hitoshura25/cvefixes huggingface dataset:
CVE-2022-39398 (PHP, published 2022-11-10T01:15Z)
Description: value: tasklists is a tasklists plugin for GLPI (Kanban). Versions prior to 2.0.3 are vulnerable to Cross-site Scripting. Cross-site Scripting (XSS) - Create XSS in task content (when add it). This issue is patched in version 2.0.3. There are no known workarounds.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/InfotelGLPI/tasklists
Files changed:
inc/task.class.php
inc/tasktype.class.php
setup.php
tasklists.xml
Commit message: Fix XSS payload (add script into content)
Bump version


Vulnerable code:
                  $rich_content = Glpi\RichText\RichText::getTextFromHtml($data['content'], false, true);
define('PLUGIN_TASKLISTS_VERSION', '2.0.2');

Fixed code:

       if (isset($input['content'])) {
        $input['content'] = Glpi\RichText\RichText::getSafeHtml($input['content'], true);
       }

                  $rich_content = Glpi\RichText\RichText::getTextFromHtml($data['content'], false, true, true);
define('PLUGIN_TASKLISTS_VERSION', '2.0.3');
        <version>
            <num>2.0.3</num>
            <compatibility>~10.0</compatibility>
            <download_url>https://github.com/InfotelGLPI/tasklists/releases/download/2.0.3/glpi-tasklists-2.0.3.tar.bz2</download_url>
        </version>
CVE-2023-36321 (C, published 2023-10-17T23:15Z)
Description: value: Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt_common.c.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/michael-methner/dlt-daemon
Files changed:
src/shared/dlt_common.c
Commit message: Check for negative index in dlt_file_message

Fixes #436

Signed-off-by: Michael Methner <mmethner@de.adit-jv.com>


Vulnerable code:
    if (index >= file->counter) {

Fixed code:
    if (index < 0 || index >= file->counter) {
CVE-2020-28840 (C, published 2023-08-11T14:15Z)
Description: value: Buffer Overflow vulnerability in jpgfile.c in Matthias-Wandel jhead version 3.04, allows local attackers to execute arbitrary code and cause a denial of service (DoS).
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/Matthias-Wandel/jhead
Files changed:
jpgfile.c
Commit message: A 'fix' to satisfy pednatic debian fuzzers.  This one read ONE byte past allocated.


Vulnerable code:
        if (ch == '\r' && Data[a+1] == '\n') continue; // Remove cr followed by lf.

Fixed code:
        if (ch == '\r' && a < length-1 && Data[a+1] == '\n') continue; // Remove cr followed by lf.
CVE-2022-28550 (Unknown, published 2023-06-13T20:15Z)
Description: value: Matthias-Wandel/jhead jhead 3.06 is vulnerable to Buffer Overflow via shellescape(), jhead.c, jhead. jhead copies strings to a stack buffer when it detects a &i or &o. However, jhead does not check the boundary of the stack buffer. As a result, there will be a stack buffer overflow problem when multiple `&i` or `&o` are given.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Matthias-Wandel/jhead
Files changed:
Commit message: Merge branch 'master' of git+ssh://192.168.0.20/home/serv/jhead


Vulnerable code:

Fixed code:
CVE-2020-12742 (PHP, published 2020-05-13T13:15Z)
Description: value: The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/iubenda/iubenda-cookie-class
Files changed:
test.php
Commit message: fix pecl security bug onto the test script


Vulnerable code:
					$url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );

Fixed code:
          if (substr($_POST['url'], 0, 4) == "http") {
					   $url = filter_var( $_POST['url'], FILTER_SANITIZE_URL );
          }
CVE-2020-11082 (Ruby, published 2020-05-28T21:15Z)
Description: value: In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kaminari/kaminari
Files changed:
kaminari-core/lib/kaminari/helpers/tags.rb
Commit message: Blacklist "original_script_name" get param


Vulnerable code:
    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name].freeze

Fixed code:
    PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
CVE-2022-1883 (Go, published 2022-05-25T09:15Z)
Description: value: SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/camptocamp/terraboard
Files changed:
db/db.go
Commit message: fix(db): possible sql injection on /search endpoint


Vulnerable code:
		where = append(where, fmt.Sprintf("states.tf_version LIKE '%s'", fmt.Sprintf("%%%s%%", v)))
		where = append(where, fmt.Sprintf("lineages.value LIKE '%s'", fmt.Sprintf("%%%s%%", v)))

Fixed code:
		where = append(where, "states.tf_version LIKE ?")
		params = append(params, fmt.Sprintf("%%%s%%", v))
		where = append(where, "lineages.value LIKE ?")
		params = append(params, fmt.Sprintf("%%%s%%", v))
CVE-2020-5237 (PHP, published 2020-02-05T14:15Z)
Description: value: Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/1up-lab/OneupUploaderBundle
Files changed:
Controller/DropzoneController.php
Controller/FineUploaderController.php
Controller/PluploadController.php
Uploader/Chunk/Storage/FilesystemStorage.php
Uploader/Chunk/Storage/FlysystemStorage.php
Uploader/Chunk/Storage/GaufretteStorage.php
Commit message: Merge pull request from GHSA-x8wj-6m73-gfqp



Vulnerable code:
        $index = $request->get('dzchunkindex');
        $last = ((int) $index + 1) === (int) $totalChunkCount;
        $index = $request->get('qqpartindex');
        $total = $request->get('qqtotalparts');
        $last = ((int) $total - 1) === (int) $index;
        $index = $request->get('chunk');

Fixed code:
        $index = (int) $request->get('dzchunkindex');
        $last = ($index + 1) === (int) $totalChunkCount;
        $index = (int) $request->get('qqpartindex');
        $total = (int) $request->get('qqtotalparts');
        $last = ($total - 1) === $index;
        $index = (int) $request->get('chunk');
        // Prevent path traversal attacks
        $uuid = basename($uuid);

        // Prevent path traversal attacks
        $uuid = basename($uuid);

        // Prevent path traversal attacks
        $uuid = basename($uuid);

        // Prevent path traversal attacks
        $uuid = basename($uuid);

        // Prevent path traversal attacks
        $uuid = basename($uuid);

        // Prevent path traversal attacks
        $uuid = basename($uuid);
CVE-2021-33035 (Other, published 2021-09-23T08:15Z)
Description: value: Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/apache/openoffice
Files changed:
main/connectivity/source/drivers/dbase/DTable.cxx
Commit message: add useful checks


Vulnerable code:

Fixed code:
            OSL_ENSURE(nLen == 8, "Invalid length for date field");
            if (nLen != 8) {
                return false;
            }
            OSL_ENSURE(nLen == 4, "Invalid length for integer field");
            if (nLen != 4) {
                return false;
            }
            OSL_ENSURE(nLen == 8, "Invalid length for double field");
            if (nLen != 8) {
                return false;
            }
                    OSL_ENSURE(nLen == 8, "Invalid length for date field");
                    if (nLen != 8) {
                        return false;
                    }
                    OSL_ENSURE(nLen == 1, "Invalid length for bit field");
                    if (nLen != 1) {
                        return false;
                    }
                        OSL_ENSURE(nLen == 8, "Invalid length for timestamp field");
                        if (nLen != 8) {
                            bHadError = true;
                            break;
                        }
                    OSL_ENSURE(nLen == 8, "Invalid length for date field");
                    if (nLen != 8) {
                        bHadError = true;
                        break;
                    }
                        OSL_ENSURE(nLen == 4, "Invalid length for integer field");
                        if (nLen != 4) {
                            bHadError = true;
                            break;
                        }
                        OSL_ENSURE(nLen == 8, "Invalid length for double field");
                        if (nLen != 8) {
                            bHadError = true;
                            break;
                        }
                    OSL_ENSURE(nLen == 1, "Invalid length for bit field");
                    if (nLen != 1) {
                        bHadError = true;
                        break;
                    }
CVE-2022-4772 (Java, published 2022-12-27T23:15Z)
Description: value: A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/dgarijo/Widoco
Files changed:
src/main/java/widoco/WidocoUtils.java
Commit message: vuln-fix: Zip Slip Vulnerability

This fixes a Zip-Slip vulnerability.

This change does one of two things. This change either

1. Inserts a guard to protect against Zip Slip.
OR
2. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.

For number 2, consider `"/usr/outnot".startsWith("/usr/out")`.
The check is bypassed although `/outnot` is not under the `/out` directory.
It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.

Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Severity: High
CVSSS: 7.4
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-zipslip/) & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.ZipSlip)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/16

Co-authored-by: Moderne <team@moderne.io>

Vulnerable code:
				File newFile = new File(outputFolder + File.separator + fileName);

Fixed code:
				File newFile = new File(outputFolder, fileName);
				if (!newFile.toPath().normalize().startsWith(outputFolder)) {
					throw new RuntimeException("Bad zip entry");
				}
CVE-2024-39909 (Go, published 2024-07-12T15:15Z)
Description: value: KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`. As it can be seen in backend/pkg/database/id_view.go, while building the SQL Query the `fmt.Sprintf` function is used to build the query string without the input having first been subjected to any validation. This vulnerability is fixed in 2.23.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openclarity/kubeclarity
Files changed:
backend/pkg/database/id_view.go
Commit message: Merge pull request from GHSA-5248-h45p-9pgw



Vulnerable code:
			tx.Or(fmt.Sprintf("%s = '%s' AND %s is not null", filterIDColumnName, id,
				lookupIDColumnName))

Fixed code:
			tx.Or("? = ? AND ? is not null", filterIDColumnName, id,
				lookupIDColumnName)
CVE-2015-10097 (PHP, published 2023-03-25T18:15Z)
Description: value: A vulnerability was found in grinnellplans-php up to 3.0. It has been declared as critical. Affected by this vulnerability is the function interface_disp_page/interface_disp_page of the file read.php. The manipulation leads to sql injection. The attack can be launched remotely. The identifier of the patch is 57e4409e19203a94495140ff1b5a697734d17cfb. It is recommended to apply a patch to fix this issue. The identifier VDB-223801 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/grinnellplans/grinnellplans-php
Files changed:
read.php
Commit message: Fix SQL injection in read.php's  - thanks, stjohns\!

Vulnerable code:
    $addtolist = (isset($_POST['addtolist']) ? $_POST['addtolist'] : false);
    } else if ($addtolist == 1) {
        $privlevel = (isset($_POST['privlevel']) ? $_POST['privlevel'] : 0);
        } else {

Fixed code:
    $addtolist = (isset($_POST['addtolist']) ? (bool)$_POST['addtolist'] : false);
    } else if ($addtolist) {
        $privlevel = (isset($_POST['privlevel']) ? (int)$_POST['privlevel'] : 0);
        } else if ($privlevel > 0 && $privlevel <= 3) {
CVE-2021-32673 (Unknown, published 2021-06-08T17:15Z)
Description: value: reg-keygen-git-hash-plugin is a reg-suit plugin to detect the snapshot key to be compare with using Git commit hash. reg-keygen-git-hash-plugin through and including 0.10.15 allow remote attackers to execute of arbitrary commands. Upgrade to version 0.10.16 or later to resolve this issue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/reg-viz/reg-suit
Files changed:
Commit message: Merge pull request from GHSA-49q3-8867-5wmp

fix: Escape shell string

Vulnerable code:

Fixed code:
CVE-2020-15117 (Unknown, published 2020-07-15T18:15Z)
Description: value: In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xffffffff (4294967295) if the servers memory is less than 4 GB. It was verified that this issue does not cause a crash through the exception handler if the available memory of the Server is more than 4GB.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/symless/synergy-core
Files changed:
Commit message: Merge pull request from GHSA-chfm-333q-gfpp

Attempts to fis DoS to servers with less then 4GB memory

Vulnerable code:

Fixed code:
CVE-2022-4066 (Unknown, published 2022-11-19T19:15Z)
Description: value: A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. The manipulation leads to allocation of resources. The name of the patch is de8ea938342b36c28024fd8393ebc27b8442a161. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-214028.
Severity: nan (CVSS v3 base score: 8.2)
Weakness: CWE-404 \u2014 Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
Repository: https://github.com/davidmoreno/onion
Files changed:
Commit message: Merge pull request #308 from kulkom/master

Fix a potential log spamming and DOS attack

Vulnerable code:

Fixed code:
CVE-2020-36826 (JavaScript, published 2024-03-25T07:15Z)
Description: value: A vulnerability was found in AwesomestCode LiveBot. It has been classified as problematic. Affected is the function parseSend of the file js/parseMessage.js. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Upgrading to version 0.1 is able to address this issue. The name of the patch is 57505527f838d1e46e8f93d567ba552a30185bfa. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257784.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/AwesomestCode/LiveBot
Files changed:
js/parseMessage.js
Commit message: Fixed a serious vulnerability

There was a serious remote code execution vulnerability that allowed anybody to execute commands on the machine of everybody they came into contact with, who was using Livebot. The 'hacker' would not have to use livebot to run this attack.

The exact vulnerabilty will not be spread to anybody for the time being


Vulnerable code:
    // Remove html in the message
    let textContent = text.replace(/(<)([^>]+)(>)/gm, '&lt;$2&gt;');

Fixed code:
    // Remove html < and > in the message
    let textContent = text
                        .replace(/</g, '&lt;')
                        .replace(/>/g, '&gt;');
    // Match links