hitoshura25/cvefixes huggingface dataset:
CVE-2022-0285 (PHP, published 2022-01-20T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/SettingsController.php
bundles/AdminBundle/Resources/public/js/pimcore/settings/thumbnail/item.js
Commit message: [Thumbnails] Escape group text properly


Vulnerable code:
                        'text' => $item->getGroup(),
                if (!$groups[$item->getGroup()]) {
                        'text' => $item->getGroup(),

Fixed code:
                        'text' => htmlspecialchars($item->getGroup()),
                if (empty($groups[$item->getGroup()])) {
                        'text' => htmlspecialchars($item->getGroup()),
            renderer: Ext.util.Format.htmlEncode,
CVE-2022-0348 (PHP, published 2022-01-27T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
Commit message: added escape function to the icon field


Vulnerable code:
                'icon' => $class->getIcon() ? $class->getIcon() : $defaultIcon,

Fixed code:
                'icon' => $class->getIcon() ? htmlspecialchars($class->getIcon()) : $defaultIcon,
CVE-2022-0509 (JavaScript, published 2022-02-08T12:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
Commit message: [Admin] Website Settings - Escape grid values properly


Vulnerable code:
                items:[this.getRowEditor()]
                items: typesColumns
        var data = record.data;
        var type = data.type;
        var property;
            property = Ext.create('Ext.form.TextField');
            property = Ext.create('Ext.form.TextArea');

Fixed code:
                items:[this.getRowEditor()],
                editor: new Ext.form.TextField({}),
                items: typesColumns,
                defaults: {
                    renderer: Ext.util.Format.htmlEncode
                },
        let data = record.data;
        let type = data.type;
        let property;
            property = {
                xtype: 'textfield',
                flex: 1,
                value: data.data
            }
            property = {
                xtype: "textarea",
                flex: 1,
                value: data.data
            }
CVE-2022-0510 (PHP, published 2022-02-08T15:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
Commit message: [Admin] DataObject - Escape class definitions group properly


Vulnerable code:
                        'text' => $item->getGroup(),
                        'text' => $item->getGroup(),

Fixed code:
                        'text' => htmlspecialchars($item->getGroup()),
                        'text' => htmlspecialchars($item->getGroup()),
CVE-2022-0665 (Unknown, published 2022-02-22T15:15Z)
Description: value: Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pimcore/pimcore
Files changed:
Commit message: [Admin] Translations - use session for file import to prevent path traversal - Merge PR #11498



Vulnerable code:

Fixed code:
CVE-2022-0831 (JavaScript, published 2022-03-04T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
Commit message: escaping 'key' custom property field in elements

Vulnerable code:
            if (in_array(customKey.getValue(), this.disallowedKeys)) {
            this.add(customKey.getValue(), customType.getValue(), false, false, false, true);

Fixed code:
            let key = htmlspecialchars(customKey.getValue());
            if (in_array(key, this.disallowedKeys)) {
            this.add(key, customType.getValue(), false, false, false, true);
CVE-2022-0832 (JavaScript, published 2022-03-04T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
Commit message: escaping fields in SERP preview

Vulnerable code:
                var title = metaPanel.getComponent("title").getValue();
                var description = metaPanel.getComponent("description").getValue();

Fixed code:
                var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());
CVE-2022-1219 (PHP, published 2022-04-08T09:15Z)
Description: value: SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/RecyclebinController.php
Commit message: [Recyclebin] Quote condition filter


Vulnerable code:
                        $conditionFilters[] = $field . $operator . " '" . $value . "' ";

Fixed code:
                        $conditionFilters[] = $field . $operator . ' ' . $db->quote($value);
CVE-2022-1339 (PHP, published 2022-04-13T10:15Z)
Description: value: SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/ElementController.php
bundles/AdminBundle/Controller/Admin/RecyclebinController.php
Commit message: Added Quote In Condition Filters


Vulnerable code:
                $value = $filter['value'];
                    $conditions[] = '`user` IN (SELECT `id` FROM `users` WHERE `name` LIKE ' . $list->quote('%'.$filter['value'].'%') . ')';
                        $maxTime = $filter['value'] + (86400 - 1); //specifies the top point of the range used in the condition
                        $dateCondition = '`' . $filter[$propertyKey] . '` ' . ' BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);
                        $field = '`'.$filter[$propertyKey].'` ';
                        $conditions[] = $field.$operator.' '.$db->quote($value);
                    $field = '`' . $filterField . '` ';

Fixed code:
                $value = ($filter['value']??'');
                    $conditions[] = '`user` IN (SELECT `id` FROM `users` WHERE `name` LIKE ' . $list->quote($value) . ')';
                        $maxTime = $value + (86400 - 1); //specifies the top point of the range used in the condition
                        $dateCondition = '`' . $filter[$propertyKey] . '` ' . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);
                        $conditions[] = $db->quoteIdentifier($filter[$propertyKey]).' '.$operator.' '.$db->quote($value);
                    $field = $db->quoteIdentifier($filterField);
CVE-2022-1351 (PHP, published 2022-04-14T10:15Z)
Description: value: Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/DependencyInjection/Configuration.php
bundles/AdminBundle/EventListener/AdminSecurityListener.php
bundles/AdminBundle/Security/ContentSecurityPolicyHandler.php
Commit message: [Security] ContentSecurityPolicyHandler - Add exclude paths property to disable csp for specific paths

Signed-off-by: dpahuja <divesh.pahuja@gmail.com>


Vulnerable code:

        ],
        self::SCRIPT_OPT => [
            'http://unpkg.com/', // For the OPCache

Fixed code:
                    ->arrayNode('exclude_paths')
                        ->scalarPrototype()->end()
                        ->info('Regular Expressions like: /^\/path\/toexclude/')
                    ->end()

        if (!empty($this->config['admin_csp_header']['exclude_paths'])) {
            $requestUri = $request->getRequestUri();
            foreach ($this->config['admin_csp_header']['exclude_paths'] as $path) {
                if (@preg_match($path, $requestUri)) {
                    return;
                }
            }
        }
CVE-2022-2796 (JavaScript, published 2022-08-23T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js
Commit message: [Admin] Translations - properly escape key on roweditor


Vulnerable code:
            {text: t("key"), sortable: true, dataIndex: 'key', flex: 1, editable: false, filter: 'string'},
                        pimcore.helpers.deleteConfirm(t('translation'), data.data.key, function () {

Fixed code:
            {text: t("key"), sortable: true, dataIndex: 'key', flex: 1, editable: false, filter: 'string',
                editor: new Ext.form.DisplayField({
                    htmlEncode: true
                })},
                        pimcore.helpers.deleteConfirm(t('translation'), Ext.util.Format.htmlEncode(data.data.key), function () {
CVE-2022-31092 (PHP, published 2022-06-27T22:15Z)
Description: value: Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting is not done properly in both cases, so there's the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the listing classes. This issue has been resolved in version 10.4.4. Users are advised to upgrade or to apple the patch manually. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
lib/Model/Listing/AbstractListing.php
Commit message: [Security] SQL Injection in Data Hub GraphQL (#12444)

* [Security] SQL Injection in Data Hub GraphQL (AbstractListing)

* Update lib/Model/Listing/AbstractListing.php

Co-authored-by: Jacob Dreesen <j.dreesen@neusta.de>

* Update lib/Model/Listing/AbstractListing.php

Co-authored-by: mcop1 <89011527+mcop1@users.noreply.github.com>

Co-authored-by: Jacob Dreesen <j.dreesen@neusta.de>
Co-authored-by: Bernhard Rusch <brusch@users.noreply.github.com>

Vulnerable code:
                    $this->orderKey[] = '`' . $o . '`';
            if ($qoute && strpos($groupBy, '`') !== 0) {
                $this->groupBy = '`' . $this->groupBy . '`';

Fixed code:
                    $this->orderKey[] = $this->quoteIdentifier($o);
          if ($qoute) {
                $quotedParts = [];
                $parts = explode(",", trim($groupBy, '`'));
                foreach($parts as $part) {
                    $quotedParts[] = $this->quoteIdentifier(trim($part));
                }

                $this->groupBy = implode(", ", $quotedParts);
    public function quoteIdentifier(string $value): string
    {
        $db = Db::get();

        return $db->quoteIdentifier($value);
    }
CVE-2022-3211 (JavaScript, published 2022-09-15T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
bundles/AdminBundle/Resources/public/js/pimcore/notification/helper.js
bundles/AdminBundle/Resources/public/js/pimcore/notification/panel.js
Commit message: [Admin] escape values on UI (#13129)

* [Admin] Escape values on UI - Properties

* [Admin] Escape values on UI - Notifications

* [Admin] Escape values on UI - Notifications

Vulnerable code:
        return '<div class="pimcore_icon_' + value + '" name="' + record.data.name + '">&nbsp;</div>';
            title: row.title,
            html: row.message,
        title: title,
        html: message,
            {header: t("sender"), flex: 2, sortable: false, dataIndex: 'sender'},

Fixed code:
        return '<div class="pimcore_icon_' + value + '" name="' + Ext.util.Format.htmlEncode(record.data.name) + '">&nbsp;</div>';
            title: Ext.util.Format.htmlEncode(row.title),
            html: Ext.util.Format.htmlEncode(row.message),
        title: Ext.util.Format.htmlEncode(title),
        html: Ext.util.Format.htmlEncode(message),
                    val = Ext.util.Format.htmlEncode(val);
            {header: t("sender"), flex: 2, sortable: false, dataIndex: 'sender', renderer: Ext.util.Format.htmlEncode},
CVE-2023-0323 (PHP, published 2023-01-16T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/DataObject/ClassDefinition/Service.php
Commit message: Fix: X-site-scripting (#13916)



Vulnerable code:

Fixed code:
            if ($title = $array['title'] ?? false) {
                if (preg_match('/<.+?>/', $title)) {
                    throw new \Exception('not a valid title:' . htmlentities($title));
                }
            }
CVE-2023-0827 (PHP, published 2023-02-14T13:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/object/tags/urlSlug.js
bundles/CoreBundle/Resources/translations/en.json
models/DataObject/ClassDefinition/Data/UrlSlug.php
Commit message: [Task] Improve check validity (#14301)

* set value to sanitized string if string doesn't match requirements

* sanitized string to improve validity check

* sanitized string to improve validity check

* added exception to validation

Vulnerable code:


                            return false;
    "postal_code_format_error": "Postal code format, e.g. use \"5020 Salzburg, Söllheimer Straße 16\" instead of \"A-5020 Salzburg, Söllheimer Straße 16\""
                $slug = $item->getSlug();

Fixed code:

                            return t('url-slug-invalid-chars');
    "postal_code_format_error": "Postal code format, e.g. use \"5020 Salzburg, Söllheimer Straße 16\" instead of \"A-5020 Salzburg, Söllheimer Straße 16\"",
    "url-slug-invalid-chars": "Provided invalid character in URL slug"
                $slug = htmlspecialchars($item->getSlug());
                    $slugToCompare = preg_replace('/[#\?\*\:\\\\<\>\|"%&@=;]/', '-', $item->getSlug());
                    if($item->getSlug() !== $slugToCompare){
                        throw new Model\Element\ValidationException('Slug contains forbidden characters!');
                    }
CVE-2023-1067 (JavaScript, published 2023-02-27T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/dataproviders/sentMail.js
bundles/AdminBundle/Resources/public/js/pimcore/settings/gdpr/gdprPanel.js
Commit message: [Task] Improve GDPR email search (#14410)

* improved email in toolbar

* added validator to email search input

Vulnerable code:
                    text: t("gdpr_dataSource_sentMail_only_email") + ": " + this.searchParams.email,
                            width: 650

Fixed code:
                    text: t("gdpr_dataSource_sentMail_only_email") + ": " + Ext.util.Format.htmlEncode(this.searchParams.email),
                            width: 650,
                            validator: function (value) {
                                if(value !== value.replace(/[^a-zA-Z0-9_\-@.]/g,'')){
                                    this.setValue(value.replace(/[^a-zA-Z0-9_\-@.]/g,''));
                                }

                                return true;
                            }
CVE-2023-1115 (PHP, published 2023-03-01T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Document/Editable/Link.php
Commit message: [Task] Optimizing dialog (#14500)

* Optimizing dialog

* Modify optimization

Vulnerable code:

Fixed code:
        // sanitize attributes
        if(isset($this->data['attributes']))  {
            $this->data['attributes'] = htmlspecialchars($this->data['attributes'], HTML_ENTITIES);
        }