hitoshura25/cvefixes huggingface dataset:
CVE-2020-26238 (XML, published 2020-11-25T00:15Z)
Description: value: Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/jmrozanec/cron-utils
Files changed:
pom.xml
Commit message: Update dependencies to fix security vulnerability.


Vulnerable code:
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-validator</artifactId>
            <version>5.3.6.Final</version>

Fixed code:
            <groupId>org.apache.bval</groupId>
            <artifactId>bval-jsr</artifactId>
            <version>1.1.2</version>
            <!--The Hibernate dependency is no longer used, due to security vulnerabilities -->
CVE-2021-41269 (Unknown, published 2021-11-15T21:15Z)
Description: value: cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/jmrozanec/cron-utils
Files changed:
Commit message: Merge pull request #493 from pwntester/patch-1

Prevent arbitrary EL expression evaluation

Vulnerable code:

Fixed code:
CVE-2021-41269 (Unknown, published 2021-11-15T21:15Z)
Description: value: cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/jmrozanec/cron-utils
Files changed:
Commit message: Merge pull request #494 from NielsDoucet/RCE-fix

Resolve RCE vulnerability.

Vulnerable code:

Fixed code:
CVE-2017-14313 (PHP, published 2017-09-12T00:29Z)
Description: value: The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/michaelryanmcneill/shibboleth
Files changed:
shibboleth.php
Commit message: escape url after add_query_arg


Vulnerable code:
	echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';

Fixed code:
	echo '<p id="shibboleth_login"><a href="' . esc_url($login_url) . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
CVE-2022-23220 (Other, published 2022-01-21T16:15Z)
Description: value: USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/gregkh/usbview
Files changed:
org.freedesktop.pkexec.usbview.policy
Commit message: org.freedesktop.pkexec.usbview.policy: fix a local root privilege escalation issue via pkexec (CVE-2022-23220).

The polkit policy allowed unprivileged users to run usbview as root with
arbitrary command line arguments, allowing a local root exploit.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


Vulnerable code:
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>

Fixed code:
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
CVE-2016-1245 (C, published 2017-02-22T23:59Z)
Description: value: It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/Quagga/quagga
Files changed:
zebra/rtadv.c
Commit message: zebra: stack overrun in IPv6 RA receive code (CVE-2016-1245)

The IPv6 RA code also receives ICMPv6 RS and RA messages.
Unfortunately, by bad coding practice, the buffer size specified on
receiving such messages mixed up 2 constants that in fact have
different values.

The code itself has:
 #define RTADV_MSG_SIZE 4096
While BUFSIZ is system-dependent, in my case (x86_64 glibc):
 /usr/include/_G_config.h:#define _G_BUFSIZ 8192
 /usr/include/libio.h:#define _IO_BUFSIZ _G_BUFSIZ
 /usr/include/stdio.h:# define BUFSIZ _IO_BUFSIZ

FreeBSD, OpenBSD, NetBSD and Illumos are not affected, since all of them
have BUFSIZ == 1024.

As the latter is passed to the kernel on recvmsg(), it's possible to
overwrite 4kB of stack -- with ICMPv6 packets that can be globally sent
to any of the system's addresses (using fragmentation to get to 8k).

(The socket has filters installed limiting this to RS and RA packets,
but does not have a filter for source address or TTL.)

Issue discovered by trying to test other stuff, which randomly caused
the stack to be smaller than 8kB in that code location, which then
causes the kernel to report EFAULT (Bad address).

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
Reviewed-by: Donald Sharp <sharpd@cumulusnetworks.com>


Vulnerable code:
  len = rtadv_recv_packet (sock, buf, BUFSIZ, &from, &ifindex, &hoplimit);

Fixed code:
  len = rtadv_recv_packet (sock, buf, sizeof (buf), &from, &ifindex, &hoplimit);
CVE-2018-25049 (JavaScript, published 2022-12-27T09:15Z)
Description: value: A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/nmanousos/email-existence
Files changed:
index.js
Commit message: security: address REDOS by rejecting long emails

The email regex /^\S+@\S+$/ is vulnerable to REDOS on very long emails.
Emails should not be longer than 300 characters per the RFC errata.
Reject emails longer than this.


Vulnerable code:

Fixed code:

	/* Does it look like a valid email? */

	/* Our email regex is vulnerable to REDOS on very large input.
	 *  Valid emails shouldn't be more than 300 characters anyway.
	 *  https://www.rfc-editor.org/errata_search.php?eid=1690 */
	const MAX_EMAIL_LEN = 300;
	if (MAX_EMAIL_LEN < email.length) {
		callback(null, false);
		return;
	}
CVE-2022-3754 (PHP, published 2022-10-29T13:15Z)
Description: value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/pwd.change.php
phpmyfaq/src/phpMyFAQ/Installer.php
Commit message: fix: check for at least 8 characters for a password


Vulnerable code:
        if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
            if (!$user->changePassword($newPassword)) {
            printf(
                '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                $PMF_LANG['ad_passwdsuc']
            );
        } else {
            printf(
                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                $PMF_LANG['ad_passwd_fail']
            );
        // check loginname
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a loginname for your account.</p>';
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for the your ' .
                'account.</p>';
        if (strlen($password) <= 5 || strlen($passwordRetyped) <= 5) {

Fixed code:
        if (strlen($newPassword) <= 7 || strlen($retypedPassword) <= 7) {
            printf(
                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                $PMF_LANG['ad_passwd_fail']
            );
        } else {
            if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
                if (!$user->changePassword($newPassword)) {
                    printf(
                        '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                        $PMF_LANG['ad_passwd_fail']
                    );
                }
                printf(
                    '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                    $PMF_LANG['ad_passwdsuc']
                );
            } else {
        // check login name
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a login name for your account.</p>';
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for your account.</p>';

        if (strlen($password) <= 7 || strlen($passwordRetyped) <= 7) {
CVE-2022-3765 (PHP, published 2022-10-31T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.config.php
phpmyfaq/admin/meta.edit.php
phpmyfaq/admin/meta.php
Commit message: fix: add missing check on special characters for page ID


Vulnerable code:
            ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_UNSAFE_RAW))
            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_UNSAFE_RAW))
      <input type="text" class="form-control" name="page_id" value="<?= $metaData->getPageId() ?>" required>
              <input type="text" class="form-control" id="page_id" required>

Fixed code:
            ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_SANITIZE_SPECIAL_CHARS))
            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_SANITIZE_SPECIAL_CHARS))
      <input type="text" class="form-control" name="page_id" maxlength="48" value="<?= $metaData->getPageId() ?>" required>
              <input type="text" class="form-control" id="page_id" maxlength="48" required>
CVE-2022-3766 (PHP, published 2022-10-31T11:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/index.php
phpmyfaq/search.php
phpmyfaq/src/phpMyFAQ/Strings.php
Commit message: fix: added missing quoting for search terms


Vulnerable code:
    'searchTerm' => Strings::htmlspecialchars($searchTerm),
            'searchString' => Strings::htmlspecialchars($inputSearchTerm, ENT_QUOTES, 'utf-8'),
        $quoteStyle = ENT_HTML5,
        $charset = 'utf-8',
        $doubleEncode = true

Fixed code:
    'searchTerm' => Strings::htmlspecialchars($searchTerm, ENT_QUOTES),
            'searchString' => Strings::htmlspecialchars($inputSearchTerm, ENT_QUOTES),
        int $quoteStyle = ENT_HTML5,
        string $charset = 'utf-8',
        bool $doubleEncode = false
CVE-2022-4407 (PHP, published 2022-12-11T15:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/index.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:

Fixed code:
$action = Strings::htmlentities($action);
CVE-2022-4408 (PHP, published 2022-12-11T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
CHANGELOG.md
phpmyfaq/admin/record.questions.php
phpmyfaq/ajaxservice.php
phpmyfaq/src/phpMyFAQ/Helper/QuestionHelper.php
Commit message: fix: added missing escaping of strings


Vulnerable code:
# phpMyFAQ 3.1.8
                        <?= $openQuestion->getQuestion() ?>
                'question' => $question,
                    $questionHelper->sendSuccessMail($questionData, $categories);
                $questionHelper->sendSuccessMail($questionData, $categories);
     * @param $categories
    public function sendSuccessMail(array $questionData, $categories)

Fixed code:
# phpMyFAQ 3.1.9
### phpMyFAQ v3.1.9 - 2022-11-

- fixed multiple security vulnerabilities (Thorsten)
- fixed minor bugs (Thorsten)

use phpMyFAQ\Strings;
                        <?= Strings::htmlentities($openQuestion->getQuestion()) ?>
                'question' => Strings::htmlspecialchars($question),
                    try {
                        $questionHelper->sendSuccessMail($questionData, $categories);
                    } catch (Exception $e) {
                        // @todo Handle exception
                    }
                try {
                    $questionHelper->sendSuccessMail($questionData, $categories);
                } catch (Exception $e) {
                    // @todo Handle exception
                }
use phpMyFAQ\Core\Exception;
     * @param array $categories
     * @throws Exception
    public function sendSuccessMail(array $questionData, array $categories): void
CVE-2023-0306 (PHP, published 2023-01-15T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/record.edit.php
phpmyfaq/admin/record.show.php
phpmyfaq/src/phpMyFAQ/Faq.php
phpmyfaq/src/phpMyFAQ/Tags.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
                                                    <?= $entry['changelog'] ?>
                           title="<?= $PMF_LANG['ad_user_edit'] ?> '<?= str_replace('"', '´', $record['title']) ?>'">
                        <?= $record['title'] ?>
                $output['title'][] = Utils::makeShorterText($row['question'], 8);
                $output['preview'][] = $row['question'];
                $tags[$tagName]['name'] = $tagName;
                $tagName,

Fixed code:
                                                    <?= Strings::htmlentities($entry['changelog']) ?>
use phpMyFAQ\Strings;
                           title="<?= $PMF_LANG['ad_user_edit'] ?> '
                           <?= str_replace('"', '´', Strings::htmlentities($record['title'])) ?>'">
                        <?= Strings::htmlentities($record['title']) ?>
                $output['title'][] = Strings::htmlentities(Utils::makeShorterText($row['question'], 8));
                $output['preview'][] = Strings::htmlentities($row['question']);
                $tags[$tagName]['name'] = Strings::htmlentities($tagName);
                Strings::htmlentities($tagName),
CVE-2023-0307 (PHP, published 2023-01-15T22:15Z)
Description: value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-521 \u2014 Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/ajaxservice.php
Commit message: fix: added missing check on password length


Vulnerable code:
        $userData = [
            'display_name' => $userName,
            'email' => $email,
            'is_visible' => $isVisible === 'on' ? 1 : 0
        ];
        $success = $user->setUserData($userData);

        if (0 !== strlen($password) && 0 !== strlen($confirm)) {

Fixed code:
        if (strlen($password) <= 7 || strlen($confirm) <= 7) {
            $message = ['error' => $PMF_LANG['ad_passwd_fail']];
            break;
        } else {
            $userData = [
                'display_name' => $userName,
                'email' => $email,
                'is_visible' => $isVisible === 'on' ? 1 : 0
            ];
            $success = $user->setUserData($userData);
CVE-2023-0308 (PHP, published 2023-01-15T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/ajax.user.php
phpmyfaq/ajaxservice.php
phpmyfaq/index.php
phpmyfaq/ucp.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
            $userdata['login'] = $user->getLogin();
        $userName = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
    'msgLoginName' => $user->getUserData('display_name'),
            'realname' => $user->getUserData('display_name'),

Fixed code:
use phpMyFAQ\Strings;
            $userdata['login'] = Strings::htmlentities($user->getLogin());
        $userName = Filter::filterInput(INPUT_POST, 'name', FILTER_SANITIZE_SPECIAL_CHARS);
    'msgLoginName' => Strings::htmlentities($user->getUserData('display_name')),
use phpMyFAQ\Strings;
            'realname' => Strings::htmlentities($user->getUserData('display_name')),
CVE-2023-0309 (PHP, published 2023-01-15T22:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/header.php
Commit message: fix: added missing conversion to HTML entities


Vulnerable code:
  <base href="<?= $faqSystem->getSystemUri($faqConfig) ?>admin/">

Fixed code:
  <base href="<?= Strings::htmlentities($faqConfig->getDefaultUrl()) ?>admin/">