hitoshura25/cvefixes huggingface dataset:
CVE-2023-2949 (PHP, published 2023-05-28T04:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/forms/eye_mag/js/eye_base.php
interface/main/finder/dynamic_finder.php
interface/main/finder/dynamic_finder_ajax.php
library/custom_template/share_template.php
Commit message: fixes: couple more misc fixes (#6336)



Vulnerable code:
        'from_id'           : <?php echo js_escape($providerID); ?>,
        let serverUrl = "dynamic_finder_ajax.php?csrf_token_form=" + <?php echo js_url(CsrfUtils::collectCsrfToken()); ?>;
            serverUrl += "&search_any=" + srcAny;
// Not checking csrf for good reasons.
//  1. Not needed since no state changes in this script
//  2. It will cause potential session clash fails because it throws a popup which messes things up
//     when opening a patient in a new window.
                     list_id: <?php echo htmlspecialchars($list_id, ENT_QUOTES);?>,
                    alert("<?php echo addslashes(xl('You should select at least one Provider'));?>");
                                echo "<option value='" . htmlspecialchars($row['id'], ENT_QUOTES) . "' $sel>" . htmlspecialchars($row['lname'] . "," . $row['fname'], ENT_QUOTES) . "</option>";
                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo htmlspecialchars(xl('Save'), ENT_QUOTES);?></span></a>

Fixed code:
        'from_id'           : <?php echo attr_js($providerID); ?>,
        let serverUrl = "dynamic_finder_ajax.php";
            serverUrl += "?search_any=" + srcAny;
// Not checking csrf since it breaks when opening up a patient in a new frame.
//  Also note that csrf checking is not needed in this script because of following 2 reasons.
//  1. cookie_samesite in OpenEMR is set to 'Strict', which is an effective security measure to stop csrf vulnerabilities.
//  2. Additionally, in this script there are no state changes, thus it is not even sensitive to csrf vulnerabilities.
                     list_id: <?php echo js_escape($list_id); ?>,
                    alert(<?php echo xlj('You should select at least one Provider');?>);
                                echo "<option value='" . attr($row['id']) . "' $sel>" . text($row['lname'] . "," . $row['fname']) . "</option>";
                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo xlt('Save');?></span></a>
CVE-2023-48711 (TypeScript, published 2023-11-24T17:15Z)
Description: value: google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the `google-translate-api-browser` package and exposing the `translateOptions` to the end user. An attacker can set a malicious `tld`, causing the application to return unsafe URLs pointing towards local resources. The `translateOptions.tld` field is not properly sanitized before being placed in the Google translate URL. This can allow an attacker with control over the `translateOptions` to set the `tld` to a payload such as `@127.0.0.1`. This causes the full URL to become `https://translate.google.@127.0.0.1/...`, where `translate.google.` is the username used to connect to localhost. An attacker can send requests within internal networks and the local host. Should any HTTPS application be present on the internal network with a vulnerability exploitable via a GET call, then it would be possible to exploit this using this vulnerability. This issue has been addressed in release version 4.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 3.7)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/cjvnjde/google-translate-api-browser
Files changed:
package.json
src/generateRequestUrl.ts
src/normaliseResponse.ts
src/translate.server.ts
Commit message: Add tld validation


Vulnerable code:
  "version": "4.1.1",
    throw new Error('No data')
    const encodedData = encodeURIComponent(`[[["${translateOptions.rpcids}","[[\\"${text}\\",\\"${translateOptions.from}\\",\\"${translateOptions.to}\\",true],[1]]",null,"generic"]]]`);
    const body = `f.req=${encodedData}&`;

    }).on('error', (err) => {
      reject(err)
    })

Fixed code:
  "version": "4.1.3",
function validateTLD(tld: string) {
  return Boolean(tld.match(/^[a-zA-Z]{2,63}$/));
}

  if (!validateTLD(translateOptions.tld)) {
    throw new Error("Invalid TLD: Must be 2-63 letters only")
  }

    throw new Error('Data is either empty or corrupted')
export function createRequestBody(text: string, translateOptions: Pick<TranslateOptions, "to" | "from" | "rpcids">) {
    const encodedData = encodeURIComponent(`[[["${translateOptions.rpcids}","[[\\"${text}\\",\\"${translateOptions.from}\\",\\"${translateOptions.to}\\",true],[1]]",null,"generic"]]]`);
    return `f.req=${encodedData}&`;
}

    const body = createRequestBody(text, translateOptions);
    }).on('error', reject);
CVE-2022-0121 (Other, published 2022-01-06T03:15Z)
Description: value: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.


Severity: MEDIUM (CVSS v3 base score: 8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hoppscotch/hoppscotch
Files changed:
packages/hoppscotch-app/components/lenses/renderers/HTMLLensRenderer.vue
Commit message: fix: apply sandbox to HTML preview iframe


Vulnerable code:

Fixed code:
      sandbox=""
CVE-2023-34097 (TypeScript, published 2023-06-05T21:15Z)
Description: value: hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability. 
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/hoppscotch/hoppscotch
Files changed:
packages/hoppscotch-backend/src/main.ts
Commit message: fix: stop logging DATABASE_URL in logs


Vulnerable code:
  console.log(`Database: ${process.env.DATABASE_URL}`);

Fixed code:
CVE-2024-27092 (Other, published 2024-02-29T01:44Z)
Description: value: Hoppscotch is an API development ecosystem.  Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achieve own goals by malicious actors.  This issue is fixed in 2023.12.6.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/hoppscotch/hoppscotch
Files changed:
packages/hoppscotch-backend/src/mailer/mailer.service.ts
packages/hoppscotch-backend/src/mailer/templates/team-invitation.hbs
packages/hoppscotch-backend/src/mailer/templates/user-invitation.hbs
Commit message: refactor: possible links in email templates do not highlight (#3851)



Vulnerable code:
        return `${mailDesc.variables.invitee} invited you to join ${mailDesc.variables.invite_team_name} in Hoppscotch`;
<p>{{invitee}} with {{invite_team_name}} has invited you to use Hoppscotch to collaborate with them. Click the button below to set up your account and get started:</p>
<p><strong>P.S.</strong> If you don't associate with {{invitee}} or {{invite_team_name}}, just ignore this email.</p>
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    

Fixed code:
        return `A user has invited you to join a team workspace in Hoppscotch`;
    a.nohighlight {
      color: inherit !important;
      text-decoration: none !important;
      cursor: default !important;
    }

<p><a class="nohighlight" name="invitee" href="#">{{invitee}}</a> with <a class="nohighlight" name="invite_team_name" href="#">{{invite_team_name}}</a> has invited you to use Hoppscotch to collaborate with them. Click the button below to set up your account and get started:</p>
<p><strong>P.S.</strong> If you don't associate with <a class="nohighlight" name="invitee" href="#">{{invitee}}</a> or <a class="nohighlight" name="invite_team_name" href="#">{{invite_team_name}}</a>, just ignore this email.</p>



    a.nohighlight {
      color: inherit !important;
      text-decoration: none !important;
      cursor: default !important;
    }
CVE-2024-34699 (CSS, published 2024-05-14T15:39Z)
Description: value: GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in `v0.20.1`.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/GZTimeWalker/GZCTF
Files changed:
src/GZCTF/ClientApp/src/components/GameNoticePanel.tsx
src/GZCTF/ClientApp/src/styles/shared/Typography.module.css
Commit message: fix(security): html injection by team name


Vulnerable code:
                    <InlineMarkdownRender
                      fz="sm"
                      fw={500}
                      c="dimmed"
                      source={formatNotice(t, notice)}
                    />
  word-break: break-word;

Fixed code:
import classes from '@Styles/Typography.module.css'
                    {notice.type === NoticeType.Normal ? (
                      <InlineMarkdownRender
                        fz="sm"
                        fw={500}
                        c="dimmed"
                        source={formatNotice(t, notice)}
                      />
                    ) : (
                      <Text fz="sm" fw={500} c="dimmed" className={classes.inline}>
                        {formatNotice(t, notice)}
                      </Text>
                    )}
  word-break: break-all;
  white-space: pre-wrap;
CVE-2023-50254 (Other, published 2023-12-22T17:15Z)
Description: value: Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/linuxdeepin/deepin-reader
Files changed:
debian/changelog
Commit message: fix: change log 6.0.7

change log 6.0.7

Log: change log 6.0.7


Vulnerable code:

Fixed code:
deepin-reader (6.0.7) unstable; urgency=medium

  * change log 6.0.7.

 -- muyuankai <muyuankai@uniontech.com>  Tue, 19 Dec 2023 11:49:10 +0800
CVE-2023-50254 (C++, published 2023-12-22T17:15Z)
Description: value: Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/linuxdeepin/deepin-reader
Files changed:
reader/document/Model.cpp
Commit message: fix: deal with docx document format

deal with docx document format

Bug: https://pms.uniontech.com/bug-view-232871.html
Log: deal with docx document format


Vulnerable code:

Fixed code:
#include <QTemporaryFile>
        QTemporaryFile tmpFile(convertedFileDir + "/word/" + QCoreApplication::applicationName() + "_XXXXXX.html");
        if( tmpFile.open()) { //fix 232871
             tmpHtmlFilePath = tmpFile.fileName(); // returns the unique file name
         }
CVE-2014-2527 (C++, published 2014-08-26T14:55Z)
Description: value: kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " (double quote) character in the directory name, a different vulnerability than CVE-2014-2528.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://bitbucket.org/jeromerobert/k4dirstat
Files changed:
src/kcleanup.cpp
Commit message: Properly escape %p and %n in cleaning actions


Vulnerable code:

    expanded.replace( QRegExp( "%p" ),
		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
    expanded.replace( QRegExp( "%n" ),
		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );

Fixed code:
    QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
CVE-2014-2528 (C++, published 2014-08-26T14:55Z)
Description: value: kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://bitbucket.org/jeromerobert/k4dirstat
Files changed:
src/kcleanup.cpp
Commit message: Properly escape %p and %n in cleaning actions


Vulnerable code:

    expanded.replace( QRegExp( "%p" ),
		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
    expanded.replace( QRegExp( "%n" ),
		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );

Fixed code:
    QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
CVE-2022-31139 (Java, published 2022-07-11T19:15Z)
Description: value: UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up `SecurityCheck.AccessLimiter` for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom `SecurityCheck.AccessLimiter` is not set up. Version 1.7.0 contains a patch.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/Karlatemp/UnsafeAccessor
Files changed:
api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java
api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java
Commit message: Fix UnsafeAccess perm checking


Vulnerable code:
        getUnsafe().throwException(throwable);
        throw new RuntimeException();
        SecurityCheck.getInstance();

Fixed code:
        Unsafe.getUnsafe0().throwException(throwable);
        throw new RuntimeException(throwable);
        SecurityCheck.AccessLimiter accessLimiter = SecurityCheck.getInstance().getLimiter();
        if (accessLimiter != null) accessLimiter.preGetUnsafeAccess();
CVE-2023-31285 (Other, published 2023-04-27T03:15Z)
Description: value: An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/serenity-is/Serenity
Files changed:
CHANGELOG.md
build/Package.Build.props
Commit message: :up: 6.7.0


Vulnerable code:
    <Version>6.6.6</Version>

Fixed code:
## 6.7.0 (2023-04-06)

Features:

  - **[WARNING!]** This release focuses on addressing potential security issues that were recently discovered by Fabian Densborn from SEC Consult. Serene/StartSharp users must either create a new project from the 6.7.0+ template or manually apply the relevant changes from this commit to their existing applications after updating Serenity packages to 6.7.0+: https://github.com/serenity-is/serene/commit/6dce8162f4382badd429a9f0f1470acb64e8c4fd
    
  - Serenity.is would like to express gratitude to Fabian Densborn for his discovery, analysis, and coordination, as well as the SEC Consult Vulnerability Lab (https://www.sec-consult.com) for responsibly reporting the identified issues and collaborating with us as we addressed them.
    
  - Added the option to use ClamAV (https://www.clamav.net/) as an antivirus scanner for temporary uploads. To enable it, add `services.ConfigureSection<Serenity.Extensions.ClamAVSettings>(Configuration);` and `services.AddSingleton<IUploadAVScanner, Serenity.Extensions.ClamAVUploadScanner>();` to your Startup.cs after upgrading to Serenity/Serenity.Extensions 6.7.0+. Consult ClamAV documentation on how to install it on your platform. This feature will be enabled by default once these changes have been made in Startup.cs. If you want to disable it for development purposes, set ClamAV:Enabled to false in your appsettings.Development.json (not recommended for production!).
    
  - Added extensionless and `.htm`/`.html` to the upload file extensions blacklist by default. An attacker can include malicious scripts in such an HTML file, send an administrative user a link to that file via email, and if the administrative user is already logged in to the site while clicking the link, the script can call services, perform actions, etc. on behalf of the user as the cookies are sent by the browser.
    
  - Ensured that the Forgot password page does not reveal information to identify whether a user with the entered email exists.
    
  - Ensured that reset password tokens can only be used once. They already expired in 3 hours, but if an attacker could see the link within that time frame (e.g., by eavesdropping), they could use it to change the password again.

    <Version>6.7.0</Version>