hitoshura25/cvefixes huggingface dataset:
CVE-2015-8807 (PHP, published 2016-04-13T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/horde
Files changed:
framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
Commit message: Escape form value.

Even though this is a numeric field, this isn't enforced until
the form is submitted.


Vulnerable code:
                       $value,

Fixed code:
                       htmlspecialchars($value),
CVE-2016-5303 (XML, published 2016-12-20T22:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/horde
Files changed:
framework/Text_Filter/package.xml
Commit message: [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu <fantasy7082@hotmail.com>).


Vulnerable code:
* 
* 

Fixed code:
* [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu &lt;fantasy7082@hotmail.com&gt;).
* [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu &lt;fantasy7082@hotmail.com&gt;).
CVE-2016-5303 (PHP, published 2016-12-20T22:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/horde/horde
Files changed:
framework/Text_Filter/lib/Horde/Text/Filter/Xss.php
framework/Text_Filter/test/Horde/Text/Filter/XssTest.php
Commit message: Fix XSS with data:html links and form actions.

The academically correct way to filter out xlink hrefs should have been to use hasAttributeNS/getAttributeNS with the XLink namespace. But from my testing browsers don't care about that namespace at all, and only use the xlink: prefix. This means that even if you correctly specify a different prefix for the XLink NS, the links won't be detected by the browser. xlink: prefixes OTOH even work without specifying the XLink namespace in the XML document.

Reported By: Liuzhu <fantasy7082@hotmail.com>


Vulnerable code:
                /* Strip out data URLs living in an A HREF element
                if ($node->hasAttribute('href') &&
                    preg_match("/\s*data:/i", $node->getAttribute('href'))) {
                    $remove[] = 'href';
            array($framedata, '')

Fixed code:
            case 'form':
                /* Strip out data URLs living in link-like elements
                if (Horde_String::lower($node->tagName) == 'form') {
                    $attributes = array('action');
                } else {
                    $attributes = array('href', 'xlink:href');
                }
                foreach ($attributes as $attribute) {
                    if ($node->hasAttribute($attribute) &&
                        preg_match("/\s*data:/i", $node->getAttribute($attribute))) {
                        $remove[] = $attribute;
                    }
            array($framedata, ''),
            array('<svg><a xlink:href="data:text/html,<script>alert(/XSS/)</script>"><rect width="1000" height="1000" fill="white"/></a></svg>', '<svg><a><rect width="1000" height="1000" fill="white"/></a></svg>'),
            array('<math><a xlink:href="data:text/html,<script>alert(/XSS/)</script>">click</a></math>', '<math><a>click</a></math>'),
            array('<form action="data:text/html,<script>alert(/XSS/)</script>"><button></form>', '<form><button/></form>'),
CVE-2017-14650 (PHP, published 2017-09-21T17:29Z)
Description: value: A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/horde/horde
Files changed:
framework/Image/lib/Horde/Image/Im.php
Commit message: Fix RCE in _raw() via $index parameter.

$index is passed down from getImageAtIndex($index).
Luckily the only official horde code calling it
is the PDF preview code with a fixed index of 0.

Still code from third party vendors using the Horde framework libs
might expose getImageAtIndex() to the web.

PoC:

----------------
<?php
$options = array('index' => "5'$(ls -al )'");
$max_pages = 10;

// php fun: implicit conversion to integer
if ($options['index'] < $max_pages)
{
    // _raw() call in Im.php might look like
    //        /usr/bin/convert  "/tmp/img1URPsC"'[0]'  -strip png:"/tmp/img0NgHfI"
    echo exec('echo \'[' . $options['index'] . ']\' ');
}
?>
----------------
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Jan Schneider <jan@horde.org>


Vulnerable code:
            . ' "' . $tmpin . '"\'[' . $options['index'] . ']\' '

Fixed code:
            . ' "' . $tmpin . '"\'[' . (integer)$options['index'] . ']\' '
CVE-2022-35936 (Go, published 2022-08-05T13:15Z)
Description: value: Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the `DeleteAccount`function, all contracts that used the identical bytecode (i.e shared the same `CodeHash`) will also stop working once one contract invokes `selfdestruct`, even though the other contracts did not invoke the `selfdestruct` OPCODE. This vulnerability has been patched in Ethermint version v0.18.0. The patch has state machine-breaking changes for applications using Ethermint, so a coordinated upgrade procedure is required. A workaround is available. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e. with identical bytecode, so that the original contract's code is recovered. The new contract deployment restores the `bytecode hash -> bytecode` entry in the internal state.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/evmos/ethermint
Files changed:
x/evm/keeper/statedb.go
x/evm/keeper/statedb_test.go
Commit message: Merge pull request from GHSA-f92v-grc2-w2fg

* remove delete code in DeleteAccount

* update unit test

* refactor test

Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com>

Vulnerable code:
	"bytes"
	ethAcct, ok := acct.(ethermint.EthAccountI)
	// remove code
	codeHashBz := ethAcct.GetCodeHash().Bytes()
	if !bytes.Equal(codeHashBz, types.EmptyCodeHash) {
		k.SetCode(ctx, codeHashBz, nil)
	}


Fixed code:
	_, ok := acct.(ethermint.EthAccountI)
	"github.com/evmos/ethermint/crypto/ethsecp256k1"
	// Generate 2nd address
	privkey, _ := ethsecp256k1.GenerateKey()
	key, err := privkey.ToECDSA()
	suite.Require().NoError(err)
	addr2 := crypto.PubkeyToAddress(key.PublicKey)

	// Add code and state to account 2
	db.SetCode(addr2, code)
	suite.Require().Equal(code, db.GetCode(addr2))
	for i := 0; i < 5; i++ {
		db.SetState(addr2, common.BytesToHash([]byte(fmt.Sprintf("key%d", i))), common.BytesToHash([]byte(fmt.Sprintf("value%d", i))))
	}

	// Commit state

	// Check code is still present in addr2 and suicided is false
	suite.Require().NotNil(db.GetCode(addr2))
	suite.Require().Equal(false, db.HasSuicided(addr2))
CVE-2014-125040 (PHP, published 2023-01-05T14:15Z)
Description: value: A vulnerability was found in stevejagodzinski DevNewsAggregator. It has been rated as critical. Affected by this issue is the function getByName of the file php/data_access/RemoteHtmlContentDataAccess.php. The manipulation of the argument name leads to sql injection. The name of the patch is b9de907e7a8c9ca9d75295da675e58c5bf06b172. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217484.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/stevejagodzinski/DevNewsAggregator
Files changed:
php/data_access/RemoteHtmlContentDataAccess.php
Commit message: Fix SQL injection vulnerability


Vulnerable code:
        return self::getForQueryString("SELECT * FROM \"DevNewsAggregatorConfiguration_htmlcontent\" WHERE name = $name");

Fixed code:
        return self::getForQueryString("SELECT * FROM \"DevNewsAggregatorConfiguration_htmlcontent\" WHERE name = $1", array($name));
CVE-2021-32698 (PHP, published 2021-06-21T22:15Z)
Description: value: eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/elabftw/elabftw
Files changed:
src/services/MakePdf.php
Commit message: security: prevent blind ssrf in pdf generation

Issue: one could set the src attribute of an img tag to anything they
want and the pdf generation will happily GET it. This means that one can
do arbitrary HTTP GET requests from the server itself. This doesn't work
in the browser context because of the restrictive CSP policy, which is
not applied during the pdf generation.

This is a MINOR vulnerability as other security measures in the PHP
configuration prevents prospective escalation.

The vulnerability was reported by @mgrRaf and @xoffense. Thank to them
for responsible disclosure. A bounty has been awarded.


Vulnerable code:
        return $this->getTwig(Config::getConfig())->render('pdf.html', $renderArr);
        // apsolute path to tex2svg app

Fixed code:
        $html = $this->getTwig(Config::getConfig())->render('pdf.html', $renderArr);

        // now remove any img src pointing to outside world
        // prevent blind ssrf (thwarted by CSP on webpage, but not in pdf)
        return preg_replace('/img src=("|\')(ht|f|)tp/i', 'nope', $html);
        // absolute path to tex2svg app
CVE-2023-42813 (Go, published 2023-11-13T21:15Z)
Description: value: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kyverno/kyverno
Files changed:
pkg/notary/notary.go
pkg/notary/repository.go
Commit message: fix: address vulnerability issues in notary implementations (#8428)

* fix: set max limit on referrers count

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add limit to max size of payload

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max count limit on listsignatures

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max signature size limit in FetchSignatureBlob

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

---------

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>

Vulnerable code:

Fixed code:
var (
	maxReferrersCount = 50
	maxPayloadSize    = 10 * 1000 * 1000 // 10 MB
)

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return nil, fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v
	if predicateDesc.Size > int64(maxPayloadSize) {
		return nil, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, predicateDesc)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r
	if manifestDesc.Size > int64(maxPayloadSize) {
		return nil, ocispec.Descriptor{}, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, manifestDesc)
	}
CVE-2023-42814 (Go, published 2023-11-13T21:15Z)
Description: value: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kyverno/kyverno
Files changed:
pkg/notary/notary.go
pkg/notary/repository.go
Commit message: fix: address vulnerability issues in notary implementations (#8428)

* fix: set max limit on referrers count

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add limit to max size of payload

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max count limit on listsignatures

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max signature size limit in FetchSignatureBlob

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

---------

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>

Vulnerable code:

Fixed code:
var (
	maxReferrersCount = 50
	maxPayloadSize    = 10 * 1000 * 1000 // 10 MB
)

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return nil, fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v
	if predicateDesc.Size > int64(maxPayloadSize) {
		return nil, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, predicateDesc)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r
	if manifestDesc.Size > int64(maxPayloadSize) {
		return nil, ocispec.Descriptor{}, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, manifestDesc)
	}
CVE-2023-42815 (Go, published 2023-11-13T21:15Z)
Description: value: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kyverno/kyverno
Files changed:
pkg/notary/notary.go
pkg/notary/repository.go
Commit message: fix: address vulnerability issues in notary implementations (#8428)

* fix: set max limit on referrers count

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add limit to max size of payload

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max count limit on listsignatures

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max signature size limit in FetchSignatureBlob

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

---------

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>

Vulnerable code:

Fixed code:
var (
	maxReferrersCount = 50
	maxPayloadSize    = 10 * 1000 * 1000 // 10 MB
)

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return nil, fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v
	if predicateDesc.Size > int64(maxPayloadSize) {
		return nil, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, predicateDesc)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r
	if manifestDesc.Size > int64(maxPayloadSize) {
		return nil, ocispec.Descriptor{}, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, manifestDesc)
	}