hitoshura25/cvefixes huggingface dataset:
CVE-2023-43813 (PHP, published 2023-12-13T19:15Z)
Description: value: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
ajax/pin_savedsearches.php
Commit message: Merge pull request from GHSA-94c3-fw5r-3362



Vulnerable code:

Fixed code:
if (!is_string($_POST['itemtype']) || getItemForItemtype($_POST['itemtype']) === false) {
    echo json_encode(['success' => false]);
    exit();
}
CVE-2023-51446 (PHP, published 2024-02-01T18:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/AuthLDAP.php
Commit message: Escape user login during LDAP operations


Vulnerable code:

Fixed code:
        } else {
            $filter_value = ldap_escape($filter_value, '', LDAP_ESCAPE_FILTER);
CVE-2023-51446 (PHP, published 2024-02-01T18:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-90 \u2014 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/AuthLDAP.php
Commit message: Escape user login during LDAP operations


Vulnerable code:

Fixed code:
        } else {
            $filter_value = ldap_escape($filter_value, '', LDAP_ESCAPE_FILTER);
CVE-2024-23645 (PHP, published 2024-02-01T18:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages.  Upgrade to 10.0.12.

Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/glpi-project/glpi
Files changed:
front/stat.global.php
front/stat.graph.php
front/stat.location.php
front/stat.tracking.php
src/Stat.php
Commit message: Sanitize parameters and encode special chars


Vulnerable code:
echo "<input type='hidden' name='itemtype' value=\"" . $_GET['itemtype'] . "\">";
}
// Why this test ?? For me it's doing nothing
if (isset($_GET["dropdown"])) {
    $_GET["dropdown"] = $_GET["dropdown"];
echo "<input type='hidden' name='itemtype' value='" . $_GET['itemtype'] . "'>";
    $year              = date("Y") - 1;
echo "<input type='hidden' name='itemtype' value=\"" . $_GET["itemtype"] . "\">";
        $out .= "<input type='hidden' name='itemtype' value='$itemtype'>";

Fixed code:
//sanitize dates
foreach (['date1', 'date2'] as $key) {
    if (array_key_exists($key, $_GET) && preg_match('/\d{4}-\d{2}-\d{2}/', (string)$_GET[$key]) !== 1) {
        unset($_GET[$key]);
    }
}
//sanitize dates
foreach (['date1', 'date2'] as $key) {
    if (array_key_exists($key, $_GET) && preg_match('/\d{4}-\d{2}-\d{2}/', (string)$_GET[$key]) !== 1) {
        unset($_GET[$key]);
    }
    if (array_key_exists($key, $_POST) && preg_match('/\d{4}-\d{2}-\d{2}/', (string)$_POST[$key]) !== 1) {
        unset($_POST[$key]);
    }
}
echo "<input type='hidden' name='itemtype' value=\"" . htmlspecialchars($_GET['itemtype']) . "\">";
} else {
    $_GET["showgraph"] = (int)$_GET["showgraph"];
//sanitize dates
foreach (['date1', 'date2'] as $key) {
    if (array_key_exists($key, $_GET) && preg_match('/\d{4}-\d{2}-\d{2}/', (string)$_GET[$key]) !== 1) {
        unset($_GET[$key]);
    }
}
} else {
    $_GET["start"] = (int)$_GET["start"];
} else {
    $_GET["dropdown"] = (string)$_GET["dropdown"];
} else {
    $_GET['itemtype'] = (string)$_GET["itemtype"];
echo "<input type='hidden' name='itemtype' value=\"" . htmlspecialchars($_GET['itemtype']) . "\">";
} else {
    $_GET["type"] = (string)$_GET["type"];
} else {
    $_GET["showgraph"] = (int)$_GET["showgraph"];
//sanitize dates
foreach (['date1', 'date2'] as $key) {
    if (array_key_exists($key, $_GET) && preg_match('/\d{4}-\d{2}-\d{2}/', (string)$_GET[$key]) !== 1) {
        unset($_GET[$key]);
    }
}
    $year          = date("Y") - 1;
} else {
    $_GET["start"] = (int)$_GET["start"];
echo "<input type='hidden' name='itemtype' value=\"" . htmlspecialchars($_GET["itemtype"]) . "\">";
        $out .= "<input type='hidden' name='itemtype' value=\"" . htmlspecialchars($itemtype) . "\">";
CVE-2024-27096 (PHP, published 2024-03-18T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Search.php
Commit message: Merge pull request from GHSA-2x8m-vrcm-2jqv



Vulnerable code:

Fixed code:
        $int_params = [
            'sort'
        ];

        foreach ($params as $key => &$val) {
            if (in_array($key, $int_params)) {
                if (is_array($val)) {
                    foreach ($val as &$subval) {
                        $subval = (int)$subval;
                    }
                } else {
                    $val = (int)$val;
                }
            }
        }
CVE-2024-27104 (PHP, published 2024-03-18T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/Dashboard/Widget.php
Commit message: Merge pull request from GHSA-prc3-cx5m-h5mj



Vulnerable code:
         <div class="html_content">{$md->transform($p['markdown_content'])}</div>

Fixed code:
        $content = RichText::getSafeHtml($md->transform($p['markdown_content']));

         <div class="html_content">{$content}</div>
CVE-2024-27914 (JavaScript, published 2024-03-18T17:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS  vulnerability. The XSS will only trigger if the administrator navigates through the debug bar. This issue has been patched in version 10.0.13.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/glpi-project/glpi
Files changed:
js/modules/Debug/Debug.js
Commit message: Merge pull request from GHSA-rcxj-fqr4-q34r



Vulnerable code:
            text.replace('>', `&gt;`).replace('<', `&lt;`);

Fixed code:
            text = escapeMarkupText(text);
CVE-2024-31456 (PHP, published 2024-05-07T14:15Z)
Description: value: GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/glpi-project/glpi
Files changed:
ajax/map.php
src/Search.php
Commit message: Merge pull request from GHSA-gcj4-2cp3-6h5j



Vulnerable code:
    $params   = $_POST['params'];

Fixed code:
    $params = $_POST['params'];
        $p = self::cleanParams($p);

        return self::cleanParams($params);
    }

    public static function cleanParams(array $params): array
    {
CVE-2024-34060 (Python, published 2024-05-23T12:15Z)
Description: value: IrisEVTXModule is an interface module for Evtx2Splunk and Iris in order to ingest Microsoft EVTX log files. The `iris-evtx-module` is a pipeline plugin of `iris-web` that processes EVTX files through IRIS web application. During the upload of an EVTX through this pipeline, the filename is not safely handled and may cause an Arbitrary File Write. This can lead to a remote code execution (RCE) when combined with a Server Side Template Injection (SSTI). This vulnerability has been patched in version 1.0.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dfir-iris/iris-evtx-module
Files changed:
iris_evtx/IrisEVTXInterface.py
requirements.txt
Commit message: [FIX] Filename secure escape


Vulnerable code:
from celery import chain, current_app
from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes
from iris_evtx.EVTXImportDispatcher import ImportDispatcher
            file_handle.save(Path(base_path, file_handle.filename))
iris_interface==1.2.0

Fixed code:
from werkzeug.utils import secure_filename
from iris_interface.IrisModuleInterface import IrisPipelineTypes, IrisModuleInterface, IrisModuleTypes

from iris_evtx.EVTXImportDispatcher import ImportDispatcher
            # Sanitize the filename
            file_name = secure_filename(file_handle.filename)
            file_handle.save(Path(base_path, file_name))
iris_interface==1.2.0
werkzeug
CVE-2022-39228 (Unknown, published 2023-03-01T17:15Z)
Description: value: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This issue has been fixed in version 3.8.0.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-36gx-9q6h-g429

Advisory fix 1 - notify user that his account is locked through email

Vulnerable code:

Fixed code:
CVE-2023-22738 (Unknown, published 2023-03-01T21:15Z)
Description: value: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assigned to organization B, they will retain their permissions and therefore might be able to access stuff they should not be allowed to access. This issue is patched in version 3.8.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-281 \u2014 Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-vvjv-97j8-94xh

Remove option to change organization id of an existing user

Vulnerable code:

Fixed code:
CVE-2023-23929 (Unknown, published 2023-03-04T00:15Z)
Description: value: vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-4w59-c3gc-rrhp

Introduce maximum length of refresh tokens

Vulnerable code:

Fixed code:
CVE-2023-23930 (Unknown, published 2023-10-11T18:15Z)
Description: value: vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-5m22-cfq9-86x6

Removing pickle serialization/deserialization

Vulnerable code:

Fixed code:
CVE-2023-47631 (Unknown, published 2023-11-14T21:15Z)
Description: value: vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected versions a node does not check if an image is allowed to run if a `parent_id` is set. A malicious party that breaches the server may modify it to set a fake `parent_id` and send a task of a non-whitelisted algorithm. The node will then execute it because the `parent_id` that is set prevents checks from being run. This impacts all servers that are breached by an expert user. This vulnerability has been patched in version 4.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-vc3v-ppc7-v486

Remove lines that skip checking if algorithm is allowed when parent id is set

Vulnerable code:

Fixed code:
CVE-2024-21649 (Unknown, published 2024-01-30T16:15Z)
Description: value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution.  This vulnerability is patched in 4.2.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-w9h2-px87-74vx

Resolve security advisory for remote code execution within algorithm …

Vulnerable code:

Fixed code:
CVE-2024-21653 (Unknown, published 2024-01-30T16:15Z)
Description: value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  Nodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive.  The vulnerability can be mitigated by removing the ssh part from the docker file and rebuilding the docker image.  Version 4.2.0 patches the vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-2wgc-48g2-cj5w

Delete option to login via SSH into the node/server container

Vulnerable code:

Fixed code:
CVE-2024-21671 (Unknown, published 2024-01-30T16:15Z)
Description: value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC).  It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks.  Version 4.2.0 patches this vulnerability.
Severity: nan (CVSS v3 base score: 3.7)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-45gq-q4xh-cp53

Fix for username timing attack

Vulnerable code:

Fixed code:
CVE-2024-22193 (Unknown, published 2024-01-30T16:15Z)
Description: value: The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a task with sensitive input data that will then be stored unencrypted in a database.  Users should ensure they set the encryption setting correctly.  This vulnerability is patched in 4.2.0.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-rjmv-52mp-gjrr

Fix that tasks are not created if the input encryption status does no…

Vulnerable code:

Fixed code:
CVE-2024-23823 (Unknown, published 2024-03-14T19:15Z)
Description: value: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the allowed origins of the server.  The impact is limited because v6 does not use session cookies. This issue has been addressed in commit `70bb4e1d8` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-4946-85pr-fvxh

Implement server configuration option to specification of allowed CORS origins

Vulnerable code:

Fixed code:
CVE-2024-24770 (Unknown, published 2024-03-14T19:15Z)
Description: value: vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the API routes `/recover/lost` and `/2fa/lost`. These routes send emails to users if they have lost their password or MFA token. This issue has been addressed in commit `aecfd6d0e` and is expected to ship in subsequent releases. Users are advised to upgrade as soon as a new release is available. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-5h3x-6gwf-73jm

Password recovery: limit emails & aim for constant-time response

Vulnerable code:

Fixed code:
CVE-2024-32969 (Unknown, published 2024-05-23T09:15Z)
Description: value: vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and use that to read task results of other collaborations that that organization is involved in.  This is only relatively trusted users - with access to manage a collaboration - are able to do this, which reduces the impact. This vulnerability was patched in version 4.5.0rc3.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vantage6/vantage6
Files changed:
Commit message: Merge pull request from GHSA-99r4-cjp4-3hmx

Advisory fix prevent extension permissions collab admin

Vulnerable code:

Fixed code: