hitoshura25/cvefixes huggingface dataset:
CVE-2022-0514 (PHP, published 2022-03-21T19:15Z)
Description: value: Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/crater-invoice/crater
Files changed:
app/Http/Controllers/V1/Admin/Settings/UpdateCompanySettingsController.php
app/Models/Invoice.php
database/migrations/2022_03_04_051438_calculate_base_values_for_invoice_items.php
Commit message: Fix tax per item issue & check currency key


Vulnerable code:
        if ($companyCurrency !== $data['currency'] && $company->hasTransactions()) {
            return response()->json([
                'success' => false,
                'message' => 'Cannot update company currency after transactions are created.'
            ]);

Fixed code:
        if (array_key_exists('currency', $data)) {
            if ($companyCurrency !== $data['currency'] && $company->hasTransactions()) {
                return response()->json([
                    'success' => false,
                    'message' => 'Cannot update company currency after transactions are created.'
                ]);
            }
                    $tax['exchnage_rate'] = $invoice->exchange_rate;
                    $tax['base_amount'] = $tax['amount'] * $exchange_rate;
                    $tax['currency_id'] = $invoice->currency_id;

<?php

use Crater\Models\InvoiceItem;
use Crater\Models\Tax;
use Illuminate\Database\Migrations\Migration;

class CalculateBaseValuesForInvoiceItems extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        $taxes = Tax::whereRelation('invoiceItem', 'base_amount', null)->get();

        if ($taxes) {
            $taxes->map(function ($tax) {
                $invoiceItem = InvoiceItem::find($tax->invoice_item_id);
                $exchange_rate = $invoiceItem->exchange_rate;
                $tax->exchange_rate = $exchange_rate;
                $tax->base_amount = $tax->amount * $exchange_rate;
                $tax->save();
            });
        }
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        //
    }
}
CVE-2022-0515 (PHP, published 2022-03-21T19:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/crater-invoice/crater
Files changed:
routes/web.php
Commit message: changed route method


Vulnerable code:
Route::get('auth/logout', function () {

Fixed code:
Route::post('auth/logout', function () {
CVE-2022-1032 (PHP, published 2022-03-29T08:15Z)
Description: value: Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/crater-invoice/crater
Files changed:
app/Http/Controllers/V1/Admin/Modules/UnzipModuleController.php
app/Http/Controllers/V1/Admin/Modules/UploadModuleController.php
app/Http/Requests/UnzipUpdateRequest.php
app/Http/Requests/UploadModuleRequest.php
Commit message: Module upload validation (#857)

https://huntr.dev/bounties/cb9a0393-be34-4021-a06c-00c7791c7622/

Vulnerable code:
use Illuminate\Http\Request;
     * @param  \Illuminate\Http\Request  $request
    public function __invoke(Request $request)
use Illuminate\Http\Request;
     * @param  \Illuminate\Http\Request  $request
    public function __invoke(Request $request)

Fixed code:
use Crater\Http\Requests\UnzipUpdateRequest;
     * @param  \Crater\Http\Requests\UnzipUpdateRequest  $request
    public function __invoke(UnzipUpdateRequest $request)
use Crater\Http\Requests\UploadModuleRequest;
     * @param  \Crater\Http\Requests\UploadModuleRequest  $request
    public function __invoke(UploadModuleRequest $request)
<?php

namespace Crater\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class UnzipUpdateRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'path' => [
                'required',
                'regex:/^[\.\/\w\-]+$/'
            ],
            'module' => [
                'required',
                'string'
            ]
        ];
    }
}
<?php

namespace Crater\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class UploadModuleRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'avatar' => [
                'required',
                'file',
                'mimes:zip',
                'max:20000'
            ],
            'module' => [
                'required',
                'string',
                'max:100'
            ]
        ];
    }
}
CVE-2022-1033 (PHP, published 2022-03-23T08:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/crater-invoice/crater
Files changed:
app/Http/Requests/UploadExpenseReceiptRequest.php
Commit message: Expense attachment validation fix (#855)

https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045/

Vulnerable code:
            'upload_receipt' => [

Fixed code:
            'attachment_receipt' => [
CVE-2011-5097 (Other, published 2012-08-08T10:26Z)
Description: value: chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/opscode/chef
Files changed:
chef-server-api/app/controllers/cookbooks.rb
features/api/cookbooks/delete_cookbooks.feature
features/api/cookbooks/upload_cookbooks.feature
features/support/env.rb
Commit message: Do not allow non-admins to upload or delete cookbooks.

Vulnerable code:
  cmd = [KNIFE_CMD, "cookbook", "upload", "-a", "-o", INTEGRATION_COOKBOOKS, "-u", "validator", "-k", File.join(Dir.tmpdir, "validation.pem"), "-c", KNIFE_CONFIG]

Fixed code:
  before :is_admin, :only => [ :update, :destroy ]
  @delete_cookbook_negative @cookbook_non_admin
  Scenario: I should not be able to delete cookbook if I am not an admin
    Given I am an administrator
     When I fully upload a sandboxed cookbook named 'testcookbook_valid' versioned '0.1.0' with 'testcookbook_valid'
    Given I am a non-admin
     When I 'DELETE' to the path '/cookbooks/testcookbook_valid/0.1.0'
     Then I should get a '403 "Forbidden"' exception

  @create_cookbook_negative @cookbook_non_admin
  Scenario: Should not be able to create a cookbook if I am not an admin
    Given I am an administrator
     When I create a sandbox named 'sandbox1' for cookbook 'testcookbook_valid'
     Then the inflated responses key 'uri' should match '^http://.+/sandboxes/[^\/]+$'
     Then I upload a file named 'metadata.json' from cookbook 'testcookbook_valid' to the sandbox
     Then the response code should be '200'
     Then I upload a file named 'metadata.rb' from cookbook 'testcookbook_valid' to the sandbox
     Then the response code should be '200'
     Then I upload a file named 'attributes/attributes.rb' from cookbook 'testcookbook_valid' to the sandbox
     Then the response code should be '200'
     Then I upload a file named 'recipes/default.rb' from cookbook 'testcookbook_valid' to the sandbox
     Then the response code should be '200'
     When I commit the sandbox
     Then I should not get an exception
    Given I am a non-admin
     When I create a versioned cookbook named 'testcookbook_valid' versioned '0.1.0' with 'testcookbook_valid'
     Then I should get a '403 "Forbidden"' exception
  c = Chef::ApiClient.cdb_load(Chef::Config[:web_ui_client_name])
  c.admin(true)
  c.cdb_save
  cmd = [KNIFE_CMD, "cookbook", "upload", "-a", "-o", INTEGRATION_COOKBOOKS, "-u", Chef::Config[:web_ui_client_name], "-k", File.join(Dir.tmpdir, "webui.pem"), "-c", KNIFE_CONFIG]
CVE-2011-5098 (Ruby, published 2012-08-08T10:26Z)
Description: value: chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/opscode/chef
Files changed:
chef-server-api/app/controllers/clients.rb
Commit message: CHEF-2649: Only allow admin clients to create admins (not validators)


Vulnerable code:
      # We can only get here if we're admin or the validator. Only
      # allow creating admin clients if we're already an admin.
      if @auth_user.admin
        params[:admin] ||= params[:inflated_object].admin
      else
        params[:admin] = false
      end

Fixed code:
      params[:admin] ||= params[:inflated_object].admin
    end

    # We can only create clients if we're the admin or the validator.
    # But only allow creating admin clients if we're already an admin.
    if params[:admin] == true && @auth_user.admin != true
      raise Forbidden, "You are not allowed to take this action."
CVE-2024-30248 (Python, published 2024-04-02T15:15Z)
Description: value: Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin page. This vulnerability was patched in version 1.3.2.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/piccolo-orm/piccolo_admin
Files changed:
piccolo_admin/endpoints.py
requirements/requirements.txt
Commit message: Merge pull request from GHSA-pmww-v6c9-7p83

* feat: add csp headers on media routes

* feat: use CSPMiddleware instead

* chore: bump piccolo API version

---------

Co-authored-by: skelmis <ethanmkh2@gmail.com>

Vulnerable code:
                            path=f"/media-files/{column._meta.table._meta.tablename}/{column._meta.name}/",  # noqa: E501
                            app=StaticFiles(
                                directory=media_storage.media_path
                            ),
piccolo_api>=1.1.0

Fixed code:
from piccolo_api.csp.middleware import CSPMiddleware, CSPConfig
                        # We apply a restrictive CSP here to mitigate SVG
                        # files being used maliciously when viewed by admins
                            path=f"/media-files/{column._meta.table._meta.tablename}/{column._meta.name}/",
                            # noqa: E501
                            app=CSPMiddleware(
                                StaticFiles(
                                    directory=media_storage.media_path
                                ),
                                config=CSPConfig(default_src="none")
                            )
piccolo_api>=1.3.1
CVE-2019-25105 (PHP, published 2023-02-26T08:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named fa73c3a42bc5c246a1b8f815699ea241aef154bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221763.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/lgommans/dro.pm
Files changed:
web/fileman.php
Commit message: Fix reflected XSS in fileman.php (self discovered, no signs of exploitation... not that there would be much to exploit, given that there are no cookies or localstorage (i.e. there is no state you could get at))


Vulnerable code:
			$retval = "$secret dro.pm/$key";
		$secret = $db->escape_string($_GET['secret']);
		
		$key = $db->query('SELECT `key` FROM `shorts` WHERE `secret` = "' . $secret . '"') or die('Database error 3984');
			die("?secret=$secret not found");
	$data = array('original_filename' => $_FILES['f']['name'], 'filename' => $key);
	$db->query('UPDATE `shorts` SET `expires` = ' . (time() + (12*3600)) . ', `type` = 2, `value` = "' . $data . '", expireAfterDownload = ' . $expireAfterDownload . ' WHERE `secret` = "' . $secret . '"') or die('Database error 29348');

Fixed code:
			$retval = htmlspecialchars($secret) . ' dro.pm/' . htmlspecialchars($key);
		$secret = $_GET['secret'];

		$key = $db->query('SELECT `key` FROM `shorts` WHERE `secret` = "' . $db->escape_string($secret) . '"') or die('Database error 3984');
			die('?secret=' . htmlspecialchars($secret) . ' not found');
	$data = ['original_filename' => $_FILES['f']['name'], 'filename' => $key];
	$db->query('UPDATE `shorts` SET `expires` = ' . (time() + (12*3600)) . ', `type` = 2, `value` = "' . $data . '", expireAfterDownload = ' . $expireAfterDownload
		. ' WHERE `secret` = "' . $db->escape_string($secret) . '"') or die('Database error 29348');
CVE-2021-37707 (PHP, published 2021-08-16T19:15Z)
Description: value: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/shopware/platform
Files changed:
src/Core/Content/Product/SalesChannel/Review/ProductReviewSaveRoute.php
src/Core/Content/Test/Product/SalesChannel/Review/ProductReviewSaveRouteTest.php
Commit message: NEXT-15681 - Improve product review validation


Vulnerable code:

Fixed code:
                'criteria' => $criteria,
use Symfony\Component\HttpFoundation\Response;
    public function testCustomerValidation(): void
    {
        $this->login();

        $this->assertReviewCount(0);

        $id = Uuid::randomHex();

        // Create review
        $this->browser->request('POST', $this->getUrl(), [
            'id' => $id,
            'title' => 'Lorem ipsum dolor sit amet',
            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
        ]);

        // Re-login as another user
        $this->login();

        // Try to use the id from previous review which is not attached to this customer
        $this->browser->request('POST', $this->getUrl(), [
            'id' => $id,
            'title' => 'Lorem ipsum dolor sit amet',
            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
        ]);

        $response = $this->browser->getResponse();

        static::assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
        $content = json_decode($response->getContent(), true);

        static::assertSame('VIOLATION::ENTITY_DOES_NOT_EXISTS', $content['errors'][0]['code']);
    }
CVE-2021-37708 (PHP, published 2021-08-16T20:15Z)
Description: value: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/shopware/platform
Files changed:
src/Core/Content/Mail/Service/MailerTransportFactory.php
src/Core/Content/Test/MailTemplate/Service/MailerTransportFactoryTest.php
Commit message: NEXT-15669 - Improve mail configuration


Vulnerable code:
                return new SendmailTransport('/usr/sbin/sendmail ' . ($configService->getString('core.mailerSettings.sendMailOptions') ?: '-bs'));

Fixed code:
                return new SendmailTransport($this->getSendMailCommandLineArgument($configService));

    private function getSendMailCommandLineArgument(SystemConfigService $configService): string
    {
        $command = '/usr/sbin/sendmail ';

        $option = $configService->getString('core.mailerSettings.sendMailOptions');

        if ($option === '') {
            $option = '-t';
        }

        if ($option !== '-bs' && $option !== '-t') {
            throw new \RuntimeException(sprintf('Given sendmail option "%s" is invalid', $option));
        }

        return $command . $option;
    }

    public function testFactoryWithLocalAndInvalidConfig(): void
    {
        $original = new SendmailTransport();

        $factory = $this->getContainer()->get('mailer.transport_factory');

        static::expectException(\RuntimeException::class);
        static::expectExceptionMessage('Given sendmail option "-t && echo bla" is invalid');

        $mailer = $factory->create(
            new ConfigService([
                'core.mailerSettings.emailAgent' => 'local',
                'core.mailerSettings.sendMailOptions' => '-t && echo bla',
            ])
        );

        static::assertEquals(\get_class($original), \get_class($mailer));
    }
CVE-2021-37710 (Other, published 2021-08-16T23:15Z)
Description: value: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/shopware/platform
Files changed:
public/.htaccess.dist
Commit message: NEXT-15677 - Fix XSS for SVG files


Vulnerable code:
    <FilesMatch "\.svg$">

Fixed code:
    <FilesMatch "\.(?i:svg)$">