hitoshura25/cvefixes huggingface dataset:
CVE-2021-3783 (PHP, published 2021-09-15T12:15Z)
Description: value: yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yourls/yourls
Files changed:
admin/upgrade.php
includes/functions-upgrade.php
includes/version.php
Commit message: Sanitize user input in upgrade (#3055)



Vulnerable code:
		$oldver = (string)( $_GET['oldver'] );
		$oldsql = (string)( $_GET['oldsql'] );

Fixed code:
		$oldver = yourls_sanitize_version($_GET['oldver']);
		$oldsql = (intval)($_GET['oldsql']);
    /**
     *  Sanitize input. Two notes :
     *  - they should already be sanitized in the caller, eg admin/upgrade.php
     *    (but hey, let's make sure)
     *  - some vars may not be used at the moment
     *    (and this is ok, they are here in case a future upgrade procedure needs them)
     */
    $step   = intval($step);
    $oldsql = intval($oldsql);
    $newsql = intval($newsql);
    $oldver = yourls_sanitize_version($oldver);
    $newver = yourls_sanitize_version($newver);

 * Must be one of the following :
 *    MAJOR.MINOR (eg 1.8)
 *    MAJOR.MINOR.PATCH (1.8.1)
 *    MAJOR.MINOR-SOMETHING (1.8-dev)
 *    MAJOR.MINOR.PATCH-SOMETHING (1.8.1-donotuse)
 *
 * Must be a string of an integer.
 *
CVE-2021-3785 (PHP, published 2021-09-15T12:15Z)
Description: value: yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yourls/yourls
Files changed:
includes/functions-shorturls.php
tests/tests/shorturl/shorturl.php
Commit message: Minor security improvements #2 (#3041)

* Escape HTML and attributes before returning
* Remove deprecated vars

Vulnerable code:
    $strip_url = stripslashes( $url );
    $strip_title = stripslashes( $title );
            $return['url']     = array( 'keyword' => $newkeyword, 'shorturl' => yourls_link($newkeyword), 'url' => $strip_url, 'display_url' => yourls_trim_long_string( $strip_url ), 'title' => $strip_title, 'display_title' => yourls_trim_long_string( $strip_title ) );
            $return['message'] = /* //translators: "Error updating http://someurl/ (Shorturl: http://sho.rt/blah)" */ yourls_s( 'Error updating %s (Short URL: %s)', yourls_trim_long_string( $strip_url ), $keyword ) ;

Fixed code:
            $return['url']     = array( 'keyword'       => $newkeyword,
                                        'shorturl'      => yourls_link($newkeyword),
                                        'url'           => yourls_esc_url($url),
                                        'display_url'   => yourls_esc_html(yourls_trim_long_string($url)),
                                        'title'         => yourls_esc_attr($title),
                                        'display_title' => yourls_esc_html(yourls_trim_long_string( $title ))
                                );
            $return['message'] = /* //translators: "Error updating http://someurl/ (Shorturl: http://sho.rt/blah)" */ yourls_s( 'Error updating %s (Short URL: %s)', yourls_esc_html(yourls_trim_long_string($url)), $keyword ) ;

        $fail = yourls_add_new_link( $url, rand_str(), rand_str() );
        $this->assertEquals( 'fail', $fail['status'] );
CVE-2020-27163 (PHP, published 2020-10-16T03:15Z)
Description: value: phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/erikdubbelboer/phpRedisAdmin
Files changed:
login.php
Commit message: Fix XSS


Vulnerable code:
           value="<?= isset($_POST['username']) ? $_POST['username'] : '' ?>"

Fixed code:
           value="<?= isset($_POST['username']) ? htmlentities($_POST['username'], defined('ENT_SUBSTITUTE') ? (ENT_QUOTES | ENT_SUBSTITUTE) : ENT_QUOTES, 'utf-8') : '' ?>"
CVE-2021-4259 (PHP, published 2022-12-19T14:15Z)
Description: value: A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-597 \u2014 Use of Wrong Operator in String Comparison
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
Repository: https://github.com/erikdubbelboer/phpRedisAdmin
Files changed:
includes/login.inc.php
Commit message: Fix magic hash attack


Vulnerable code:
    if ($data['response'] != $response) {

Fixed code:
    if ($data['response'] !== $response) {
CVE-2021-4268 (PHP, published 2022-12-21T19:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/erikdubbelboer/phpRedisAdmin
Files changed:
edit.php
export.php
import.php
includes/common.inc.php
login.php
rename.php
ttl.php
Commit message: Prevent Cross-Site Request Forgery


Vulnerable code:

Fixed code:
<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
if (session_status() !== PHP_SESSION_DISABLED) {
  session_start();

  if (isset($_SESSION['phpredisadmin_csrf'])) {
    $csrfToken = $_SESSION['phpredisadmin_csrf'];
  } else {
    $csrfToken = bin2hex(random_bytes(16));
    $_SESSION['phpredisadmin_csrf'] = $csrfToken;
  }
} else {
  $csrfToken = 'nosession';
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  if ($_POST['csrf'] !== $csrfToken) {
    die('bad csrf token');
  }
}
<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
CVE-2024-35183 (Go, published 2024-05-15T22:15Z)
Description: value: wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than `github.com`. Most git-dependent functionality in wolfictl relies on its own `git` package, which contains centralized logic for implementing interactions with git repositories. Some of this functionality requires authentication in order to access private repositories. A central function `GetGitAuth` looks for a GitHub token in the environment variable `GITHUB_TOKEN` and returns it as an HTTP basic auth object to be used with the `github.com/go-git/go-git/v5` library. Most callers (direct or indirect) of `GetGitAuth` use the token to authenticate to github.com only; however, in some cases callers were passing this authentication without checking that the remote git repository was hosted on github.com. This behavior has existed in one form or another since commit 0d06e1578300327c212dda26a5ab31d09352b9d0 - committed January 25, 2023. This impacts anyone who ran the `wolfictl check update` commands with a Melange configuration that included a `git-checkout` directive step that referenced a git repository not hosted on github.com. This also impacts anyone who ran `wolfictl update <url>` with a remote URL outside of github.com. Additionally, these subcommands must have run with the `GITHUB_TOKEN` environment variable set to a valid GitHub token. Users should upgrade to version 0.16.10 to receive a patch.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wolfi-dev/wolfictl
Files changed:
pkg/git/submodules/update.go
pkg/git/submodules/update_test.go
pkg/update/update.go
Commit message: wolfictl update: use git auth when cloning melange config repo

Signed-off-by: James Rawlings <jrawlings@chainguard.dev>


Vulnerable code:
	submodules, err := updateConfigfile(dir, owner, repo, version)
func updateConfigfile(dir, owner, repo, version string) ([]string, error) {
func TestSubmodules_update(t *testing.T) {
	data, err := os.ReadFile(filepath.Join("testdata", ".gitmodules"))
	_, err = updateConfigfile(dir, "foo", "bar", "v1.2.4")
	repo, err := git.PlainClone(tempDir, false, &git.CloneOptions{
	})

Fixed code:
	submodules, err := updateConfigFile(dir, owner, repo, version)
func updateConfigFile(dir, owner, repo, version string) ([]string, error) {
func TestSubmodules_updateConfigFile(t *testing.T) {
	data, err := os.ReadFile(filepath.Join("testdata", "multiple_submodules", ".gitmodules"))
	_, err = updateConfigFile(dir, "foo", "bar", "v1.2.4")
	cloneOpts := &git.CloneOptions{
	}
	gitToken := os.Getenv("GITHUB_TOKEN")
	if gitToken != "" {
		cloneOpts.Auth = &gitHttp.BasicAuth{
			Username: "abc123",
			Password: gitToken,
		}
	}

	repo, err := git.PlainClone(tempDir, false, cloneOpts)
CVE-2024-28247 (Unknown, published 2024-03-27T19:15Z)
Description: value: The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" begins with "file*" it is understood that it is updating from a local file, on the other hand if it does not begin with "file*" depending on the state of the response it does one thing or another. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen. This vulnerability is fixed by 5.18.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pi-hole/pi-hole
Files changed:
Commit message: Merge pull request from GHSA-95g6-7q26-mp9x

Only use local files (file://) when they have explicit permissions a+r

Vulnerable code:

Fixed code:
CVE-2024-34361 (Shell, published 2024-07-05T19:15Z)
Description: value: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pi-hole/pi-hole
Files changed:
gravity.sh
Commit message: Add protocol validation when downloading blocklist from URL

Signed-off-by: DL6ER <dl6er@dl6er.de>


Vulnerable code:

Fixed code:
  # Check for allowed protocols
  if [[ $url != "http"* && $url != "https"* && $url != "file"* && $url != "ftp"* && $url != "ftps"* && $url != "sftp"* ]]; then
    echo -e "${OVER}  ${CROSS} ${str} Invalid protocol specified, ignoring list"
    download=false
  fi
CVE-2023-27485 (Scala, published 2023-03-07T19:15Z)
Description: value: thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user. This bug was fixed in commit `f1ae67d8bb2`and released with version 1.5.3. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/thm-mni-ii/feedbacksystem
Files changed:
modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/SubmissionController.scala
modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/services/persistence/CheckrunnerSubTaskService.scala
Commit message: Merge pull request from GHSA-fhq8-p3w6-mmgr



Vulnerable code:
        case Some(cc) => checkrunnerSubTaskServer.listResultsWithTasks(cc.id, sid)
  def listResultsWithTasks(configurationId: Int, submissionId: Int): List[SubTaskResult] = DB.query(
    "SELECT st.name, st.points AS max_points, str.points FROM checkrunner_sub_task_result str JOIN " +
      "checkrunner_sub_task st ON str.sub_task_id = st.sub_task_id " +
      "WHERE str.configuration_id = ? AND str.submission_id = ?",
    configurationId, submissionId

Fixed code:
        case Some(cc) => checkrunnerSubTaskServer.listResultsWithTasks(uid, cc.id, sid)
  def listResultsWithTasks(userId: Int, configurationId: Int, submissionId: Int): List[SubTaskResult] = DB.query(
    "SELECT st.name, st.points AS max_points, str.points FROM checkrunner_sub_task_result str " +
      "JOIN checkrunner_sub_task st ON str.sub_task_id = st.sub_task_id " +
      "JOIN user_task_submission uts ON str.submission_id = uts.submission_id " +
      "WHERE str.configuration_id = ? AND str.submission_id = ? AND uts.user_id = ?",
    configurationId, submissionId, userId
CVE-2023-37468 (Scala, published 2023-07-13T21:15Z)
Description: value: Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.


Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-312 \u2014 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Repository: https://github.com/thm-mni-ii/feedbacksystem
Files changed:
modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/LoginController.scala
Commit message: Merge pull request from GHSA-g28r-8wg3-7349

passwords

Vulnerable code:
      } yield (user, password)
        case Some((user, password)) =>
          val localUser = userService.find(user.username).getOrElse(userService.create(user, password))

Fixed code:
      } yield user
        case Some((user)) =>
          val localUser = userService.find(user.username).getOrElse(userService.create(user, null))
CVE-2024-25107 (Unknown, published 2024-02-08T23:15Z)
Description: value: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/miraheze/WikiDiscover
Files changed:
Commit message: Merge pull request from GHSA-cfcf-94jv-455f

Merge changes from WikiDiscover-ghsa-cfcf-94jv-455f

Vulnerable code:

Fixed code:
CVE-2021-43861 (Unknown, published 2021-12-30T14:15Z)
Description: value: Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/mermaid-js/mermaid
Files changed:
Commit message: Merge pull request from GHSA-p3rp-vmj9-gv6v

Advisory fix 1

Vulnerable code:

Fixed code:
CVE-2022-31108 (Unknown, published 2022-06-28T19:15Z)
Description: value: Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. This issue may lead to `Information Disclosure` via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc. This issue has been resolved in version 9.1.3. Users are advised to upgrade. Users unable to upgrade should ensure that user input is adequately escaped before embedding it in CSS blocks.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mermaid-js/mermaid
Files changed:
Commit message: Merge pull request from GHSA-x3vm-38hw-55wf

CSS Injection security issue

Vulnerable code:

Fixed code:
CVE-2022-35942 (JavaScript, published 2022-08-12T23:15Z)
Description: value: Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove `allowExtendedProperties: true` DataSource setting - Add `allowExtendedProperties: false` DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.
Severity: nan (CVSS v3 base score: 10)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/loopbackio/loopback-connector-postgresql
Files changed:
lib/postgresql.js
Commit message: fix: improve filter sanitisation

Add sanitisation of user-input for `contains` LoopBack filter which may allow for arbitrary SQL injection.

Signed-off-by: Rifa Achrinza <25147899+achrinza@users.noreply.github.com>


Vulnerable code:
      return new ParameterizedSQL(columnName + ' @> array[' + operatorValue.map((v) => `'${v}'`) + ']::'
        + propertyDefinition.postgresql.dataType);
      return new ParameterizedSQL(`to_tsvector(${columnName}) @@ to_tsquery('${operatorValue}')`);

Fixed code:
      return new ParameterizedSQL(columnName + ' @> array[' + operatorValue.map(() => '?') + ']::'
        + propertyDefinition.postgresql.dataType,
        operatorValue);
      return new ParameterizedSQL(`to_tsvector(${columnName}) @@ to_tsquery(?)`, [operatorValue]);