hitoshura25/cvefixes huggingface dataset:
CVE-2015-10101 (PHP, published 2023-04-15T21:15Z)
Description: value: A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/google-analytics-top-posts-widget
Files changed:
class-tgm-plugin-activation.php
google-analytics-top-posts-widget.php
readme.txt
Commit message: Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage/

git-svn-id: https://plugins.svn.wordpress.org/google-analytics-top-posts-widget/trunk@1139349 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
                            'dismiss'  => '<a class="dismiss-notice" href="' . add_query_arg( 'tgmpa-dismiss', 'dismiss_admin_notices' ) . '" target="_parent">' . __( 'Dismiss this notice', $this->domain ) . '</a>',
            
            
            
            
            
            /** Sort alphabetically each plugin type array, merge them and then sort in reverse	(lists Required plugins first) */	
}
Version: 1.5.6
Tested up to: 4.1  
Stable tag: 1.5.6  
Version: 1.5.6  

Fixed code:
                            'dismiss'  => '<a class="dismiss-notice" href="' . esc_url( add_query_arg( 'tgmpa-dismiss', 'dismiss_admin_notices' ) ) . '" target="_parent">' . __( 'Dismiss this notice', $this->domain ) . '</a>',





            /** Sort alphabetically each plugin type array, merge them and then sort in reverse	(lists Required plugins first) */
}
Version: 1.5.7
Tested up to: 4.2  
Stable tag: 1.5.7  
Version: 1.5.7  
= 1.5.7 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

= 1.5.7 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage
CVE-2022-31081 (Perl, published 2022-06-27T21:15Z)
Description: value: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/libwww-perl/HTTP-Daemon
Files changed:
lib/HTTP/Daemon.pm
Commit message: Fix Content-Length ', '-separated string issues

After a security issue, we ensure we comply to
RFC-7230 -- HTTP/1.1 Message Syntax and Routing
- section 3.3.2 -- Content-Length
- section 3.3.3 -- Message Body Length


Vulnerable code:

Fixed code:
        # After a security issue, we ensure we comply to
        # RFC-7230 -- HTTP/1.1 Message Syntax and Routing
        # section 3.3.2 -- Content-Length
        # section 3.3.3 -- Message Body Length

        # split and clean up Content-Length ', ' separated string
        my @vals = map {my $str = $_; $str =~ s/^\s+//; $str =~ s/\s+$//; $str }
            split ',', $ct_len;
        # check that they are all numbers (RFC: Content-Length = 1*DIGIT)
        my @nums = grep { /^[0-9]+$/} @vals;
        unless (@vals == @nums) {
            $self->send_error(400);
            $self->reason("Content-Length value must be a unsigned integer");
            return;
        }
        # check they are all the same
        my $ct_len = shift @nums;
        foreach (@nums) {
            next if $_ == $ct_len;
            $self->send_error(400);
            $self->reason("Content-Length values are not the same");
            return;
        }
        # ensure we have now a fixed header, with only 1 value
        $r->header('Content-Length' => $ct_len);
CVE-2022-31081 (Perl, published 2022-06-27T21:15Z)
Description: value: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/libwww-perl/HTTP-Daemon
Files changed:
lib/HTTP/Daemon.pm
Commit message: Include reason in response body content

Vulnerable code:
            $self->send_error(400);
            $self->reason("Content-Length value must be a unsigned integer");
            $self->send_error(400);
            $self->reason("Content-Length values are not the same");

Fixed code:
            my $reason = "Content-Length value must be an unsigned integer";
            $self->send_error(400, $reason);
            $self->reason($reason);
            my $reason = "Content-Length values are not the same";
            $self->send_error(400, $reason);
            $self->reason($reason);
CVE-2023-49277 (Python, published 2023-12-01T21:15Z)
Description: value: dpaste is an open source pastebin application written in Python using the Django framework. A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized access, data theft, or other malicious activities. Users are strongly advised to upgrade to dpaste release v3.8 or later versions, as dpaste versions older than v3.8 are susceptible to the identified security vulnerability. No known workarounds have been identified, and applying the patch is the most effective way to remediate the vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/DarrenOfficial/dpaste
Files changed:
dpaste/views.py
Commit message: fix: correct escaping of api responses

The API did not respond as intended. :D
Co-authored-by: Brian Ferri brian.ferri19@gmail.com>


Vulnerable code:
                'Invalid lexer "%s" given. Valid lexers are: %s'
                % (lexer, ", ".join(highlight.LEXER_KEYS))
                    'Invalid expire choice "{}" given. Valid values are: {}'.format(
                        expires, ", ".join(expire_options)
                    )
    return response

Fixed code:
from django.utils.html import escape
                f'Invalid lexer choice "{escape(lexer)}" given. Valid lexer values are: {", ".join(highlight.LEXER_KEYS)}'
                    f'Invalid expire choice "{escape(expires)}" given. Valid expire values are: {", ".join(expire_options)}'
    return response
CVE-2008-10002 (JavaScript, published 2023-03-05T02:15Z)
Description: value: A vulnerability has been found in cfire24 ajaxlife up to 0.3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.3.3 is able to address this issue. The patch is identified as 9fb53b67312fe3f4336e01c1e3e1bedb4be0c1c8. It is recommended to upgrade the affected component. VDB-222286 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/cfire24/ajaxlife
Files changed:
client/AjaxLife.InstantMessage.js
client/AjaxLife.SpatialChat.js
Commit message: - Fixes injection exploit caused by link feature.
  - Example: saying the following to a user of AjaxLife:
    See <a href="http:/&#47;en.wikipedia.org/wiki/Second_Life" onclick="AjaxLife.Network.Send('SendAgentMoney',{Target: 'fa42243d-b76e-49f8-880c-ddc7b5479f78', Amount: 500);" target="_blank">http:/&#47;en.wikipedia.org/wiki/Second_Life</a> for an example.


Vulnerable code:
			text = AjaxLife.Utils.LinkURLs(text);
		text = AjaxLife.Utils.LinkURLs(text);

Fixed code:
			text = AjaxLife.Utils.LinkURLs(text.escapeHTML());
		text = AjaxLife.Utils.LinkURLs(text.escapeHTML());
CVE-2017-20181 (XML, published 2023-03-07T00:15Z)
Description: value: A vulnerability classified as critical was found in hgzojer Vocable Trainer up to 1.3.0 on Android. This vulnerability affects unknown code of the file src/at/hgz/vocabletrainer/VocableTrainerProvider.java. The manipulation leads to path traversal. Attacking locally is a requirement. Upgrading to version 1.3.1 is able to address this issue. The name of the patch is accf6838078f8eb105cfc7865aba5c705fb68426. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222328.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/hgzojer/vocabletrainer
Files changed:
AndroidManifest.xml
src/at/hgz/vocabletrainer/VocableTrainerProvider.java
Commit message: Bugfix Path Traversal Vulnerability - see https://support.google.com/faqs/answer/7496913


Vulnerable code:
    android:versionCode="9"
    android:versionName="1.3.0" >
	public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {       
	     File cacheDir = getContext().getCacheDir();
	     File privateFile = new File(cacheDir, uri.getLastPathSegment());
	     return ParcelFileDescriptor.open(privateFile, ParcelFileDescriptor.MODE_READ_ONLY);

Fixed code:
    android:versionCode="10"
    android:versionName="1.3.1" >
import java.io.IOException;
	public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {
		try {
			String cacheDir = getContext().getCacheDir().toString();
			File privateFile = new File(cacheDir, uri.getLastPathSegment());
			if (!privateFile.getCanonicalPath().startsWith(cacheDir)) {
				throw new IllegalArgumentException();
			}

			return ParcelFileDescriptor.open(privateFile, ParcelFileDescriptor.MODE_READ_ONLY);
		} catch (IOException e) {
			throw new RuntimeException(e.getMessage(), e);
		}
CVE-2022-24822 (JSON, published 2022-04-06T18:15Z)
Description: value: Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/podium-lib/layout
Files changed:
package.json
Commit message: fix: update Proxy module to fix trailer header vulnerability

Vulnerable code:
    "@podium/proxy": "4.2.73",

Fixed code:
    "@podium/proxy": "4.2.74",
CVE-2018-7753 (Unknown, published 2018-03-07T23:29Z)
Description: value: An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mozilla/bleach
Files changed:
Commit message: Merge pull request #356 from willkg/fix-entities

Fix url sanitizing

Vulnerable code:

Fixed code:
CVE-2020-22617 (C++, published 2021-10-08T20:15Z)
Description: value: Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/Ardour/ardour
Files changed:
libs/pbd/xml++.cc
Commit message: fix apparent free-ordering issue reported in #7926


Vulnerable code:
		xmlXPathFreeContext(ctxt);
		xmlXPathFreeContext(ctxt);

Fixed code:
		xmlXPathFreeContext(ctxt);
		xmlXPathFreeContext(ctxt);
CVE-2020-15139 (JavaScript, published 2020-08-10T22:15Z)
Description: value: In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24, make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mybb/mybb
Files changed:
jscripts/bbcodes_sceditor.js
Commit message: Fix MyCode message formatting XSS in visual editor


Vulnerable code:
				return '<div align="' + (attrs.defaultattr || 'left') + '">' + content + '</div>';
			return '<font data-scefontsize="' + attrs.defaultattr + '" size="' + size + '">' + content + '</font>';
			$cite.html($cite.text());
				data += ' data-pid="' + attrs.pid + '"';
				data += ' data-dateline="' + attrs.dateline + '"';
				content = '<cite>' + attrs.defaultattr.replace(/ /g, '&nbsp;') + '</cite>' + content;
					attrs.defaultattr +

Fixed code:
				return '<div align="' + ($.sceditor.escapeEntities(attrs.defaultattr) || 'left') + '">' + content + '</div>';
			return '<font data-scefontsize="' + $.sceditor.escapeEntities(attrs.defaultattr) + '" size="' + size + '">' + content + '</font>';
				data += ' data-pid="' + $.sceditor.escapeEntities(attrs.pid) + '"';
				data += ' data-dateline="' + $.sceditor.escapeEntities(attrs.dateline) + '"';
				content = '<cite>' + $.sceditor.escapeEntities(attrs.defaultattr).replace(/ /g, '&nbsp;') + '</cite>' + content;
					$.sceditor.escapeEntities(attrs.defaultattr) +
CVE-2021-27279 (PHP, published 2021-02-22T20:15Z)
Description: value: MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mybb/mybb
Files changed:
inc/class_parser.php
Commit message: Fix Nested Email MyCode Persistent XSS


Vulnerable code:
		if(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+$/si", $email))
		{
			$email = $email;
		}
		elseif(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+\?(.*?)$/si", $email))
		{
			$email = htmlspecialchars_uni($email);
		}

Fixed code:

		$email = $this->encode_url($email);
CVE-2022-24734 (PHP, published 2022-03-09T22:15Z)
Description: value: MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/mybb/mybb
Files changed:
admin/modules/config/settings.php
Commit message: Fix ACP Settings management RCE


Vulnerable code:
		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")
		$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
		if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")

Fixed code:
		$mybb->input['type'] = $mybb->get_input('type');
		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")
		$mybb->input['type'] = $mybb->get_input('type');
		if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")