hitoshura25/cvefixes huggingface dataset:
CVE-2021-37711 (PHP, published 2021-08-16T23:15Z)
Description: value: Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/shopware/platform
Files changed:
src/Core/Content/Media/File/FileUrlValidator.php
src/Core/Content/Test/Media/File/FileUrlValidatorTest.php
Commit message: NEXT-15673 - Fix file upload ip validation for IPv6


Vulnerable code:

Fixed code:
        return $this->validateIp($ip);
    }

    private function validateIp(string $ip): bool
    {
        if (!filter_var($ip, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
            return true;
        }

        // Convert IPv6 to packed format and back so we can check if there is a IPv4 representation of the IP
        $packedIp = inet_pton($ip);
        if (!$packedIp) {
            return false;
        }
        $convertedIp = inet_ntop($packedIp);
        if (!$convertedIp) {
            return false;
        }
        $convertedIp = explode(':', $convertedIp);
        $ipv4 = array_pop($convertedIp);

        // Additionally filter IPv4 representation of the IP
        if (filter_var($ipv4, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4)) {
            return $this->validateIp($ipv4);
        }

<?php declare(strict_types=1);

namespace Shopware\Core\Content\Test\Media\File;

use PHPUnit\Framework\TestCase;
use Shopware\Core\Content\Media\File\FileUrlValidator;

class FileUrlValidatorTest extends TestCase
{
    /**
     * @dataProvider fileSourceProvider
     */
    public function testIsValid(string $source, bool $expectedResult): void
    {
        $validator = new FileUrlValidator();

        static::assertEquals($expectedResult, $validator->isValid($source));
    }

    public function fileSourceProvider(): array
    {
        return [
            'reserved IPv4' => ['https://127.0.0.1', false],
            'converted reserved IPv4' => ['https://0:0:0:0:0:FFFF:7F00:0001', false],
            'reserved IPv4 mapped to IPv6' => ['https://[0:0:0:0:0:FFFF:127.0.0.1]', false],
            'reserved IPv6' => ['https://FE80::', false],
            'private IPv4' => ['https://192.168.0.0', false],
            'converted private IPv4' => ['https://0:0:0:0:0:FFFF:C0A8:0000', false],
            'private IPv4 mapped to IPv6' => ['https://[0:0:0:0:0:FFFF:192.168.0.0]', false],
            'private IPv6' => ['https://FC00::', false],
            'invalid IPv4' => ['https://378.0.0.1', false],
            'valid IPv4' => ['https://8.8.8.8', true],
            'valid IPv6' => ['https://2001:db8::8a2e:370:7334', true],
            'valid IPv6 URL' => ['https://[2001:db8::8a2e:370:7334]', true],
        ];
    }
}
CVE-2023-52082 (PHP, published 2023-12-28T16:16Z)
Description: value: Lychee is a free photo-management tool.  Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe.  The patch is provided on version 5.0.2.  To work around this issue, disable SQL EXPLAIN logging.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/LycheeOrg/Lychee
Files changed:
app/Providers/AppServiceProvider.php
database/migrations/2023_12_28_144906_bump_version050002.php
resources/views/livewire/forms/album/share-with.blade.php
version.md
Commit message: Fix Injection + v5.0.2 (#2123)



Vulnerable code:
		$explain = DB::select('EXPLAIN ' . $sql_with_bindings);
                                        wire:click="select('{{ $result['id'] }}','{{ $result['username'] }}')">
                                            <span class="ml-4 text-left">{{ $result['username'] }}</span>
5.0.1

Fixed code:
		$explain = DB::select('EXPLAIN ' . $query->sql, $query->bindings);
<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Support\Facades\DB;

return new class() extends Migration {
	/**
	 * Run the migrations.
	 *
	 * @return void
	 */
	public function up(): void
	{
		DB::table('configs')->where('key', 'version')->update(['value' => '050002']);
	}

	/**
	 * Reverse the migrations.
	 *
	 * @return void
	 */
	public function down(): void
	{
		DB::table('configs')->where('key', 'version')->update(['value' => '050001']);
	}
};
                                        wire:click="select('{{ $result['id'] }}',@js($result['username']))">
                                            <span class="ml-4 text-left">{{ ($result['username']) }}</span>
5.0.2
CVE-2023-40168 (JavaScript, published 2023-08-17T20:15Z)
Description: value: TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening the sb3 file or loading the extension. The web version of TurboWarp is not affected. This bug has been addressed in commit `55e07e99b59` after an initial fix which was reverted. Users are advised to upgrade to version 1.8.0 or later. Users unable to upgrade should avoid opening sb3 files or loading extensions from untrusted sources.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/TurboWarp/desktop
Files changed:
src/main/extensions.js
src/main/index.js
src/main/library-files.js
src/main/protocols.js
src/main/request-security.js
Commit message: Fix some bugs related to protocols and file: URIs


Vulnerable code:
protocol.registerSchemesAsPrivileged([
  {
    scheme: 'tw-extensions',
    privileges: {
      supportFetchAPI: true
    }
  }
]);

  app.on('ready', () => {
protocol.registerSchemesAsPrivileged([
  {
    scheme: 'tw-library-files',
    privileges: {
      supportFetchAPI: true
    }
  }
]);


Fixed code:
import './protocols';
import './request-security';
  app.whenReady().then(() => {
import {protocol} from 'electron';

protocol.registerSchemesAsPrivileged([
  {
    scheme: 'tw-extensions',
    privileges: {
      supportFetchAPI: true
    }
  },
  {
    scheme: 'tw-library-files',
    privileges: {
      supportFetchAPI: true
    }
  }
]);
import {app} from 'electron';

const isRequestAllowed = (details) => {
  const url = new URL(details.url);
  if (url.protocol === 'file:') {
    // Requests to files must be inside the application
    return url.pathname.startsWith(__dirname);
  }

  if (details.resourceType !== 'xhr') {
    // Immune to CORS even in standard browsers
    return true;
  }

  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
    // Special protocols are immune to CORS
    return true;
  }

  const allowOriginHeader = details.responseHeaders['access-control-allow-origin'];
  if (!Array.isArray(allowOriginHeader)) {
    // No header, not allowed
    return false;
  }

  // Header must be set to "*"
  // We don't have a real Origin that we can check
  return allowOriginHeader.join(',') === '*';
};

app.on('session-created', (session) => {
  session.webRequest.onHeadersReceived((details, callback) => {
    callback({
      cancel: !isRequestAllowed(details)
    });
  });
});
CVE-2023-40168 (JavaScript, published 2023-08-17T20:15Z)
Description: value: TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only required user interaction is opening the sb3 file or loading the extension. The web version of TurboWarp is not affected. This bug has been addressed in commit `55e07e99b59` after an initial fix which was reverted. Users are advised to upgrade to version 1.8.0 or later. Users unable to upgrade should avoid opening sb3 files or loading extensions from untrusted sources.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/TurboWarp/desktop
Files changed:
src/main/index.js
Commit message: Remove the code that broke Windows


Vulnerable code:
import './request-security';
import {app} from 'electron';

const isRequestAllowed = (details) => {
  const url = new URL(details.url);
  if (url.protocol === 'file:') {
    // Requests to files must be inside the application
    return url.pathname.startsWith(__dirname);
  }

  if (details.resourceType !== 'xhr') {
    // Immune to CORS even in standard browsers
    return true;
  }

  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
    // Special protocols are immune to CORS
    return true;
  }

  const allowOriginHeader = details.responseHeaders['access-control-allow-origin'];
  if (!Array.isArray(allowOriginHeader)) {
    // No header, not allowed
    return false;
  }

  // Header must be set to "*"
  // We don't have a real Origin that we can check
  return allowOriginHeader.join(',') === '*';
};

app.on('session-created', (session) => {
  session.webRequest.onHeadersReceived((details, callback) => {
    callback({
      cancel: !isRequestAllowed(details)
    });
  });
});

Fixed code:
CVE-2022-27475 (PHP, published 2022-04-13T12:15Z)
Description: value: Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tramyardg/hotel-mgmt-system
Files changed:
app/Util.php
Commit message: + sanitize xss function


Vulnerable code:

Fixed code:

    public static function sanitize_xss($value) 
    {
      return htmlspecialchars(strip_tags($value));
    }
CVE-2021-32659 (TypeScript, published 2021-06-16T19:15Z)
Description: value: Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options.
Severity: LOW (CVSS v3 base score: 4.9)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/matrix-org/matrix-appservice-bridge
Files changed:
src/components/room-upgrade-handler.ts
Commit message: Check m.room.create event on room upgrade


Vulnerable code:

Fixed code:
        const { predecessor } = await intent.getStateEvent(newRoomId, 'm.room.create');
        if (predecessor.room_id !== oldRoomId) {
            log.error(
    `Room doesn't have a matching predecessor (expected: ${oldRoomId}, got: ${predecessor.room_id}), not bridging.`
            );
            return false;
        }
CVE-2023-38691 (TypeScript, published 2023-08-04T17:15Z)
Description: value: matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/matrix-org/matrix-appservice-bridge
Files changed:
src/provisioning/api.ts
Commit message: Merge pull request from GHSA-vc7j-h8xg-fv5x

* Refuse to accept foreign users in OpenID responses

* Make sure we correctly handle server names with colons in them

---------

Co-authored-by: Tadeusz Sośnierz <tadeusz@sosnierz.com>

Vulnerable code:

Fixed code:

            const mxidMatch = userId.match(/([^:]+):(.+)/);
            if (!mxidMatch) {
                throw new ApiError("Server did not respond with a valid MXID", ErrCode.BadOpenID);
            }
            const [, _localpart, serverName] = mxidMatch;
            if (serverName !== server) {
                throw new ApiError("Server returned a MXID belonging to another homeserver", ErrCode.BadOpenID);
            }
CVE-2014-3741 (JavaScript, published 2017-10-23T18:29Z)
Description: value: The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/tojocky/node-printer
Files changed:
lib/printer.js
Commit message: Removed possible command injection


Vulnerable code:
        child_process.exec('lpr -P'+printer+' -oraw -r'+' '+temp_file_name, function(err, stdout, stderr){

Fixed code:
        child_process.execFile('lpr', ['-P' + printer, '-oraw', '-r', temp_file_name], function(err, stdout, stderr){
CVE-2022-21669 (Unknown, published 2022-01-11T15:15Z)
Description: value: PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/PuddingBot/pudding-bot
Files changed:
Commit message: Merge pull request #15 from PuddingBot/CVE-2022-21669

CVE-2022-21669

Remove exposed bot token and integrate with gitleaks as a pre-commit hook
to prevent future security leaks.

Vulnerable code:

Fixed code:
CVE-2017-20170 (PHP, published 2023-01-17T14:15Z)
Description: value: A vulnerability was found in ollpu parontalli. It has been classified as critical. Affected is an unknown function of the file httpdocs/index.php. The manipulation of the argument s leads to sql injection. The patch is identified as 6891bb2dec57dca6daabc15a6d2808c8896620e5. It is recommended to apply a patch to fix this issue. VDB-218418 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ollpu/parontalli
Files changed:
httpdocs/index.php
Commit message: Fix SQL-injection vulnerability in page identifier parameter

Well that's embarrassing...


Vulnerable code:
if(!isset($_GET["s"]))	{$_GET['s'] = $fprow['uid'];}

Fixed code:
if(!isset($_GET["s"])) {$_GET['s'] = $fprow['uid'];}
else {
  $_GET['s'] = mysqli_real_escape_string($yht, $_GET['s']);
}
CVE-2018-25092 (Unknown, published 2023-11-05T21:15Z)
Description: value: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/Vaerys-Dawn/DiscordSailv2
Files changed:
Commit message: 2.10.3 Bug Fixes and Removed Vulnerabilites

+ added Ban logging
+ added Kick logging
* Remove ability for CCs to contain existing command names.
* Make the return message more informative.
* Fixes a vulnerability in some commands that would allow users to use
mentions they would not normally have access to.
* fixed a bug involving the commands command showing dm commands
regardless of what page you were on.
+ added page system to the listJoinMessages
* fixed vulerability in the tag handler that would allow users to use
mentions.
+ added ChannelSetting Profiles
* addprofile no longer adds profiles if the user already has one
+ added toggle SendJoinMessages
* renamed JoinServerMessages tp WelcomeMessages
fixed a bug that caused daily messages to crash
* stoped sail from logging pin messages


Vulnerable code:

Fixed code:
CVE-2018-25093 (Unknown, published 2023-11-06T01:15Z)
Description: value: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The name of the patch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244484.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/Vaerys-Dawn/DiscordSailv2
Files changed:
Commit message: 2.10.3 Bug Fixes and Removed Vulnerabilites

+ added Ban logging
+ added Kick logging
* Remove ability for CCs to contain existing command names.
* Make the return message more informative.
* Fixes a vulnerability in some commands that would allow users to use
mentions they would not normally have access to.
* fixed a bug involving the commands command showing dm commands
regardless of what page you were on.
+ added page system to the listJoinMessages
* fixed vulerability in the tag handler that would allow users to use
mentions.
+ added ChannelSetting Profiles
* addprofile no longer adds profiles if the user already has one
+ added toggle SendJoinMessages
* renamed JoinServerMessages tp WelcomeMessages
fixed a bug that caused daily messages to crash
* stoped sail from logging pin messages


Vulnerable code:

Fixed code:
CVE-2022-4819 (PHP, published 2022-12-28T21:15Z)
Description: value: A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is d4ffdb0ef806453c54ddca7fdda3e5c60356285c. It is recommended to apply a patch to fix this issue. VDB-216998 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kohler/hotcrp
Files changed:
src/api/api_decision.php
src/assigners/a_decision.php
src/decisioninfo.php
src/help/h_keywords.php
src/listactions/la_decide.php
src/mailrecipients.php
src/papertable.php
Commit message: Fix XSS (exploitable only by chairs) reported by Xiangyu Gao.


Vulnerable code:
        $jr = new JsonResult(["ok" => true, "value" => $dec->id, "result" => htmlspecialchars($dec->name)]);
        $name_h = htmlspecialchars($dec->id === 0 ? "No decision" : $dec->name);
                echo $hth->search_trow("dec:{$qdname}", "decision is “" . htmlspecialchars($dec->name) . "” (partial matches OK)");
            $opts[$dec->id] = $dec->name;
                    $this->defsel("dec:{$dec->name}", "Contact authors of " . htmlspecialchars($dec->name) . " papers", $hide ? self::F_HIDE : 0);
            $opts[$dec->id] = $dec->name;
            htmlspecialchars($this->prow->decision()->name),

Fixed code:
        $jr = new JsonResult(["ok" => true, "value" => $dec->id, "result" => $dec->name_as(5)]);
        $name_h = $dec->id === 0 ? "No decision" : $dec->name_as(5);
    /** @param 0|5 $format
     * @return string */
    function name_as($format) {
        return $format === 5 ? htmlspecialchars($this->name) : $this->name;
    }

                echo $hth->search_trow("dec:{$qdname}", "decision is “" . $dec->name_as(5) . "” (partial matches OK)");
            $opts[$dec->id] = $dec->name_as(5);
                    $this->defsel("dec:{$dec->name}", "Contact authors of " . $dec->name_as(5) . " papers", $hide ? self::F_HIDE : 0);
            $opts[$dec->id] = $dec->name_as(5);
            $this->prow->decision()->name_as(5),