hitoshura25/cvefixes huggingface dataset:
CVE-2023-3521 (PHP, published 2023-07-06T02:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fossbilling/fossbilling
Files changed:
src/library/FOSSBilling/ErrorPage.php
src/load.php
Commit message: Prevent exceptions from being interpreted as HTML (#1394)



Vulnerable code:
        $error['message'] ??= __trans('Uh-oh! You\'ve received a generic error message: :errorMessage', [':errorMessage' => '<code>' . $message . '</code>']);
        echo $e->getMessage() . PHP_EOL;
    error_log($e->getMessage());
        $result = ['result' => null, 'error' => ['message' => $e->getMessage(), 'code' => $code]];
        $errorPage->generatePage($e->getCode(), $e->getMessage());

Fixed code:
        $error['message'] ??= __trans('You\'ve received a generic error message: :errorMessage', [':errorMessage' => '<code>' . $message . '</code>']);
    $message = htmlspecialchars($e->getMessage());
        echo $message . PHP_EOL;
    error_log($message);
        $result = ['result' => null, 'error' => ['message' => $message, 'code' => $code]];
        $errorPage->generatePage($e->getCode(), $message);
CVE-2021-23414 (JavaScript, published 2021-07-28T08:15Z)
Description: value: This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/videojs/video.js
Files changed:
src/js/utils/url.js
test/unit/utils/url.test.js
Commit message: fix: remove IE8 url parsing workaround (#7334)



Vulnerable code:
  let a = document.createElement('a');
  // IE8 (and 9?) Fix
  // ie8 doesn't parse the URL correctly until the anchor is actually
  // added to the body, and an innerHTML is needed to trigger the parsing
  const addToBody = (a.host === '' && a.protocol !== 'file:');
  let div;

  if (addToBody) {
    div = document.createElement('div');
    div.innerHTML = `<a href="${url}"></a>`;
    a = div.firstChild;
    // prevent the div from affecting layout
    div.setAttribute('style', 'display:none; position:absolute;');
    document.body.appendChild(div);
  }

  // This is also needed for IE8 because the anchor loses its
  // IE9 adds the port to the host property unlike everyone else. If
  if (addToBody) {
    document.body.removeChild(div);
  assert.equal(
    Url.parseUrl('#').protocol,
    window.location.protocol,
    'parsed relative url protocol'
  );

Fixed code:
  // This entire method can be replace with URL once we are able to drop IE11

  const a = document.createElement('a');
  // This is also needed for IE because the anchor loses its
  // IE adds the port to the host property unlike everyone else. If
  /* istanbul ignore if */
  if (!details.host) {
    details.host = window.location.host;
  assert.equal(Url.parseUrl('#').protocol, window.location.protocol, 'parsed relative url protocol');
  assert.equal(Url.parseUrl('#foo').hash, '#foo', 'parsed relative url hash');
CVE-2020-26149 (TypeScript, published 2020-09-30T18:15Z)
Description: value: NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/nats-io/nats.ws
Files changed:
.github/workflows/natsws.yml
package.json
src/nats-base-client.ts
src/ws_transport.ts
Commit message: [update] [security] updated nats-base-client to v1.0.0-9 (#47)

* [update] [security] updated nats-base-client to v1.0.0-9

* bumped package version

Vulnerable code:
          deno-version: 1.4.0
  "version": "1.0.0-110",
export * from "https://raw.githubusercontent.com/nats-io/nats.deno/v1.0.0-8/nats-base-client/internal_mod.ts";
const VERSION = "1.0.0-110";

Fixed code:
          deno-version: 1.4.2
  "version": "1.0.0-111",
export * from "https://raw.githubusercontent.com/nats-io/nats.deno/v1.0.0-9/nats-base-client/internal_mod.ts";
const VERSION = "1.0.0-111";
CVE-2013-7250 (Java, published 2014-01-02T14:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/micromata/projectforge-webapp
Files changed:
src/main/java/org/projectforge/web/core/JsonBuilder.java
src/main/java/org/projectforge/web/wicket/autocompletion/PFAutoCompleteBehavior.java
Commit message: Escapes now HTML (JsonBuilder).


Vulnerable code:
            sb.append(c);

Fixed code:
  private boolean escapeHtml;

  /**
   * @param escapeHtml the escapeHtml to set (default is false).
   * @return this for chaining.
   */
  public JsonBuilder setEscapeHtml(final boolean escapeHtml)
  {
    this.escapeHtml = escapeHtml;
    return this;
  }

            if (escapeHtml == true) {
              switch (c) {
                case '<':
                  sb.append("&lt;");
                  break;
                case '>':
                  sb.append("&gt;");
                  break;
                case '&':
                  sb.append("&amp;");
                  break;
                case '"':
                  sb.append("&quot;");
                  break;
                case '\'':
                  sb.append("&#x27;");
                  break;
                case '/':
                  sb.append("&#x2F;");
                  break;
                default:
                  sb.append(c);
              }
            } else {
              sb.append(c);
            }
    private MyJsonBuilder()
    {
      setEscapeHtml(true);
    }
CVE-2022-4583 (Java, published 2022-12-17T13:15Z)
Description: value: A vulnerability was found in jLEMS. It has been declared as critical. Affected by this vulnerability is the function unpackJar of the file src/main/java/org/lemsml/jlems/io/util/JUtil.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 8c224637d7d561076364a9e3c2c375daeaf463dc. It is recommended to apply a patch to fix this issue. The identifier VDB-216169 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/LEMS/jLEMS
Files changed:
src/main/java/org/lemsml/jlems/io/util/JUtil.java
Commit message: vuln-fix: Zip Slip Vulnerability

This fixes a Zip-Slip vulnerability.

This change does one of two things. This change either

1. Inserts a guard to protect against Zip Slip.
OR
2. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.

For number 2, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.

Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: High
CVSSS: 7.4
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-zipslip/) & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.ZipSlip)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/16

Co-authored-by: Moderne <team@moderne.io>

Vulnerable code:

Fixed code:
							if (!f.toPath().normalize().startsWith(fout.toPath().normalize())) {
								throw new RuntimeException("Bad zip entry");
							}
CVE-2011-2765 (Python, published 2018-08-20T13:29Z)
Description: value: pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/irmen/Pyro3
Files changed:
Pyro/ext/daemonizer.py
Commit message: changed pidfile location because of security vulnerability, debian bug #631912


Vulnerable code:
            self.pidfile = "/tmp/%s.pid" % self.__class__.__name__.lower()

Fixed code:
            # PID file moved out of /tmp to avoid security vulnerability
            # changed by Debian maintainer per Debian bug #631912
            self.pidfile = "/var/run/pyro-%s.pid" % self.__class__.__name__.lower()
                "[--pidfile=...] " \
            if len(argv) > 2 and argv[2].startswith('--pidfile=') and \
                len(argv[2]) > len('--pidfile='):
                self.pidfile = argv[2][len('--pidfile='):]
CVE-2021-21319 (PHP, published 2021-10-25T16:15Z)
Description: value: Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/galette/galette
Files changed:
galette/lib/Galette/DynamicFields/DynamicField.php
galette/lib/Galette/Entity/TranslatableTrait.php
galette/templates/default/configurer_fiche_content.tpl
Commit message: Fix stored XSS on dynamic fields configuration


Vulnerable code:
                'field_name'        => $this->name,
            return _T($this->name);
            return $this->name;
                            <span class="sr-only">{_T string="Edit '%s' field" pattern="/%s/" replace=$field->getName()}</span>
                            <span class="sr-only">{_T string="Translate '%s' field" pattern="/%s/" replace=$field->getName()}</span>
                            <span class="sr-only">{_T string="Delete '%s' field" pattern="/%s/" replace=$field->getName()}</span>
                            <span class="sr-only">{_T string="Move up '%s' field" pattern="/%s/" replace=$field->getName()}</span>
                            <span class="sr-only">{_T string="Move down '%s' field" pattern="/%s/" replace=$field->getName()}</span>

Fixed code:
                'field_name'        => strip_tags($this->name),
            return _T(strip_tags($this->name));
            return strip_tags($this->name);
                            <span class="sr-only">{_T string="Edit '%s' field" pattern="/%s/" replace=$field->getName()|escape}</span>
                            <span class="sr-only">{_T string="Translate '%s' field" pattern="/%s/" replace=$field->getName()|escape}</span>
                            <span class="sr-only">{_T string="Delete '%s' field" pattern="/%s/" replace=$field->getName()|escape}</span>
                            <span class="sr-only">{_T string="Move up '%s' field" pattern="/%s/" replace=$field->getName()|escape}</span>
                            <span class="sr-only">{_T string="Move down '%s' field" pattern="/%s/" replace=$field->getName()|escape}</span>
CVE-2021-21319 (PHP, published 2021-10-25T16:15Z)
Description: value: Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/galette/galette
Files changed:
tests/Galette/Entity/tests/units/Adherent.php
Commit message: Add test on stored xss


Vulnerable code:

Fixed code:

    /**
     * Test XSS/SQL injection
     *
     * @return void
     */
    public function testInjection()
    {
        $data = [
            'nom_adh'           => 'Doe',
            'prenom_adh'        => 'Johny <script>console.log("anything");</script>',
            'email_adh'         => 'jdoe@doe.com',
            'login_adh'         => 'jdoe',
            'info_public_adh'   => 'Any <script>console.log("useful");</script> information'
        ] + $this->dataAdherentOne();
        $member = $this->createMember($data);

        $this->string($member->sfullname)->isIdenticalTo('DOE Johny Console.log("anything");');
        $this->string($member->others_infos)->isIdenticalTo('Any console.log("useful"); information');
    }
CVE-2023-22451 (Python, published 2023-01-02T16:15Z)
Description: value: Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/kiwitcms/Kiwi
Files changed:
tcms/kiwi_auth/tests/__init__.py
tcms/kiwi_auth/tests/test_admin.py
tcms/kiwi_auth/tests/test_forms.py
tcms/kiwi_auth/tests/test_views.py
Commit message: Update tests to use a stronger password


Vulnerable code:
                "password1": "xo-xo-xo",
                "password2": "xo-xo-xo",
                "password1": "xo-xo-xo",
                "password2": "xo-xo-xo",
                "password1": "xo-xo-xo",
                "password2": "xo-xo-xo",
            "password1": "password",
            "password2": "password",
            "password1": "password",
            "password2": "password",
                        "password1": "password",
                        "password2": "password",
                "password1": "password-1",
                "password2": "password-2",
                "password1": "password",
                "password2": "password",

Fixed code:
__FOR_TESTING__ = "5a5b6e17f9c34025a75b052fc06c50ab"
from . import __FOR_TESTING__

                "password1": __FOR_TESTING__,
                "password2": __FOR_TESTING__,
                "password1": __FOR_TESTING__,
                "password2": __FOR_TESTING__,
                "password1": __FOR_TESTING__,
                "password2": __FOR_TESTING__,
from . import __FOR_TESTING__

            "password1": __FOR_TESTING__,
            "password2": __FOR_TESTING__,
            "password1": __FOR_TESTING__,
            "password2": __FOR_TESTING__,
from . import __FOR_TESTING__

                        "password1": __FOR_TESTING__,
                        "password2": __FOR_TESTING__,
                "password1": __FOR_TESTING__,
                "password2": f"000-{__FOR_TESTING__}",
                "password1": __FOR_TESTING__,
                "password2": __FOR_TESTING__,
CVE-2023-25156 (Other, published 2023-02-15T15:15Z)
Description: value: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/kiwitcms/Kiwi
Files changed:
etc/nginx.conf
Commit message: Rate limit everything under /accounts/


Vulnerable code:

Fixed code:
    map $request_uri $limit_key {
        default "";
        ~^/accounts/ $binary_remote_addr;
    }
    limit_req_zone $limit_key zone=ten-per-sec:10m rate=10r/s;
    limit_req_status 429;


            limit_req zone=ten-per-sec burst=20 nodelay;
CVE-2023-25171 (Python, published 2023-02-15T15:15Z)
Description: value: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/kiwitcms/Kiwi
Files changed:
tcms/kiwi_auth/forms.py
tcms/kiwi_auth/tests/test_views.py
tcms/templates/registration/password_reset_form.html
Commit message: Show captcha on password reset form if enabled


Vulnerable code:
        data = {"email": "tester@example.com"}
        response = self.client.post(self.password_reset_url, data, follow=True)

Fixed code:
    captcha = (
        fields.CaptchaField(
            widget=CustomCaptchaTextInput(attrs={"class": "form-control"})
        )
        if settings.USE_CAPTCHA
        else None
    )


        try:
            # https://github.com/mbi/django-simple-captcha/issues/84
            # pylint: disable=import-outside-toplevel
            from captcha.conf import settings as captcha_settings

            captcha_settings.CAPTCHA_TEST_MODE = True

            response = self.client.post(
                self.password_reset_url,
                {
                    "email": "tester@example.com",
                    "captcha_0": "PASSED",
                    "captcha_1": "PASSED",
                },
                follow=True,
            )
        finally:
            captcha_settings.CAPTCHA_TEST_MODE = False
        {% if 'captcha' in form.fields %}
            {{ form.captcha.errors }}
            {{ form.captcha }}
        {% endif %}
CVE-2023-27489 (Python, published 2023-03-29T19:15Z)
Description: value: Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kiwitcms/Kiwi
Files changed:
etc/nginx.conf
tcms/core/middleware.py
tcms/settings/devel.py
tests/test_http.sh
Commit message: Define Content-Security-Policy header to block inline JavaScript

also define the same headers in middleware during testing and
development to avoid building a container for every change


Vulnerable code:
MIDDLEWARE += ["debug_toolbar.middleware.DebugToolbarMiddleware"]  # noqa: F405

Fixed code:
    # WARNING: make sure these match tcms.core.middleware.ExtraHeadersMiddleware
    add_header Content-Security-Policy "script-src 'self' cdn.crowdin.com;";


class ExtraHeadersMiddleware(MiddlewareMixin):
    """
    This is enabled only during testing and development. The actual headers
    are configured in `etc/nginx.conf`!
    """

    def process_response(self, request, response):
        if settings.DEBUG:
            response.headers["X-Frame-Options"] = "DENY"
            response.headers["X-Content-Type-Options"] = "nosniff"
            response.headers[
                "Content-Security-Policy"
            ] = "script-src 'self' cdn.crowdin.com;"

        return response
MIDDLEWARE += [  # noqa: F405
    "debug_toolbar.middleware.DebugToolbarMiddleware",
    "tcms.core.middleware.ExtraHeadersMiddleware",
]
    rlPhaseStartTest "Should send Content-Security-Policy header"
        rlRun -t -c "curl -k -D- https://localhost 2>/dev/null | grep $'Content-Security-Policy: script-src \'self\' cdn.crowdin.com;'"
    rlPhaseEnd