hitoshura25/cvefixes huggingface dataset:
CVE-2023-1116 (JavaScript, published 2023-03-01T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/EmailController.php
bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
bundles/AdminBundle/Resources/public/js/pimcore/settings/email/blacklist.js
Commit message: [Task] Optimized blacklist email input (#14467)

* optimized email input

* added filter for email address

* fixed typo

Vulnerable code:
                foreach ($data as &$value) {
                            pimcore.helpers.deleteConfirm(t('email_blacklist'), data.data.address, function () {
                                grid.getStore().removeAt(rowIndex);
                            }.bind(this));
                    "address": value

Fixed code:
                foreach ($data as $key => &$value) {
                        if($key === 'address'){
                            $value = filter_var($value, FILTER_SANITIZE_EMAIL);
                        }

pimcore.helpers.sanitizeEmail = function (email) {
    return email.replace(/[^a-zA-Z0-9_\-@.+]/g,'');
};

                            const sanitizedEmail = pimcore.helpers.sanitizeEmail(data.data.address);

                            pimcore.helpers.deleteConfirm(
                                t('email_blacklist'),
                                sanitizedEmail,
                                function () {
                                    grid.getStore().removeAt(rowIndex);
                                }.bind(this)
                            );
                const sanitizedEmail = pimcore.helpers.sanitizeEmail(value);

                    "address": sanitizedEmail
CVE-2023-1117 (PHP, published 2023-03-01T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/SettingsController.php
bundles/AdminBundle/Resources/public/js/pimcore/settings/videothumbnail/item.js
Commit message: optimized video thumbnail creation (#14472)



Vulnerable code:
                $pipe->addItem($type, $item, $mediaName);

Fixed code:
                $pipe->addItem($type, $item, htmlspecialchars($mediaName));
        name = name.replace(/[^a-zA-Z0-9_\-+]/g,'');
CVE-2023-1286 (JavaScript, published 2023-03-09T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/document/printpages/pdf_preview.js
Commit message: [Task] Improve webtoprint pdf (#14560)

* Improve webtoprint pdf

* Use different method

Vulnerable code:
        if (type == "bool") {
            if (value) {
                return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn x-grid-checkcolumn-checked" style=""></div></div>';
            } else {
                return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn" style=""></div></div>';
            }
        if (type == "select") {

Fixed code:
        if (type === "text") {
            return Ext.util.Format.htmlEncode(value);
        }

        if (type === "bool") {
            return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn' + (value ? ' x-grid-checkcolumn-checked' : '') + '" style=""></div></div>';
        if (type === "select") {
CVE-2023-1312 (JavaScript, published 2023-03-10T11:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/log/admin.js
Commit message: [ApplicationLogger] Improve Date & Time fields error tooltips (#14606)



Vulnerable code:

Fixed code:
                invalidText: 'Enter date as MM/DD/YYYY',
                invalidText: 'Enter time as HH:MM AM/PM',
                invalidText: 'Enter date as MM/DD/YYYY',
                invalidText: 'Enter time as HH:MM AM/PM',
CVE-2023-1429 (JavaScript, published 2023-03-16T12:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/docTypes.js
Commit message: improve Document Types.


Vulnerable code:
                        pimcore.helpers.deleteConfirm(t('document_type'), data.data.name, function () {
                            grid.getStore().removeAt(rowIndex);

Fixed code:
                        pimcore.helpers.deleteConfirm(t('document_type'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
                                grid.getStore().removeAt(rowIndex);
CVE-2023-1515 (JavaScript, published 2023-03-20T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/redirects.js
Commit message: [Task]: Improve redirects. (#14562)

undefined

Vulnerable code:
                    format: 'Y-m-d'

Fixed code:
                    format: 'Y-m-d',
                    onChange: function(value) {
                        if(Ext.String.hasHtmlCharacters(value)) {
                            this.reset();
                        }
                    },
CVE-2023-1517 (JavaScript, published 2023-03-20T16:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/element/scheduler.js
Commit message: Update scheduling


Vulnerable code:

Fixed code:
                        listeners: {
                            focus : function(component) {
                                component.setValue(Ext.util.Format.htmlDecode(component.value));
                            },
                            blur: function(component){
                                component.setValue(Ext.util.Format.htmlEncode(component.value));
                            }
                        }
CVE-2023-1578 (PHP, published 2023-03-22T16:15Z)
Description: value: SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Searchadmin/SearchController.php
Commit message: [Task] Optimized `SearchController::findAction` (#14538)

* optimized findAction in SearchController

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

* Update bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>

---------

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>
Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>

Vulnerable code:
        $types = explode(',', $allParams['type'] ?? '');
        $subtypes = explode(',', $allParams['subtype'] ?? '');
        $classnames = explode(',', $allParams['class'] ?? '');

Fixed code:
        $types = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['type'] ?? ''));
        $subtypes = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['subtype'] ?? ''));
        $classnames = explode(',', preg_replace("/[^a-z0-9_,]/i", '', $allParams['class'] ?? ''));
CVE-2023-1701 (JavaScript, published 2023-03-29T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js
bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
Commit message: Security fix in Predefined section (#14721)

* Escape predefined property

* Escape predefined metadata

Vulnerable code:
                        pimcore.helpers.deleteConfirm(t('predefined_metadata'), data.data.name, function () {
                        pimcore.helpers.deleteConfirm(t('predefined_properties'), data.data.name, function () {

Fixed code:
                        pimcore.helpers.deleteConfirm(t('predefined_metadata'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
                        pimcore.helpers.deleteConfirm(t('predefined_properties'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
CVE-2023-1702 (JavaScript, published 2023-03-29T16:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js
bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
Commit message: Security fix in Predefined section (#14721)

* Escape predefined property

* Escape predefined metadata

Vulnerable code:
                        pimcore.helpers.deleteConfirm(t('predefined_metadata'), data.data.name, function () {
                        pimcore.helpers.deleteConfirm(t('predefined_properties'), data.data.name, function () {

Fixed code:
                        pimcore.helpers.deleteConfirm(t('predefined_metadata'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
                        pimcore.helpers.deleteConfirm(t('predefined_properties'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
CVE-2023-1703 (PHP, published 2023-03-29T16:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
bundles/AdminBundle/Resources/public/js/pimcore/object/classes/class.js
Commit message: [Task] Optimized composite index key (#14636)

* chore: validate composite index key

* fix: add php validation

Vulnerable code:
            value: data.index_key

Fixed code:
        if ($values['compositeIndices']) {
            foreach ($values['compositeIndices'] as $index => $compositeIndex) {
                if ($compositeIndex['index_key'] !== ($sanitizedKey = preg_replace('/[^a-za-z0-9_\-+]/', '', $compositeIndex['index_key']))) {
                    $values['compositeIndices'][$index]['index_key'] = $sanitizedKey;
                }
            }
        }

            value: data.index_key,
            validator: function (value) {
                if(value !== value.replace(/[^a-za-z0-9_\-+]/g,'')){
                    this.setvalue(value.replace(/[^a-za-z0-9_\-+]/g,''));
                }

                return true;
            }
CVE-2023-1704 (JavaScript, published 2023-03-29T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/translationEditor.js
Commit message: task: remove inline html and rely on wysiwyg (#14732)



Vulnerable code:
            var html = '<div class="pimcore_editable_wysiwyg" id="' + this.editableDivId + '" contenteditable="true">' + value + '</div>';

Fixed code:
            var html = '<div class="pimcore_editable_wysiwyg" id="' + this.editableDivId + '" contenteditable="true"></div>';
            this.ckeditor.setData(this.field.getValue());
CVE-2023-2341 (PHP, published 2023-04-27T14:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/LoginController.php
Commit message: fixed xss on login page (#14975)



Vulnerable code:
            $params['error'] = $request->get('too_many_attempts');

Fixed code:
use Pimcore\Security\SecurityHelper;
            $params['error'] = SecurityHelper::convertHtmlSpecialChars($request->get('too_many_attempts'));
CVE-2023-2342 (PHP, published 2023-04-27T14:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
models/WebsiteSetting.php
Commit message: [Security] Fixed xss in website settings panel (#14957)

* fixed xss in website settings panel

* added `htmlspecialchars` to model

* added `SecurityHelper::convertHtmlSpecialChars`

Vulnerable code:


                editor: new Ext.form.TextField({})
                editor: new Ext.form.TextField({}),

        $this->name = $name;
        $this->data = $data;

Fixed code:
                editor: new Ext.form.TextField({
                    listeners: {
                        'change': pimcore.helpers.htmlEncodeTextField
                    }
                })
                editor: new Ext.form.TextField({
                    listeners: {
                        'change': pimcore.helpers.htmlEncodeTextField
                    }
                }),
use Pimcore\Security\SecurityHelper;
        $this->name = SecurityHelper::convertHtmlSpecialChars($name);
        $this->data = SecurityHelper::convertHtmlSpecialChars($data);
CVE-2023-23937 (JavaScript, published 2023-02-03T20:15Z)
Description: value: Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce.
The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16. 
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/UserController.php
bundles/AdminBundle/Resources/public/js/pimcore/settings/profile/panel.js
bundles/AdminBundle/Resources/public/js/pimcore/settings/user/user/settings.js
Commit message: [Task]: Mime type check on Profile Avatar upload (#14125)

* Task: mime type check on avatar upload

* Task: change to use getTypeFromMimeMapping

* Task: add missing import

Vulnerable code:

Fixed code:
use Pimcore\Model\Asset;
use Symfony\Component\HttpFoundation\File\UploadedFile;
        //Check if uploaded file is an image
        $avatarFile = $request->files->get('Filedata');

        $assetType = Asset::getTypeFromMimeMapping($avatarFile->getMimeType(), $avatarFile);

        if (!$avatarFile instanceof UploadedFile || $assetType !== 'image') {
            throw new \Exception('Unsupported file format.');
        }

                            }.bind(this),
                            function () {
                                Ext.MessageBox.alert(t('error'), t("unsupported_filetype"));
                            }.bind(this),
                            function () {
                                Ext.MessageBox.alert(t('error'), t("unsupported_filetype"));
CVE-2023-2614 (PHP, published 2023-05-10T06:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Reports/CustomReportController.php
bundles/AdminBundle/Resources/public/js/pimcore/report/custom/panel.js
Commit message: Fix name field in custom reports (#15007)



Vulnerable code:

        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('portlet_customreport'), record.data.text), function (btn) {

Fixed code:
        $this->isValidConfigName($request->get('name'));

        $this->isValidConfigName($newName);
        $this->isValidConfigName($request->get('name'));

    /**
     * @throws \Exception
     */
    public function isValidConfigName(string $configName) {
        if(!preg_match('/^[a-zA-Z0-9_\-]+$/', $configName)) {
            throw new \Exception('The customer report name is invalid');
        }
    }
        const decodedName = Ext.util.Format.htmlDecode(record.data.text);
        Ext.Msg.confirm(t('delete'), sprintf(t('delete_message_advanced'), t('portlet_customreport'), Ext.util.Format.htmlEncode(decodedName)), function (btn) {
CVE-2023-2630 (PHP, published 2023-05-10T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/TranslationController.php
Commit message: fixed sql injection in translation api (#14952)



Vulnerable code:
                    $condition = $field . ' ' . $operator . ' ' . $db->quote($value);

Fixed code:
                    $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
CVE-2023-2730 (JavaScript, published 2023-05-16T12:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
Commit message: escaping fields in SERP preview

Vulnerable code:
                var title = metaPanel.getComponent("title").getValue();
                var description = metaPanel.getComponent("description").getValue();

Fixed code:
                var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());