hitoshura25/cvefixes huggingface dataset:
CVE-2023-4304 (PHP, published 2023-08-11T01:15Z)
Description: value: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.


Severity: nan (CVSS v3 base score: 2.7)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/froxlor/froxlor
Files changed:
lib/Froxlor/Api/ApiParameter.php
lib/Froxlor/Api/Commands/Admins.php
lib/Froxlor/Validate/Validate.php
Commit message: validate non-empy admin-name in Admins.update()

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
	 * @param array $params
	public function __construct($params = null)
	 * @return array
	 * @param string $param
	 * @param string $ul_field
	protected function getUlParam($param = null, $ul_field = null, $optional = false, $default = 0)
	 * get specific parameter from the parameterlist;
	 * @param string $param
	protected function getParam($param = null, $optional = false, $default = '')
		if ($this->cmd_params[$param] === "") {
	 * makes debugging a whole lot more comfortable
	private function getModFunctionString($level = 1, $max_level = 5, $trace = null)
	 * @param string $param
	protected function getBoolParam($param = null, $optional = false, $default = false)
	 * Returns if an emailaddress is in correct format or not

Fixed code:
	 * @param array|null $params
	public function __construct(array $params = null)
	 * @return string|array
	 * @param string|null $param
	 * @param string|null $ul_field
	protected function getUlParam(string $param = null, string $ul_field = null, bool $optional = false, $default = 0)
	 * get specific parameter from the parameter list;
	 * @param string|null $param
	protected function getParam(string $param = null, bool $optional = false, $default = '')
		if (!is_array($this->cmd_params[$param]) && trim($this->cmd_params[$param]) === "") {
	 * makes debugging a lot more comfortable
	private function getModFunctionString(int $level = 1, int $max_level = 5, $trace = null)
	 * @param string|null $param
	protected function getBoolParam(string $param = null, bool $optional = false, $default = false)
				if (empty(trim($name))) {
					Response::standardError([
						'stringisempty',
						'admin.name'
					], '', true);
				}
				if (empty(trim($email))) {
					Response::standardError([
						'stringisempty',
						'admin.email'
					], '', true);
				}
	 * Returns if an email-address is in correct format or not
CVE-2023-4829 (PHP, published 2023-10-13T13:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.0.22.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/froxlor/froxlor
Files changed:
lib/Froxlor/Api/Commands/HostingPlans.php
Commit message: correct validation of hostingplan name and description

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
			$name = Validate::validate(trim($name), 'name', '', '', [], true);
			$description = Validate::validate(str_replace("\r\n", "\n", $description), 'description', Validate::REGEX_DESC_TEXT);
			$name = Validate::validate(trim($name), 'name', '', '', [], true);
			$description = Validate::validate(str_replace("\r\n", "\n", $description), 'description', Validate::REGEX_DESC_TEXT);

Fixed code:
			$name = Validate::validate(trim($name), 'name', Validate::REGEX_DESC_TEXT, '', [], true);
			$description = Validate::validate(str_replace("\r\n", "\n", $description), 'description', Validate::REGEX_CONF_TEXT);
			$name = Validate::validate(trim($name), 'name', Validate::REGEX_DESC_TEXT, '', [], true);
			$description = Validate::validate(str_replace("\r\n", "\n", $description), 'description', Validate::REGEX_CONF_TEXT);
CVE-2022-45473 (C++, published 2022-11-18T18:15Z)
Description: value: In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/drachtio/drachtio-server
Files changed:
src/controller.cpp
Commit message: make drachtio log file not globally readable (#241)


Vulnerable code:

Fixed code:
#include <boost/filesystem.hpp>
                    boost::filesystem::permissions(name,
                        boost::filesystem::perms::owner_read |
                        boost::filesystem::perms::owner_write |
                        boost::filesystem::perms::group_read |
                        boost::filesystem::perms::group_write
                    );
CVE-2022-45474 (C++, published 2022-11-18T18:15Z)
Description: value: drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/drachtio/drachtio-server
Files changed:
src/request-handler.cpp
Commit message: fix for use-after-free (#240)


Vulnerable code:
    if(*fdp == action || *fdp == CURL_POLL_INOUT) {
         (*fdp == action || *fdp == CURL_POLL_INOUT)) {


Fixed code:
    int f = *fdp;
    if(f == action || f == CURL_POLL_INOUT) {
         (f == action || f == CURL_POLL_INOUT)) {
    *conn->response = '\0' ;
CVE-2022-45909 (C++, published 2022-11-26T03:15Z)
Description: value: drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/drachtio/drachtio-server
Files changed:
src/drachtio.cpp
src/sip-dialog-controller.cpp
Commit message: sending an invite with a request-uri longer than 255 characters can cause a crash (#238)



Vulnerable code:
        char buf[255];
        char obuf[255] ;
        s = strncpy( buf, uri.c_str(), 255 ) ;
        return true ;
        char buf[255];
        char obuf[255] ;
        int nChars = sip_name_addr_e(obuf, 255, 0, display, 1, url, params, comment) ;
            normalizeSipUri( requestUri, 0 ) ;

Fixed code:
#define MAX_SIP_URI_LEN (1024)

        char buf[MAX_SIP_URI_LEN];
        char obuf[MAX_SIP_URI_LEN] ;
        s = strncpy( buf, uri.c_str(), MAX_SIP_URI_LEN ) ;
        return uri.length() < MAX_SIP_URI_LEN ;
        char buf[MAX_SIP_URI_LEN];
        char obuf[MAX_SIP_URI_LEN] ;
        int nChars = sip_name_addr_e(obuf, MAX_SIP_URI_LEN, 0, display, 1, url, params, comment) ;
            if (!normalizeSipUri( requestUri, 0 )) {
                throw std::runtime_error(string("invalid request-uri: ") + requestUri ) ;
            }
CVE-2022-47515 (C++, published 2022-12-18T05:15Z)
Description: value: An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/drachtio/drachtio-server
Files changed:
src/controller.cpp
Commit message: bugfix (#245) - long incoming message crashes server


Vulnerable code:
            m_sipMessage.resize( m_sipMessage.length() - 1) ;

Fixed code:
            if (m_sipMessage.length() > 1) m_sipMessage.resize( m_sipMessage.length() - 1) ;
CVE-2015-10073 (PHP, published 2023-02-06T20:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tinymighty/wiki-seo
Files changed:
WikiSEO.body.php
Commit message: Fix XSS in extension

This extension did not escape its user-supplied input for the meta property tags

Example: {{#seo:article:publisher=foo"><script>alert('XSS')</script> <b f="}}

This sort of vulnerability could be leveraged to take over other user's accounts
and other evil things.

Vulnerable code:
					$out->addHeadItem("og:description", "<meta property=\"og:description\" content=\"$content\" />" . "\n");
				$out->addHeadItem("$property", "<meta property=\"$property\" content=\"$content\" />" . "\n");

Fixed code:
					$out->addHeadItem("og:description", Html::element( 'meta', array( 'property' => 'og:description', 'content' => $content ) ) . "\n");
				$out->addHeadItem("$property", Html::element( 'meta', array( 'property' => $property, 'content' => $content ) ) . "\n");
CVE-2020-7600 (JavaScript, published 2020-03-12T23:15Z)
Description: value: querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/diegohaz/querymen
Files changed:
.travis.yml
src/index.js
test/index.js
test/querymen-schema.js
Commit message: Fix prototype pollution vulnerability (#77)

* Fix prototype pollution vulnerability

* Fix test

Vulnerable code:
  - v5
  - v4
  t.same(add('123,456', [RegExp]), [/123/i, /123/i], 'should add a param with type option regexp array')

Fixed code:
  - v6
  if (
    type === 'constructor' ||
    type === '__proto__' ||
    name === 'constructor' ||
    name === '__proto__'
  ) {
    return
  }
test('Prototype pollution', (t) => {
  const { toString } = {}

  querymen.handler('__proto__', 'toString', 'JHU')
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  querymen.handler('formatters', '__proto__', { toString: 'JHU' })
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  querymen.handler('validators', '__proto__', { toString: 'JHU' })
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  t.end()
})

  t.same(add('123,456', [RegExp]), [/123/i, /456/i], 'should add a param with type option regexp array')
CVE-2014-125053 (PHP, published 2023-01-06T23:15Z)
Description: value: A vulnerability was found in Piwigo-Guest-Book up to 1.3.0. It has been declared as critical. This vulnerability affects unknown code of the file include/guestbook.inc.php of the component Navigation Bar. The manipulation of the argument start leads to sql injection. Upgrading to version 1.3.1 is able to address this issue. The patch is identified as 0cdd1c388edf15089c3a7541cefe7756e560581d. It is recommended to upgrade the affected component. VDB-217582 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Piwigo/Piwigo-Guest-Book
Files changed:
include/guestbook.inc.php
Commit message: potential SQL injection


Vulnerable code:
if (isset($_GET['start']))

Fixed code:
if (isset($_GET['start']) && is_numeric($_GET['start']) && $_GET['start'] >= 0)
CVE-2022-47516 (C, published 2022-12-18T05:15Z)
Description: value: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/davehorton/sofia-sip
Files changed:
libsofia-sip-ua/tport/tport.c
Commit message: remove assert that can reasonably be expected to happen


Vulnerable code:
  assert(self);


Fixed code:
CVE-2022-47517 (C, published 2022-12-18T05:15Z)
Description: value: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/davehorton/sofia-sip
Files changed:
libsofia-sip-ua/url/url.c
Commit message: fix off-by-one access triggered eg by Contact: %


Vulnerable code:
 * @code
 * @param src     Source URL structure.
 * @param src     Source URL structure.

Fixed code:
 *ï¿½@code
    if (i >= strlen(s) - 1) return NULL;
 *ï¿½@param src     Source URL structure.
 *ï¿½@param src     Source URL structure.
CVE-2022-47517 (C, published 2022-12-18T05:15Z)
Description: value: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/davehorton/sofia-sip
Files changed:
libsofia-sip-ua/url/url.c
Commit message: better fix for prev commit


Vulnerable code:
    if (i >= strlen(s) - 1) return NULL;
    h1 = s[i + 1], h2 = s[i + 2];


Fixed code:
    h1 = s[i + 1];
    if (!h1) {
        *d = '\0';
        return NULL;
    }
    h2 = s[i + 2];
CVE-2017-15284 (PHP, published 2017-10-12T08:29Z)
Description: value: Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octobercms/library
Files changed:
src/Filesystem/Definitions.php
Commit message: Remove SVG from image types

SVG files should not be treated as images - especially when coming to uploads. An SVG file can contain arbitrary HTML data as well as event handlers in native elements
Refs: https://html5sec.org/#svg
Original report by: Ishaq Mohammed


Vulnerable code:
            'gif',
            'svg'

Fixed code:
            'gif'
CVE-2021-29487 (PHP, published 2021-08-26T19:15Z)
Description: value: octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/octobercms/library
Files changed:
src/Auth/Models/Role.php
src/Auth/Models/User.php
Commit message: Use int casting

These manifested as strings for some users


Vulnerable code:
                    if ($checkPermission != $rolePermission && starts_with($rolePermission, $checkPermission) && $value === 1) {
                    if ($checkPermission != $rolePermission && ends_with($rolePermission, $checkPermission) && $value === 1) {
                        if ($checkGroupPermission != $permission && starts_with($permission, $checkGroupPermission) && $value === 1) {
                    elseif ($permission === $rolePermission && $rolePermissions[$permission] === 1) {
                    if ($checkPermission != $mergedPermission && starts_with($mergedPermission, $checkPermission) && $value === 1) {
                    if ($checkPermission != $mergedPermission && ends_with($mergedPermission, $checkPermission) && $value === 1) {
                        if ($checkMergedPermission != $permission && starts_with($permission, $checkMergedPermission) && $value === 1) {
                    elseif ($permission === $mergedPermission && $mergedPermissions[$permission] === 1) {

Fixed code:
                    if ($checkPermission != $rolePermission && starts_with($rolePermission, $checkPermission) && (int) $value === 1) {
                    if ($checkPermission != $rolePermission && ends_with($rolePermission, $checkPermission) && (int) $value === 1) {
                        if ($checkGroupPermission != $permission && starts_with($permission, $checkGroupPermission) && (int) $value === 1) {
                    elseif ($permission === $rolePermission && (int) $rolePermissions[$permission] === 1) {
                    if ($checkPermission != $mergedPermission && starts_with($mergedPermission, $checkPermission) && (int) $value === 1) {
                    if ($checkPermission != $mergedPermission && ends_with($mergedPermission, $checkPermission) && (int) $value === 1) {
                        if ($checkMergedPermission != $permission && starts_with($permission, $checkMergedPermission) && (int) $value === 1) {
                    elseif ($permission === $mergedPermission && (int) $mergedPermissions[$permission] === 1) {
CVE-2021-32648 (PHP, published 2021-08-26T19:15Z)
Description: value: octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/octobercms/library
Files changed:
src/Auth/Models/Role.php
src/Auth/Models/User.php
Commit message: Use int casting

These manifested as strings for some users


Vulnerable code:
                    if ($checkPermission != $rolePermission && starts_with($rolePermission, $checkPermission) && $value === 1) {
                    if ($checkPermission != $rolePermission && ends_with($rolePermission, $checkPermission) && $value === 1) {
                        if ($checkGroupPermission != $permission && starts_with($permission, $checkGroupPermission) && $value === 1) {
                    elseif ($permission === $rolePermission && $rolePermissions[$permission] === 1) {
                    if ($checkPermission != $mergedPermission && starts_with($mergedPermission, $checkPermission) && $value === 1) {
                    if ($checkPermission != $mergedPermission && ends_with($mergedPermission, $checkPermission) && $value === 1) {
                        if ($checkMergedPermission != $permission && starts_with($permission, $checkMergedPermission) && $value === 1) {
                    elseif ($permission === $mergedPermission && $mergedPermissions[$permission] === 1) {

Fixed code:
                    if ($checkPermission != $rolePermission && starts_with($rolePermission, $checkPermission) && (int) $value === 1) {
                    if ($checkPermission != $rolePermission && ends_with($rolePermission, $checkPermission) && (int) $value === 1) {
                        if ($checkGroupPermission != $permission && starts_with($permission, $checkGroupPermission) && (int) $value === 1) {
                    elseif ($permission === $rolePermission && (int) $rolePermissions[$permission] === 1) {
                    if ($checkPermission != $mergedPermission && starts_with($mergedPermission, $checkPermission) && (int) $value === 1) {
                    if ($checkPermission != $mergedPermission && ends_with($mergedPermission, $checkPermission) && (int) $value === 1) {
                        if ($checkMergedPermission != $permission && starts_with($permission, $checkMergedPermission) && (int) $value === 1) {
                    elseif ($permission === $mergedPermission && (int) $mergedPermissions[$permission] === 1) {
CVE-2021-3311 (PHP, published 2021-02-05T14:15Z)
Description: value: An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/octobercms/library
Files changed:
src/Auth/Manager.php
Commit message: Invalidate the session ID to prevent reuse

1. Good logs in
2. Bad captures Good's session cookie
3. Good logs out
4. Session cookie no longer works
5. Good logs in a second time
6. ORIGINAL session cookie works (Bad is also signed in)


Vulnerable code:
        Session::flush();

Fixed code:
        Session::invalidate();