hitoshura25/cvefixes huggingface dataset:
CVE-2024-28185 (Other, published 2024-04-18T15:15Z)
Description: value: Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/judge0/judge0
Files changed:
Dockerfile
Commit message: Use user judge0


Vulnerable code:
ARG DEV_USER=judge0
ARG DEV_USER_ID=1000

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        tmux \
        vim && \
    useradd -u $DEV_USER_ID -m -r $DEV_USER && \
    echo "$DEV_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers

USER $DEV_USER


Fixed code:
RUN useradd -u 1000 -m -r judge0 && \
    echo "judge0 ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers && \
    chown -R judge0: /api

USER judge0
CVE-2021-4049 (PHP, published 2021-12-07T11:15Z)
Description: value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhuser/wentinactive.tpl.php
lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
lhc_web/modules/lhuser/logout.php
lhc_web/modules/lhuser/module.php
Commit message: csrf for logout url


Vulnerable code:
<a class="btn btn-secondary btn-warning float-right" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Logout');?></a>
                <a class="dropdown-item pl-2" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?>"><i class="material-icons">exit_to_app</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?></a>
erLhcoreClassModule::redirect('user/login');
    'params' => array()

Fixed code:
<a class="btn btn-secondary btn-warning float-right" onclick="$(this).attr('href',$(this).attr('href')+'/(csfr)/'+confLH.csrf_token)" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Logout');?></a>
                <a class="dropdown-item pl-2" onclick="$(this).attr('href',$(this).attr('href')+'/(csfr)/'+confLH.csrf_token)" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?>"><i class="material-icons">exit_to_app</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?></a>
if (!$lhUser->isLogged() || !$lhUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
    die('Invalid CSFR Token');
    exit;
}

//erLhcoreClassModule::redirect('user/login');
    'params' => array(),
    'uparams' => array('csfr')
CVE-2021-4050 (PHP, published 2021-12-08T11:15Z)
Description: value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/lib/core/lhcore/lhfileupload.php
lhc_web/lib/core/lhcore/lhfileuploadadmin.php
Commit message: Clean SVG and adjust file size


Vulnerable code:
                $fileUpload->extension = $matches[1];
                $fileUpload->extension = end($partsFile);
                $fileUpload->size = filesize($fileUpload->file_path_server);

Fixed code:
                $fileUpload->extension = strtolower($matches[1]);
                $fileUpload->extension = strtolower(end($partsFile));
            }

            if ($fileUpload->extension == 'svg') {
                erLhcoreClassFileUploadAdmin::cleanSVG($fileUpload->file_path_server);
                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
            if ($fileUpload->extension == 'svg') {
                self::cleanSVG($fileUpload->file_path_server);
                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);
            }

                $file->size = $fileUpload->size = filesize($fileUpload->file_path_server);

    public static function cleanSVG($path)
    {
        $sanitizer = new \enshrined\svgSanitize\Sanitizer();
        $dirtySVG = file_get_contents($path);
        $cleanSVG = $sanitizer->sanitize($dirtySVG);
        file_put_contents($path.'_svg', $cleanSVG);
        unlink($path);
        rename($path.'_svg', $path);
    }
CVE-2021-4131 (PHP, published 2021-12-18T07:15Z)
Description: value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php
lhc_web/modules/lhsystem/expirecache.php
lhc_web/modules/lhsystem/module.php
Commit message: CSFR Token expire cache


Vulnerable code:
	<li><a href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>			
    'functions' => array( 'expirecache' )

Fixed code:
	<li><a class="csfr-required" href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>
$currentUser = erLhcoreClassUser::instance();

if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
    die('Invalid CSFR Token');
    exit;
}
    'functions' => array( 'expirecache' ),
    'uparams' => array('csfr')
CVE-2021-4169 (PHP, published 2021-12-26T12:15Z)
Description: value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
lhc_web/modules/lhuser/avatarbuilder.php
Commit message: Proper escape


Vulnerable code:
                    <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo htmlspecialchars($id)?>' alt="" title="" />
$id = $Params['user_parameters']['id'];

Fixed code:
                    <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo urlencode(htmlspecialchars($id))?>' alt="" title="" />
$id = strip_tags($Params['user_parameters']['id']);
CVE-2021-4175 (PHP, published 2021-12-29T15:15Z)
Description: value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
Commit message: Missing htmlspecialchars


Vulnerable code:
        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print $mb_options['fcm_key'] : ''?>" />

Fixed code:
        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print htmlspecialchars($mb_options['fcm_key']) : ''?>" />
CVE-2021-4176 (PHP, published 2021-12-29T15:15Z)
Description: value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
Commit message: Old widget postMessage escape string


Vulnerable code:
	parent.postMessage("<?php echo $Result['additional_post_message']?>", '*');
	parent.postMessage("<?php echo $msgPArent?>", '*');

Fixed code:
	parent.postMessage(<?php echo json_encode($Result['additional_post_message'])?>, '*');
	parent.postMessage(<?php echo json_encode($msgPArent)?>, '*');
CVE-2021-4177 (PHP, published 2021-12-28T06:15Z)
Description: value: livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhchat/geoconfiguration.tpl.php
lhc_web/ezcomponents/Base/src/file.php
lhc_web/ezcomponents/ConsoleTools/src/input/option.php
lhc_web/modules/lhchat/geoconfiguration.php
Commit message: Disable to change city database location


Vulnerable code:
								    <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Location of city database'); ?></label> 
								    <input class="form-control" type="text" name="CityGeoLocation" value="<?php isset($geo_data['max_mind_city_location']) && ($geo_data['max_mind_city_location'] != '') ?  print htmlspecialchars($geo_data['max_mind_city_location']) : print 'var/external/geoip/GeoLite2-City.mmdb' ?>" />
    static public function walkRecursive( $sourceDir, array $includeFilters = array(), array $excludeFilters = array(), $callback, &$callbackContext )
        $short = '', 
        $long, 
        'CityGeoLocation' => new ezcInputFormDefinitionElement(
            ezcInputFormDefinitionElement::OPTIONAL, 'string'
        ),
                $data['max_mind_city_location'] = $form->CityGeoLocation != '' ? $form->CityGeoLocation : 'var/external/geoip/GeoLite2-City.mmdb';
                          
                

Fixed code:
								    <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Location of city database. Make sure you uploaded file in this location.'); ?></label>
								    <input class="form-control" type="text" readonly value="<?php isset($geo_data['max_mind_city_location']) && ($geo_data['max_mind_city_location'] != '') ?  print htmlspecialchars($geo_data['max_mind_city_location']) : print 'var/external/geoip/GeoLite2-City.mmdb' ?>" />
    static public function walkRecursive( $sourceDir, array $includeFilters, array $excludeFilters, $callback, &$callbackContext )
        $short = '',
        $long = '',
                $data['max_mind_city_location'] = 'var/external/geoip/GeoLite2-City.mmdb';
CVE-2021-4179 (PHP, published 2021-12-28T09:15Z)
Description: value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/lib/core/lhchat/lhchatworkflow.php
lhc_web/modules/lhchat/addmsgadmin.php
lhc_web/modules/lhchat/module.php
lhc_web/modules/lhrestapi/addmsgadmin.php
Commit message: Separate permission to use [html] code


Vulnerable code:
    	        if (isset($_POST['meta_msg'])) {
                    if ($form->hasValidData('meta_msg') && $form->meta_msg != '') {

Fixed code:

            if (strpos($msg->msg,'[html]') !== false && !erLhcoreClassUser::instance()->hasAccessTo('lhchat','htmlbbcodeenabled')) {
                $msg->msg = '[html] is disabled for you!';
                $msg->user_id = -1;
            }

                if (strpos($msg->msg,'[html]') !== false && !$currentUser->hasAccessTo('lhchat','htmlbbcodeenabled')) {
                    $msg->msg = '[html] is disabled for you!';
                    $msg->user_id = -1;
                }

    	        if (isset($_POST['meta_msg']) && $currentUser->hasAccessTo('lhchat','metamsgenabled')) {
$FunctionList['htmlbbcodeenabled'] = array('explain' => 'Allow operator to use [html] bbcode.');
$FunctionList['metamsgenabled'] = array('explain' => 'Allow operator to use meta_msg in message add interface.');
                    if (strpos($msg->msg,'[html]') !== false && !erLhcoreClassRestAPIHandler::hasAccessTo('lhchat','htmlbbcodeenabled')) {
                        $msg->msg = '[html] is disabled for you!';
                        $msg->user_id = -1;
                    }

                    if ($form->hasValidData('meta_msg') && $form->meta_msg != '' && erLhcoreClassRestAPIHandler::hasAccessTo('lhchat','metamsgenabled')) {
CVE-2022-0083 (PHP, published 2022-01-04T07:15Z)
Description: value: livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhuser/forgotpasswordsent.tpl.php
lhc_web/modules/lhuser/forgotpassword.php
Commit message: Show same message in all cases


Vulnerable code:
<p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','E-mail sent. Click the link in the email and You will be able to set a new password.')?></p>
			erLhcoreClassModule::redirect('user/forgotpassword');
			exit;

Fixed code:
<p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','If this e-mail exists we have send password remind link. Click the link in the email and You will be able to set a new password.')?></p>
            $tpl = erLhcoreClassTemplate::getInstance( 'lhuser/forgotpasswordsent.tpl.php');
CVE-2022-0226 (PHP, published 2022-01-14T19:15Z)
Description: value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/modules/lhaudit/configuration.php
Commit message: Missing csfr check


Vulnerable code:

Fixed code:
    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect();
        exit;
    }
CVE-2022-0231 (PHP, published 2022-01-14T12:15Z)
Description: value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhfile/configuration.tpl.php
lhc_web/modules/lhfile/configuration.php
Commit message: CSRF for file configuration URL


Vulnerable code:

Fixed code:
    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>


    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('file/configuration');
        exit;
    }
CVE-2022-0245 (PHP, published 2022-01-18T06:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhchat/cannedmsgedit.tpl.php
lhc_web/design/defaulttheme/tpl/lhchat/newcannedmsg.tpl.php
lhc_web/modules/lhchat/cannedmsgedit.php
lhc_web/modules/lhchat/newcannedmsg.php
lhc_web/modules/lhgroupchat/options.php
lhc_web/modules/lhnotifications/settings.php
Commit message: CSRF tokens


Vulnerable code:

Fixed code:
    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>


    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('chat/cannedmsg');
        exit;
    }

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('chat/cannedmsg');
        exit;
    }

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('groupchat/options');
        exit;
    }

    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('notifications/index');
        exit;
    }
CVE-2022-0253 (PHP, published 2022-01-17T14:15Z)
Description: value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/design/defaulttheme/tpl/lhviews/loadview.tpl.php
lhc_web/design/defaulttheme/tpl/lhviews/save_chat_view.tpl.php
lhc_web/design/defaulttheme/tpl/lhwebhooks/edit.tpl.php
lhc_web/design/defaulttheme/tpl/lhwebhooks/editincoming.tpl.php
Commit message: Do not execute angular title


Vulnerable code:
            <li role="presentation" class="nav-item"><a class="nav-link active" href="#chatlist" aria-controls="chatlist" role="tab" data-toggle="tab" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Chat list');?>">
    <form action="<?php echo htmlspecialchars($action_url)?>/(export)/2?<?php echo $appendPrintExportURL?>" method="post" target="_blank" onsubmit="return lhinst.submitModalForm($(this))">
<h1><?php echo htmlspecialchars($item->name)?></h1>
<h1><?php echo htmlspecialchars($item->name)?></h1>

Fixed code:
            <li role="presentation" class="nav-item"><a class="nav-link active" href="#chatlist" aria-controls="chatlist" ng-non-bindable role="tab" data-toggle="tab" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Chat list');?>">
    <form action="<?php echo htmlspecialchars($action_url)?>/(export)/2?<?php echo $appendPrintExportURL?>" method="post" ng-non-bindable target="_blank" onsubmit="return lhinst.submitModalForm($(this))">
<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>
<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>
CVE-2022-0266 (PHP, published 2022-01-19T06:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Severity: MEDIUM (CVSS v3 base score: 6.6)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/livehelperchat/livehelperchat
Files changed:
lhc_web/modules/lhuser/delete.php
lhc_web/modules/lhuser/deletegroup.php
Commit message: Display logic should match backand logic


Vulnerable code:

Fixed code:
if ((int)$Params['user_parameters']['user_id'] == 1) {
    die('admin account never can be deleted!');
    exit;
}

if ((int)$Params['user_parameters']['group_id'] == 1) {
    die('admin account never can be deleted!');
    exit;
}