hitoshura25/cvefixes huggingface dataset:
CVE-2014-6394 (JavaScript, published 2014-10-08T17:55Z)
Description: value: visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/visionmedia/send
Files changed:
History.md
lib/send.js
test/fixtures/name.d/name.txt
test/send.js
Commit message: Fix a path traversal issue when using root

fixes #59
fixes #60


Vulnerable code:
    root = normalize(root)
    parts = path.substr(root.length + 1).split(sep)

Fixed code:
unreleased
==========

  * Fix a path traversal issue when using `root`

    root = normalize(root + sep)
    parts = path.substr(root.length).split(sep)
loki
      it('should with with trailing slash', function(done){
        var app = http.createServer(function(req, res){
          send(req, req.url, {root: __dirname + '/fixtures/'})
          .pipe(res);
        });

        request(app)
        .get('/name.txt')
        .expect(200, 'tobi', done)
      })


      it('should not allow root transversal', function(done){
        var app = http.createServer(function(req, res){
          send(req, req.url, {root: __dirname + '/fixtures/name.d'})
          .pipe(res);
        });

        request(app)
        .get('/../name.dir/name.txt')
        .expect(403, done)
      })
CVE-2021-32812 (JavaScript, published 2021-08-02T23:15Z)
Description: value: Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/TekMonksGitHub/monkshu
Files changed:
frontend/server/server.js
Commit message: Fix for GHSA-hcpx-66hq-7g4x. Cross-site reflection


Vulnerable code:
				.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))

Fixed code:
				.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
CVE-2021-32812 (JavaScript, published 2021-08-02T23:15Z)
Description: value: Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TekMonksGitHub/monkshu
Files changed:
frontend/server/server.js
Commit message: Fix for GHSA-hcpx-66hq-7g4x. Cross-site reflection


Vulnerable code:
				.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: ${req.url}, Server error: ${err}`))

Fixed code:
				.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
					.on("error", err => _sendError(req, res, 500, `500: Error: ${err}`))
CVE-2017-12064 (PHP, published 2017-08-01T05:29Z)
Description: value: The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/openemr/openemr
Files changed:
library/edihistory/edih_csv_inc.php
library/sanitize.inc.php
Commit message: security fix


Vulnerable code:
*
* Copyright (C) 2012 by following Brady Miller <brady.g.miller@gmail.com>
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 3
* of the License, or (at your option) any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
*
* @package OpenEMR
* @author Brady Miller <brady.g.miller@gmail.com>
* @author Roberto Vasquez <robertogagliotta@gmail.com>
* @author Shachar Zilbershlag <shaharzi@matrix.co.il>
* @link http://www.open-emr.org
*/
  if (empty($label) || preg_match('/[^A-Za-z0-9_.-]/', $label))

Fixed code:
	check_file_dir_name($logname);
 *
 * @package OpenEMR
 * @link    http://www.open-emr.org
 * @author  Brady Miller <brady.g.miller@gmail.com>
 * @author  Roberto Vasquez <robertogagliotta@gmail.com>
 * @author  Shachar Zilbershlag <shaharzi@matrix.co.il>
 * @copyright Copyright (c) 2012-2017 Brady Miller <brady.g.miller@gmail.com>
 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
 */


  if (empty($label) || preg_match('/[^A-Za-z0-9_.-]/', $label)) {
    error_log("ERROR: The following variable contains invalid characters:" . $label);
  }
CVE-2018-17179 (PHP, published 2019-05-17T16:29Z)
Description: value: An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/openemr/openemr
Files changed:
interface/forms/eye_mag/php/taskman_functions.php
Commit message: bug fixes (#1790)



Vulnerable code:
                            xlt('Filename').": ".$filename;
            $send['DOC_link'] = "<a href='".$webroot."/openemr/controller.php?document&view&patient_id=".$task['PATIENT_ID']."&doc_id=".$task['DOC_ID']."'
				(NOW(), '$from_id', '$to_id','$patient_id','$doc_type','$doc_id','$enc')";
        sqlQuery($sql);
        $send['DOC_link'] = "<a href='".$webroot."/openemr/controller.php?document&view&patient_id=".$task['PATIENT_ID']."&doc_id=".$task['DOC_ID']."'
    
                        <td class='col2'><?php echo xlt('Report of visit'); ?>: <?php echo text($pt_name); ?> on <?php echo $visit_date; ?>

Fixed code:
                            xlt('Filename').": ". text($filename);
            $send['DOC_link'] = "<a href='".$webroot."/openemr/controller.php?document&view&patient_id=".attr($task['PATIENT_ID'])."&doc_id=".attr($task['DOC_ID'])."'
				(NOW(), ?, ?, ?, ?, ?, ?)";
        sqlQuery($sql, array($from_id, $to_id, $patient_id, $doc_type, $doc_id, $enc));
        $send['DOC_link'] = "<a href='".$webroot."/openemr/controller.php?document&view&patient_id=".attr($task['PATIENT_ID'])."&doc_id=".attr($task['DOC_ID'])."'

                        <td class='col2'><?php echo xlt('Report of visit'); ?>: <?php echo text($pt_name); ?> on <?php echo text($visit_date); ?>
CVE-2018-17180 (PHP, published 2019-05-17T16:29Z)
Description: value: An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/openemr/openemr
Files changed:
portal/index.php
portal/lib/appsql.class.php
portal/lib/download_template.php
Commit message: portal fixes (#1795)




Vulnerable code:
    $_SESSION['patient_portal_onsite_two'] = true;
                $logsql .= "where id=".$rec ." And patient_id=".$audit['patient_id'];
    
        
            $evlist = fetchEvents($DOS, $DOS, " AND pc_pid = '$patientid' ");
    

Fixed code:
    $_SESSION['register'] = true;
                $logsql .= "where id='" . add_escape_custom($rec) . "' And patient_id='" . add_escape_custom($audit['patient_id']) . "'";


            $evlist = fetchEvents($DOS, $DOS, " AND pc_pid = ? ", null, false, 0, array($patientid));


check_file_dir_name($form_filename);
    check_file_dir_name($pid);
CVE-2018-17181 (PHP, published 2019-05-17T16:29Z)
Description: value: An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/openemr/openemr
Files changed:
portal/index.php
portal/lib/appsql.class.php
portal/lib/download_template.php
Commit message: portal fixes (#1795)




Vulnerable code:
    $_SESSION['patient_portal_onsite_two'] = true;
                $logsql .= "where id=".$rec ." And patient_id=".$audit['patient_id'];
    
        
            $evlist = fetchEvents($DOS, $DOS, " AND pc_pid = '$patientid' ");
    

Fixed code:
    $_SESSION['register'] = true;
                $logsql .= "where id='" . add_escape_custom($rec) . "' And patient_id='" . add_escape_custom($audit['patient_id']) . "'";


            $evlist = fetchEvents($DOS, $DOS, " AND pc_pid = ? ", null, false, 0, array($patientid));


check_file_dir_name($form_filename);
    check_file_dir_name($pid);
CVE-2018-9250 (PHP, published 2018-05-18T14:29Z)
Description: value: interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/openemr/openemr
Files changed:
interface/super/edit_list.php
Commit message: security fix (#1578)



Vulnerable code:
 * Copyright (C) 2007-2017 Rod Roark <rod@sunsetsystems.com>
 * Copyright (C) 2017      Brady Miller <brady.g.miller@gmail.com>
 *
 * LICENSE: This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
 *
 * @package OpenEMR
 * @author  Rod Roark <rod@sunsetsystems.com>
 * @author  Brady Miller <brady.g.miller@gmail.com>
 * @author  Teny <teny@zhservices.com>
 * @link    http://www.open-emr.org
        ") VALUES ( " .
        "'lists'," . // the master list-of-lists
        "'" . $newlistID . "'," .
        "'" . $_POST['newlistname'] . "', " .
        "'" . ($row['maxseq'] + 1) . "'," .
        "'1', '0')");
    

Fixed code:
 * @package   OpenEMR
 * @link      http://www.open-emr.org
 * @author    Rod Roark <rod@sunsetsystems.com>
 * @author    Brady Miller <brady.g.miller@gmail.com>
 * @author    Teny <teny@zhservices.com>
 * @copyright Copyright (c) 2007-2017 Rod Roark <rod@sunsetsystems.com>
 * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
 * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3

        ") VALUES ( 'lists', ?, ?, ?, '1', '0')", array($newlistID, $_POST['newlistname'], ($row['maxseq'] + 1)));
CVE-2021-25917 (PHP, published 2021-03-22T20:15Z)
Description: value: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/orders/patient_match_dialog.php
interface/patient_file/report/patient_report.php
interface/usergroup/mfa_registrations.php
interface/usergroup/mfa_totp.php
interface/usergroup/mfa_u2f.php
interface/usergroup/usergroup_admin.php
Commit message: bug fixes (#4280)



Vulnerable code:
        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }

Fixed code:
        var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;
CVE-2021-25918 (PHP, published 2021-03-22T20:15Z)
Description: value: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/orders/patient_match_dialog.php
interface/patient_file/report/patient_report.php
interface/usergroup/mfa_registrations.php
interface/usergroup/mfa_totp.php
interface/usergroup/mfa_u2f.php
interface/usergroup/usergroup_admin.php
Commit message: bug fixes (#4280)



Vulnerable code:
        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }

Fixed code:
        var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;