hitoshura25/cvefixes huggingface dataset:
CVE-2022-25319 (PHP, published 2022-02-18T06:15Z)
Description: value: An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Controller/Open/IndividualsController.php
src/Controller/Open/OrganisationsController.php
Commit message: fix: [security] open endpoints should only be open when enabled

- as reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
        $this->Authentication->allowUnauthenticated(['index']);
        $this->Authentication->allowUnauthenticated(['index']);

Fixed code:
use Cake\Core\Configure;
        $open = Configure::read('Cerebrate.open');
        if (!empty($open) && in_array('individuals', $open)) {
            $this->Authentication->allowUnauthenticated(['index']);
        }
use Cake\Core\Configure;
        $open = Configure::read('Cerebrate.open');
        if (!empty($open) && in_array('organisations', $open)) {
            $this->Authentication->allowUnauthenticated(['index']);
        }
CVE-2022-25320 (PHP, published 2022-02-18T06:15Z)
Description: value: An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Controller/UserSettingsController.php
Commit message: fix: [security] user settings allow enumeration of usernames

- as reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
            $settingsForUser = $this->UserSettings->Users->find()->where([
            ])->first();
     * isLoggedUserAllowedToEdit 

Fixed code:
            $conditions = [
            ];
            if (empty($currentUser['role']['perm_admin'])) {
                $conditions['organisation_id'] = $currentUser['organisation_id'];
            }
            $settingsForUser = $this->UserSettings->Users->find()->where($conditions)->first();
            if (empty($settingsForUser)) {
                throw new NotFoundException(__('Invalid {0}.', __('user')));
            }
     * isLoggedUserAllowedToEdit
CVE-2022-25321 (PHP, published 2022-02-18T06:15Z)
Description: value: An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
templates/element/Settings/field.php
Commit message: fix: [settings:settingField] Enforce sanitization of input fields

- As reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
                    'id' => $settingId,
                    'data-setting-name' => $settingName,
                    'value' => isset($setting['value']) ? $setting['value'] : "",
                    'placeholder' => $setting['default'] ?? '',
                    'aria-describedby' => "{$settingId}Help"
                'id' => $settingId,
                    'data-setting-name' => $settingName
                'id' => $settingId,
                'data-setting-name' => $settingName,
                'aria-describedby' => "{$settingId}Help"
            $setting['value'] = $setting['value'] ?? '';
                    'value' => $key,
                'id' => $settingId,
                'data-setting-name' => $settingName,
                'placeholder' => $setting['default'] ?? '',
                'aria-describedby' => "{$settingId}Help"

Fixed code:
                    'id' => h($settingId),
                    'data-setting-name' => h($settingName),
                    'value' => isset($setting['value']) ? h($setting['value']) : "",
                    'placeholder' => empty($setting['default']) ? '' : h($setting['default']),
                    'aria-describedby' => h("{$settingId}Help")
                'id' => h($settingId),
                    'data-setting-name' => h($settingName)
                'id' => h($settingId),
                'data-setting-name' => h($settingName),
                'aria-describedby' => h("{$settingId}Help")
            $setting['value'] = empty($setting['value']) ? '' : h($setting['value']);
                    'value' => h($key),
                'id' => h($settingId),
                'data-setting-name' => h($settingName),
                'placeholder' => empty($setting['default']) ? '' : h($setting['default']),
                'aria-describedby' => h("{$settingId}Help")
CVE-2022-25321 (PHP, published 2022-02-18T06:15Z)
Description: value: An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Model/Table/UserSettingsTable.php
templates/Instance/home.php
templates/element/layouts/sidebar/bookmark-entry.php
Commit message: fix: [userSettings] Perform URI validation for bookmarks

- As reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
    <?php if (!empty($bookmarks)): ?>
                    <a href="<?= h($bookmark['url']) ?>" class="w-bold">
                        <?= h($bookmark['label']) ?>
                    </a>
    <?php else: ?>
        'class' => ['mb-1'],
            'href' => h($url),

Fixed code:

    /**
     * validURI - Ensure the provided URI can be safely put as a link
     *
     * @param String $uri
     * @return bool if the URI is safe to be put as a link
     */
    public function validURI(String $uri): bool
    {
        $parsed = parse_url($uri);
        $isLocalPath = empty($parsed['scheme']) && empty($parsed['domain']) && !empty($parsed['path']);
        $isValidURL = !empty($parsed['scheme']) && in_array($parsed['scheme'], ['http', 'https']) && filter_var($uri, FILTER_SANITIZE_URL);
        return $isLocalPath || $isValidURL;
    }

use Cake\ORM\TableRegistry;

$this->userSettingsTable = TableRegistry::getTableLocator()->get('UserSettings');
    <?php if (!empty($bookmarks)) : ?>
                    <?php if ($this->userSettingsTable->validURI($bookmark['url'])): ?>
                        <a href="<?= h($bookmark['url']) ?>" class="w-bold">
                            <?= h($bookmark['label']) ?>
                        </a>
                    <?php else: ?>
                        <span class="w-bold">
                            <?= h($bookmark['url']) ?>
                        </span>
                    <?php endif; ?>
    <?php else : ?>
    use Cake\ORM\TableRegistry;

    $this->userSettingsTable = TableRegistry::getTableLocator()->get('UserSettings');
    $validURI = $this->userSettingsTable->validURI($url);

        'class' => ['mb-1', !$validURI ? 'disabled' : ''],
            'href' => $validURI ? h($url) : '#',
CVE-2023-26468 (PHP, published 2023-02-24T00:15Z)
Description: value: Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Controller/AuthKeysController.php
Commit message: security: [authkey:add] Restrict creation of API keys for users in the same org and for other org_admins



Vulnerable code:
                $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0])->all()->extract('id')->toList();
                $userConditions['role_id IN'] = $role_ids;

Fixed code:
                $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0, 'perm_org_admin' => 0])->all()->extract('id')->toList();
                $userConditions['organisation_id'] = $currentUser['organisation_id'];
                $userConditions['OR'] = [
                    ['role_id IN' => $role_ids],
                    ['id' => $currentUser['id']],
                ];
CVE-2023-28883 (PHP, published 2023-03-27T03:15Z)
Description: value: In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Controller/InstanceController.php
src/Model/Table/InstanceTable.php
Commit message: fix: [security] blind SQL injection in searchAll

- As reported by Zigrin Security


Vulnerable code:
    public function searchAll($value, $user, $limit=5, $model=null)

Fixed code:
        $limit = is_numeric($limit) ? $limit : 5;
    public function searchAll($value, $user, int $limit=5, $model=null)
CVE-2023-41363 (PHP, published 2023-08-29T05:15Z)
Description: value: In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Controller/UserSettingsController.php
Commit message: fix: [security] user settings editable by arbitrary user fixed

- as reported by Infigo on behalf of ENISA


Vulnerable code:
        if (!$this->isLoggedUserAllowedToEdit($entity)) {
            throw new NotFoundException(__('Invalid {0}.', 'user setting'));
            'redirect' => ['action' => 'index', $entity->user_id]
            'user' => $this->UserSettings->Users->find('list', [
                'sort' => ['username' => 'asc']
            ]),
            $isAllowed = $setting->user_id == $currentUser->id;

Fixed code:
        $currentUser = $this->ACL->getUser();
        $validUsers = [];
        $individual_ids = [];
        if (!$currentUser['role']['perm_admin']) {
            if ($currentUser['role']['perm_org_admin']) {
                $validUsers = $this->Users->find('list')->select(['id', 'username'])->order(['username' => 'asc'])->where(['organisation_id' => $currentUser['organisation']['id']])->all()->toArray();
            } else {
                $validUsers = [$currentUser['id'] => $currentUser['username']];
            }
        } else {
            $validUsers = $this->Users->find('list')->select(['id', 'username'])->order(['username' => 'asc'])->all()->toArray();
            'redirect' => ['action' => 'index', $entity->user_id],
            'beforeSave' => function ($data) use ($validUsers) {
                if (!in_array($data['user_id'], array_keys($validUsers))) {
                    throw new MethodNotAllowedException(__('You cannot edit the given user.'));
                }
                return $data;
            }
            'user' => $validUsers,
            } else {
                $isAllowed = $setting->user_id == $currentUser->id;
CVE-2023-41908 (PHP, published 2023-09-05T07:15Z)
Description: value: Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
config/bootstrap.php
config/routes.php
Commit message: chg: [config] Force usage of secure cookie for session and csrf protection


Vulnerable code:

Fixed code:
Configure::write('Session', [
    'defaults' => 'php',
    'ini' => [
        'session.cookie_httponly' => true,
        'session.cookie_secure' => true,
    ]
]);

        'secure' => true,
CVE-2015-5356 (PHP, published 2015-07-01T16:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/GetSimpleCMS/GetSimpleCMS
Files changed:
admin/filebrowser.php
Commit message: fix #1059


Vulnerable code:
$func = (isset($_GET['func'])) ? $_GET['func'] : "";
			$func = @$_GET['func'];

Fixed code:
$func = (isset($_GET['func'])) ? var_out($_GET['func']) : "";
CVE-2023-3085 (Other, published 2023-06-03T11:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the function run_action of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument request_path leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 22.10_b202303121313 is able to address this issue. The patch is named 24d7da2416b9ab246825c33c213fe939a89b369c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230663.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/x-wrt/luci
Files changed:
modules/luci-base/ucode/dispatcher.uc
modules/luci-base/ucode/template/header.ut
Commit message: luci-base: dispatcher.uc: prevent XSS through 404 error template

Make sure to escape the user controlled URL passed as part of the error
message into the error404 template in order to avoid XSS.

Reported-by: 40826d <40826d@posteo.de>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>


Vulnerable code:
			error404(`No page is registered at '/${join("/", resolved.ctx.request_path)}'.\n` +
	L = new LuCI({{ {
	} }});

Fixed code:
			error404(`No page is registered at '/${entityencode(join("/", resolved.ctx.request_path))}'.\n` +
	L = new LuCI({{ replace(`${ {
	} }`, '/', '\\/') }});
CVE-2022-40673 (C++, published 2022-09-14T11:15Z)
Description: value: KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/JonMagon/KDiskMark
Files changed:
src/helper.cpp
Commit message: Add missing authorization checking in Helper::flushPageCache()



Vulnerable code:

Fixed code:
    if (!isCallerAuthorized()) {
        return {};
    }
CVE-2022-4105 (Python, published 2022-11-21T20:15Z)
Description: value: A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kiwitcms/kiwi
Files changed:
tcms/core/history.py
Commit message: Clean HTML input when generating history diff

helps us prevent XSS attacks


Vulnerable code:

Fixed code:
from tcms.core.templatetags.extra_filters import bleach_input


        # clean stored XSS
        if isinstance(old_value, str):
            old_value = bleach_input(old_value)
        if isinstance(new_value, str):
            new_value = bleach_input(new_value)
CVE-2020-36564 (Unknown, published 2022-12-27T22:15Z)
Description: value: Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/justinas/nosurf
Files changed:
Commit message: Merge pull request #60 from aeneasr/fix-verify

Resolve critical vulnerability allowing arbitrary tokens to pass as matching

Vulnerable code:

Fixed code:
CVE-2021-29482 (Go, published 2021-04-28T19:15Z)
Description: value: xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/ulikunitz/xz
Files changed:
bits.go
bits_test.go
Commit message: xz: fix a security issue for readUvarint

readUvarint could be provided a sequence of bytes where the application
would never stop. That is the same issue that has been recently
reported for the Go Standard Library as CVE-2020-16845.

The fix simply adds a check for the number of bytes read and reports an
overflow after more than 10 bytes are read, which is
$\ceil{\frac{64}{7}}$.

The commit also includes a test to ensure that the error is returned.

I thank Github user 0xdecaf for reporting the issue.


Vulnerable code:
			if i > 10 || i == 10 && b > 1 {

Fixed code:
	const maxUvarintLen = 10

		if i > maxUvarintLen {
			return x, i, errOverflowU64
		}
			if i == maxUvarintLen && b > 1 {

func TestUvarIntCVE_2020_16845(t *testing.T) {
	var a = []byte{0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
		0x88, 0x89, 0x8a, 0x8b}

	r := bytes.NewReader(a)
	_, _, err := readUvarint(r)
	if err != errOverflowU64 {
		t.Fatalf("readUvarint overflow not detected")
	}
}
CVE-2022-2652 (C, published 2022-08-04T10:15Z)
Description: value: Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
Severity: nan (CVSS v3 base score: 6)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/umlaeute/v4l2loopback
Files changed:
v4l2loopback.c
Commit message: add explicit format specifier to printf() invocations

CWE-134


Vulnerable code:
	snprintf(cap->card, labellen, dev->card_label);
	snprintf(dev->vdev->name, sizeof(dev->vdev->name), dev->card_label);

Fixed code:
	snprintf(cap->card, labellen, "%s", dev->card_label);
	snprintf(dev->vdev->name, sizeof(dev->vdev->name), "%s", dev->card_label);
CVE-2022-24953 (PHP, published 2022-02-17T05:15Z)
Description: value: The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/pear/Crypt_GPG
Files changed:
package.php
package.xml
Commit message: Prepare 1.6.7 release


Vulnerable code:
$apiVersion     = '1.6.6';
$releaseVersion = '1.6.6';
$releaseNotes   = "Fix possible infinite loop.\n"
    . "Use configured debug handler also in CLI.\n"
    . "Support generating keys without a user name.";
 <date>2021-09-05</date>
 <time>10:27:54</time>
  <release>1.6.6</release>
  <api>1.6.6</api>
Fix possible infinite loop.
Use configured debug handler also in CLI.
Support generating keys without a user name.
    <release>1.6.6</release>
    <api>1.6.6</api>
   <date>2021-09-05</date>
Fix possible infinite loop.
Use configured debug handler also in CLI.
Support generating keys without a user name.

Fixed code:
$apiVersion     = '1.6.7';
$releaseVersion = '1.6.7';
$releaseNotes   = "[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].\n"
    . "Ignore tests/debug.log and .gitattributes itself.";
 <date>2022-02-16</date>
 <time>18:38:44</time>
  <release>1.6.7</release>
  <api>1.6.7</api>
[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
Ignore tests/debug.log and .gitattributes itself.
    <release>1.6.7</release>
    <api>1.6.7</api>
   <date>2022-02-16</date>
[CVE-2022-24953] Insert the end-of-options marker before operation arguments [thomas-chauchefoin-sonarsource].
Ignore tests/debug.log and .gitattributes itself.