hitoshura25/cvefixes huggingface dataset:
CVE-2023-28106 (JavaScript, published 2023-03-16T17:15Z)
Description: value: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/Document/DocumentControllerBase.php
bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
Commit message: optimized urlslug input (#14669)



Vulnerable code:
                                                path: el.getValue()

Fixed code:

                if(array_key_exists('prettyUrl' , $settings)){
                    $settings['prettyUrl'] = htmlspecialchars($settings['prettyUrl']);
                }

                                                path: pimcore.helpers.sanitizeUrlSlug(el.getValue())
                                    }.bind(this),
                                    "change": function (el) {
                                        const sanitizedValue = pimcore.helpers.sanitizeUrlSlug(el.getValue());
                                        el.setValue(sanitizedValue);
pimcore.helpers.sanitizeUrlSlug = function (slug) {
    return slug.replace(/[^a-z0-9-_+/]/gi, '');
};
CVE-2023-28108 (PHP, published 2023-03-16T17:15Z)
Description: value: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Tool/UUID/Dao.php
Commit message: [Task] Optimized get by UUID (#14633)

* fix: unify uuid queries

* replaced query with queryBuilder

---------

Co-authored-by: ChristianFeldkirchne <christian.feldkirchner@pimcore.com>

Vulnerable code:
        $data = $this->db->fetchAssociative('SELECT * FROM ' . self::TABLE_NAME ." where uuid='" . $uuid . "'");
        return (bool) $this->db->fetchOne('SELECT uuid FROM ' . self::TABLE_NAME . ' where uuid = ?', [$uuid]);

Fixed code:
use Doctrine\DBAL\Types\Types;
        $queryBuilder = $this->db->createQueryBuilder();
        $queryBuilder
            ->select('*')
            ->from(self::TABLE_NAME)
            ->where('uuid = :uuid')
            ->setParameter('uuid', $uuid, Types::STRING);

        $data = $queryBuilder
            ->execute()
            ->fetchAssociative();

        $queryBuilder = $this->db->createQueryBuilder();
        $queryBuilder
            ->select('uuid')
            ->from(self::TABLE_NAME)
            ->where('uuid = :uuid')
            ->setParameter('uuid', $uuid, Types::STRING);


        $result = $queryBuilder
            ->execute()
            ->fetchOne();

        return (bool) $result;
CVE-2023-28438 (PHP, published 2023-03-22T21:15Z)
Description: value: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
Severity: nan (CVSS v3 base score: 8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Tool/CustomReport/Adapter/Sql.php
Commit message: [Task] Optimized custom reports filter (#14526)

* optimized custom reports filter

* Update models/Tool/CustomReport/Adapter/Sql.php

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

---------

Co-authored-by: Jacob Dreesen <jacob@hdreesen.de>

Vulnerable code:
                $order = ' ORDER BY ' . $db->quoteIdentifier($sort) . ' ' . $dir;
                    $havingParts[] = "$field = " . $db->quote($value);

Fixed code:
                $dir = ((strtoupper($dir) === 'ASC') ? 'ASC' : 'DESC');
                $order = ' ORDER BY ' . $db->quoteIdentifier($sort) . ' ' .$dir;
                    $havingParts[] = ($db->quoteIdentifier($field) ." = " . $db->quote($value));
CVE-2023-2983 (PHP, published 2023-05-30T15:15Z)
Description: value: Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-267 \u2014 Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/UserController.php
Commit message: task: improve non-admin update user

Vulnerable code:
        if ($user instanceof User && $user->isAdmin() && !$this->getAdminUser()->isAdmin()) {
            if ($user instanceof User && !$this->getAdminUser()->isAdmin()) {

Fixed code:
        $currentUserIsAdmin = $this->getAdminUser()->isAdmin();
        if ($user instanceof User && $user->isAdmin() && !$currentUserIsAdmin) {
            if ($user instanceof User && !$currentUserIsAdmin) {
CVE-2023-2984 (PHP, published 2023-05-30T15:15Z)
Description: value: Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
Repository: https://github.com/pimcore/pimcore
Files changed:
lib/Pimcore.php
Commit message: [Security] Improved sanatizing of `pimcore_log` parameter (#15084)

* added some more chars to remove

* Update Pimcore.php

Vulnerable code:
                // slashed are not allowed, replace them with hyphens
                $requestLogName = str_replace('/', '-', $_REQUEST['pimcore_log']);

Fixed code:
                $requestLogName = str_replace(['/', '\\', '..'], '-', $_REQUEST['pimcore_log']);
CVE-2023-30848 (PHP, published 2023-04-27T16:15Z)
Description: value: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Searchadmin/SearchController.php
Commit message: Remove sql comments and add different exception on syntax error (#14972)



Vulnerable code:
        $hits = $searcherList->load();

Fixed code:
use Doctrine\DBAL\Exception\SyntaxErrorException;
            //remove sql comments
            $fields = str_replace('--', '', $fields);
        try {
            $hits = $searcherList->load();
        } catch (SyntaxErrorException $syntaxErrorException) {
            throw new \InvalidArgumentException('Check your arguments.');
        }
CVE-2023-30850 (PHP, published 2023-04-27T17:15Z)
Description: value: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/TranslationController.php
Commit message: fixed sql injection in translation api (#14952)



Vulnerable code:
                    $condition = $field . ' ' . $operator . ' ' . $db->quote($value);

Fixed code:
                    $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
CVE-2023-30852 (PHP, published 2023-04-27T17:15Z)
Description: value: Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/Asset/AssetController.php
bundles/AdminBundle/Resources/public/js/pimcore/asset/tree.js
doc/Development_Documentation/23_Installation_and_Upgrade/09_Upgrade_Notes/README.md
Commit message: [Security] Admin Authenticated Arbitrary File Read (#14974)

* Fix: disable asset importFromServer for users

* Doc: Add Upgrade Notes

Vulnerable code:
                        if (perspectiveCfg.inTreeContextMenu("asset.add.importFromServer")) {

Fixed code:
        if(!Tool\Admin::getCurrentUser()->isAdmin()) {
            throw $this->createAccessDeniedException('Permission denied. You don\'t have the rights to import files from the server!');
        }

                        if (perspectiveCfg.inTreeContextMenu("asset.add.importFromServer") && pimcore.currentuser.admin) {
## 10.5.21
- [Assets] The Asset `Import from Server` feature is now only available for admins. It will be removed in Pimcore 11
CVE-2023-3673 (PHP, published 2023-07-14T13:15Z)
Description: value:  SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Controller/Admin/LogController.php
bundles/AdminBundle/Controller/Admin/TranslationController.php
bundles/AdminBundle/Helper/QueryParams.php
models/Search/Backend/Data/Listing.php
models/Translation/Listing.php
Commit message: [Task]: Improve Admin translation and application logger sorting (#15303)

* task: improve valid key for translation listing

* task: force the direction to be ASC/DESC since these are the only valid options

* task: quote application logger sorting setting

* task: add backend search grid valid order keys

Vulnerable code:
            $qb->orderBy($sortingSettings['orderKey'], $sortingSettings['order']);
                $order = $sortParam['direction'];
                $order = $sortParam['direction'];

Fixed code:
            $qb->orderBy($db->quoteIdentifier($sortingSettings['orderKey']), $sortingSettings['order']);
            $list->setLanguages($validLanguages);
            $order = strtoupper($sortParam['direction']) === 'DESC' ? 'DESC' : 'ASC';


    /**
     * @inheritdoc
     */
    public function isValidOrderKey($key)
    {
        return in_array(
            $key,
            [
                'type',
                'id',
                'key',
                'index',
                'fullpath',
                'maintype',
                'subtype',
                'published',
                'creationDate',
                'modificationDate',
                'userOwner',
                'userModification',
                'data',
                'properties'
            ]
        );
    }
    /**
     * @inheritdoc
     */
    public function isValidOrderKey($key)
    {
        return in_array($key, ['key', 'type']) || in_array($key, $this->getLanguages());
    }
CVE-2023-3820 (PHP, published 2023-07-21T15:15Z)
Description: value:  SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Helper/GridHelperService.php
Commit message: [Bug]: Quote sorting key (#15523)

* quote sorting key

* add quoting to order key with `?` case too

* refactor, no need to get Db

* break line to fix codesmell

* improve spacing

* remove trailing space

Vulnerable code:
                        $db = Db::get();
                        $orderKey = $db->quoteIdentifier($brickDescriptor['containerKey'] . '_localized') . '.' . $db->quoteIdentifier($brickDescriptor['brickfield']);
                        $orderKey = $orderKeyParts[0].'.'.$orderKeyParts[1];
                    $orderKey = $list->getDao()->getTableName().'.'.$orderKey;

Fixed code:
                        $orderKey = $list->quoteIdentifier($brickDescriptor['containerKey'] . '_localized')
                            . '.' . $list->quoteIdentifier($brickDescriptor['brickfield']);
                        $orderKey = $list->quoteIdentifier($orderKeyParts[0])
                            . '.' . $list->quoteIdentifier($orderKeyParts[1]);
                    $orderKey = $list->getDao()->getTableName() . '.' . $list->quoteIdentifier($orderKey);
CVE-2024-29197 (PHP, published 2024-03-26T15:15Z)
Description: value: Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. Previews are broad open to any user and with just the hint of a restricted link one could gain access to possible confident / unreleased information. This vulnerability is fixed in 11.2.2 and 11.1.6.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/CoreBundle/src/EventListener/Frontend/ElementListener.php
Commit message: Merge pull request from GHSA-5737-rqv4-v445

* Do not allow access to preview for non-user.

* Add logger.

Vulnerable code:

Fixed code:
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
            if ($document && !$document->isPublished() && !$user) {
                $this->logger->warning(
                    "Denying access to document {$document->getFullPath()} as it is unpublished and there is no user in the session."
                );

                throw new AccessDeniedHttpException(sprintf('Access denied for %s', $document->getFullPath()));
            }
CVE-2024-32871 (PHP, published 2024-06-04T15:15Z)
Description: value: Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/pimcore/pimcore
Files changed:
models/Asset/Document/ImageThumbnail.php
models/Asset/Image/Thumbnail.php
models/Asset/Thumbnail/ImageThumbnailTrait.php
models/Asset/Video/ImageThumbnail.php
Commit message: Fix thumbnail generation if asset or config is null


Vulnerable code:
        if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
            throw new ThumbnailFormatNotSupportedException();
        }

        if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
            throw new ThumbnailFormatNotSupportedException();
        }

        if (!$this->checkMaxScalingFactor($this->config->getHighResolution())) {
            throw new ThumbnailMaxScalingFactorException();
        }
            $original = pathinfo($asset->getRealFullPath(), PATHINFO_EXTENSION);
     * @throws Exception
        if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
            throw new ThumbnailFormatNotSupportedException();
        }


Fixed code:

            if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
                throw new ThumbnailFormatNotSupportedException();
            }

        $this->validate();

    /**
     * @throws ThumbnailFormatNotSupportedException
     * @throws ThumbnailMaxScalingFactorException
     */
    private function validate(): void
    {
        if(!$this->asset || !$this->config) {
            return;
        }
        if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
            throw new ThumbnailFormatNotSupportedException();
        }

        if (!$this->checkMaxScalingFactor($this->config->getHighResolution())) {
            throw new ThumbnailMaxScalingFactorException();
        }
    }
            $original = strtolower(pathinfo($asset->getRealFullPath(), PATHINFO_EXTENSION));
     * @throws Exception|\League\Flysystem\FilesystemException|ThumbnailFormatNotSupportedException

            if (!$this->checkAllowedFormats($this->config->getFormat(), $this->asset)) {
                throw new ThumbnailFormatNotSupportedException();
            }
CVE-2022-4859 (Java, published 2022-12-30T12:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jogetworkflow/jw-community
Files changed:
wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java
Commit message: Fixed: wflow-core - User Profile Menu - Prevent XSS. T1604 @7.0-SNAPSHOT

Vulnerable code:
        if ("".equals(getPropertyString("f_firstName"))) {
            currentUser.setFirstName(getRequestParameterString("firstName"));
            currentUser.setLastName(getRequestParameterString("lastName"));

Fixed code:
import org.joget.commons.util.SecurityUtil;
        if ("".equals(getPropertyString("f_firstName")) && !StringUtil.stripAllHtmlTag(getRequestParameterString("firstName")).isEmpty()) {
            currentUser.setFirstName(StringUtil.stripAllHtmlTag(getRequestParameterString("firstName")));
            currentUser.setLastName(StringUtil.stripAllHtmlTag(getRequestParameterString("lastName")));