hitoshura25/cvefixes huggingface dataset:
CVE-2023-27472 (Other, published 2023-03-06T19:15Z)
Description: value:  quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulnerability). Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag in any entity name. This issue has been patched in version 1.28.1 of the application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/atampy25/quickentity-editor-next
Files changed:
src/lib/components/MinimalTree.svelte
src/lib/components/Tree.svelte
src/lib/utils.ts
Commit message: Sanitise tree view text


Vulnerable code:
	import { getReferencedLocalEntity } from "$lib/utils"
				check_callback: true
				text: `${entityData.name} (ref ${entityID})`,
				text: entry.name + " (comment)",
	import { changeReferenceToLocalEntity, genRandHex, getReferencedEntities, getReferencedExternalEntities, getReferencedLocalEntity, normaliseToHash, traverseEntityTree } from "$lib/utils"
				check_callback: true
				text: `${entityData.name} (ref ${entityID})`,
				text: entry.name + " (comment)",

Fixed code:
	import { getReferencedLocalEntity, sanitise } from "$lib/utils"
				check_callback: true,
				force_text: true
				text: `${sanitise(entityData.name)} (ref ${entityID})`,
				text: sanitise(entry.name) + " (comment)",
	import { changeReferenceToLocalEntity, genRandHex, getReferencedEntities, getReferencedExternalEntities, getReferencedLocalEntity, normaliseToHash, sanitise, traverseEntityTree } from "$lib/utils"
				check_callback: true,
				force_text: true
				text: `${sanitise(entityData.name)} (ref ${entityID})`,
				text: sanitise(entry.name) + " (comment)",

export function sanitise(a: string) {
	const sanitiser = new DOMParser().parseFromString(`<div></div>`, "text/html")
	sanitiser.querySelector("div")!.innerText = a

	return sanitiser.querySelector("div")!.innerHTML
}
CVE-2011-3602 (C, published 2014-04-27T21:55Z)
Description: value: Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/reubenhwk/radvd
Files changed:
device-linux.c
Commit message: set_interface_var() doesn't check interface name and blindly does
fopen(path "/" ifname, "w") on it.  As "ifname" is an untrusted input, it
should be checked for ".." and/or "/" in it.  Otherwise, an infected
unprivileged daemon may overwrite contents of file named "mtu",
"hoplimit", etc. in arbitrary location with arbitrary 32-bit value in
decimal representation ("%d").  If an attacker has a local account or
may create arbitrary symlinks with these names in any location (e.g.
/tmp), any file may be overwritten with a decimal value.


Vulnerable code:

Fixed code:
	/* No path traversal */
	if (strstr(name, "..") || strchr(name, '/'))
		return -1;
CVE-2022-3167 (Python, published 2022-09-08T19:15Z)
Description: value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/tests/test_csrf.py
rdiffweb/tools/security.py
Commit message: Add Clickjacking Defense


Vulnerable code:
    First, by defining `SameSite=Lax` on the cookie
    Second by validating the `Origin` and `Referer`.
    Ref.: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
        cherrypy.request.hooks.attach('before_finalize', self._set_same_site)
    def _set_same_site(self):
        cookie = cherrypy.serving.response.cookie.get('session_id', None)

Fixed code:
## 2.4.1 (2022-09-08)

* Add Clickjacking Defense


    def test_clickjacking_defense(self):
        # Given a POST request made to rdiffweb
        # When the request is made without an origin
        self.getPage('/')
        # Then the request is accepted with 200 OK
        self.assertStatus(200)
        self.assertHeaderItemValue('X-Frame-Options', 'DENY')
    * Define X-Frame-Options = DENY
    * Define Cookies SameSite=Lax
    * Validate `Origin` and `Referer` on POST, PUT, PATCH, DELETE
    Ref.:
    https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
    https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
        cherrypy.request.hooks.attach('before_finalize', self._set_headers)
    def _set_headers(self):
        response = cherrypy.serving.response
        # Define X-Frame-Options to avoid Clickjacking
        response.headers['X-Frame-Options'] = 'DENY'
        cookie = response.cookie.get('session_id', None)
CVE-2022-3174 (Python, published 2022-09-13T10:15Z)
Description: value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/tests/test_secure_headers.py
rdiffweb/rdw_app.py
rdiffweb/tools/secure_headers.py
Commit message: Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session #209


Vulnerable code:
* Add Clickjacking Defense
class CsrfTest(rdiffweb.test.WebCase):
    def test_samesite_lax(self):
    def test_samesite_lax_without_session(self):
import rdiffweb.tools.security
                'tools.csrf.on': True,
class CsrfAuth(HandlerTool):
        HandlerTool.__init__(self, self.run, name='csrf')
        # Awaiting bug fix in cherrypy
        # https://github.com/cherrypy/cherrypy/issues/1767
        # Force SameSite to Lax
cherrypy.tools.csrf = CsrfAuth()

Fixed code:
## 2.4.2 (2022-09-08)

This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

* Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174) #209

This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

* Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)
class SecureHeadersTest(rdiffweb.test.WebCase):
    def test_cookie_samesite_lax(self):
    def test_cookie_samesite_lax_without_session(self):
    def test_cookie_with_https(self):
        # Given an https request made to rdiffweb
        self.getPage('/', headers=[('X-Forwarded-Proto', 'https')])
        # When receiving the response
        # Then the header contains Set-Cookie with Secure
        cookie = self.assertHeader('Set-Cookie')
        self.assertIn('Secure', cookie)

    def test_cookie_with_http(self):
        # Given an https request made to rdiffweb
        self.getPage('/')
        # When receiving the response
        # Then the header contains Set-Cookie with Secure
        cookie = self.assertHeader('Set-Cookie')
        self.assertNotIn('Secure', cookie)

import rdiffweb.tools.secure_headers
@cherrypy.tools.secure_headers()
class SecureHeaders(HandlerTool):
    * Define Cookies Secure when https is detected
        HandlerTool.__init__(self, self.run, name='secure_headers')

        # Enforce security on cookies
            # Awaiting bug fix in cherrypy
            # https://github.com/cherrypy/cherrypy/issues/1767
            # Force SameSite to Lax
            # Check if https is enabled
            https = cherrypy.request.base.startswith('https')
            if https:
                cookie['secure'] = 1
cherrypy.tools.secure_headers = SecureHeaders()
CVE-2022-3221 (Python, published 2022-09-15T09:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/pref_sshkeys.py
rdiffweb/controller/tests/test_page_prefs_ssh.py
Commit message: Mitigate CSRF in profile's SSH Keys #212


Vulnerable code:
        if action == "add":
        elif action == 'delete':

Fixed code:
## 2.4.3 (2022-09-14)

This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.

* Mitigate CSRF in profile's SSH Keys #212

        delete_form = DeleteSshForm()
        if action == "add" and form.is_submitted():
        elif action == 'delete' and delete_form.is_submitted():
    def test_add_get_method(self):
        # Given an authenticated user
        user = self.app.store.get_user('admin')
        # When querying a page with parameters (HTTP GET)
        self.getPage(
            "/prefs/sshkeys?action=add&title=ssh1&key=ssh-rsa+AAAAB3NzaC1yc2EAAAADAQABAAAAgQCzurRNVKwb0ZJCmUgGenoe4vth5gnHxgnzjHSUO8r7IZiouB6DAciiVUAryV6MQm5trwIXNo0QDwFxyX99exIwUlDu3OzhZHKKbb721hCID17AWZMAQIgxQdu6b27s5YgJXsaxXWvEO2lSRVOnVXoCSI7mK5St%2FCJ8O1OdXivNIQ%3D%3D+noname%0D%0A"
        )
        # Then page return without error
        self.assertStatus(200)
        # Then ssh key is not added
        self.assertEqual(0, len(list(user.authorizedkeys)))
CVE-2022-3457 (Python, published 2022-10-13T20:15Z)
Description: value: Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/tests/test_secure_headers.py
rdiffweb/tools/secure_headers.py
Commit message: Enforce 'Origin' validation


Vulnerable code:
        if origin and not origin.startswith(request.base):

Fixed code:
* Enforce 'Origin' validation [CVE-2022-3457](https://nvd.nist.gov/vuln/detail/CVE-2022-3457)
    def test_post_with_prefixed_origin(self):
        # Given a POST request made to rdiffweb
        # When the request is made using a different origin
        base = 'http://%s:%s' % (self.HOST + 'anything.com', self.PORT)
        self.getPage('/dashboard/', headers=[('Origin', base)], method='POST')
        # Then the request is accepted with 200 OK
        self.assertStatus(403)
        self.assertInBody('Unexpected Origin header')

        if origin and origin != request.base:
CVE-2022-4644 (Python, published 2022-12-22T01:15Z)
Description: value: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/rdw_app.py
Commit message: Discard `X-Forwarded-Host` headers


Vulnerable code:
@cherrypy.tools.proxy(remote='X-Real-IP')

Fixed code:
## Next Release - 2.5.4

* Discard `X-Forwarded-Host` headers

@cherrypy.tools.proxy(local=None, remote='X-Real-IP')
CVE-2022-4723 (Python, published 2022-12-27T15:15Z)
Description: value: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/page_pref_mfa.py
rdiffweb/core/config.py
rdiffweb/tools/ratelimit.py
Commit message: Ratelimit "Resend code to my email" in Two-Factor Authentication view


Vulnerable code:
        help='maximum number of requests per hour that can be made on sensitive endpoints. When this limit is reached, an HTTP 429 message is returned to the user or the user is logged out. This security measure is used to limit brute force attacks on the login page and the RESTful API.',
    token = (request.login or request.remote.ip) + '.' + (scope or request.path_info)

Fixed code:
* Ratelimit "Resend code to my email" in Two-Factor Authentication view - credit to [Nehal Pillai](https://www.linkedin.com/in/nehal-pillai-02a854172)
    @cherrypy.tools.ratelimit(methods=['POST'])
        help='maximum number of requests per hour that can be made on sensitive endpoints. When this limit is reached, an HTTP 429 message is returned to the user or the user is logged out. This security measure is used to limit brute force attacks on the login page and the RESTful API. default: 20 requests / hour',
    identifier = request.remote.ip
    if hasattr(cherrypy.serving, 'session') and cherrypy.serving.session.get('_cp_username', None):
        identifier = cherrypy.serving.session.get('_cp_username', None)
    token = identifier + '.' + (scope or request.path_info)
CVE-2023-4138 (Unknown, published 2023-08-03T15:15Z)
Description: value: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
Commit message: Merge branch 'patrik-ratelimit-send-report' into 'master'

Add ratelimit to "send me a status report" to avoid email flooding #272

See merge request ikus-soft/rdiffweb!335

Vulnerable code:

Fixed code:
CVE-2023-5289 (Python, published 2023-09-29T14:15Z)
Description: value: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
rdiffweb/controller/page_admin_users.py
rdiffweb/controller/page_pref_sshkeys.py
rdiffweb/controller/page_pref_tokens.py
Commit message: Add ratelimit to AccessToken, SSH Keys, User creation


Vulnerable code:
    @cherrypy.expose()
    @cherrypy.expose()
    @cherrypy.expose()


# TODO Allow configuration of notification settigns

Fixed code:
    @cherrypy.expose
    @cherrypy.tools.ratelimit(methods=['POST'])
    @cherrypy.expose
    @cherrypy.expose
    @cherrypy.tools.ratelimit(methods=['POST'])
    @cherrypy.tools.ratelimit(methods=['POST'])
CVE-2022-2713 (PHP, published 2022-08-08T15:15Z)
Description: value: Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
lib/Lime/App.php
Commit message: Stop execution of code after redirecting


Vulnerable code:

Fixed code:
- Stop execution of code after redirecting

        $this->trigger('app:request:stop');
        $this->trigger('after', [true]);

        exit;
        if ($flush) {

            $this->on('app:request:stop', function() {

                if ($this->response->status === 307 && isset($this->response->headers['Location'])) {
                    \header("Location: {$this->response->headers['Location']}");
                    exit;
                }

                $this->response->flush();
            });
        }
CVE-2022-2818 (PHP, published 2022-08-15T11:21Z)
Description: value: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/App/Controller/Auth.php
Commit message: Fix exposing 2FA secret in JWT token on login


Vulnerable code:
                        'twofa' => $this->helper('jwt')->create($user)
            } else {
                // remove twofa settings
                unset($user['twofa']);
}

Fixed code:
- Fix exposing 2FA secret in JWT token on login
                unset($user['twofa']);

                        'twofa' => $this->helper('jwt')->create([
                            '_id'   => $user['_id'],
                            'user'  => $user['user'],
                            'name'  => $user['name'],
                            'email' => $user['email'],
                            'role'  => $user['role'],
                        ])
            // remove 2FA settings from user session
            unset($user['twofa']);

}
CVE-2023-0759 (PHP, published 2023-02-09T14:15Z)
Description: value: Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-268 \u2014 Privilege Chaining
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/System/Controller/Users.php
Commit message: Fix not allowed user role modification by intercepting request


Vulnerable code:

Fixed code:
## WIP

- Fix not allowed user role modification by intercepting request

        // don't allow to change role if not allowed
        if (isset($user['role']) && !$this->isAllowed('app/users/manage')) {
            unset($user['role']);
        }
CVE-2023-0780 (PHP, published 2023-02-11T02:20Z)
Description: value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/App/admin.php
Commit message: Set X-Frame-Options to prevent possible clickjacking via iframe layer


Vulnerable code:

Fixed code:
- Fix min/max settings for number fields #76
- Set X-Frame-Options to prevent possible clickjacking via iframe layer
    // prevent possible clickjacking via iframe layer
    $this->response->headers['X-Frame-Options'] = 'SAMEORIGIN';
CVE-2023-1313 (PHP, published 2023-03-10T12:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/Assets/bootstrap.php
Commit message: Prevent uploading php files in assets manager


Vulnerable code:

Fixed code:
## WIP

- Prevent uploading php files in assets manager

                // prevent uploading php files
                if ($_isAllowed && pathinfo($_file, PATHINFO_EXTENSION) === 'php') {
                    $_isAllowed = false;
                }
CVE-2023-4195 (PHP, published 2023-08-06T18:15Z)
Description: value: PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-98 \u2014 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/Assets/bootstrap.php
Commit message: Prevent uploading .phps files


Vulnerable code:
                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml'])) {

Fixed code:
## WIP

- Prevent uploading .phps files

                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml', 'phps'])) {
CVE-2023-4196 (PHP, published 2023-08-06T18:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cockpit-hq/cockpit
Files changed:
CHANGELOG.md
modules/Assets/bootstrap.php
Commit message: Prevent uploading .phps + .html files in assets manager


Vulnerable code:
- Prevent uploading .phps files
                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml', 'phps'])) {

Fixed code:
- Prevent uploading .phps + .html files in assets manager
        $forbidden = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];

                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbidden)) {