hitoshura25/cvefixes huggingface dataset:
CVE-2021-3985 (PHP, published 2021-12-01T11:15Z)
Description: value: kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kevinpapst/kimai2
Files changed:
src/Twig/Runtime/MarkdownExtension.php
src/Utils/Markdown.php
tests/Twig/Runtime/MarkdownExtensionTest.php
tests/Utils/MarkdownTest.php
Commit message: make sure that markdown uses safe mode (#2961)



Vulnerable code:
            $content = $this->markdown->toHtml($content, false);
            return $this->markdown->toHtml($content, false);
        return $this->markdown->toHtml($content, false);
        $this->parser->setSafeMode($safe);

Fixed code:
            $content = $this->markdown->toHtml($content);
            return $this->markdown->toHtml($content);
        return $this->markdown->toHtml($content);
        if ($safe !== true) {
            @trigger_error('Only safe mode is supported in Markdown since 1.16.3 to prevent XSS attacks. Parameter $safe will be removed with 2.0', E_USER_DEPRECATED);
        }

        $this->parser->setSafeMode(true);
        $this->parser->setMarkupEscaped(true);
        $this->assertEquals(
            '<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
            $sut->markdownToHtml('[XSS](javascript:alert(`XSS`))')
        );
        $this->assertEquals(
            '<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
            $sut->timesheetContent('[XSS](javascript:alert(`XSS`))')
        );
        $this->assertEquals(
            '<p><a href="javascript%3Aalert(`XSS`)">XSS</a></p>',
            $sut->commentContent('[XSS](javascript:alert(`XSS`))')
        );
EOT;
        $this->assertEquals($html, $sut->toHtml($markdown));
    }

    public function testLinksAreSanitized()
    {
        $sut = new Markdown();

        $html = <<<'EOT'
<p><a href="javascript%3Aalert(`XSS`)">XSS</a><br />
<a href="javascript%3Aalert(&quot;XSS&quot;)">XSS</a><br />
<a href="javascript%3Aalert(&#039;XSS&#039;)">XSS</a></p>
EOT;

        $markdown = <<<EOT
[XSS](javascript:alert(`XSS`))
[XSS](javascript:alert("XSS"))
[XSS](javascript:alert('XSS'))
CVE-2021-4033 (PHP, published 2021-12-09T20:15Z)
Description: value: kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/kevinpapst/kimai2
Files changed:
src/Controller/AbstractController.php
src/Controller/InvoiceController.php
src/Form/Extension/SelectWithApiDataExtension.php
Commit message: fix invoice create and search (#2990)



Vulnerable code:
    public function indexAction(Request $request, SystemConfiguration $configuration): Response
    public function createInvoiceAction(Customer $customer, InvoiceTemplate $template, Request $request, SystemConfiguration $configuration): Response
        $form->submit($request->query->all(), false);
        $formField = $formPrefix . '_' . $apiData['select'];

Fixed code:
        $request->query->remove('_token');

    public function indexAction(Request $request, SystemConfiguration $configuration, CsrfTokenManagerInterface $csrfTokenManager): Response
                $csrfTokenManager->refreshToken('invoice.create');

                $query->setCustomers([$customer]);
    public function createInvoiceAction(Customer $customer, InvoiceTemplate $template, Request $request, SystemConfiguration $configuration, CsrfTokenManagerInterface $csrfTokenManager): Response
        $csrfTokenManager->refreshToken('invoice.create');

        if ($this->handleSearch($form, $request)) {
            return $this->redirectToRoute('invoice');
        }
        $formField = $apiData['select'];
        // forms with prefix (like toolbar & search) would result in a wrong field name "_foo" instead of "foo"
        if ($formPrefix !== '') {
            $formField = $formPrefix . '_' . $apiData['select'];
        }
CVE-2022-1430 (Python, published 2022-05-18T14:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octoprint/octoprint
Files changed:
src/octoprint/server/views.py
Commit message: 🔒️ Sanitize and validate login redirect

Fixes an XSS and an open redirect issue.


Vulnerable code:
    redirect_url = request.args.get("redirect", request.script_root + url_for("index"))

Fixed code:
from urllib.parse import urlparse
    default_redirect_url = request.script_root + url_for("index")
    redirect_url = request.args.get("redirect", default_redirect_url)

    parsed = urlparse(redirect_url)  # check if redirect url is valid
    if parsed.scheme != "" or parsed.netloc != "":
        _logger.warning(
            f"Got an invalid redirect URL with the login attempt, misconfiguration or attack attempt: {redirect_url}"
        )
        redirect_url = default_redirect_url
CVE-2022-3068 (Python, published 2022-09-21T12:15Z)
Description: value: Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/octoprint/octoprint
Files changed:
src/octoprint/plugins/pluginmanager/__init__.py
Commit message: 🔒️ Fix a wrong permission role

A wrong role assigned to PluginManager LIST permission as
introduced in 1.8.0 causes a privilege escalation,
allowing read-only and user group the same rights as
the MANAGE permission:

- enabling/disabling plugins
- uninstalling plugins
- listing installed plugins incl. their details
- retrieving plugin notices
- deleting orphaned plugin settings


Vulnerable code:
                "roles": ["manage"],

Fixed code:
                "roles": ["list"],
CVE-2022-3607 (Python, published 2022-10-19T13:15Z)
Description: value: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
Severity: nan (CVSS v3 base score: 6)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/octoprint/octoprint
Files changed:
src/octoprint/server/api/languages.py
Commit message: 🔒️ Close a sanity check hole in language packs

A language pack containing a directory traversing
symlink could be uploaded. Upon backup creation, the
symlink would then lead to inclusion of whatever it
was pointing to in the resulting backup. This could
be used by an attacker with admin permissions to extract
information from the server.


Vulnerable code:
        map(_validate_archive_name, zip.namelist())
        map(_validate_archive_name, tar.getmembers())
def _validate_archive_name(name):
    if name.startswith("/") or ".." in name:

Fixed code:
        for info in zip.infolist():
            _validate_zip_info(info, target)
        for info in tar.getmembers():
            _validate_tar_info(info, target)
def _validate_archive_name(name, target):
    if not os.path.abspath(os.path.join(target, name)).startswith(target + os.path.sep):
def _validate_zip_info(info, target):
    _validate_archive_name(info.filename, target)


def _validate_tar_info(info, target):
    _validate_archive_name(info.name, target)
    if not (info.isfile() or info.isdir()):
        raise InvalidLanguagePack("Provided language pack contains invalid file type")
CVE-2021-33393 (Other, published 2021-06-09T22:15Z)
Description: value: lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/ipfire/ipfire-2.x
Files changed:
lfs/backup
Commit message: backup: prevent /var/ipfire/backup/bin/backup.pl from being owned by nobody

This is dangerous as nobody could write arbitrary contents to this file
and execute it afterwards.

Partially fixes: #12619

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>


Vulnerable code:
# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
PAK_VER    = 1
	install -v -m 755 $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin

Fixed code:
# Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
PAK_VER    = 2
	install -v -m 755 -o root $(DIR_SRC)/config/backup/backup.pl /var/ipfire/backup/bin
	chown root:root -R /var/ipfire/backup/bin/
CVE-2018-25054 (Other, published 2022-12-28T12:15Z)
Description: value: A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp of the component Search Handler. The manipulation of the argument details leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is d345e6bc7798bd717a583ec7f545ca387819d5c7. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216960.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/shred/cilla
Files changed:
cilla-xample/src/main/webapp/WEB-INF/jsp/view/search.jsp
Commit message: Fix XSS flaw on example search


Vulnerable code:
        <fmt:param value="${details}"/>

Fixed code:
<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
        <fmt:param value="${fn:escapeXml(details)}"/>
CVE-2021-3762 (Go, published 2022-03-03T22:15Z)
Description: value: A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/quay/claircore
Files changed:
rpm/packagescanner.go
rpm/packagescanner_test.go
Commit message: rpm: prevent directory traversal when extracting

A malicious tar archive with a member consisting of multiple "parent"
elements could cause a file outside of the target directory to be
overwritten.

Fixes: CVE-2021-3762
Signed-off-by: Hank Donnay <hdonnay@redhat.com>


Vulnerable code:
		tgt := filepath.Join(root, filepath.Clean(h.Name))
			ln := filepath.Join(root, filepath.Clean(h.Linkname))
			ln := filepath.Join(root, filepath.Clean(h.Linkname))

Fixed code:
		tgt := relPath(root, h.Name)
			ln := relPath(root, h.Linkname)
			ln := relPath(root, h.Linkname)

// RelPath takes a member and forcibly interprets it as a path underneath root.
//
// This should be used anytime a path for a new file on disk is needed when
// unpacking a tar.
func relPath(root, member string) string {
	return filepath.Join(root, filepath.Join("/", member))
}
	"strings"

func TestRelPath(t *testing.T) {
	root := `/tmp/fakedata`
	tt := [][2]string{
		{
			"dev/null",
			"/dev/null",
		},
		{
			"dev/null",
			"./dev/null",
		},
		{
			"dev/null",
			"dev/null",
		},
		{
			"dev/null",
			strings.Repeat("../", 10) + "dev/null",
		},
		{
			"dev/null",
			strings.Repeat("../", 10) + "dev/./../dev/null",
		},
	}

	for _, tc := range tt {
		want := filepath.Join(root, tc[0])
		t.Logf("in: %q + %q", root, tc[1])
		got := relPath(root, tc[1])
		t.Logf("got: %q, want: %q", got, want)
		if got != want {
			t.Error()
		}
	}
}
CVE-2018-1000533 (PHP, published 2018-06-26T16:29Z)
Description: value: klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/klaussilveira/gitlist
Files changed:
src/Git/Repository.php
tests/RepositoryTest.php
Commit message: Fixed RCE in git grep.

A specific option in git grep could be added inside the
pattern to be searched for, resulting in possible RCE.

Thanks to Kacper Szurek (https://security.szurek.pl) for
catching this one!


Vulnerable code:
            $results = $this->getClient()->run($this, "grep -i --line-number {$query} $branch");

Fixed code:
        $query = preg_replace('/(--?[A-Za-z0-9\-]+)/', '', $query);
            $results = $this->getClient()->run($this, "grep -i --line-number -- {$query} $branch");
        $searchResults = [];
<?php

use GitList\Git\Client;
use GitList\Git\Repository;
use PHPUnit\Framework\TestCase;
use Prophecy\Argument;

class RepositoryTest extends TestCase
{
    public function testIsSanitizingSearchWithPager()
    {
        $client = $this->prophesize(Client::class);
        $client->run(Argument::type(Repository::class), "grep -i --line-number -- '=sleep 5;' master")->shouldBeCalled();

        $repository = new Repository('/tmp', $client->reveal());
        $repository->searchTree('--open-files-in-pager=sleep 5;', 'master');
        $repository->searchTree('-O=sleep 5;', 'master');
    }

    public function testIsSanitizingSearchWithAnyOption()
    {
        $client = $this->prophesize(Client::class);
        $client->run(Argument::type(Repository::class), "grep -i --line-number -- 'foobar  =bar;' foo")->shouldBeCalled();

        $repository = new Repository('/tmp', $client->reveal());
        $repository->searchTree('foobar --bar --foo=bar;', 'foo');
    }
}
CVE-2019-19502 (Unknown, published 2019-12-02T16:15Z)
Description: value: Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/xsmo/Image-Uploader-and-Browser-for-CKEditor
Files changed:
Commit message: Merge pull request #11 from mvisat/security-fix

Fix security issue

Vulnerable code:

Fixed code:
CVE-2019-20805 (C++, published 2020-06-01T14:15Z)
Description: value: p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/upx/upx
Files changed:
src/p_lx_elf.cpp
Commit message: Avoid bogus values in PT_DYNAMIC segment.

Detect duplicate DT_*.
Detect out-of-bounds hashtab and gashtab.
Detect missing DT_REL, DT_RELA.
Detect out-of-bounds d_val.
https://github.com/upx/upx/issues/317
	modified:   p_lx_elf.cpp


Vulnerable code:
    unsigned const v_hsh = elf_unsigned_dynamic(Elf64_Dyn::DT_HASH);
        hashtab = (unsigned const *)elf_find_dynamic(Elf64_Dyn::DT_HASH);
    if (!dynsym || !dynstr) {
    if (!dynsym || !dynstr) {
        if (t) {
        if (t) {
            return &((unsigned char const *)file_image)[(size_t)t];

Fixed code:
            if (dt_table[d_tag]
            &&    get_te32(&dynp->d_val)
               != get_te32(&dynp0[-1+ dt_table[d_tag]].d_val)) {
                char msg[50]; snprintf(msg, sizeof(msg),
                    "duplicate DT_%#x: [%#x] [%#x]",
                    d_tag, -1+ dt_table[d_tag], -1+ ndx);
                throwCantPack(msg);
            }
    unsigned const v_hsh = elf_unsigned_dynamic(Elf32_Dyn::DT_HASH);
        hashtab = (unsigned const *)elf_find_dynamic(Elf32_Dyn::DT_HASH);
        if (!hashtab) {
            char msg[40]; snprintf(msg, sizeof(msg),
               "bad DT_HASH %#x", v_hsh);
            throwCantPack(msg);
        }
        if (!gashtab) {
            char msg[40]; snprintf(msg, sizeof(msg),
               "bad DT_GNU_HASH %#x", v_gsh);
            throwCantPack(msg);
        }
    if (!dynsym || !dynstr || !rela) {
    if (!dynsym || !dynstr || !rel) {
        if (t && t < file_size) {
            if (dt_table[d_tag]
            &&    get_te64(&dynp->d_val)
               != get_te64(&dynp0[-1+ dt_table[d_tag]].d_val)) {
                char msg[50]; snprintf(msg, sizeof(msg),
                    "duplicate DT_%#x: [%#x] [%#x]",
                    (unsigned)d_tag, -1+ dt_table[d_tag], -1+ ndx);
                throwCantPack(msg);
            }
        if (!hashtab) {
            char msg[40]; snprintf(msg, sizeof(msg),
               "bad DT_HASH %#x", v_hsh);
            throwCantPack(msg);
        }
        if (!gashtab) {
            char msg[40]; snprintf(msg, sizeof(msg),
               "bad DT_GNU_HASH %#x", v_gsh);
            throwCantPack(msg);
        }
        if (t && t < (upx_uint64_t)file_size) {
            return t + file_image;
CVE-2020-27787 (C++, published 2022-08-18T19:15Z)
Description: value: A Segmentaation fault was found in UPX in invert_pt_dynamic() function in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/upx/upx
Files changed:
src/p_lx_elf.cpp
Commit message: Detect 0==DT_SYMTAB in invert_pt_dynamic()

https://github.com/upx/upx/issues/333
	modified:   p_lx_elf.cpp


Vulnerable code:
        unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val);
        if (!nbucket
        unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val);
        if (!n_bucket || !n_bitmask
        unsigned const v_sym = get_te32(&dynp0[-1+ x_sym].d_val);
        if (!nbucket
        upx_uint64_t const v_sym = get_te64(&dynp0[-1+ x_sym].d_val);
        if (!n_bucket || !n_bitmask

Fixed code:
        unsigned const v_sym = !x_sym ? 0 : get_te32(&dynp0[-1+ x_sym].d_val);
        if (!nbucket || !v_sym
        unsigned const v_sym = !x_sym ? 0 : get_te32(&dynp0[-1+ x_sym].d_val);
        if (!n_bucket || !n_bitmask || !v_sym
        unsigned const v_sym = !x_sym ? 0 : get_te32(&dynp0[-1+ x_sym].d_val);
        if (!nbucket || !v_sym
        upx_uint64_t const v_sym = !x_sym ? 0 : get_te64(&dynp0[-1+ x_sym].d_val);
        if (!n_bucket || !n_bitmask || !v_sym
CVE-2020-27788 (C++, published 2022-08-18T20:15Z)
Description: value: An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/upx/upx
Files changed:
src/p_lx_elf.cpp
Commit message: Detect bad e_shstrtab better.

https://github.com/upx/upx/issues/332
	modified:   p_lx_elf.cpp


Vulnerable code:
                || (u32_t)file_size <= sh_name  // FIXME: weak
                    throwCantPack("bad e_shstrndx");
                || (u32_t)file_size <= sh_name  // FIXME: weak
                    throwCantPack("bad e_shstrndx");

Fixed code:
                || (u32_t)file_size <= (sizeof(".shstrtab")
                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                    throwCantPack("bad e_shstrtab");
                || (u32_t)file_size <= (sizeof(".shstrtab")
                    + sh_name + (shstrtab - (const char *)&file_image[0]))
                    throwCantPack("bad e_shstrtab");
CVE-2020-27790 (C++, published 2022-08-18T19:15Z)
Description: value: A floating point exception issue was discovered in UPX in PackLinuxElf64::invert_pt_dynamic() function of p_lx_elf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service. The highest impact is to Availability.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/upx/upx
Files changed:
src/p_lx_elf.cpp
Commit message: Detect bogus DT_SYMENT.

https://github.com/upx/upx/issues/331
	modified:   p_lx_elf.cpp


Vulnerable code:

Fixed code:
        if (sz_sym < sizeof(Elf32_Sym)) {
            char msg[50]; snprintf(msg, sizeof(msg),
                "bad DT_SYMENT %x", sz_sym);
            throwCantPack(msg);
        }
        if (symnum_end < 1) {
            throwCantPack("bad DT_SYMTAB");
        }
        if (sz_sym < sizeof(Elf64_Sym)) {
            char msg[50]; snprintf(msg, sizeof(msg),
                "bad DT_SYMENT %x", sz_sym);
            throwCantPack(msg);
        }
        if (symnum_end < 1) {
            throwCantPack("bad DT_SYMTAB");
        }