hitoshura25/cvefixes huggingface dataset:
CVE-2017-5480 (PHP, published 2017-01-15T22:59Z)
Description: value: Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
inc/files/files.ctrl.php
Commit message: Fixed fm_selected parameter exploit


Vulnerable code:

Fixed code:

// Prevent directory traversal using '..'
$re = '/\/?\.\.\/+/';
	if( preg_match( $re, $l_source_path ) )
	{
		debug_die( 'Invalid fm_selected parameter value' );
	}
CVE-2017-5494 (PHP, published 2017-01-15T22:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
conf/_application.php
install/_functions_create.php
install/_functions_evoupgrade.php
Commit message: Updated file types table to only allow admins to upload files with SWF extension


Vulnerable code:
$new_db_version = 11810;
			(20, 'swf', 'Flash video file', 'application/x-shockwave-flash', 'file_video', 'browser', 'registered'),

Fixed code:
$new_db_version = 11815;
			(20, 'swf', 'Flash video file', 'application/x-shockwave-flash', 'file_video', 'browser', 'admin'),
	if( upg_task_start( 11815, 'Updating file types table...' ) )
	{ // part of 6.7.10-stable
		$DB->query( 'UPDATE T_filetypes
				SET ftyp_allowed = "admin"
			WHERE ftyp_extensions REGEXP "[[:<:]]swf[[:>:]]"' );
		upg_task_end();
	}
CVE-2017-5539 (Unknown, published 2017-01-23T07:59Z)
Description: value: The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.
Severity: HIGH (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
Commit message: Merge branch 'develop'


Vulnerable code:

Fixed code:
CVE-2017-5553 (PHP, published 2017-01-23T07:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in plugins/markdown_plugin/_markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/b2evolution/b2evolution
Files changed:
plugins/markdown_plugin/_parsedown.inc.php
Commit message: Ignore wrong urls on markdown plugin


Vulnerable code:
		if (preg_match_all('/^[ ]{0,3}\[(.+)\][ ]?:[ ]*\n?[ ]*(.+)$/m', $text, $matches, PREG_SET_ORDER))
				if( preg_match_all( '/(!?)(\[((?:[^][]+|(?2))*)\])\(([^"]*?)( "([^"]+)")?\)/', $text, $matches, PREG_SET_ORDER ) )
								$element = '<img src="'.$matches[4].'" alt="'.$matches[3].'"'.( ! empty( $matches[6] ) ? ' title="'.$matches[6].'"' : '' ).'>';
								$element = '<a href="'.$matches[4].'"'.( ! empty( $matches[6] ) ? ' title="'.$matches[6].'"' : '' ).'>'.$element_text.'</a>';

Fixed code:
	12. Ignore wrong URLs for links and images; Allow only which begin with http://, https:// or /
		if (preg_match_all('/^[ ]{0,3}\[(.+)\][ ]?:[ ]*\n?[ ]*((https?:\/\/|\/).+)$/m', $text, $matches, PREG_SET_ORDER))
				if( preg_match_all( '/(!?)(\[((?:[^][]+|(?2))*)\])\((https?:\/\/|\/)([^"]*?)( "([^"]+)")?\)/', $text, $matches, PREG_SET_ORDER ) )
								$element = '<img src="'.$matches[4].$matches[5].'" alt="'.$matches[3].'"'.( ! empty( $matches[7] ) ? ' title="'.$matches[7].'"' : '' ).'>';
								$element = '<a href="'.$matches[4].$matches[5].'"'.( ! empty( $matches[7] ) ? ' title="'.$matches[7].'"' : '' ).'>'.$element_text.'</a>';
CVE-2020-24654 (C++, published 2020-09-02T17:15Z)
Description: value: In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
Severity: MEDIUM (CVSS v3 base score: 3.3)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/KDE/ark
Files changed:
plugins/libarchive/libarchiveplugin.cpp
Commit message: Pass the ARCHIVE_EXTRACT_SECURE_SYMLINKS flag to libarchive

There are archive types which allow to first create a symlink and then
later on dereference it. If the symlink points outside of the archive,
this results in writing outside of the destination directory.

With the ARCHIVE_EXTRACT_SECURE_SYMLINKS option set, libarchive avoids
this situation by verifying that none of the target path components are
symlinks before writing.

Remove the commented out code in the method, which would actually
misbehave if enabled again.

Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>


Vulnerable code:
    int result = ARCHIVE_EXTRACT_TIME;
    result |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;

    // TODO: Don't use arksettings here
    /*if ( ArkSettings::preservePerms() )
    {
        result &= ARCHIVE_EXTRACT_PERM;
    }

    if ( !ArkSettings::extractOverwrite() )
    {
        result &= ARCHIVE_EXTRACT_NO_OVERWRITE;
    }*/

    return result;

Fixed code:
    return ARCHIVE_EXTRACT_TIME
           | ARCHIVE_EXTRACT_SECURE_NODOTDOT
           | ARCHIVE_EXTRACT_SECURE_SYMLINKS;
CVE-2014-0177 (Ruby, published 2014-05-27T14:55Z)
Description: value: The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/github/hub
Files changed:
lib/hub/commands.rb
lib/hub/context.rb
Commit message: Use non-predictable filename for downloaded patch file

Since the /tmp directory is readable by everybody on Unix, and since
the patch name could be public or easy to guess, a attacker could create a symlink
to a file writable by the user running hub, which would be replaced by the patch.

This has been assigned CVE-2014-0177


Vulnerable code:
        patch_file = File.join(tmp_dir, patch_name)
      def tmp_dir
        ENV['TMPDIR'] || ENV['TEMP'] || '/tmp'
      end


Fixed code:
        patch_file = Tempfile.new('patch_name')
CVE-2024-3651 (Python, published 2024-07-07T18:15Z)
Description: value: A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kjd/idna
Files changed:
HISTORY.rst
LICENSE.md
idna/package_data.py
Commit message: Release v3.7


Vulnerable code:
Copyright (c) 2013-2023, Kim Davies and contributors.
__version__ = '3.6'

Fixed code:
3.7 (2024-04-11)

- Fix issue where specially crafted inputs to encode() could
  take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Copyright (c) 2013-2024, Kim Davies and contributors.
__version__ = '3.7'
CVE-2021-32765 (C, published 2021-10-04T21:15Z)
Description: value: Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/redis/hiredis
Files changed:
hiredis.c
test.c
Commit message: Fix for integer/buffer overflow CVE-2021-32765

This fix prevents hiredis from trying to allocate more than `SIZE_MAX`
bytes, which would result in a buffer overrun.

[Full Details](https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2)


Vulnerable code:

Fixed code:
        if (SIZE_MAX / sizeof(redisReply*) < elements) return NULL;  /* Don't overflow */
    test("Multi-bulk never overflows regardless of maxelements: ");
    size_t bad_mbulk_len = (SIZE_MAX / sizeof(void *)) + 3;
    char bad_mbulk_reply[100];
    snprintf(bad_mbulk_reply, sizeof(bad_mbulk_reply), "*%llu\r\n+asdf\r\n",
        (unsigned long long) bad_mbulk_len);

    reader = redisReaderCreate();
    reader->maxelements = 0;    /* Don't rely on default limit */
    redisReaderFeed(reader, bad_mbulk_reply, strlen(bad_mbulk_reply));
    ret = redisReaderGetReply(reader,&reply);
    test_cond(ret == REDIS_ERR && strcasecmp(reader->errstr, "Out of memory") == 0);
    freeReplyObject(reply);
    redisReaderFree(reader);
CVE-2024-29900 (TypeScript, published 2024-03-29T16:15Z)
Description: value: Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/electron/packager
Files changed:
src/resedit.ts
Commit message: fix: do not deref the integrity buffer (#1699)



Vulnerable code:
      type: 'Integrity',
      id: 'ElectronAsar',
      bin: Buffer.from(JSON.stringify(options.asarIntegrity)).buffer,

Fixed code:
    const integrityList = Object.keys(options.asarIntegrity).map((file) => ({
      file,
      alg: options.asarIntegrity![file].algorithm,
      value: options.asarIntegrity![file].hash,
    }));
      type: 'INTEGRITY',
      id: 'ELECTRONASAR',
      bin: Buffer.from(JSON.stringify(integrityList), 'utf-8'),
CVE-2014-8351 (PHP, published 2014-11-06T15:55Z)
Description: value: SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/LaboCNIL/CookieViz
Files changed:
cookieviz/info.php
cookieviz/json.php
Commit message: Patch vulnerabilities

Patch vulnerabilities :
CVE-2014-8352
CVE-2014-8351


Vulnerable code:
<?php
	$domain = $_GET["domain"];
	$init_max_date = $_GET["max_date"];
	$domain = $_GET["domain"];

Fixed code:
﻿<?php
	$domain = mysql_real_escape_string($_GET["domain"]);
	
else
{
	exit;
}

	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
	if (!is_numeric($init_max_date))
	{
		$init_max_date="";
	}
	$domain = mysql_real_escape_string($_GET["domain"]);
CVE-2014-8352 (PHP, published 2014-11-06T15:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in json.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz allows remote we servers to inject arbitrary web script or HTML via the max_date parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/LaboCNIL/CookieViz
Files changed:
cookieviz/info.php
cookieviz/json.php
Commit message: Patch vulnerabilities

Patch vulnerabilities :
CVE-2014-8352
CVE-2014-8351


Vulnerable code:
<?php
	$domain = $_GET["domain"];
	$init_max_date = $_GET["max_date"];
	$domain = $_GET["domain"];

Fixed code:
﻿<?php
	$domain = mysql_real_escape_string($_GET["domain"]);
	
else
{
	exit;
}

	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
	if (!is_numeric($init_max_date))
	{
		$init_max_date="";
	}
	$domain = mysql_real_escape_string($_GET["domain"]);
CVE-2023-2591 (PHP, published 2023-05-09T10:15Z)
Description: value: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
pages/items.js.php
Commit message: 3.0.7

Fix potential vulnerability in item label field


Vulnerable code:
                    'description': $('#form-item-description').summernote('code') !== "<p><br></p>" ? DOMPurify.sanitize($('#form-item-description').summernote('code'), {USE_PROFILES: {html: true}}) : '',
                    'label': DOMPurify.sanitize($('#form-item-label').val()),

Fixed code:
                    'description': $('#form-item-description').summernote('code') !== "<p><br></p>" ? DOMPurify.sanitize($('#form-item-description').summernote('code'), {USE_PROFILES: {html: true, svg: false, svgFilters: false}}) : '',
                    'label': DOMPurify.sanitize($('#form-item-label').val(), {USE_PROFILES: {html:false, svg: false, svgFilters: false}}),
CVE-2023-3083 (PHP, published 2023-06-03T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Severity: nan (CVSS v3 base score: 8.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
includes/core/load.js.php
includes/core/logout.php
index.php
pages/users.js.php
sources/main.queries.php
Commit message: 3.0.9

Fix xss in user form
WIP - session ending handling


Vulnerable code:
                    'login': DOMPurify.sanitize($('#form-login').val()),
                    'name': DOMPurify.sanitize($('#form-name').val()),
                    'lastname': DOMPurify.sanitize($('#form-lastname').val()),
                    'email': DOMPurify.sanitize($('#form-email').val()),
    header('Cache-Control: no-cache, must-revalidate');

Fixed code:

    $(document).ready(function() {
        //console.log('-- PAGE LOADED --'+$(location).attr('href').includes('?')+" -- "+store.get('teampassUser'));
        if ($(location).attr('href').includes('?') === true && (store.get('teampassUser') === undefined || parseInt(store.get('teampassUser').user_id) <= 0)) {
            $(location).attr('href', 'index.php?session=expired');
            return false;
        }

        // prevent a resubmit on refresh and back button
        if (window.history.replaceState) {
            window.history.replaceState(null, null, window.location.href);
        }
    });

        localStorage.clear();
header("Cache-Control: no-cache, no-store, must-revalidate");
header("Pragma: no-cache");
header("Expires: 0");

        //history.pushState(null, null, 'index.php?session=expired');
        /*function preventBack() {
            window.history.forward(); 
        }        
        setTimeout("preventBack()", 0);        
        window.onunload = function () { null };
        */
            // Sanitize text fields
            let formLogin = fieldSanitizeStep1('#form-login', false, false, false),
                formName = fieldSanitizeStep1('#form-name', false, false, false),
                formLastname = fieldSanitizeStep1('#form-lastname', false, false, false),
                formEmail = fieldSanitizeStep1('#form-email', false, false, false),
            if (formLogin === false || formName === false || formLastname === false || formEmail === false) {
                // Label is empty
                toastr.remove();
                toastr.warning(
                    'XSS attempt detected. Field has been emptied.',
                    'Error', {
                        timeOut: 5000,
                        progressBar: true
                    }
                );
                return false;
            }

                    'login': formLogin,
                    'name': formName,
                    'lastname': formLastname,
                    'email': formEmail,
    header('Cache-Control: no-cache');
CVE-2023-3084 (PHP, published 2023-06-03T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
includes/core/load.js.php
pages/items.js.php
pages/users.js.php
sources/identify.php
Commit message: 3.0.9

Fix for XSS on FolderName


Vulnerable code:
            if (typeof store.get('teampassUser').is_ready_for_usage !== 'undefined' && parseInt(store.get('teampassUser').is_ready_for_usage) === 0) {
            'title': DOMPurify.sanitize($('#form-folder-add-label').val(), {USE_PROFILES: {html: false}}),
            'icon': DOMPurify.sanitize($('#form-folder-add-icon').val(), {USE_PROFILES: {html: false}}),
            'iconSelected': DOMPurify.sanitize($('#form-folder-add-icon-selected').val(), {USE_PROFILES: {html: false}}),
                formEmail = fieldSanitizeStep1('#form-email', false, false, false),
                $userMfa['mfaData'],

Fixed code:
            if (typeof store.get('teampassUser') !== 'undefined' && typeof store.get('teampassUser').is_ready_for_usage !== 'undefined' && parseInt(store.get('teampassUser').is_ready_for_usage) === 0) {
        // Sanitize text fields
        let formLabel = fieldSanitizeStep1('#form-folder-add-label', false, false, false),
            formIcon = fieldSanitizeStep1('#form-folder-add-icon', false, false, false),
            formIconSelected = fieldSanitizeStep1('#form-folder-add-icon-selected', false, false, false);
        if (formLabel === false || formIcon === false || formIconSelected === false) {
            // Label is empty
            toastr.remove();
            toastr.warning(
                'XSS attempt detected. Field has been emptied.',
                'Error', {
                    timeOut: 5000,
                    progressBar: true
                }
            );
            return false;
        }

            'title': formLabel,
            'icon': formIcon,
            'iconSelected': formIconSelected,
                formEmail = fieldSanitizeStep1('#form-email', false, false, false);
                [
                    'error' => true,
                    'message' => $userMfa['mfaData']['message'],
                    'mfaStatus' => $userMfa['mfaData']['mfaStatus'],
                ],