in2)))->isTrue();
      $this->boolean($computer->update(\Toolbox::addslashes_deep($in)))->isTrue();
      $computer = new \Computer(); //$computer->fields contents is already escaped!
      $this->boolean($computer->getFromDB($id))->isTrue();
CVE-2020-15175 (PHP, published 2020-10-07T19:15Z)
Description: value: In GLPI before version 9.5.2, the `?pluginimage.send.php?` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/glpi-project/glpi
Files changed:
CHANGELOG.md
front/pluginimage.send.php
Commit message: Merge pull request from GHSA-rm52-jx9h-rwcp

- Prevent removal of any plugin file from unauthenticated user
- Prevent access to files outside plugins directories
- Prevent access to files from inactive plugins
- Limit access to images and fix content-type
- Add changelog entry

Vulnerable code:
if (!isset($_GET["name"]) || !isset($_GET["plugin"])) {
    || (basename($_GET["plugin"]) != $_GET["plugin"])) {
$Path = GLPI_PLUGIN_DOC_DIR."/".$_GET["plugin"]."/";
header("Content-type: image/png");
if (file_exists($Path.$_GET["name"])) {
   readfile($Path.$_GET["name"]);
   if (isset($_GET["clean"])) {
      unlink($Path.$_GET["name"]);
   }

Fixed code:
- Ability to delete a plugin image using `/front/pluginimage.send.php` script.
if (!isset($_GET["name"]) || !isset($_GET["plugin"]) || !Plugin::isPluginActive($_GET["plugin"])) {
$dir = GLPI_PLUGIN_DOC_DIR."/".$_GET["plugin"]."/";
$filepath = $dir.$_GET["name"];

    || (basename($_GET["plugin"]) != $_GET["plugin"])
    || !Toolbox::startsWith(realpath($filepath), realpath(GLPI_PLUGIN_DOC_DIR))
    || !Document::isImage($filepath)) {
if (file_exists($filepath)) {
   header("Content-type: " . Toolbox::getMime($filepath));
   readfile($filepath);
   header("Content-type: image/png");
CVE-2020-15176 (PHP, published 2020-10-07T19:15Z)
Description: value: In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
CHANGELOG.md
ajax/dropdownConnectNetworkPort.php
inc/crontask.class.php
inc/dbmysql.class.php
inc/dbmysqliterator.class.php
inc/report.class.php
tests/units/DB.php
tests/units/DBmysqlIterator.php
Commit message: Merge pull request from GHSA-x93w-64x9-58qw

* Remove ability to use SQL expressions as string in criterion values

* Fix iterator syntax

Co-authored-by: Johan Cwiklinski <jcwiklinski@teclib.com>

Vulnerable code:
## [9.5.1] unreleased
                     'glpi_networkports_networkports.networkports_id_2' => $DB->quoteName('glpi_networkports.id')
               ['hourmin'   => ['<', $DB->quoteName('hourmax')]],
               'hourmin'   => ['>', $DB->quoteName('hourmax')],
      } else if (!preg_match("/^`.*?`$/", $value)) { //`field` is valid only for mysql :/
      } else if (DBmysql::isNameQuoted($value)) { //FIXME: database related
         return $value;
                        'LINK.networkports_id_2'   => $DB->quoteName('PORT_1.id')
         ['`field`', '`field`'],
      $it = $this->it->execute('foo', ['bar' => '`field`']);

Fixed code:
## [9.5.2] unreleased

### API changes

#### Removed

- Ability to use SQL expressions as string in criterion values in SQL iterator (replaced by usage of `QueryExpression`).

## [9.5.1] 2020-07-16
                     'glpi_networkports_networkports.networkports_id_2' => new QueryExpression($DB->quoteName('glpi_networkports.id'))
               ['hourmin'   => ['<', new QueryExpression($DB->quoteName('hourmax'))]],
               'hourmin'   => ['>', new QueryExpression($DB->quoteName('hourmax'))],
      } else {
                        'LINK.networkports_id_2'   => new QueryExpression($DB->quoteName('PORT_1.id'))
         [new \QueryExpression('`field`'), '`field`'],
      $it = $this->it->execute('foo', ['bar' => new \QueryExpression('`field`')]);
CVE-2020-15177 (PHP, published 2020-10-07T19:15Z)
Description: value: In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
install/install.php
Commit message: Merge pull request from GHSA-prvh-9m4h-4m79



Vulnerable code:
if (!isset($_POST["install"])) {

Fixed code:
if (!isset($_SESSION['can_process_install']) || !isset($_POST["install"])) {

   // Add a flag that will be used to validate that installation can be processed.
   // This flag is put here just after checking that DB config file does not exist yet.
   // It is mandatory to validate that `Etape_4` to `Etape_6` are not used outside installation process
   // to change GLPI base URL without even being authenticated.
   $_SESSION['can_process_install'] = true;
CVE-2020-15217 (PHP, published 2020-10-07T19:15Z)
Description: value: In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
inc/knowbaseitem.class.php
Commit message: Merge pull request from GHSA-x9hg-j29f-wvvv



Vulnerable code:
               $search_where = ['OR' => $ors];

Fixed code:
               $search_where =  $criteria['WHERE']; // Visibility restrict criteria

               $search_where[] = ['OR' => $ors];