hitoshura25/cvefixes huggingface dataset:
CVE-2021-31572 (C, published 2021-04-22T18:15Z)
Description: value: The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/FreeRTOS/FreeRTOS-Kernel
Files changed:
stream_buffer.c
Commit message: Add addition overflow check for stream buffer (#226)



Vulnerable code:
        xBufferSizeBytes++;
        pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */

Fixed code:
        if( xBufferSizeBytes < ( xBufferSizeBytes + 1 + sizeof( StreamBuffer_t ) ) )
        {
            xBufferSizeBytes++;
            pucAllocatedMemory = ( uint8_t * ) pvPortMalloc( xBufferSizeBytes + sizeof( StreamBuffer_t ) ); /*lint !e9079 malloc() only returns void*. */
        }
        else
        {
            pucAllocatedMemory = NULL;
        }
CVE-2020-11004 (PHP, published 2020-04-24T21:15Z)
Description: value: SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Admidio/admidio
Files changed:
adm_program/system/classes/TableAccess.php
Commit message: Unauthenticated Blind SQL injection #908


Vulnerable code:
            $sqlWhereCondition .= ' AND ' . $columnName . ' = \'' . $columnValue . '\' ';
        $returnCode = $this->readData($sqlWhereCondition);

Fixed code:
            $sqlWhereCondition .= ' AND ' . $columnName . ' = ? ';
        $returnCode = $this->readData($sqlWhereCondition, array_values($columnArray));
CVE-2021-43810 (PHP, published 2021-12-07T22:15Z)
Description: value: Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Admidio/admidio
Files changed:
adm_program/system/bootstrap/function.php
adm_program/system/classes/StringUtils.php
adm_program/system/redirect.php
Commit message: Cross-site Scripting (XSS) when redirect an url


Vulnerable code:
 *                                          **date**, **file** or **folder** that is expected and which will be checked.
        case 'file':
                $validRegex = '/^[\wáàâåäæçéèêîñóòôöõøœúùûüß$&!?() \/%=#:~.@+-]+$/i';
$getUrl = admFuncVariableIsValid($_GET, 'url', 'string', array('requireValue' => true));

Fixed code:
 *                                          **url**, **date**, **file** or **folder** that is expected and which will be checked.
        case 'file': // fallthrough
        case 'folder':

        case 'url':
            if (!StringUtils::strValidCharacters($value, 'url')) {
                $errorMessage = $gL10n->get('SYS_INVALID_PAGE_VIEW');
            }
            break;
                //$validRegex = '/^[\wáàâåäæçéèêîñóòôöõøœúùûüß$&!?() \/%=#:~.@+-]+$/i';
                $validRegex = '/\b(?:(?:https?|ftp):\/\/|www\.)[-a-z0-9+&@#\/%?=~_|!:,.;]*[-a-z0-9+&@#\/%=~_|]/i';
$getUrl = admFuncVariableIsValid($_GET, 'url', 'url', array('requireValue' => true));
CVE-2021-43810 (Unknown, published 2021-12-07T22:15Z)
Description: value: Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Admidio/admidio
Files changed:
Commit message: Merge pull request from GHSA-3qgf-qgc3-42hh

Improve check of urls

Vulnerable code:

Fixed code:
CVE-2014-1459 (Unknown, published 2014-02-11T17:55Z)
Description: value: SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the _position_down_id parameter.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/doorgets/doorGets
Files changed:
Commit message: Patch sérurity


Vulnerable code:

Fixed code:
CVE-2023-36665 (JavaScript, published 2023-07-05T14:15Z)
Description: value: "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/protobufjs/protobuf.js
Files changed:
src/util.js
tests/api_util.js
Commit message: fix: do not let setProperty change the prototype (#1899)

* fix: do not let setProperty change the prototype

* test: add unit test

Vulnerable code:
        if (part === "__proto__") {

Fixed code:
        if (part === "__proto__" || part === "prototype") {
        
        util.setProperty({}, "__proto__.test", "value");
        test.is({}.test, undefined);

        util.setProperty({}, "prototype.test", "value");
        test.is({}.test, undefined);

        util.setProperty({}, "constructor.prototype.test", "value");
        test.is({}.test, undefined);
CVE-2020-26262 (Unknown, published 2021-01-13T19:15Z)
Description: value: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-441 \u2014 Unintended Proxy or Intermediary ('Confused Deputy')
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
Repository: https://github.com/coturn/coturn
Files changed:
Commit message: Merge branch 'advisory-fix-1' CVE-2020-26262


Vulnerable code:

Fixed code:
CVE-2020-26262 (Unknown, published 2021-01-13T19:15Z)
Description: value: Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `--denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `--allow-loopback-peers` has been specified.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-682 \u2014 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
Repository: https://github.com/coturn/coturn
Files changed:
Commit message: Merge branch 'advisory-fix-1' CVE-2020-26262


Vulnerable code:

Fixed code:
CVE-2012-3508 (Other, published 2012-08-25T10:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
CHANGELOG
program/lib/washtml.php
Commit message: Fix XSS issue with href="javascript:" not being removed (#1488613)


Vulnerable code:
         ($key == 'href' && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value)))
      } else

Fixed code:
- Fix XSS issue with href="javascript:" not being removed (#1488613)
         ($key == 'href' && !preg_match('!^javascript!i', $value)
           && preg_match('!^([a-z][a-z0-9.+-]+:|//|#).+!i', $value))
      ) {
      }
      }
      else
CVE-2012-6121 (PHP, published 2013-02-24T21:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
CHANGELOG
program/lib/washtml.php
tests/MailFunc.php
Commit message: - Fix XSS vulnerability in vbscript: and data:text links handling (#1488850)


Vulnerable code:
         ($key == 'href' && !preg_match('!^javascript!i', $value)

Fixed code:
- Fix XSS vulnerability in vbscript: and data:text links handling (#1488850)
         ($key == 'href' && !preg_match('!^(javascript|vbscript|data:text)!i', $value)
    /**
     * Test the elimination of some XSS vulnerabilities
     */
    function test_html_xss3()
    {
        // #1488850
        $html = '<p><a href="data:text/html,&lt;script&gt;alert(document.cookie)&lt;/script&gt;">Firefox</a>'
            .'<a href="vbscript:alert(document.cookie)">Internet Explorer</a></p>';
        $washed = rcmail_wash_html($html, array('safe' => true), array());

        $this->assertNotRegExp('/data:text/', $washed, "Remove data:text/html links");
        $this->assertNotRegExp('/vbscript:/', $washed, "Remove vbscript: links");
    }
CVE-2015-5381 (Other, published 2017-05-23T04:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
CHANGELOG
program/include/rcmail.php
Commit message: Fix XSS vulnerability in _mbox argument handling (#1490417)


Vulnerable code:
                $args  = array('msg' => $err_str);

Fixed code:
- Fix XSS vulnerability in _mbox argument handling (#1490417)
                $args  = array('msg' => rcube::Q($err_str));
CVE-2015-5382 (Other, published 2017-05-23T04:29Z)
Description: value: program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
CHANGELOG
program/steps/addressbook/photo.inc
Commit message: Fix security issue in contact photo handling (#1490379)


Vulnerable code:
// deliver alt image
if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
    $data = file_get_contents($alt_img);
}


Fixed code:
- Fix security issue in contact photo handling (#1490379)
CVE-2015-5383 (Other, published 2017-05-23T04:29Z)
Description: value: Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
INSTALL
config/.htaccess
logs/.htaccess
temp/.htaccess
Commit message: Add .htaccess files to deny access to config, temp, logs + describe how to protect access to these directories in the INSTALL instructions (#1490378)


Vulnerable code:

Fixed code:
SECURE YOUR INSTALLATION
========================

Access through the webserver to the following directories should be denied:

  /config
  /temp
  /logs

Roundcube uses .htaccess files to protect these directories, so be sure to
allow override of the Limit directives to get them taken into account. The
package also ships a .htaccess file in the root directory which defines some
rewrite rules. In order to properly secure your installation, please enable
mod_rewrite for Apache webserver and double check access to the above listed
directories and their contents is denied.


# deny webserver access to this directory
Deny from all
# deny webserver access to this directory
Deny from all
# deny webserver access to this directory
Deny from all
CVE-2020-12625 (PHP, published 2020-05-04T02:15Z)
Description: value: An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
CHANGELOG
program/lib/Roundcube/rcube_washtml.php
tests/Framework/Washtml.php
Commit message: Fix XSS issue in handling of CDATA in HTML messages


Vulnerable code:
                $dump .= $node->nodeValue;
                break;


Fixed code:
- Security: Fix XSS issue in handling of CDATA in HTML messages

    /**
     * Test CDATA cleanup
     */
    function test_cdata()
    {
        $html = '<p><![CDATA[<script>alert(document.cookie)</script>]]></p>';

        $washer = new rcube_washtml;
        $washed = $washer->wash($html);

        $this->assertTrue(strpos($washed, '<script>') === false, "CDATA content");
    }
CVE-2023-5631 (PHP, published 2023-10-18T15:15Z)
Description: value: 
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker

to load arbitrary JavaScript code.








Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/roundcube/roundcubemail
Files changed:
CHANGELOG.md
program/lib/Roundcube/rcube_washtml.php
tests/Framework/Washtml.php
Commit message: Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)


Vulnerable code:
            if (stripos($matches[1], 'svg') !== false) {
                if (stripos($matches[1], ';base64') !== false) {
                    $svg  = base64_decode($svg);
                    $type = $matches[1];
                    $type = $matches[1] . ';base64';

Fixed code:
- Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)
            $type = preg_replace('/\s/', '', $matches[1]);

            if (stripos($type, 'svg') !== false) {
                if (stripos($type, ';base64') !== false) {
                    $svg = base64_decode($svg);
                    $type .= ';base64';
            [
                '<html><svg><use href="data:image/s vg+xml;base64,' // space
                    . 'PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4gPGltYWdlIGhy'
                    . 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>',
                '<svg><use x-washed="href"></use></svg>'
            ],
            [
                '<html><svg><use href="data:image/s' . "\n" . 'vg+xml;base64,' // new-line
                    . 'PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4gPGltYWdlIGhy'
                    . 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>',
                '<svg><use x-washed="href"></use></svg>'
            ],
            [
                '<html><svg><use href="data:image/s	vg+xml;base64,' // tab
                    . 'PHN2ZyBpZD0ieCIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4gPGltYWdlIGhy'
                    . 'ZWY9IngiIG9uZXJyb3I9ImFsZXJ0KCcxJykiLz48L3N2Zz4=#x"></svg></html>',
                '<svg><use x-washed="href"></use></svg>'
            ],