hitoshura25/cvefixes huggingface dataset:
CVE-2023-0438 (Python, published 2023-01-23T14:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/modoboa/modoboa
Files changed:
modoboa/admin/templates/admin/domain_detail.html
modoboa/admin/views/identity.py
Commit message: Force DELETE method for remove permission view.

Avoids CSRF issue.


Vulnerable code:

Fixed code:

      $('a[name="removeperm"]').click(function (evt) {
          evt.preventDefault();
          var $this = $(this);
          $.ajax({
              url: $this.attr('href'),
              method: 'DELETE'
          }).done(function () {
              window.location.reload();
          });
      });
@require_http_methods(["DELETE"])
CVE-2023-0470 (Unknown, published 2023-01-26T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #2757 from modoboa/fix/xss_issue_domain_form

Fixed XSS issue in domain creation form.

Vulnerable code:

Fixed code:
CVE-2023-0519 (JavaScript, published 2023-01-26T23:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modoboa/modoboa
Files changed:
modoboa/admin/static/admin/js/admin.js
modoboa/core/templates/core/logs_page.html
modoboa/static/js/autocompleter.js
Commit message: Avoid XSS issues while deleting account and looking at logs.


Vulnerable code:
            question: function() { return this.$element.attr('title'); },
  <td>{{ l.message|tohtml|safe }}</td>
                        $('<li><a href="#" name="' + value + '">' + value + '</a></li>')

Fixed code:
            question: function() { return htmlEncode(this.$element.attr('title')); },
  <td>{{ l.message }}</td>
                        $('<li><a href="#" name="' + htmlEncode(value) + '">' + htmlEncode(value) + '</a></li>')
CVE-2023-0777 (Unknown, published 2023-02-10T19:15Z)
Description: value: Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-305 \u2014 Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #2767 from modoboa/api-throttling

Api throttling for rest framework

Vulnerable code:

Fixed code:
CVE-2023-0949 (Unknown, published 2023-02-22T09:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #2797 from modoboa/fix/xss_issue_with_tags

Fixed XSS vulnerability

Vulnerable code:

Fixed code:
CVE-2023-2160 (Python, published 2023-04-18T16:15Z)
Description: value: Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/modoboa/modoboa
Files changed:
modoboa/core/forms.py
modoboa/core/tests/test_core.py
Commit message: Fixed security issue with password update.


Vulnerable code:

Fixed code:
        elif newpassword or confirmation:
            if not confirmation:
                self.add_error("confirmation", _("This field is required."))
            else:
                self.add_error("newpassword", _("This field is required."))
        self.ajax_post(
            reverse("core:user_profile"),
            {"oldpassword": "toto",
             "confirmation": "tutu"},
            status=400
        )
CVE-2023-2227 (Python, published 2023-04-21T13:15Z)
Description: value: Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/modoboa/modoboa
Files changed:
modoboa/admin/api/v1/viewsets.py
modoboa/core/api/v2/views.py
modoboa/lib/permissions.py
modoboa/parameters/api/v2/viewsets.py
Commit message: Added missing permissions on API endpoints


Vulnerable code:
        
from rest_framework import response, status
from modoboa.lib.throttle import UserLesserDdosUser, LoginThrottle, PasswordResetApplyThrottle, PasswordResetRequestThrottle, PasswordResetTotpThrottle
from rest_framework import response, viewsets

Fixed code:
from rest_framework import permissions, response, status
from modoboa.lib.permissions import IsSuperUser
from modoboa.lib.throttle import (
    UserLesserDdosUser, LoginThrottle, PasswordResetApplyThrottle,
    PasswordResetRequestThrottle, PasswordResetTotpThrottle
)
    permission_classes = [permissions.IsAuthenticated, IsSuperUser]
from rest_framework import permissions



class IsSuperUser(permissions.BasePermission):
    """Permission class to allow only super users."""

    def has_permission(self, request, view):
        return request.user.is_superuser
from rest_framework import permissions, response, viewsets
from modoboa.lib.permissions import IsSuperUser
    permission_classes = [permissions.IsAuthenticated, IsSuperUser]
CVE-2023-2228 (Python, published 2023-04-21T13:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
Severity: nan (CVSS v3 base score: 6.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/modoboa/modoboa
Files changed:
modoboa/admin/views/domain.py
modoboa/admin/views/identity.py
Commit message: Fixed CSRF issues in edit operations.


Vulnerable code:

Fixed code:
@require_http_methods(["POST"])
@require_http_methods(["POST"])
CVE-2023-5688 (Unknown, published 2023-10-20T17:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #3095 from modoboa/fix/xss_profile_form

Fixed XSS vulnerability when displaying form error messages.

Vulnerable code:

Fixed code:
CVE-2023-5689 (Unknown, published 2023-10-20T17:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #3095 from modoboa/fix/xss_profile_form

Fixed XSS vulnerability when displaying form error messages.

Vulnerable code:

Fixed code:
CVE-2023-5690 (Unknown, published 2023-10-20T17:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/modoboa/modoboa
Files changed:
Commit message: Merge pull request #3090 from modoboa/fix/csrf_issue_logout

Fixed CSRF vulnerability on logout view

Vulnerable code:

Fixed code:
CVE-2022-36065 (TypeScript, published 2022-09-06T21:15Z)
Description: value: GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the right location, they can execute arbitrary code within the container. To be affected, ALL of the following must be true: Self-hosted deployment (GrowthBook Cloud is unaffected); using local file uploads (as opposed to S3 or Google Cloud Storage); NODE_ENV set to a non-production value and JWT_SECRET set to an easily guessable string like `dev`. This issue is patched in commit 1a5edff8786d141161bf880c2fd9ccbe2850a264 (2022-08-29). As a workaround, set `JWT_SECRET` environment variable to a long random string. This will stop arbitrary file uploads, but the only way to stop attackers from registering accounts is by updating to the latest build.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/growthbook/growthbook
Files changed:
packages/back-end/src/controllers/auth.ts
packages/back-end/src/services/files.ts
packages/back-end/src/util/secrets.ts
Commit message: Secure file uploads when NODE_ENV=dev (#487)



Vulnerable code:
  const fullPath = getUploadsDir() + "/" + filePath;
if (prod && !IS_CLOUD && JWT_SECRET === "dev") {

Fixed code:
  // Only allow this API endpoint when it's a brand-new installation with no users yet
  const newInstallation = await isNewInstallation();
  if (!newInstallation) {
    throw new Error(
      "An organization is already configured. Please refresh the page and try again."
    );
  }

  // Watch out for poison null bytes
  if (filePath.indexOf("\0") !== -1) {
    throw new Error("Error: Filename must not contain null bytes");
  }

  const rootDirectory = getUploadsDir();
  const fullPath = path.join(rootDirectory, filePath);

  // Prevent directory traversal
  if (fullPath.indexOf(rootDirectory) !== 0) {
    throw new Error(
      "Error: Path must not escape out of the 'uploads' directory."
    );
  }

const isLocalhost = APP_ORIGIN.includes("localhost");
if ((prod || !isLocalhost) && !IS_CLOUD && JWT_SECRET === "dev") {
CVE-2021-31783 (PHP, published 2021-04-26T19:15Z)
Description: value: show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/Piwigo/LocalFilesEditor
Files changed:
show_default.php
Commit message: fixes #2 strongly check the input parameter to avoid unexpected files to be displayed.

Privately reported by Harry Goodman from NCC


Vulnerable code:
  if (!is_admin() or (!substr_count($path, 'config_default.inc.php') and !substr_count($path, '.lang.php')))
    

Fixed code:
check_input_parameter('file', $_GET, false, '/^(include\/config_default\.inc\.php|language\/[a-z]+_[A-Z]+\/(common|admin)\.lang\.php)$/');

  if (!is_admin())
CVE-2012-2673 (C, published 2012-07-25T19:55Z)
Description: value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/ivmai/bdwgc
Files changed:
malloc.c
Commit message: Speedup calloc size overflow check by preventing division if small values

* malloc.c (GC_SQRT_SIZE_MAX): New macro.
* malloc.c (calloc): Add fast initial size overflow check to avoid
integer division for reasonably small values passed.


Vulnerable code:
    if (lb && n > GC_SIZE_MAX / lb)

Fixed code:
#define GC_SQRT_SIZE_MAX ((1U << (WORDSZ / 2)) - 1)

    if ((lb | n) > GC_SQRT_SIZE_MAX /* fast initial test */
        && lb && n > GC_SIZE_MAX / lb)
CVE-2012-2673 (C, published 2012-07-25T19:55Z)
Description: value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/ivmai/bdwgc
Files changed:
malloc.c
Commit message: Fix calloc-related code to prevent SIZE_MAX redefinition in sys headers

* malloc.c: Include limits.h for SIZE_MAX.
* malloc.c (SIZE_MAX, calloc): Define GC_SIZE_MAX instead of SIZE_MAX.


Vulnerable code:
#ifndef SIZE_MAX
#define SIZE_MAX (~(size_t)0)
    if (lb && n > SIZE_MAX / lb)

Fixed code:
#include <limits.h>
#ifdef SIZE_MAX
# define GC_SIZE_MAX SIZE_MAX
#else
# define GC_SIZE_MAX (~(size_t)0)

    if (lb && n > GC_SIZE_MAX / lb)
CVE-2012-2673 (C, published 2012-07-25T19:55Z)
Description: value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/ivmai/bdwgc
Files changed:
malloc.c
Commit message: Fix calloc() overflow

* malloc.c (calloc): Check multiplication overflow in calloc(),
assuming REDIRECT_MALLOC.


Vulnerable code:

Fixed code:
#ifndef SIZE_MAX
#define SIZE_MAX (~(size_t)0)
#endif
    if (lb && n > SIZE_MAX / lb)
      return NULL;
CVE-2012-2673 (C, published 2012-07-25T19:55Z)
Description: value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/ivmai/bdwgc
Files changed:
malloc.c
mallocx.c
Commit message: Fix allocation size overflows due to rounding.

* malloc.c (GC_generic_malloc): Check if the allocation size is
rounded to a smaller value.
* mallocx.c (GC_generic_malloc_ignore_off_page): Likewise.


Vulnerable code:

Fixed code:
        if (lb_rounded < lb)
            return((*GC_get_oom_fn())(lb));
    if (lb_rounded < lb)
        return((*GC_get_oom_fn())(lb));
CVE-2014-125080 (PHP, published 2023-01-16T18:15Z)
Description: value: A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path traversal. The patch is identified as a5dcd87f46080a624b1a9ad4b0dd035bbd24ac50. It is recommended to apply a patch to fix this issue. VDB-218398 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/frontaccounting/faplanet
Files changed:
admin/inst_module.php
includes/hooks.inc
Commit message: Fixed directory traversal issues.


Vulnerable code:
	if (file_exists($path_to_root.'/modules/'.$id.'/hooks.php')) {
		include_once($path_to_root.'/modules/'.$id.'/hooks.php');
	if (file_exists($path_to_root . "/lang/".$_SESSION['language']->code."/locale.inc"))
		include_once($path_to_root . "/lang/".$_SESSION['language']->code."/locale.inc");

Fixed code:
	if (file_exists($path_to_root.'/modules/'.clean_file_name($id).'/hooks.php')) {
		include_once($path_to_root.'/modules/'.clean_file_name($id).'/hooks.php');
	$lang_code  = clean_file_name($_SESSION['language']->code);
	if (file_exists($path_to_root . "/lang/" . $lang_code . "/locale.inc"))
		include_once($path_to_root . "/lang/" . $lang_code . "/locale.inc");
CVE-2019-1010199 (C#, published 2019-07-23T18:15Z)
Description: value: ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ServiceStack/ServiceStack
Files changed:
src/ServiceStack/Formats/HtmlFormat.cs
Commit message: HtmlEncode Raw URL in HtmlFormat snapshot


Vulnerable code:
                json = json.Replace("<", "&lt;").Replace(">", "&gt;");
                    .TrimEnd('?', '&');

Fixed code:
                json = json.HtmlEncode();
                    .TrimEnd('?', '&')
                    .HtmlEncode();
CVE-2020-28042 (C#, published 2020-11-02T21:15Z)
Description: value: ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/ServiceStack/ServiceStack
Files changed:
src/ServiceStack.Common/EnumerableExtensions.cs
Commit message: Update EquivalentTo to test length & null for equality as well


Vulnerable code:

Fixed code:
            if (bytes == null || other == null)
                return bytes == other;

            if (bytes.Length != other.Length)
                return false;
CVE-2023-23939 (TypeScript, published 2023-03-06T19:15Z)
Description: value: Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs `fs.chmodSync(kubectlPath, 777)` to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalation to the user that can also run kubectl, most likely root. This attack is only possible if an attacker somehow breached the GitHub actions runner or if a user is utilizing an Action that maliciously executes this attack. This has been fixed and released in all versions `v3` and later. 775 permissions are used instead. Users are advised to upgrade. There are no known workarounds for this issue.

Severity: nan (CVSS v3 base score: 7)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/Azure/setup-kubectl
Files changed:
src/run.test.ts
src/run.ts
Commit message: lower permissions for chmod (#51)



Vulnerable code:
        expect(fs.chmodSync).toBeCalledWith(path.join('pathToCachedTool', 'kubectl.exe'), '777');
        expect(fs.chmodSync).toBeCalledWith(path.join('pathToCachedTool', 'kubectl.exe'), '777');
    fs.chmodSync(kubectlPath, '777');

Fixed code:
        expect(fs.chmodSync).toBeCalledWith(path.join('pathToCachedTool', 'kubectl.exe'), '775');
        expect(fs.chmodSync).toBeCalledWith(path.join('pathToCachedTool', 'kubectl.exe'), '775');
    fs.chmodSync(kubectlPath, '775');