hitoshura25/cvefixes huggingface dataset:
CVE-2020-7763 (JavaScript, published 2020-11-05T14:15Z)
Description: value: This affects the package phantom-html-to-pdf before 0.6.1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pofider/phantom-html-to-pdf
Files changed:
lib/scripts/conversionScriptPart.js
test/test.js
Commit message: fix access to files without protocol


Vulnerable code:
    }

    //potentially dangerous request
    if (request.url.lastIndexOf("file:///", 0) === 0 && !body.allowLocalFilesAccess) {
        networkRequest.abort();
        return;
    }
var should = require("should"),
    fs = require("fs"),
        });

        it('should create a pdf file ignoring ssl errors', function(done) {
            conversion({
                url: 'https://sygris.com'
            }, function(err, res) {
                if (err) {
                    return done(err);
                }

                res.numberOfPages.should.be.eql(1);
                res.stream.should.have.property("readable");
                done();
            });
        });
                JSON.stringify(res.logs).should.containEql('foo');

Fixed code:
    }   
     //potentially dangerous request
     if (request.url.lastIndexOf("http://", 0) !== 0 && request.url.lastIndexOf("https://", 0) && !body.allowLocalFilesAccess) {
        networkRequest.abort();
        return;
    }

var should = require("should"),   
    fs = require("fs"),    
        });       
                ;

        it('should reject local files', function(done) {
            conversion({
                html: `<script>
                document.write(window.location='${__filename.replace(/\\/g, '/')}')                
              </script>`
            }, function(err, res) {
                if (err) {
                    return done(err);
                }
                JSON.stringify(res.logs).should.containEql('Unable to load resource')
                done()
            });
        });

        it('should allow local files when allowLocalFilesAccess', function(done) {
            conversion({
                allowLocalFilesAccess: true,
                html: `<script>
                document.write(window.location='${__filename.replace(/\\/g, '/')}')                
              </script>`
            }, function(err, res) {
                if (err) {
                    return done(err);
                }
                JSON.stringify(res.logs).should.not.containEql('Unable to load resource')
                done()
            });
        });
CVE-2023-51665 (JavaScript, published 2023-12-27T18:15Z)
Description: value: Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/advplyr/audiobookshelf
Files changed:
server/Auth.js
Commit message: Update:/auth/openid/config API endpoint to require admin user and validate issuer URL


Vulnerable code:
           (Database.serverSettings.authOpenIDMobileRedirectURIs.length === 1 && Database.serverSettings.authOpenIDMobileRedirectURIs[0] === '*')) {
    
     * Used to auto-populate the openid URLs in config/authentication
    router.get('/auth/openid/config', async (req, res) => {
      const configUrl = `${issuerUrl}/.well-known/openid-configuration`
      axios.get(configUrl).then(({ data }) => {

Fixed code:
            (Database.serverSettings.authOpenIDMobileRedirectURIs.length === 1 && Database.serverSettings.authOpenIDMobileRedirectURIs[0] === '*')) {

     * Helper route used to auto-populate the openid URLs in config/authentication
     * Takes an issuer URL as a query param and requests the config data at "/.well-known/openid-configuration"
     * 
     * @example /auth/openid/config?issuer=http://192.168.1.66:9000/application/o/audiobookshelf/
    router.get('/auth/openid/config', this.isAuthenticated, async (req, res) => {
      if (!req.user.isAdminOrUp) {
        Logger.error(`[Auth] Non-admin user "${req.user.username}" attempted to get issuer config`)
        return res.sendStatus(403)
      }


      // Strip trailing slash
      // Append config pathname and validate URL
      let configUrl = null
      try {
        configUrl = new URL(`${issuerUrl}/.well-known/openid-configuration`)
        if (!configUrl.pathname.endsWith('/.well-known/openid-configuration')) {
          throw new Error('Invalid pathname')
        }
      } catch (error) {
        Logger.error(`[Auth] Failed to get openid configuration. Invalid URL "${configUrl}"`, error)
        return res.status(400).send('Invalid request. Query param \'issuer\' is invalid')
      }

      axios.get(configUrl.toString()).then(({ data }) => {
CVE-2023-51697 (JavaScript, published 2023-12-27T18:15Z)
Description: value: Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in `podcastUtils.js`. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/advplyr/audiobookshelf
Files changed:
server/controllers/PodcastController.js
server/utils/index.js
server/utils/podcastUtils.js
Commit message: Update:API endpoint /podcasts/feed validates rssFeed URL and uses SSRF req filter


Vulnerable code:
    var url = req.body.rssFeed
      return res.status(400).send('Bad request')
    Array(str1.length + 1).fill(null));
    track[0][i] = i;
    track[j][0] = j;
      const indicator = str1[i - 1] === str2[j - 1] ? 0 : 1;
      );
  return track[str2.length][str1.length];
const Logger = require('../Logger')
  return axios.get(feedUrl, { timeout: 12000, responseType: 'arraybuffer', headers: { Accept: 'application/rss+xml' } }).then(async (data) => {
      return false
      return false
    return false

Fixed code:
const { validateUrl } = require('../utils/index')
  /**
   * POST: /api/podcasts/feed
   * 
   * @typedef getPodcastFeedReqBody
   * @property {string} rssFeed
   * 
   * @param {import('express').Request<{}, {}, getPodcastFeedReqBody, {}} req 
   * @param {import('express').Response} res 
   */
    const url = validateUrl(req.body.rssFeed)
      return res.status(400).send('Invalid request body. "rssFeed" must be a valid URL')
    Array(str1.length + 1).fill(null))
    track[0][i] = i
    track[j][0] = j
      const indicator = str1[i - 1] === str2[j - 1] ? 0 : 1
      )
  return track[str2.length][str1.length]
}

/**
 * Validate url string with URL class
 * 
 * @param {string} rawUrl 
 * @returns {string} null if invalid
 */
module.exports.validateUrl = (rawUrl) => {
  if (!rawUrl || typeof rawUrl !== 'string') return null
  try {
    return new URL(rawUrl).toString()
  } catch (error) {
    Logger.error(`Invalid URL "${rawUrl}"`, error)
    return null
  }
const ssrfFilter = require('ssrf-req-filter')
const Logger = require('../Logger')
/**
 * Get podcast RSS feed as JSON
 * Uses SSRF filter to prevent internal URLs
 * 
 * @param {string} feedUrl 
 * @param {boolean} [excludeEpisodeMetadata=false]
 * @returns {Promise}
 */

  return axios({
    url: feedUrl,
    method: 'GET',
    timeout: 12000,
    responseType: 'arraybuffer',
    headers: { Accept: 'application/rss+xml' },
    httpAgent: ssrfFilter(feedUrl),
    httpsAgent: ssrfFilter(feedUrl)
  }).then(async (data) => {
      return null
      return null
    return null
CVE-2017-16876 (Python, published 2017-12-29T15:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lepture/mistune
Files changed:
mistune.py
Commit message: Fix CVE-2017-16876


Vulnerable code:
__version__ = '0.8'
    return _key_pattern.sub(' ', key.lower())
            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (_valid_end, _valid_attr),

Fixed code:
__version__ = '0.8.1'
    key = escape(key.lower(), quote=True)
    return _key_pattern.sub(' ', key)
            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (
                _valid_end, _valid_attr),
CVE-2022-21159 (C, published 2022-04-15T16:15Z)
Description: value: A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/mz-automation/libiec61850
Files changed:
src/mms/iso_presentation/iso_presentation.c
Commit message: - fixed - Bug in presentation layer parser can cause infinite loop (LIB61850-302)


Vulnerable code:

Fixed code:

            if (bufPos < 0)
                return -1;
CVE-2019-25087 (C++, published 2022-12-27T09:15Z)
Description: value: A vulnerability was found in RamseyK httpserver. It has been rated as critical. This issue affects the function ResourceHost::getResource of the file src/ResourceHost.cpp of the component URI Handler. The manipulation of the argument uri leads to path traversal: '../filedir'. The attack may be initiated remotely. The name of the patch is 1a0de56e4dafff9c2f9c8f6b130a764f7a50df52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216863.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/RamseyK/httpserver
Files changed:
README.md
src/HTTPServer.cpp
src/ResourceHost.cpp
Commit message: Deny any directory traversal paths.  README update


Vulnerable code:
A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool
		std::cout << req->getHeaderStr(i) << std::endl;

Fixed code:
A high performance, single threaded, HTTP server written in C++ to serve as a kqueue socket management and HTTP protocol learning tool on BSD systems
## Compiling Notes
* On FreeBSD, compile with gmake

		std::cout << "\t" << req->getHeaderStr(i) << std::endl;
	if (uri.find("../") != std::string::npos)
		return NULL;
CVE-2014-2829 (Unknown, published 2014-04-11T01:55Z)
Description: value: Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/esl/MongooseIM
Files changed:
Commit message: Merge pull request #167 from esl/zlib_cwe400_fix

Add zlib inflated data size limit

Vulnerable code:

Fixed code:
CVE-2020-15084 (Unknown, published 2020-06-30T16:15Z)
Description: value: In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/auth0/express-jwt
Files changed:
Commit message: Merge pull request from GHSA-6g6m-m6h5-w9gf

Made algorithms mandatory

Vulnerable code:

Fixed code:
CVE-2016-7149 (PHP, published 2017-01-18T17:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
_tests/blogs/evocore/misc.funcs.simpletest.php
inc/_core/_misc.funcs.php
Commit message: Fix autolink function to avoid XSS issue


Vulnerable code:
		array( '#(^|[\s>\(]|\[url=)(https?|mailto)://([^<>{}\s]+[^.,:;!\?<>{}\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)aim:([^,<\s\]\)]+)#i',
			'#(^|[\s>\(]|\[url=)www\.'.$pattern_domain.'([^<>{}\s]*[^.,:;!\?\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)([a-z0-9\-_.]+?)@'.$pattern_domain.'([^.,:;!\?<\s\]\)]+)#i', ),

Fixed code:

				// XSS sample:
				'text http://test_url.test"onmouseover="alert(1)"onerror=1 "text' => 'text <a href="http://test_url.test">http://test_url.test</a>"onmouseover="alert(1)"onerror=1 "text',
		array( '#(^|[\s>\(]|\[url=)(https?|mailto)://([^"<>{}\s]+[^".,:;!\?<>{}\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)aim:([^",<\s\]\)]+)#i',
			'#(^|[\s>\(]|\[url=)www\.'.$pattern_domain.'([^"<>{}\s]*[^".,:;!\?\s\]\)])#i',
			'#(^|[\s>\(]|\[url=)([a-z0-9\-_.]+?)@'.$pattern_domain.'([^".,:;!\?<\s\]\)]+)#i', ),
CVE-2016-7150 (PHP, published 2017-01-18T17:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
skins_site/_site_body_header.inc.php
Commit message: Fix XSS vulnerability on "site name"


Vulnerable code:
	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.$Settings->get( 'notification_long_name' ).'"' : '';
	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.$Settings->get( 'notification_short_name' ).'"'.$site_title.' />';

Fixed code:
	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.format_to_output( $Settings->get( 'notification_long_name' ), 'htmlattr' ).'"' : '';
	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.format_to_output( $Settings->get( 'notification_short_name' ), 'htmlattr' ).'"'.$site_title.' />';
CVE-2016-8901 (PHP, published 2019-05-23T18:29Z)
Description: value: b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
htsrv/call_plugin.php
Commit message: Fix object injection vulnerability


Vulnerable code:
	if( ( substr( $params, 0, 2 ) == 'a:' ) && ( ! preg_match( '/(;|{|})O:\+?[0-9]+:"/', $params ) ) )

Fixed code:
	if( ( substr( $params, 0, 2 ) == 'a:' ) && ( ! preg_match( '/(s:\d+:"[^"]*"|i:\d+)(;|{|})O:\+?[0-9]+:"/', $params ) ) )
CVE-2016-8901 (PHP, published 2019-05-23T18:29Z)
Description: value: b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
htsrv/call_plugin.php
Commit message: Fix object injection vulnerability


Vulnerable code:
if( is_null($params) )
{ // Default:
{ // params given. This may result in "false", but this means that unserializing failed.
	$params = @unserialize($params);

Fixed code:
if( is_null( $params ) )
{	// Use empty array by default if params are not sent by request:
{	// Params given:
	if( substr( $params, 0, 2 ) == 'a:' )
	{	// Allow to unserialize only arrays, to avoid object injection vulnerability:
		// (This may result in "false", but this means that unserializing failed)
		$params = @unserialize( $params );
	}
	else
	{	// Restrict all non array params to empty array:
		$params = array();
	}
CVE-2017-1000423 (PHP, published 2018-01-02T20:29Z)
Description: value: b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
install/_functions_install.php
Commit message: Format install params


Vulnerable code:
					."\t'user'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_user'] )."',\$1"
					."\t'password' => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_password'] )."',\$2"
					."\t'name'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_name'] )."',\$3"
					."\t'host'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_host'] )."',\$4",
				"tableprefix = '".str_replace( "'", "\'", $params['db_tableprefix'] )."';",
				"baseurl = '".str_replace( "'", "\'", $params['baseurl'] )."';",
				"admin_email = '".str_replace( "'", "\'", $params['admin_email'] )."';",

Fixed code:
/**
 * Format an install param like DB config and base url
 *
 * @return string
 */
function format_install_param( $value )
{
	$value = str_replace( array( "'",  "\$" ), array( "\'", "\\$" ), $value );
	return preg_replace( "#([\\\\]*)(\\\\\\\')#", "\\\\\\\\\\\\\\\\\'", $value );
}


					."\t'user'     => '".format_install_param( $params['db_user'] )."',\$1"
					."\t'password' => '".format_install_param( $params['db_password'] )."',\$2"
					."\t'name'     => '".format_install_param( $params['db_name'] )."',\$3"
					."\t'host'     => '".format_install_param( $params['db_host'] )."',\$4",
				"tableprefix = '".format_install_param( $params['db_tableprefix'] )."';",
				"baseurl = '".format_install_param( $params['baseurl'] )."';",
				"admin_email = '".format_install_param( $params['admin_email'] )."';",
CVE-2017-1000423 (PHP, published 2018-01-02T20:29Z)
Description: value: b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
install/_functions_install.php
Commit message: Format install params


Vulnerable code:
	$value = str_replace( array( "'",  "\$" ), array( "\'", "\\$" ), $value );
	return preg_replace( "#([\\\\]*)(\\\\\\\')#", "\\\\\\\\\\\\\\\\\'", $value );

Fixed code:
	// We need backslashes only for single quote(') and backslash(\):
	$value = addcslashes( $value, "'\\" );
	/*
		The below code excludes even number of slashes, because we need always odd
		number of slashes before single quote(') to avoid a broken string value.
		Examples for source and result:
		  \'     => \'         (1 slash is not converted because it is used only for single quote backslashing)
		  \\'    => \\\'       (2 slashes are converted to 3, because only first one slash must be backslashed)
		  \\\'   => \\\\\'     (3 slashes are converted to 5, first two slashes must be backslashed)
		  \\\\'  => \\\\\\\'   (4 slashes are converted to 7, first three slashes must be backslashed)
		  \\\\\' => \\\\\\\\\' (5 slashes are converted to 9, first four slashes must be backslashed)
	*/
	return preg_replace( '#(\\\\*)(\\\')#', '$1$1$2', $value );