hitoshura25/cvefixes huggingface dataset:
CVE-2017-16804 (Ruby, published 2017-11-13T20:29Z)
Description: value: In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/redmine/redmine
Files changed:
app/models/mailer.rb
test/unit/mailer_test.rb
Commit message: Send reminders about visible issues only (#25713).

Patch by Felix Schäfer.

git-svn-id: http://svn.redmine.org/redmine/trunk@16557 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
      reminder(assignee, issues, days).deliver if assignee.is_a?(User) && assignee.active?

Fixed code:
      if assignee.is_a?(User) && assignee.active? && issues.present?
        visible_issues = issues.select {|i| i.visible?(assignee)}
        reminder(assignee, visible_issues, days).deliver if visible_issues.present?
      end
  def test_reminders_should_only_include_issues_the_user_can_see
    with_settings :default_language => 'en' do
      user = User.find(3)
      member = Member.create!(:project_id => 2, :principal => user, :role_ids => [1])
      Issue.create!(:project_id => 2, :tracker_id => 1, :status_id => 1,
                      :subject => 'Issue dlopper should not see', :assigned_to_id => 3,
                      :due_date => 5.days.from_now,
                      :author_id => 2)
      member.destroy
      ActionMailer::Base.deliveries.clear

      Mailer.reminders(:days => 42)
      assert_equal 1, ActionMailer::Base.deliveries.size
      mail = last_email
      assert mail.bcc.include?('dlopper@somenet.foo')
      assert_mail_body_no_match 'Issue dlopper should not see', mail
    end
  end
CVE-2017-18026 (Ruby, published 2018-01-10T09:29Z)
Description: value: Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/redmine/redmine
Files changed:
lib/redmine/scm/adapters/mercurial_adapter.rb
Commit message: mercurial: separate command options and positional arguments with "--" (#27516)

We don't have much problems here thanks to hgtarget(path) and CGI.escape(),
which prepends a repository path and encodes "=" character respectively, but
it's better to not rely on the side effect of these functions.

Contributed by Yuya Nishihara.

git-svn-id: http://svn.redmine.org/redmine/trunk@17061 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
                        CGI.escape(without_leading_slash(p1.to_s))) do |io|
          hg_args << hgtarget(path) unless path.blank?
            hg_args << CGI.escape(hgtarget(p))
          hg 'rhcat', '-r', CGI.escape(hgrev(identifier)), hgtarget(p) do |io|
          hg 'rhannotate', '-ncu', '-r', CGI.escape(hgrev(identifier)), hgtarget(p) do |io|

Fixed code:
                        '--', CGI.escape(without_leading_slash(p1.to_s))) do |io|
          hg_args << '--' << hgtarget(path) unless path.blank?
            hg_args << '--' << CGI.escape(hgtarget(p))
          hg 'rhcat', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
          hg 'rhannotate', '-ncu', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
CVE-2023-40954 (Python, published 2023-12-15T01:15Z)
Description: value: A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/gmarczynski/odoo-web-progress
Files changed:
web_progress/models/web_progress.py
web_progress/tests/test_web_progress.py
Commit message: [FIX] Escape parameter of SQL query, closes #34


Vulnerable code:
        WHERE create_date > timezone('utc', now()) - INTERVAL '{recency} SECOND'
        self.env.cr.execute(query)
from odoo import exceptions

Fixed code:
        WHERE create_date > timezone('utc', now()) - INTERVAL '%s SECOND'
        self.env.cr.execute(query, (recency, ))
from odoo import exceptions, api, registry
from odoo.tools import mute_logger
from psycopg2.errors import SyntaxError


class WebProgressTestAllProgress(common.SavepointCase):
    at_install = True
    post_install = False

    @mute_logger('odoo.sql_db')
    def test_get_all_progress(self):
        """
        Check call to get_all_progress without and with parameters.
        Verify if the parameter is properly escaped in the internal SQL query.
        """
        progress_code = str(uuid.uuid4())
        partner_obj = self.env['res.partner'].with_context(progress_code=progress_code)
        partner_obj.web_progress_percent(0, "Start")
        with api.Environment.manage():
            with registry(self.env.cr.dbname).cursor() as new_cr:
                # Create a new environment with a new cursor
                new_env = api.Environment(new_cr, self.env.uid, self.env.context)
                progress_obj = self.env['web.progress'].with_env(new_env)
                res = progress_obj.get_all_progress()
                self.assertEqual(res, [{'code': progress_code}])
                res = progress_obj.get_all_progress(0)
                self.assertEqual(res, [])
                with self.assertRaises(SyntaxError) as e:
                    progress_obj.get_all_progress("0 SECOND' GROUP BY code; "
                                                  "SELECT code, array_agg(state) FROM web_progress "
                                                  "WHERE create_date > timezone('utc', now()) - INTERVAL '10")
                new_cr.rollback()
CVE-2015-7348 (PHP, published 2015-12-07T20:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zTree/zTree_v3
Files changed:
demo/cn/asyncData/getNodes.php
demo/cn/asyncData/getNodesForBigData.php
demo/en/asyncData/getNodes.php
demo/en/asyncData/getNodesForBigData.php
Commit message: fix CVE-2015-7348


Vulnerable code:
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
$pName = str_replace("%<%", "&lt;", $pName);
$pName = str_replace("%>%", "&gt;", $pName);
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
?>]
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
$pName = str_replace("%<%", "&lt;", $pName);
$pName = str_replace("%>%", "&gt;", $pName);
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
?>]

Fixed code:
$pId = htmlspecialchars($pId);
$pName = htmlspecialchars($pName);
$pId = htmlspecialchars($pId);
?>]
$pId = htmlspecialchars($pId);
$pName = htmlspecialchars($pName);
$pId = htmlspecialchars($pId);
?>]
CVE-2018-25056 (Other, published 2022-12-28T12:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yola/yolapi
Files changed:
requirements.txt
yolapi/pypi/metadata.py
Commit message: Sanitize HTML to avoid XSS attacks


Vulnerable code:

Fixed code:
bleach==2.1.4
bleach-whitelist==0.0.9
import bleach
from bleach_whitelist import print_tags, print_attrs, all_styles
    html = bleach.clean(
        html, print_tags + ['a', 'cite', 'pre'], print_attrs, all_styles)
CVE-2020-28349 (Go, published 2020-11-09T01:15Z)
Description: value: An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service via malformed frequency attributes in CollectAndCallOnceCollect in internal/uplink/collect.go. NOTE: the vendor's position is that there are no "guarantees that allowing untrusted LoRa gateways to the network should still result in a secure network.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/brocaar/chirpstack-network-server
Files changed:
internal/backend/gateway/mqtt/backend.go
internal/uplink/collect.go
Commit message: Improve uplink de-duplication.

This removes the de-duplication at the MQTT backend. Some MQTT brokers
provide shared subscription options in which case this additional
de-duplication is not needed.

For MQTT brokers that do not support shared subscriptions, the
collectAndCallOnce function will still filter out duplicated uplinks.

By adding the TXInfo object (hex encoded) to the de-duplication key,
uplink messages received on multiple channels will be handled
separately as they will result in different de-duplication keys.


Vulnerable code:
	"encoding/hex"
	// Since with MQTT all subscribers will receive the uplink messages sent
	// by all the gateways, the first instance receiving the message must lock it,
	// so that other instances can ignore the same message (from the same gw).
	key := fmt.Sprintf("lora:ns:uplink:lock:%s:%d:%d:%d:%s", gatewayID, uplinkFrame.TxInfo.Frequency, uplinkFrame.RxInfo.Board, uplinkFrame.RxInfo.Antenna, hex.EncodeToString(uplinkFrame.PhyPayload))
	if locked, err := b.isLocked(key); err != nil || locked {
		if err != nil {
			log.WithError(err).WithFields(log.Fields{
				"uplink_id": uplinkID,
				"key":       key,
			}).Error("gateway/mqtt: acquire lock error")
		}
		return
	}

	CollectKeyTempl     = "lora:ns:rx:collect:%s"
	CollectLockKeyTempl = "lora:ns:rx:collect:%s:lock"
	key := fmt.Sprintf(CollectKeyTempl, phyKey)
	lockKey := fmt.Sprintf(CollectLockKeyTempl, phyKey)

Fixed code:
	CollectKeyTempl     = "lora:ns:rx:collect:%s:%s"
	CollectLockKeyTempl = "lora:ns:rx:collect:%s:%s:lock"
	txInfoB, err := proto.Marshal(rxPacket.TxInfo)
	if err != nil {
		return errors.Wrap(err, "marshal protobuf error")
	}
	txInfoHEX := hex.EncodeToString(txInfoB)

	key := fmt.Sprintf(CollectKeyTempl, txInfoHEX, phyKey)
	lockKey := fmt.Sprintf(CollectLockKeyTempl, txInfoHEX, phyKey)
CVE-2020-26251 (Unknown, published 2020-12-18T18:15Z)
Description: value: Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.
Severity: MEDIUM (CVSS v3 base score: 4.7)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/open-zaak/open-zaak
Files changed:
Commit message: Merge pull request from GHSA-chhr-gxrg-64x7

Security/cors configuration

Vulnerable code:

Fixed code:
CVE-2014-3994 (Other, published 2014-06-16T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/djblets/djblets
Files changed:
NEWS
Commit message: Update the 0.7.30 release notes with the CVEs.


Vulnerable code:

Fixed code:
		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2014-3994 (Python, published 2014-06-16T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/djblets/djblets
Files changed:
djblets/util/templatetags/djblets_js.py
djblets/util/templatetags/tests.py
Commit message: Fix a XSS vulnerability with bad input to json_dumps.

Django's JSON serialization does not handle escaping of any characters
to make them safe for injecting into HTML. This allows an attacker who
can provide part of a JSON-serializable object to craft a string that
can break out of a <script> tag and create its own, injecting a custom
script.

To fix this, we escape '<', '>', and '&' characters in the resulting
string, preventing a </script> from executing.


Vulnerable code:
    return mark_safe(result)

Fixed code:
from django.utils.encoding import force_text
_safe_js_escapes = {
    ord('&'): '\\u0026',
    ord('<'): '\\u003C',
    ord('>'): '\\u003E',
}

    return mark_safe(force_text(result).translate(_safe_js_escapes))
from __future__ import unicode_literals

from djblets.testing.testcases import TestCase
from djblets.util.templatetags.djblets_js import json_dumps


class JSTagTests(TestCase):
    """Unit tests for djblets_js template tags."""
    def test_json_dumps_xss(self):
        """Testing json_dumps doesn't allow XSS injection"""
        # This is bug 3406.
        obj = {
            'xss': '</script><script>alert(1);</script>'
        }

        self.assertEqual(
            json_dumps(obj),
            '{"xss": "\\u003C/script\\u003E\\u003Cscript\\u003E'
            'alert(1);\\u003C/script\\u003E"}')
CVE-2014-3994 (Other, published 2014-06-16T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/djblets/djblets
Files changed:
NEWS
Commit message: Update the 0.8.3 release notes with the CVEs.


Vulnerable code:

Fixed code:
		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2014-3995 (Other, published 2014-06-16T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/djblets/djblets
Files changed:
NEWS
Commit message: Update the 0.7.30 release notes with the CVEs.


Vulnerable code:

Fixed code:
		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2014-3995 (Python, published 2014-06-16T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/djblets/djblets
Files changed:
djblets/gravatars/templatetags/gravatars.py
djblets/gravatars/templatetags/tests.py
Commit message: Fix a XSS vulnerability in the gravatar template tag.

The generated gravatar HTML wasn't handling escaping of the display name
of the user, allowing an attacker to choose a name that would close out
the <img> tag and inject a <script> tag.

By switching to Django's format_html(), we can guarantee safe escaping
of content.


Vulnerable code:
        return ('<img src="%s" width="%s" height="%s" alt="%s" '
                '     class="gravatar"/>' %
                (url, size, size, user.get_full_name() or user.username))

Fixed code:
from django.utils.html import format_html
        return format_html(
            '<img src="{0}" width="{1}" height="{1}" alt="{2}" '
            'class="gravatar"/>',
            url, size, user.get_full_name() or user.username)
from __future__ import unicode_literals

from django.contrib.auth.models import User
from django.template import Token, TOKEN_TEXT

from djblets.testing.testcases import TagTest
from djblets.gravatars.templatetags.gravatars import gravatar


class DummyRequest(object):
    def is_secure(self):
        return False


class TagTests(TagTest):
    """Unit tests for gravatars template tags."""
    def test_gravatar_xss(self):
        """Testing {% gravatar %} doesn't allow XSS injection"""
        user = User(username='test',
                    first_name='"><script>alert(1);</script><"',
                    email='test@example.com')

        node = gravatar(self.parser, Token(TOKEN_TEXT, 'gravatar user 32'))
        context = {
            'request': DummyRequest(),
            'user': user,
        }

        self.assertEqual(
            node.render(context),
            '<img src="http://www.gravatar.com/avatar/'
            '55502f40dc8b7c769880b10874abc9d0?s=32" width="32" height="32" '
            'alt="&quot;&gt;&lt;script&gt;alert(1);&lt;/script&gt;&lt;&quot;" '
            'class="gravatar"/>')
CVE-2014-3995 (Other, published 2014-06-16T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/djblets/djblets
Files changed:
NEWS
Commit message: Update the 0.8.3 release notes with the CVEs.


Vulnerable code:

Fixed code:
		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2024-29191 (HTML, published 2024-04-04T15:15Z)
Description: value: gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (`links.html`) appends the `src` GET parameter (`[0]`) in all of its links for 1-click previews. The context in which `src` is being appended is `innerHTML` (`[1]`), which will insert the text as HTML. Commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AlexxIT/go2rtc
Files changed:
www/index.html
www/links.html
Commit message: Add sanitize from XSS to WebUI



Vulnerable code:
            for (const [name, value] of Object.entries(data)) {
    const src = new URLSearchParams(location.search).get('src');

Fixed code:
            for (const [key, value] of Object.entries(data)) {
                const name = key.replace(/[<">]/g, ''); // sanitize
    const src = new URLSearchParams(location.search).get('src').replace(/[<">]/g, ''); // sanitize