hitoshura25/cvefixes huggingface dataset:
CVE-2023-29015 (Other, published 2023-04-06T20:15Z)
Description: value: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/intranda/goobi-viewer-core
Files changed:
goobi-viewer-core/src/main/resources/META-INF/resources/resources/includes/user/userComments.xhtml
Commit message: escape comment text; fixes #24585

Vulnerable code:
							<span class="user-comments__comment-metadata-creator">#{comment.creator.displayNameEscaped}</span>
									#{comment.displayText}</div>

Fixed code:
							<span class="user-comments__comment-metadata-creator">
							    #{comment.creator.displayNameEscaped}
							</span>
									<h:outputText value="#{comment.displayText}" escape="true" />
								</div>
CVE-2021-21352 (PHP, published 2021-03-03T01:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In TimeTracker before version 1.19.24.5415 tokens used in password reset feature in Time Tracker are based on system time and, therefore, are predictable. This opens a window for brute force attacks to guess user tokens and, once successful, change user passwords, including that of a system administrator. This vulnerability is pathced in version 1.19.24.5415 (started to use more secure tokens) with an additional improvement in 1.19.24.5416 (limited an available window for brute force token guessing).
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/anuko/timetracker
Files changed:
WEB-INF/templates/report.tpl
initialize.php
password_reset.php
Commit message: Fixed a critical security vulnerability with password resets.


Vulnerable code:
define("APP_VERSION", "1.19.23.5414");
    $temp_ref = md5(uniqid());

Fixed code:
        {* <td></td>{* column for edit icons *}
     {* <td><a href="time_edit.php?id={$item.id}"><img class="table_icon" alt="{$i18n.label.edit}" src="img/icon-edit.png"></a></td>{* column for edit icons *}
    {* <td></td>{* column for edit icons *}
    {* <td></td>{* column for edit icons *}
define("APP_VERSION", "1.19.24.5415");
    $cryptographically_strong = true;
    $random_bytes = openssl_random_pseudo_bytes(16, $cryptographically_strong);
    if ($random_bytes === false) die ("openssl_random_pseudo_bytes function call failed...");
    $temp_ref = bin2hex($random_bytes);
CVE-2021-29436 (PHP, published 2021-04-13T20:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/anuko/timetracker
Files changed:
WEB-INF/config.php.dist
WEB-INF/lib/common.lib.php
initialize.php
Commit message: An attempt to mitigate cross site request forgery vulnerability.


Vulnerable code:
define("APP_VERSION", "1.19.26.5430");

Fixed code:
// HTTP_TARGET - defines http target for cross site request forgery protection.
// It can be used when you access the application via a proxy.
// define('HTTP_TARGET', 'localhost');


  // Protection against cross site request forgery.
  if (!ttMitigateCSRF())
    return false;

// ttMitigateCSRF verifies request headers in an attempt to block cross site request forgery.
function ttMitigateCSRF() {
  // No need to do anything for get requests.
  global $request;
  if ($request->isGet())
    return true;

  $origin = $_SERVER['HTTP_ORIGIN'];
  if ($origin) {
    $pos = strpos($origin, '//');
    $origin = substr($origin, $pos+2); // Strip protocol.
  }
  if (!$origin) {
    // Try using referer.
    $origin = $_SERVER['HTTP_REFERER'];
    if ($origin) {
      $pos = strpos($origin, '//');
      $origin = substr($origin, $pos+2); // Strip protocol.
      $pos = strpos($origin, '/');
      $origin = substr($origin, 0, $pos); // Leave host only.
    }
  }
  error_log("origin: ".$origin);
  $target = defined('HTTP_TARGET') ? HTTP_TARGET : $_SERVER['HTTP_HOST'];
  error_log("target: ".$target);
  if (strcmp($origin, $target)) {
    error_log("Potential cross site request forgery. Origin: '$origin' does not match target: '$target'.");
    return false; // Origin and target do not match,
  }

  // TODO: review and improve this function for custom ports.
  return true;
}


define("APP_VERSION", "1.19.27.5431");
CVE-2021-29436 (PHP, published 2021-04-13T20:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cross site request forgery (CSRF) vulnerability existed. The nature of CSRF is that a logged on user may be tricked by social engineering to click on an attacker-provided form that executes an unintended action such as changing user password. The vulnerability is fixed in Time Tracker version 1.19.27.5431. Upgrade is recommended. If upgrade is not practical, introduce ttMitigateCSRF() function in /WEB-INF/lib/common.php.lib using the latest available code and call it from ttAccessAllowed().
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/anuko/timetracker
Files changed:
WEB-INF/config.php.dist
WEB-INF/lib/common.lib.php
initialize.php
Commit message: Tested CSRF fix for custom ports - it's working, also removed unnecessary logging.


Vulnerable code:
// define('HTTP_TARGET', 'localhost');
  error_log("origin: ".$origin);
  error_log("target: ".$target);
    return false; // Origin and target do not match,
  // TODO: review and improve this function for custom ports.
define("APP_VERSION", "1.19.27.5431");

Fixed code:
// define('HTTP_TARGET', 'localhost:8080');
    return false; // Origin and target do not match.
define("APP_VERSION", "1.19.27.5432");
CVE-2021-41139 (PHP, published 2021-10-13T17:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible to craft the URI with malicious JavaScript, use social engineering to convince logged on user to click on such link, and have the attacker-supplied JavaScript to be executed in user's browser. This issue is patched in version 1.19.30.5600. As a workaround, one may introduce `ttValidDbDateFormatDate` function as in the latest version and add a call to it within the access checks block in time.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/anuko/timetracker
Files changed:
WEB-INF/lib/common.lib.php
initialize.php
time.php
Commit message: A better fix to validate a passed-in date.


Vulnerable code:
  // This should accept a string in format 'YYYY-MM-DD', 'MM/DD/YYYY', 'DD-MM-YYYY', 'DD.MM.YYYY', or 'DD.MM.YYYY whatever'.
    
  return true;    
define("APP_VERSION", "1.19.30.5599");
if ($date && !ttValidDate($date)) {

Fixed code:
  // This should validate a string in format 'YYYY-MM-DD', 'MM/DD/YYYY', 'DD-MM-YYYY', 'DD.MM.YYYY', or 'DD.MM.YYYY whatever'.

  return true;
}

// ttValidDbDateFormatDate is used to check user input to validate a date in DB_DATEFORMAT.
function ttValidDbDateFormatDate($val)
{
  $val = trim($val);
  if (strlen($val) == 0)
    return false;

  // This should validate a string in format 'YYYY-MM-DD'.
  if (!preg_match('/^\d\d\d\d-\d\d-\d\d$/', $val))
    return false;

  return true;
define("APP_VERSION", "1.19.30.5600");
if ($date && !ttValidDbDateFormatDate($date)) {
CVE-2021-41139 (PHP, published 2021-10-13T17:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible to craft the URI with malicious JavaScript, use social engineering to convince logged on user to click on such link, and have the attacker-supplied JavaScript to be executed in user's browser. This issue is patched in version 1.19.30.5600. As a workaround, one may introduce `ttValidDbDateFormatDate` function as in the latest version and add a call to it within the access checks block in time.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/anuko/timetracker
Files changed:
initialize.php
time.php
Commit message: Added a check for passed in date to time.php.


Vulnerable code:
define("APP_VERSION", "1.19.29.5598");

Fixed code:
define("APP_VERSION", "1.19.30.5599");
// If we are passed in a date, make sure it is in correct format.
$date = $request->getParameter('date');
if ($date && !ttValidDate($date)) {
  header('Location: access_denied.php');
  exit();
}
CVE-2021-43851 (PHP, published 2021-12-22T00:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/anuko/timetracker
Files changed:
WEB-INF/lib/ttGroupHelper.class.php
initialize.php
Commit message: Added additional protection against an sql injection fixed in previous commit.


Vulnerable code:
    $sql = "select parent_id from tt_groups where id = $group_id and org_id = $user->org_id and status = 1";
define("APP_VERSION", "1.19.31.5602");

Fixed code:
    // Checking parameters for sanity is normally done in access check blocks on pages.
    // This cast below is just in case we forgot to check $group_id to be an integer.
    $groupId = (int) $group_id; // Protection against sql injection.

    $sql = "select parent_id from tt_groups where id = $groupId and org_id = $user->org_id and status = 1";
define("APP_VERSION", "1.19.31.5603");
CVE-2021-43851 (PHP, published 2021-12-22T00:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. SQL injection vulnerability exist in multiple files in Time Tracker version 1.19.33.5606 and prior due to not properly checking of the "group" and "status" parameters in POST requests. Group parameter is posted along when navigating between organizational subgroups (groups.php file). Status parameter is used in multiple files to change a status of an entity such as making a project, task, or user inactive. This issue has been patched in version 1.19.33.5607. An upgrade is highly recommended. If an upgrade is not practical, introduce ttValidStatus function as in the latest version and start using it user input check blocks wherever status field is used. For groups.php fix, introduce ttValidInteger function as in the latest version and use it in the access check block in the file.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/anuko/timetracker
Files changed:
groups.php
initialize.php
Commit message: Fixed an sql injection vulnerability in groups.php.


Vulnerable code:
if ($request->isPost() && !$user->isGroupValid($request->getParameter('group'))) {
  header('Location: access_denied.php'); // Wrong group id in post.
  exit();
define("APP_VERSION", "1.19.30.5601");

Fixed code:
if ($request->isPost()) {
  $group_id = $request->getParameter('group');
  if (!ttValidInteger($group_id)) {
    header('Location: access_denied.php'); // Protection against sql injection.
    exit();
  }
  if (!$user->isGroupValid($group_id)) {
    header('Location: access_denied.php'); // Wrong group id in post.
    exit();
  }
define("APP_VERSION", "1.19.31.5602");
CVE-2022-24707 (PHP, published 2022-02-24T16:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/anuko/timetracker
Files changed:
initialize.php
puncher.php
Commit message: Addressed an sql injection vulnerability in puncher.php.


Vulnerable code:
define("APP_VERSION", "1.20.0.5641");

Fixed code:
define("APP_VERSION", "1.20.0.5642");
// If we are passed in a date, make sure it is in correct format.
// TODO: redo this temporary sql injection fix as we are not supposed to pass a date.
$date = $request->getParameter('date');
if ($date && !ttValidDbDateFormatDate($date)) {
  header('Location: access_denied.php');
  exit();
}
CVE-2022-24708 (PHP, published 2022-02-24T16:15Z)
Description: value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with elements of JavaScript. Such script could then be executed in user browser on subsequent requests on pages where primary group name was displayed. This is vulnerability has been fixed in version 1.20.0.5646. Users who are unable to upgrade may modify ttUser.class.php to use an additional call to htmlspecialchars when printing group name.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/anuko/timetracker
Files changed:
WEB-INF/lib/ttUser.class.php
initialize.php
Commit message: Addressed stored XSS vulnerability when displaying primary group name.


Vulnerable code:
        $user_part .= ', '.$this->group_name;
define("APP_VERSION", "1.20.0.5645");

Fixed code:
        $user_part .= ', '.htmlspecialchars($this->group_name);
define("APP_VERSION", "1.20.0.5646");
CVE-2023-32066 (PHP, published 2023-05-09T16:15Z)
Description: value: Time Tracker is an open source time tracking system. The week view plugin in Time Tracker versions 1.22.11.5782 and prior was not escaping titles for notes in week view table. Because of that, it was possible for a logged in user to enter notes with elements of JavaScript. Such script could then be executed in user browser on subsequent requests to week view. This issue is fixed in version 1.22.12.5783. As a workaround, use `htmlspecialchars` when calling `$field->setTitle` on line #245 in the `week.php` file,  as happens in version 1.22.12.5783.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/anuko/timetracker
Files changed:
initialize.php
week.php
Commit message: Addressed stored XSS vulnerability in week.php by escaping cell title.


Vulnerable code:
define("APP_VERSION", "1.22.11.5782");
        $field->setTitle($table->getValueAt($row,$column)['note']);     // Tooltip to help view the entire comment.

Fixed code:
define("APP_VERSION", "1.22.12.5783");
        $field->setTitle(htmlspecialchars($table->getValueAt($row,$column)['note'])); // Tooltip to help view the entire comment.
CVE-2023-32308 (PHP, published 2023-05-15T21:15Z)
Description: value: anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/anuko/timetracker
Files changed:
initialize.php
invoices.php
Commit message: Addressed an sql vulnerability in invoices.php for bogus post parameters for sorting.


Vulnerable code:
define("APP_VERSION", "1.22.11.5780");
  if($request->getParameter('sorting_changed')) {

Fixed code:
define("APP_VERSION", "1.22.11.5781");
  if($err->no() && $request->getParameter('sorting_changed')) {
CVE-2021-33420 (Unknown, published 2022-12-15T19:15Z)
Description: value: A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/inikulin/replicator
Files changed:
Commit message: Merge pull request #17 from inikulin/sec

fix: Avoid RCE when deserialising TypedArrays [closes #16][part of #12]

Vulnerable code:

Fixed code: