hitoshura25/cvefixes huggingface dataset:
CVE-2023-3086 (PHP, published 2023-06-03T12:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
includes/js/functions.js
pages/profile.js.php
sources/main.functions.php
Commit message: 3.0.9

Fix xss in user profile form


Vulnerable code:
    
            .replaceAll('&gt;', '>'),
            'name': DOMPurify.sanitize($('#profile-user-name').val()),
            'lastname': DOMPurify.sanitize($('#profile-user-lastname').val()),
            'email': DOMPurify.sanitize($('#profile-user-email').val()),
        //console.log(data)
    $sanitizer = new Elegant\sanitizer\Sanitizer($data, $filters);
    return $sanitizer->sanitize();

Fixed code:
/*
    // Sanitize string
    var tagsToReplace = {
        '&': '&amp;',
        '<': '&lt;',
        '>': '&gt;',
        "'" : '&#39;',
        '"' : '&quot;'
    };
    text = text.replace(/[&<>'"]/g, function(tag) {
        return tagsToReplace[tag] || tag;
    });
    */
            .replaceAll('&gt;', '>')
            .replaceAll('&amp;', '&')
            .replaceAll('&quot;', '"')
            .replaceAll('&#39;', "'"),
        // Sanitize text fields
        let formName = fieldSanitizeStep1('#profile-user-name', false, false, false),
            formLastname = fieldSanitizeStep1('#profile-user-lastname', false, false, false),
            formEmail = fieldSanitizeStep1('#profile-user-email', false, false, false);
        if (formName === false || formLastname === false || formEmail === false) {
            // Label is empty
            toastr.remove();
            toastr.warning(
                'XSS attempt detected. Field has been emptied.',
                'Error', {
                    timeOut: 5000,
                    progressBar: true
                }
            );
            return false;
        }

        // Prepare data
            'name': formName,
            'lastname': formLastname,
            'email': formEmail,
        console.log(data);
        //return false;
        // " onmouseover="confirm(document.cookie)"
    $sanitizer = new Elegant\sanitizer\Sanitizer($data, $filters);

    // Load AntiXSS
    include_once $path. '/includes/libraries/anti-xss-master/src/voku/helper/ASCII.php';
    include_once $path . '/includes/libraries/anti-xss-master/src/voku/helper/UTF8.php';
    include_once $path . '/includes/libraries/anti-xss-master/src/voku/helper/AntiXSS.php';
    $antiXss = new voku\helper\AntiXSS();
    return $antiXss->xss_clean($sanitizer->sanitize());
CVE-2023-3552 (PHP, published 2023-07-08T09:15Z)
Description: value: Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
includes/js/functions.js
pages/folders.js.php
Commit message: 3.0.10

Fix possible xss in folder page


Vulnerable code:
    return DOMPurify.sanitize(
        sanitizeDom(text)
            .replaceAll('&lt;', '<')
            .replaceAll('&#x3C;', '<')
            .replaceAll('&#60;', '<')
            .replaceAll('&gt;', '>')
            .replaceAll('&#x3E;', '>')
            .replaceAll('&#62;', '>')
            .replaceAll('&amp;', '&')
            .replaceAll('&#38;', '&')
            .replaceAll('&#x26;', '&')
            .replaceAll('&quot;', '"')
            .replaceAll('&#34;;', '"')
            .replaceAll('&#x22;', '"')
            .replaceAll('&#39;', "'"),
        {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}

Fixed code:
    return sanitizeDom(
        DOMPurify.sanitize(
            text
                .replaceAll('&lt;', '<')
                .replaceAll('&#x3C;', '<')
                .replaceAll('&#x3c;', '<')
                .replaceAll('&#60;', '<')
                .replaceAll('&gt;', '>')
                .replaceAll('&#x3E;', '>')
                .replaceAll('&#x3e;', '>')
                .replaceAll('&#62;', '>')
                .replaceAll('&amp;', '&')
                .replaceAll('&#38;', '&')
                .replaceAll('&#x26;', '&')
                .replaceAll('&quot;', '"')
                .replaceAll('&#34;;', '"')
                .replaceAll('&#x22;', '"')
                .replaceAll('&#39;', "'"),
            {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}
        )
            return false;
CVE-2015-6941 (Python, published 2017-08-09T16:29Z)
Description: value: win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-534 \u2014 DEPRECATED: Information Exposure Through Debug Log Files
This entry has been deprecated because its abstraction was too low-level.  See CWE-532.
Repository: https://github.com/twangboy/salt
Files changed:
salt/states/user.py
Commit message: Replaced password with redacted when displayed


Vulnerable code:
                                         ' {1}'.format(name, password)
                    ret['changes']['password'] = password
                                         ' {1}'.format(name, password)
                    ret['changes']['passwd'] = password

Fixed code:
                if key == 'password':
                    val = 'XXX-REDACTED-XXX'
                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                    ret['changes']['password'] = 'XXX-REDACTED-XXX'
                                         ' {1}'.format(name, 'XXX-REDACTED-XXX')
                    ret['changes']['passwd'] = 'XXX-REDACTED-XXX'
CVE-2020-15095 (JavaScript, published 2020-07-07T19:15Z)
Description: value: Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
Severity: LOW (CVSS v3 base score: 4.4)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/npm/cli
Files changed:
bin/npm-cli.js
lib/fetch-package-metadata.js
lib/utils/error-handler.js
lib/utils/error-message.js
lib/utils/replace-info.js
Commit message: chore: remove auth info from logs


Vulnerable code:
  log.verbose('cli', process.argv)
const tempFilename = require('./utils/temp-filename')
const pacote = require('pacote')
      log.silly('fetchPackageMetaData', 'error for ' + String(spec), er.message)
  log.verbose('argv', process.argv.map(JSON.stringify).join(' '))

Fixed code:
  var replaceInfo = require('../lib/utils/replace-info.js')
  var args = replaceInfo(process.argv)
  log.verbose('cli', args)
const pacote = require('pacote')
const tempFilename = require('./utils/temp-filename.js')
const replaceInfo = require('./utils/replace-info.js')
      er.message = replaceInfo(er.message)
      var spc = replaceInfo(String(spec))
      log.silly('fetchPackageMetaData', 'error for ' + spc, er.message)
var replaceInfo = require('./replace-info.js')
    v = replaceInfo(v)
  var args = replaceInfo(process.argv)
  log.verbose('argv', args.map(JSON.stringify).join(' '))
var replaceInfo = require('./replace-info.js')

  er.message = replaceInfo(er.message)
  er.stack = replaceInfo(er.stack)

const URL = require('url')

// replaces auth info in an array
//  of arguments or in a strings
function replaceInfo (arg) {
  const isArray = Array.isArray(arg)
  const isString = typeof arg === 'string'

  if (!isArray && !isString) return arg

  const args = isString ? arg.split(' ') : arg
  const info = args.map(arg => {
    try {
      const url = new URL(arg)
      return url.password === '' ? arg : arg.replace(url.password, '***')
    } catch (e) { return arg }
  })

  return isString ? info.join(' ') : info
}

module.exports = replaceInfo
CVE-2018-1000041 (C, published 2018-02-09T23:29Z)
Description: value: GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ImageMagick/librsvg
Files changed:
rsvg-io.c
Commit message: Fixed possible credentials leaking reported by Alex Birsan.


Vulnerable code:
    if (g_file_test (filename, G_FILE_TEST_EXISTS) || g_path_is_absolute (filename)) {

Fixed code:
    if (g_path_is_absolute (filename)) {
CVE-2021-21403 (Go, published 2021-03-26T18:15Z)
Description: value: In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/kongchuanhujiao/server
Files changed:
internal/app/datahub/pkg/account/memory.go
internal/app/kongchuanhujiao/account/apis.go
internal/app/kongchuanhujiao/account/utils.go
Commit message: 重构：优化验证码生成逻辑，最小化权责


Vulnerable code:
import "github.com/kongchuanhujiao/server/internal/app/datahub/internal/memory"
func GetCode(id string) string {
	return memory.Code[id]
}
func WriteCode(id string, code string) {
	memory.Code[id] = code
func DeleteCode(id string) {
	delete(memory.Code, id)
	if v.Code != account.GetCode(v.ID) || v.Code == "" { // FIXME datahub 鉴权
	"math/rand"
	"strconv"
	"time"


	rand.Seed(time.Now().UnixNano())
	c := strconv.FormatFloat(rand.Float64(), 'f', -1, 64)[2:6]

		message.NewTextMessage("您的验证码是：" + c + "，请勿泄露给他人。有效期5分钟").
	account.WriteCode(id, c)

	go func() {
		timer := time.NewTimer(5 * time.Minute)
		defer timer.Stop()
		<-timer.C
		account.DeleteCode(id)
	}()


Fixed code:
import (
	"math/rand"
	"strconv"
	"time"
	"github.com/kongchuanhujiao/server/internal/app/datahub/internal/memory"
)

// GenerateCode 写入验证码返回一个验证码
func GenerateCode(id string) (c string) {

	rand.Seed(time.Now().UnixNano())
	c = strconv.FormatFloat(rand.Float64(), 'f', -1, 64)[2:6]
	memory.Code[id] = c

	go func() {
		timer := time.NewTimer(5 * time.Minute)
		defer timer.Stop()
		<-timer.C
		deleteCode(id)
	}()

	return
// VerifyCode 验证验证码
func VerifyCode(id string, code string) (ok bool) {
	if code == memory.Code[id] {
		ok = true
		deleteCode(id)
	}
	return

// deleteCode 删除验证码
func deleteCode(id string) { delete(memory.Code, id) }
	if account.VerifyCode(v.ID, v.Code) || v.Code == "" {
		message.NewTextMessage("您的验证码是：" + account.GenerateCode(id) + "，请勿泄露给他人。有效期5分钟").
CVE-2021-32851 (TypeScript, published 2023-02-20T22:15Z)
Description: value: Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue is patched in version 0.18.1
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ssshooter/mind-elixir-core
Files changed:
package.json
readme.md
src/plugin/contextMenu.ts
src/plugin/nodeMenu.ts
src/plugin/toolBar.ts
src/utils/dom.ts
src/utils/index.ts
Commit message: fix: prevent XSS


Vulnerable code:
  "version": "0.18.0",
<script src="https://cdn.jsdelivr.net/npm/regenerator-runtime"></script>
    div.innerHTML = words
    li.innerHTML = `<span>${name}</span><span>${keyname}</span>`
const createDiv = (id, name) => {
  div.innerHTML = `<span>${name}</span>`
  const styleDiv = createDiv('nm-style', 'style')
  const tagDiv = createDiv('nm-tag', 'tag')
  const iconDiv = createDiv('nm-icon', 'icon')
  tagDiv.innerHTML = `
      ${i18n[locale].tag}<input class="nm-tag" tabindex="-1" placeholder="${i18n[locale].tagsSeparate}" /><br>
  `
  iconDiv.innerHTML = `
      ${i18n[locale].icon}<input class="nm-icon" tabindex="-1" placeholder="${i18n[locale].iconsSeparate}" /><br>
  `
  percentage.innerHTML = '100%'

  tpc.innerHTML = nodeObj.topic
    linkContainer.innerHTML = '🔗'
      .map(icon => `<span>${icon}</span>`)
      .map(tag => `<span>${tag}</span>`)
  div.innerHTML = origin
  expander.innerHTML = expanded !== false ? '-' : '+'

Fixed code:
  "version": "0.18.1",
import { encodeHTML } from '../utils/index'
    div.innerText = words
    li.innerHTML = `<span>${encodeHTML(name)}</span><span>${encodeHTML(keyname)}</span>`
const createDiv = (id) => {
  const styleDiv = createDiv('nm-style')
  const tagDiv = createDiv('nm-tag')
  const iconDiv = createDiv('nm-icon')
  tagDiv.innerHTML = `${i18n[locale].tag}<input class="nm-tag" tabindex="-1" placeholder="${i18n[locale].tagsSeparate}" /><br>`
  iconDiv.innerHTML = `${i18n[locale].icon}<input class="nm-icon" tabindex="-1" placeholder="${i18n[locale].iconsSeparate}" /><br>`
  percentage.innerText = '100%'
import { encodeHTML } from '../utils/index'
  tpc.innerText = nodeObj.topic
    linkContainer.innerText = '🔗'
      .map(icon => `<span>${encodeHTML(icon)}</span>`)
      .map(tag => `<span>${encodeHTML(tag)}</span>`)
  div.innerText = origin
  expander.innerText = expanded !== false ? '-' : '+'
export function encodeHTML(s) {
  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;')
}
CVE-2020-29074 (C, published 2020-11-25T23:15Z)
Description: value: scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/LibVNC/x11vnc
Files changed:
src/scan.c
Commit message: scan: limit access to shared memory segments to current user


Vulnerable code:
	    xim->bytes_per_line * xim->height, IPC_CREAT | 0777);

Fixed code:
	    xim->bytes_per_line * xim->height, IPC_CREAT | 0600);
CVE-2021-4286 (Unknown, published 2022-12-27T11:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/cocagne/pysrp
Files changed:
Commit message: Merge pull request #43 from ddealmei/fix-srp-vuln

Fix side channel leaks

Vulnerable code:

Fixed code:
CVE-2013-4509 (Python, published 2013-11-23T19:55Z)
Description: value: The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/ibus/ibus-anthy
Files changed:
engine/engine.py
Commit message: Added to check the input purpose for gnome-shell password dialog.


Vulnerable code:

Fixed code:
        self.__input_purpose = 0
        self.__has_input_purpose = False
        if hasattr(IBus, 'InputPurpose'):
            self.__has_input_purpose = True
        if self.__has_input_purpose:
            self.__input_purpose = 0
    def do_set_content_type(self, purpose, hints):
        if self.__has_input_purpose:
            self.__input_purpose = purpose

        if self.__has_input_purpose and \
           self.__input_purpose == IBus.InputPurpose.PASSWORD:
            return False
CVE-2021-29451 (Java, published 2021-04-16T22:15Z)
Description: value: Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/ManyDesigns/Portofino
Files changed:
CHANGELOG.md
dispatcher/src/main/java/com/manydesigns/portofino/dispatcher/security/jwt/JWTRealm.java
portofino-core/src/main/java/com/manydesigns/portofino/shiro/AbstractPortofinoRealm.java
Commit message: Fix security vulnerability


Vulnerable code:
- Backwards compatibility: revert `T extends Serializable` in CRUD actions, introduced in v5.2.0. [#428](https://github.com/ManyDesigns/Portofino/issues/428)
import io.jsonwebtoken.Jwt;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
        Jwt jwt = Jwts.parser().
                parse((String) token.getPrincipal());
    protected Map<String, Serializable> getPrincipal(Jwt jwt) {
import io.jsonwebtoken.Jwt;
import io.jsonwebtoken.JwtException;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
        Jwt jwt;
            jwt = Jwts.parser().setSigningKey(key).parse(token.getPrincipal());
    protected Object extractPrincipalFromWebToken(Jwt jwt) {
        Map body = (Map) jwt.getBody();

Fixed code:
- Important security vulnerability that may have allowed access with forged tokens.
- Backwards compatibility: revert `T extends Serializable` in CRUD actions, introduced in v5.2.0. [#428](https://github.com/ManyDesigns/Portofino/issues/428)
import io.jsonwebtoken.*;
        Jws<Claims> jwt = Jwts.parser().
                parseClaimsJws((String) token.getPrincipal());
    protected Map<String, Serializable> getPrincipal(Jws<Claims> jwt) {
import io.jsonwebtoken.*;
        Jws<Claims> jwt;
            jwt = Jwts.parser().setSigningKey(key).parseClaimsJws(token.getPrincipal());
    protected Object extractPrincipalFromWebToken(Jws<Claims> jwt) {
        Map<String, Object> body = jwt.getBody();
CVE-2022-3952 (Java, published 2022-11-11T14:15Z)
Description: value: A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/ManyDesigns/Portofino
Files changed:
microservices/launcher/src/main/java/com/manydesigns/portofino/microservices/launcher/WarFileLauncher.java
Commit message: vuln-fix: Temporary Directory Hijacking or Information Disclosure



This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure.

Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Severity: High
CVSSS: 7.3
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/10


Co-authored-by: Moderne <team@moderne.io>

Vulnerable code:
        File tempDir = File.createTempFile("portofino.tomcat.", "." + port);
        tempDir.delete();
        tempDir.mkdir();

Fixed code:
import java.nio.file.Files;
        File tempDir = Files.createTempDirectory("portofino.tomcat." + "." + port).toFile();