hitoshura25/cvefixes huggingface dataset:
CVE-2024-24574 (PHP, published 2024-02-05T21:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/attachments.php
Commit message: Fixing unsafe render filename on attachments.php

Pathing the unsafe filename rendering that causing the Store XSS on attachments pages

Vulnerable code:
          <td><?= $item->filename ?></td>
          <td><?= $item->record_lang ?></td>
          <td><?= $item->mime_type ?></td>

Fixed code:
use phpMyFAQ\Strings;
          <td><?= Strings::htmlentities($item->filename); ?></td>
          <td><?= Strings::htmlentities($item->record_lang); ?></td>
          <td><?= Strings::htmlentities($item->mime_type); ?></td>
CVE-2024-24574 (PHP, published 2024-02-05T21:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leads to allowed execution of JavaScript code in client side (XSS). This vulnerability has been patched in version 3.2.5.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/attachments.php
Commit message: Fixing unsafe render filename on attachments.php

Pathing the unsafe filename rendering that causing the Store XSS on attachments pages

Vulnerable code:
          <td><?= $item->filename ?></td>
          <td><?= $item->record_lang ?></td>
          <td><?= $item->mime_type ?></td>

Fixed code:
use phpMyFAQ\Strings;
          <td><?= Strings::htmlentities($item->filename); ?></td>
          <td><?= Strings::htmlentities($item->record_lang); ?></td>
          <td><?= Strings::htmlentities($item->mime_type); ?></td>
CVE-2024-27299 (PHP, published 2024-03-25T19:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. A SQL injection vulnerability has been discovered in the the "Add News" functionality due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. The vulnerable field lies in the  `authorEmail` field which uses PHP's `FILTER_VALIDATE_EMAIL` filter. This filter is insufficient in protecting against SQL injection attacks and should still be properly escaped. However, in this version of phpMyFAQ (3.2.5), this field is not escaped properly can be used together with other fields to fully exploit the SQL injection vulnerability. This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/src/phpMyFAQ/News.php
Commit message: fix: added missing escapting of value


Vulnerable code:
            $data['authorEmail'],
            $data['authorEmail'],

Fixed code:
            $this->configuration->getDb()->escape($data['authorEmail']),
            $this->configuration->getDb()->escape($data['authorEmail']),
CVE-2024-27300 (PHP, published 2024-03-25T19:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The `email` field in phpMyFAQ's user control panel page is vulnerable to stored XSS attacks due to the inadequacy of PHP's `FILTER_VALIDATE_EMAIL` function, which only validates the email format, not its content. This vulnerability enables an attacker to execute arbitrary client-side JavaScript within the context of another user's phpMyFAQ session. This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/user.php
phpmyfaq/ucp.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                        <a href="mailto:<?= $user->getUserData('email') ?>">
                            <?= $user->getUserData('email') ?>
            'email' => $user->getUserData('email'),

Fixed code:
                        <a href="mailto:<?= Strings::htmlentities($user->getUserData('email')) ?>">
                            <?= Strings::htmlentities($user->getUserData('email')) ?>
            'email' => Strings::htmlentities($user->getUserData('email')),
CVE-2024-28105 (PHP, published 2024-03-25T19:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/api/attachment.php
phpmyfaq/src/phpMyFAQ/Attachment/File.php
Commit message: fix: don't allow to upload arbitrary binary data


Vulnerable code:
                $file['type'] !== "text/html"
                $response->setData('The image is too large.');
                // Doing this check we're sure not to unnecessary

Fixed code:
                $file['type'] !== 'text/html' && $file['type'] !== 'application/octet-stream'
                $response->setData('The file is too large or unsupported.');
                // Doing this check, we're sure not to unnecessarily
CVE-2024-28106 (PHP, published 2024-03-25T19:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in a POST request, an attacker can inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS payload triggers. This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/news.php
Commit message: fix: added missing cleanup for news content


Vulnerable code:

Fixed code:
use phpMyFAQ\Helper\FaqHelper;
$helper = new FaqHelper($faqConfig);
$newsContent = $helper->cleanUpContent($newsContent);
CVE-2024-28107 (PHP, published 2024-03-25T19:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases.  A SQL injection vulnerability has been discovered in the `insertentry` & `saveentry` when modifying records due to improper escaping of the email address. This allows any authenticated user with the rights to add/edit FAQ news to exploit this vulnerability to exfiltrate data, take over accounts and in some cases, even achieve RCE. This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/src/phpMyFAQ/Faq.php
Commit message: fix: added missing escapting of value


Vulnerable code:
            $faq->getEmail(),
            $faq->getNotes()
            $faq->getEmail(),
            $faq->getNotes(),

Fixed code:
            $this->config->getDb()->escape($faq->getEmail()),
            $this->config->getDb()->escape($faq->getNotes())
            $this->config->getDb()->escape($faq->getEmail()),
            $this->config->getDb()->escape($faq->getNotes()),
CVE-2024-28108 (PHP, published 2024-03-25T19:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the `contentLink` parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. _Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ._ This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/api.service.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                    $contentLink

Fixed code:
                    Strings::htmlentities($contentLink)
CVE-2024-29196 (PHP, published 2024-03-26T03:15Z)
Description: value: phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thorsten/phpMyFAQ
Files changed:
phpmyfaq/admin/configuration.php
Commit message: fix: improved check on path


Vulnerable code:
            $editData['edit']['records.attachmentsPath'] = str_replace(
                '../',
                '',
                $editData['edit']['records.attachmentsPath']
            );

Fixed code:
use Symfony\Component\HttpFoundation\Request;
            if (false !== realpath($editData['edit']['records.attachmentsPath'])) {
                $editData['edit']['records.attachmentsPath'] = str_replace(
                    Request::createFromGlobals()->server->get('DOCUMENT_ROOT') . DIRECTORY_SEPARATOR,
                    '',
                    realpath($editData['edit']['records.attachmentsPath'])
                );
            } else {
                unset($editData['edit']['records.attachmentsPath']);
            }
CVE-2020-14976 (C, published 2020-06-23T20:15Z)
Description: value: GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/GNS3/ubridge
Files changed:
src/iniparser/iniparser.c
src/iniparser/iniparser.h
src/parse.c
Commit message: Hide errored line content during parsing configuration INI file on default


Vulnerable code:
dictionary * iniparser_load(const char * ininame)
            fprintf(stderr, "iniparser: syntax error in %s (%d):\n",
                    ininame,
                    lineno);
            fprintf(stderr, "-> %s\n", line);
dictionary * iniparser_load(const char * ininame);
    if ((ubridge_config = iniparser_load(filename)) == NULL) {

Fixed code:
dictionary * iniparser_load(const char * ininame, load_options options)

            if(options & HIDE_ERRORED_LINE_CONTENT) {
              fprintf(stderr, "iniparser: syntax error in %s (%d)\n",
                      ininame,
                      lineno);
            }
            else {
              fprintf(stderr, "iniparser: syntax error in %s (%d):\n",
                      ininame,
                      lineno);
              fprintf(stderr, "-> %s\n", line);
            }
typedef enum {
  HIDE_ERRORED_LINE_CONTENT = (1<<0)
} load_options;

  @param    options Name of the ini file to read.
dictionary * iniparser_load(const char * ininame, load_options options);
    if ((ubridge_config = iniparser_load(filename, HIDE_ERRORED_LINE_CONTENT)) == NULL) {
CVE-2020-7964 (Unknown, published 2020-01-24T20:15Z)
Description: value: An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/mirumee/saleor
Files changed:
Commit message: Merge pull request #5192 from maarcingebala/fix-checkout-attach-user-permissions

Fix permission for checkoutCustomerAttach mutation

Vulnerable code:

Fixed code:
CVE-2018-1002205 (Unknown, published 2018-07-25T17:29Z)
Description: value: DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/haf/DotNetZip.Semverd
Files changed:
Commit message: Merge pull request #121 from shana/bugs/relative-paths

Sanitize zip entry paths before extracting

Vulnerable code:

Fixed code:
CVE-2021-21321 (JavaScript, published 2021-03-02T04:15Z)
Description: value: fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server. In fastify-reply-from before version 4.0.2, by crafting a specific URL, it is possible to escape the prefix of the proxied backend service. If the base url of the proxied server is "/pub/", a user expect that accessing "/priv" on the target service would not be possible. In affected versions, it is possible. This is fixed in version 4.0.2.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/fastify/fastify-reply-from
Files changed:
lib/utils.js
test/build-url.js
test/unix-http.js
Commit message: Merge pull request from GHSA-qmw8-3v4g-gwj4

* fix: Re-enable unix+http:// base URL, prevent escape of base URL path

Co-Authored-By: Corey Farrell <git@cfware.com>

* More fixes

* Test more build-url error cases

Co-authored-by: Corey Farrell <git@cfware.com>

Vulnerable code:
  if (reqBase && !reqBase.startsWith(dest.origin)) {
    throw new Error('source must be a relative path string')
  { source: 'urn:foo:bar', base: 'http://localhost' }
instance.register(From)
const socketPath = `${__filename}.socket`

  reply.from(`unix+http://${querystring.escape(socketPath)}/hello`)

Fixed code:
  if (reqBase) {
    if (!reqBase.endsWith('/') && dest.href.length > reqBase.length) {
      reqBase = reqBase + '/'
    }

    if (!dest.href.startsWith(reqBase)) {
      throw new Error('source must be a relative path string')
    }
test('should handle lack of trailing slash in base', (t) => {
  t.plan(3)
  let url = buildURL('hi', 'http://localhost/hi')
  t.equal(url.href, 'http://localhost/hi')

  url = buildURL('hi/', 'http://localhost/hi')
  t.equal(url.href, 'http://localhost/hi/')

  url = buildURL('hi/more', 'http://localhost/hi')
  t.equal(url.href, 'http://localhost/hi/more')
})

  { source: 'urn:foo:bar', base: 'http://localhost' },
  { source: 'http://localhost/private', base: 'http://localhost/exposed/' },
  { source: 'http://localhost/exposed-extra', base: 'http://localhost/exposed' },
  { source: '/private', base: 'http://localhost/exposed/' },
  { source: '/exposed-extra', base: 'http://localhost/exposed' },
  { source: '../private', base: 'http://localhost/exposed/' },
  { source: 'exposed-extra', base: 'http://localhost/exposed' }
const socketPath = `${__filename}.socket`
const upstream = `unix+http://${querystring.escape(socketPath)}/`

instance.register(From, { base: upstream })
  reply.from('hello')
CVE-2014-125032 (PHP, published 2023-01-02T08:15Z)
Description: value: A vulnerability was found in porpeeranut go-with-me. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file module/frontend/add.php. The manipulation leads to sql injection. The identifier of the patch is b92451e4f9e85e26cf493c95ea0a69e354c35df9. It is recommended to apply a patch to fix this issue. The identifier VDB-217177 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/porpeeranut/go-with-me
Files changed:
module/frontend/add.php
Commit message: Fix sql injection in add.php file


Vulnerable code:
  $owner = $m_id;
  $loc_id = $_POST["loc_id"];
  $timing_id = $_POST["timing_id"];
  $pos_id = $_POST["pos_id"];
  $msg = $_POST["msg"];
  $p_id = $_POST["p_id"];
  $p_id = $_POST["p_id"];
  $to = $_POST["to"];
  $msg = $_POST["msg"];

Fixed code:
  $owner = intval($m_id);
  $loc_id = intval($_POST["loc_id"]);
  $timing_id = intval($_POST["timing_id"]);
  $pos_id = intval($_POST["pos_id"]);
  $msg = clean($_POST["msg"]);
  $p_id = intval($_POST["p_id"]);
  $p_id = intval($_POST["p_id"]);
  $to = intval($_POST["to"]);
  $msg = clean($_POST["msg"]);
CVE-2024-23329 (Python, published 2024-01-19T20:15Z)
Description: value:  changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 3.7)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/dgtlmoon/changedetection.io
Files changed:
changedetectionio/api/api_v1.py
Commit message: Security update - Adding API token secure check for API endpoint `/api/v1/watch/<uuid>/history` @rozpuszczalny


Vulnerable code:

Fixed code:
    @auth.check_token
CVE-2021-41110 (Java, published 2021-10-01T13:15Z)
Description: value: cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/common-workflow-language/cwlviewer
Files changed:
src/main/java/org/commonwl/view/cwl/CWLService.java
Commit message: Use Yaml SafeConstructor (#355)



Vulnerable code:
        Yaml reader = new Yaml();
        Path p;
        
        Yaml reader = new Yaml();

Fixed code:
import org.yaml.snakeyaml.constructor.SafeConstructor;
        Yaml reader = new Yaml(new SafeConstructor());
        Yaml reader = new Yaml(new SafeConstructor());
CVE-2019-12900 (C, published 2019-06-19T23:15Z)
Description: value: BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://gitlab.com/federicomenaquintero/bzip2
Files changed:
decompress.c
Commit message: Make sure nSelectors is not out of range

nSelectors is used in a loop from 0 to nSelectors to access selectorMtf
which is
	UChar    selectorMtf[BZ_MAX_SELECTORS];
so if nSelectors is bigger than BZ_MAX_SELECTORS it'll do an invalid memory
access

Fixes out of bounds access discovered while fuzzying karchive


Vulnerable code:
      if (nSelectors < 1) RETURN(BZ_DATA_ERROR);

Fixed code:
      if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR);