hitoshura25/cvefixes huggingface dataset:
CVE-2023-0327 (PHP, published 2023-01-16T19:15Z)
Description: value: A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/saemorris/TheRadSystem
Files changed:
_login.php
setup.sql
users.php
Commit message: Fixed some bugs and SQL injection.


Vulnerable code:
		// <-- Bad.
		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = '$user' AND password = '$pass'";
				<input type="text" name="q" />

Fixed code:
		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = :username AND password = :password";
		oci_bind_by_name($statement, ':username', $user);
		oci_bind_by_name($statement, ':password', $pass);
DROP SEQUENCE person_id_seq;
				<input type="text" name="q" value="<?php echo $_GET['q']; ?>" />
CVE-2022-36436 (Python, published 2022-09-14T11:15Z)
Description: value: OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/osuosl/twisted_vncauthproxy
Files changed:
vncap/tests/test_protocol.py
vncap/vnc/protocol.py
Commit message: Fix CVE-2022-36436 - Authentication bypass in RFB security handshake (#1)



Vulnerable code:
        self.assertEqual(self.t.buf, "\x02\x01\x02")
            # Hardcoded: 2 security types: None and VNC Auth.
            self.transport.write("\x02\x01\x02")
        elif security_type == 1:
            # No authentication. Just move to the SecurityResult.
            self.authenticated()

Fixed code:
    def pauseProducing(self):
        pass

        self.assertEqual(self.t.buf, "\x01\x02")

    def test_select_security_type_none(self):
        self.t.buf = ""
        self.p.select_security_type("\x01")
        self.assertTrue(self.t.lost)

    def test_select_security_type_vnc_auth(self):
        self.t.buf = ""
        self.p.select_security_type("\x02")
        self.assertFalse(self.t.lost)
        self.assertEqual(len(self.t.buf), 16)
            # Hardcoded: 1 security type: VNC Auth.
            self.transport.write("\x01\x02")
CVE-2019-25211 (Go, published 2024-06-29T00:15Z)
Description: value: parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/gin-contrib/cors
Files changed:
cors.go
Commit message: fixe(domain): wildcard parse bug (#106)



Vulnerable code:
			wRules = append(wRules, []string{o[:i-1], "*"})

Fixed code:
			wRules = append(wRules, []string{o[:i], "*"})
CVE-2015-10013 (PHP, published 2023-01-05T10:15Z)
Description: value: A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/WebDevStudios/taxonomy-switcher
Files changed:
README.md
readme.txt
taxonomy-switcher.php
Commit message: Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage


Vulnerable code:
Stable tag: 1.0.1
Version: 1.0.1
		wp_redirect( add_query_arg( 'page', $this->ui->admin_slug, admin_url( '/tools.php' ) ) );

Fixed code:
#### 1.0.2
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Stable tag: 1.0.2
= 1.0.2 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Version: 1.0.2
		wp_redirect( esc_url_raw( add_query_arg( 'page', $this->ui->admin_slug, admin_url( '/tools.php' ) ) ) );
CVE-2021-32825 (Other, published 2021-08-16T19:15Z)
Description: value: bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee43806126012066aad4 there is a "zipslip" vulnerability. The unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, he may be able to read arbitrary system files the parent process has permissions to read. For more details including a PoC see the referenced GHSL-2020-258.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/bblfsh/bblfshd
Files changed:
.gitignore
runtime/unpack.go
Commit message: untar: add check on link


Vulnerable code:

Fixed code:
.idea/


			trueTarget, err := filepath.EvalSymlinks(target)
			if err != nil {
				return err
			}
			if !strings.HasPrefix(trueTarget, dest) {
				return fmt.Errorf("hardlink %q -> %q outside destination", target, hdr.Linkname)
			}

			trueTarget, err := filepath.EvalSymlinks(target)
			if err != nil {
				return err
			}
			if !strings.HasPrefix(trueTarget, dest) {
				return fmt.Errorf("hardlink %q -> %q outside destination", target, hdr.Linkname)
			}
CVE-2014-125089 (Other, published 2023-02-21T03:15Z)
Description: value: A vulnerability was found in cention-chatserver 3.8.0-rc1. It has been declared as problematic. Affected by this vulnerability is the function _formatBody of the file lib/InternalChatProtocol.fe. The manipulation of the argument body leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.9 is able to address this issue. The identifier of the patch is c4c0258bbd18f6915f97f91d5fee625384096a26. It is recommended to upgrade the affected component. The identifier VDB-221497 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cention-mujibur-rahman/cention-chatserver
Files changed:
lib/InternalChatProtocol.fe
Commit message: Fix for XSS vulnerability

ClearIT informed us about a video from customer ComHem that showed
how a carefully constructed message which includes a as of right
now unknown Javascript file that allowed the customer from the External.app chat
see the agents username and password.

The code now escapes a few characters with HTML entity encoding to prevent this sort of attack.
The code escapes the following characters

& into &amp;
< into &lt;
> into &gt;
" into &quot;
' into &#x27;
/ into &#x2F;

This has been done according to the recommendation found here:
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet


Vulnerable code:
		object r = new Regexp('(\b(https?|ftp):\/\/[-A-Z0-9+&@#\/%?=~_|!:,.;]*[-A-Z0-9+&@#\/%=~_|])', 'i');
		return r.replaceAll(body, '<a style="color:#333399;" target="_blank" href="\1">\1</a>');

Fixed code:
		object r;
		body = Regexp.replaceAll('&', body, '&amp;');
		body = Regexp.replaceAll('<', body, '&lt;');
		body = Regexp.replaceAll('>', body, '&gt;');
		body = Regexp.replaceAll('"', body, '&quot;');
		body = Regexp.replaceAll("'", body, '&#x27;');
		body = Regexp.replaceAll('/', body, '&#x2F;');
		r = new Regexp('(\b(https?|ftp):\/\/[-A-Z0-9+&@#\/%?=~_|!:,.;]*[-A-Z0-9+&@#\/%=~_|])', 'i');
		body = r.replaceAll(body, '<a style="color:#333399;" target="_blank" href="\1">\1</a>');
		return body;
CVE-2023-26054 (Unknown, published 2023-03-06T19:15Z)
Description: value: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/moby/buildkit
Files changed:
Commit message: Merge pull request from GHSA-gc89-7gcr-jxqc

provenance: ensure URLs are redacted before written

Vulnerable code:

Fixed code:
CVE-2024-34342 (Other, published 2024-05-07T15:15Z)
Description: value: react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wojtekmaj/react-pdf
Files changed:
packages/react-pdf/src/Document.tsx
Commit message: Force isEvalSupported to false

Fixes [GHSA-wgrm-67xf-hhpq](https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq)


Vulnerable code:
    const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: true };

Fixed code:
    const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: false };
CVE-2017-8807 (C, published 2017-11-16T02:29Z)
Description: value: vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/varnishcache/varnish-cache
Files changed:
bin/varnishd/cache/cache_fetch.c
Commit message: Avoid buffer read overflow on vcl_error and -sfile

The file stevedore may return a buffer larger than asked for when
requesting storage. Due to lack of check for this condition, the code
to copy the synthetic error memory buffer from vcl_error would overrun
the buffer.

Patch by @shamger

Fixes: #2429


Vulnerable code:

Fixed code:
		if (l > ll)
			l = ll;
CVE-2022-23603 (Unknown, published 2022-02-01T11:15Z)
Description: value: iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Files changed:
Commit message: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix

Vulnerable code:

Fixed code:
CVE-2022-23603 (Unknown, published 2022-02-01T11:15Z)
Description: value: iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Files changed:
Commit message: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix 2

Vulnerable code:

Fixed code:
CVE-2022-23609 (Python, published 2022-02-04T23:15Z)
Description: value: iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Files changed:
upload/server.py
Commit message: quick security fix


Vulnerable code:

        remove(filename)

Fixed code:
import werkzeug.utils
        remove(werkzeug.utils.secure_filename(filename))
CVE-2022-23611 (Python, published 2022-02-04T23:15Z)
Description: value: iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Files changed:
module/connect_to_server.py
Commit message: small fix


Vulnerable code:

Fixed code:
    import werkzeug.utils
    image_file = werkzeug.utils.secure_filename(ast.literal_eval(image_file))
CVE-2018-8947 (PHP, published 2018-03-25T16:29Z)
Description: value: rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/rap2hpoutre/laravel-log-viewer
Files changed:
src/controllers/LogViewerController.php
src/views/log.blade.php
Commit message: security fix


Vulnerable code:
            LaravelLogViewer::setFile(base64_decode($this->request->input('l')));
            return $this->download(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('dl'))));
            app('files')->delete(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('del'))));
          <a href="?l={{ base64_encode($file) }}"
          <a href="?dl={{ base64_encode($current_file) }}"><span class="fa fa-download"></span>
          <a id="delete-log" href="?del={{ base64_encode($current_file) }}"><span

Fixed code:
            LaravelLogViewer::setFile(\Crypt::decrypt($this->request->input('l')));
            return $this->download(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('dl'))));
            app('files')->delete(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('del'))));
          <a href="?l={{ \Crypt::encrypt($file) }}"
          <a href="?dl={{ \Crypt::encrypt($current_file) }}"><span class="fa fa-download"></span>
          <a id="delete-log" href="?del={{ \Crypt::encrypt($current_file) }}"><span
CVE-2022-1341 (C, published 2022-04-18T17:15Z)
Description: value: An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/vgropp/bwm-ng
Files changed:
src/options.c
Commit message: Fix https://github.com/vgropp/bwm-ng/issues/26


Vulnerable code:

Fixed code:
            if(!str) {
              printf("Fatal: failed to allocate %zu bytes.\n", strlen(pwd_entry->pw_dir)+14);
              exit(EXIT_FAILURE);
            }
CVE-2016-7452 (PHP, published 2016-11-03T10:59Z)
Description: value: The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/pixidou/controllers/pixidouController.php
Commit message: security fix to pixidou editor


Vulnerable code:

        //eDebug($this->params,true);

Fixed code:
        // clean up parameters
        $this->params['fid'] = intval($this->params['fid']);
        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
            $this->params['exitType'] = 'error';
        }
CVE-2016-7453 (PHP, published 2016-11-03T10:59Z)
Description: value: The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/pixidou/controllers/pixidouController.php
Commit message: security fix to pixidou editor


Vulnerable code:

        //eDebug($this->params,true);

Fixed code:
        // clean up parameters
        $this->params['fid'] = intval($this->params['fid']);
        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
            $this->params['exitType'] = 'error';
        }