hitoshura25/cvefixes huggingface dataset:
CVE-2021-43779 (PHP, published 2022-01-05T19:15Z)
Description: value: GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.
Severity: HIGH (CVSS v3 base score: 9.9)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/pluginsGLPI/addressing
Files changed:
ajax/addressing.php
ajax/ping.php
front/reserveip.form.php
Commit message: fix Remote Command Execution vulnerability


Vulnerable code:
   $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
if (!isset($_POST['ip'])) {
   $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);

Fixed code:
   if(filter_var($_GET["ip"], FILTER_VALIDATE_IP)) {
      $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
   }

if (!isset($_POST['ip']) || !filter_var($_POST["ip"], FILTER_VALIDATE_IP)) {
   if(filter_var($_REQUEST["ip"], FILTER_VALIDATE_IP)) {
      $reserveip->showReservationForm($_REQUEST["ip"], $_REQUEST["id_addressing"], $_REQUEST['rand']);
   }
CVE-2013-10023 (Other, published 2023-04-08T09:15Z)
Description: value: A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcal_filter_where of the file edcal.php. The manipulation of the argument edcal_startDate/edcal_endDate leads to sql injection. The attack can be launched remotely. Upgrading to version 2.7 is able to address this issue. The patch is named a9277f13781187daee760b4dfd052b1b68e101cc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-225151.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/editorial-calendar
Files changed:
edcal.php
readme.txt
Commit message: We are now validating the start and end dates before adding them to the post filter so we can make sure there's no possible SQL injection attack.

git-svn-id: https://plugins.svn.wordpress.org/editorial-calendar/trunk@667412 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:

Fixed code:
            /*
             * The start date and end date come from the client and we want to make
             * sure there's no SQL injection attack here.  We know these values must
             * be dates in a format like 2013-02-03.  Date parsing is complex and PHP
             * dates allow a lot of different formats.  The simplest way to make sure
             * this isn't a SQL injection attack is to remove the dashes and check if
             * the result is numeric.  If it is then this can't be a SQL injection attack.
             */
             if (!is_numeric(str_replace("-", "", $edcal_startDate)) || !is_numeric(str_replace("-", "", $edcal_endDate))) {
                die("The specified start date and end date for the posts query must be numeric.");
             }
             
We are now preventing a potential SQL injection attack with the start date and end date filter when querying posts.  This fixes a potential security issue found by the Mozilla security testing team.  https://bugzilla.mozilla.org/show_bug.cgi?id=738112
CVE-2020-12629 (PHP, published 2020-05-04T13:15Z)
Description: value: include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/class.sla.php
Commit message: xss: SLA Name

This mitigates an issue discovered by Gais Cyber Security where the SLA Name
can be exploited via XSS to execute code. This sanitizes the content for
`create()` and `update()` with `Format::htmlchars()` so we are safe from any
XSS attempts.


Vulnerable code:

Fixed code:
        $vars = Format::htmlchars($vars);
        $vars = Format::htmlchars($vars);
CVE-2022-4271 (PHP, published 2022-12-02T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/ajax.users.php
include/class.client.php
include/class.user.php
include/staff/templates/user-account.tmpl.php
include/staff/templates/user-register.tmpl.php
Commit message: security: Username XSS

This mitigates a vulnerability reported by legoclones on
[huntr.dev](https://huntr.dev/) where XSS can be stored/executed via a
User's `username`. If an Agent is redirected to the User Lookup AJAX
response directly it will execute the stored XSS. This adds
`Format::sanitize()` to the `username` before saving to the database so any
potential XSS is sanitized. Additionally, this adds `Format::htmlchars()` to
the `username` before displaying in the UI to help prevent code execution.


Vulnerable code:
        $q = $_REQUEST['q'];
                    "id" => $id, "/bin/true" => $_REQUEST['q']);
                $this->set('username', $vars['username']);
        $this->set('username', $vars['username']);
            $account->set('username', $vars['username']);
                    <input type="text" size="35" name="username" value="<?php echo $info['username']; ?>" autocomplete="new-password">
                    <input type="text" size="35" name="username" value="<?php echo $info['username'] ?: $user->getEmail(); ?>">
                    &nbsp;<span class="error">&nbsp;<?php echo $errors['username']; ?></span>

Fixed code:
        $q = Format::sanitize($_REQUEST['q']);
                    "id" => $id, "/bin/true" => $q);
                $this->set('username', Format::sanitize($vars['username']));
        $this->set('username', Format::sanitize($vars['username']));
            $account->set('username', Format::sanitize($vars['username']));
                    <input type="text" size="35" name="username" value="<?php echo Format::htmlchars($info['username']); ?>" autocomplete="new-password">
                    <input type="text" size="35" name="username" value="<?php echo $info['username'] ? Format::htmlchars($info['username']) : $user->getEmail(); ?>">
                    &nbsp;<span class="error">&nbsp;<?php echo Format::htmlchars($errors['username']); ?></span>
CVE-2023-1315 (PHP, published 2023-03-10T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/ajax.search.php
include/staff/templates/advanced-search.tmpl.php
Commit message: xss: Search parent_id

This mitigates a vulnerability reported by @indevi0us where XSS is
possible via the parent_id parameter. This forces the parameter to an
INT so that there is no chance of XSS.


Vulnerable code:
            'parent_id' => @$_GET['parent_id'] ?: 0,
                    'parent_id' =>  $_GET['pid'],
$parent_id = (isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
        : $search->parent_id;

Fixed code:
            'parent_id' => (int) @$_GET['parent_id'] ?: 0,
                    'parent_id' => (int) $_GET['pid'],
$parent_id = (int) ((isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
        : $search->parent_id);
CVE-2023-1316 (PHP, published 2023-03-10T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/class.email.php
Commit message: xss: System Email

This mitigates a vulnerability reported by @edr4 where XSS is possible
via System Email. This adds sanitization to the email before
saving/displaying. This also forces the other options (topic,
department, etc.) to int so there is no chance of XSS.


Vulnerable code:
        $this->email = $vars['email'];
        $this->dept_id = $vars['dept_id'];
        $this->priority_id = $vars['priority_id'];
        $this->topic_id = $vars['topic_id'];
        $this->noautoresp = $vars['noautoresp'];

Fixed code:
        $this->email = Format::sanitize($vars['email']);
        $this->dept_id = (int) $vars['dept_id'];
        $this->priority_id = (int) (isset($vars['priority_id']) ? $vars['priority_id'] : 0);
        $this->topic_id = (int) $vars['topic_id'];
        $this->noautoresp = (int) $vars['noautoresp'];
CVE-2023-1317 (PHP, published 2023-03-10T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/ajax.orgs.php
Commit message: xss: Organization Search q

This mitigates a vulnerability reported by @indevi0us where XSS is
possible via the `q` parameter in organization lookups. This sanitizes
the parameter value before use as well as htmlchars it before adding to
JSON output.


Vulnerable code:
        $q = $_REQUEST['q'];
                'id' => $id, '/bin/true' => $_REQUEST['q']);

Fixed code:
        $q = Format::sanitize($_REQUEST['q']);
                'id' => $id, '/bin/true' => Format::htmlchars($q));
CVE-2023-1318 (PHP, published 2023-03-10T16:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/class.osticket.php
Commit message: xss: AJAX Paths

This mitigates a vulnerability reported by indevi0us where XSS is
possible via some AJAX paths.


Vulnerable code:
            return $_SERVER['PATH_INFO'];
            return $_SERVER['ORIG_PATH_INFO'];

Fixed code:
            return htmlentities($_SERVER['PATH_INFO']);
            return htmlentities($_SERVER['ORIG_PATH_INFO']);
CVE-2023-1319 (PHP, published 2023-03-10T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osticket/osticket
Files changed:
include/class.role.php
Commit message: xss: Roles

This mitigates a vulnerability reported by indevi0us where XSS is
possible via the `name` parameter for Roles.


Vulnerable code:
        if (!$vars['name'])
        elseif (($r=Role::lookup(array('name'=>$vars['name'])))
        $this->name = $vars['name'];
        $this->notes = $vars['notes'];

Fixed code:
        $name = Format::sanitize($vars['name']);
        if (!$name)
        elseif (($r=Role::lookup(array('name'=>$name)))
        $this->name = $name;
        $this->notes = Format::sanitize($vars['notes']);
CVE-2024-23636 (Other, published 2024-01-23T18:15Z)
Description: value: SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/sofastack/sofa-rpc
Files changed:
codec/codec-api/src/main/resources/sofa-rpc/serialize_blacklist.txt
Commit message: Merge pull request from GHSA-7q8p-9953-pxvr

Co-authored-by: liujianjun.ljj <liujianjun.ljj@antgroup.com>

Vulnerable code:
java.lang.Class
java.lang.Runtime

Fixed code:
CVE-2016-4040 (Java, published 2016-04-19T14:59Z)
Description: value: SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/dotCMS/core
Files changed:
src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java
src/com/dotmarketing/factories/EmailFactory.java
src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java
Commit message: fixes #8840 sort by sanitizing and email header injection


Vulnerable code:
		return orderBy;

Fixed code:
				invalidCaptchaURL = invalidCaptchaURL.replaceAll("\\s", " ");
				
				// strip line breaks from headers
				from = from.replaceAll("\\s", " ");
				to = to.replaceAll("\\s", " ");
				cc = cc.replaceAll("\\s", " ");
				bcc = bcc.replaceAll("\\s", " ");
				fromName = fromName.replaceAll("\\s", " ");
				subject = subject.replaceAll("\\s", " ");
				
				
				
				
				
				
				
				
				
import com.dotmarketing.common.util.SQLUtil;
		
		
		orderBy= SQLUtil.sanitizeSortBy(orderBy);
		return SQLUtil.sanitizeSortBy(orderBy);
		orderBy = SQLUtil.sanitizeSortBy(orderBy);
CVE-2017-9732 (C, published 2018-12-20T23:29Z)
Description: value: The read_packet function in knc (Kerberised NetCat) before 1.11-1 is vulnerable to denial of service (memory exhaustion) that can be exploited remotely without authentication, possibly affecting another services running on the targeted host.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/elric1/knc
Files changed:
bin/gssstdio.c
Commit message: knc: fix a couple of memory leaks.

One of these can be remotely triggered during the authentication
phase which leads to a remote DoS possibility.

Pointed out by: Imre Rad <radimre83@gmail.com>


Vulnerable code:
			return -1;
			return -1;
		return -1;
			return -1;
		return -1;
		return -1;

Fixed code:
	gss_release_buffer(&min, &in);

	gss_release_buffer(&min, &out);
			goto bail;
			goto bail;
		goto bail;
			goto bail;

		goto bail;
		goto bail;

bail:
	free(tmpbuf);
	tmpbuf = NULL;

	return -1;
CVE-2018-15836 (Other, published 2018-09-26T21:29Z)
Description: value: In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/xelerance/Openswan
Files changed:
CHANGES
Makefile.ver
debian/NEWS
debian/changelog
packaging/centos5/openswan.spec
packaging/fedora/openswan.spec
packaging/rhel7/openswan.spec
packaging/suse/openswan.spec
Commit message: Update VERSION to 2.6.50.1


Vulnerable code:
IPSECBASEVERSION=2.6.50
openswan (1:2.6.50-0xelerance1) trusty; urgency=low
  * Update to 2.6.50
openswan (1:2.6.50-0xelerance1) trusty; urgency=low
  * Update to 2.6.50
Version: 2.6.50
Version: 2.6.50
Version: 2.6.50
Version: 2.6.50

Fixed code:
v2.6.50.1 (August 24, 2018)

This release fixes CVE-2018-15836 (a Bleichenbacher-style signature
forgery which involves RSA padding attack)

* wo#7449 . test case for Bleichenbacher-style signature forgery [Bart Trojanowski]
* wo#7449 . verify padding contents for IKEv2 RSA sig check [Bart Trojanowski]
* wo#7449 . added lo06-verifybadsigs test case [Bart Trojanowski]
* b01-install test case will no longer spam with the environment
  variables [Bart Trojanowski]
* lp28-addrinfoserialize: IP address for moon changed to
  192.139.46.82 [Bart Trojanowski]

IPSECBASEVERSION=2.6.50.1
openswan (1:2.6.50.1-0xelerance1) trusty; urgency=low
  * Update to 2.6.50.1
openswan (1:2.6.50.1-0xelerance1) trusty; urgency=low
  * Update to 2.6.50.1
Version: 2.6.50.1
Version: 2.6.50.1
Version: 2.6.50.1
Version: 2.6.50.1
CVE-2018-15836 (C, published 2018-09-26T21:29Z)
Description: value: In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/xelerance/Openswan
Files changed:
lib/liboswkeys/signatures.c
Commit message: wo#7449 . verify padding contents for IKEv2 RSA sig check

Special thanks to Sze Yiu Chau of Purdue University (schau@purdue.edu)
who reported the issue.


Vulnerable code:
    s += padlen + 3;
    (*psig) = s;

Fixed code:
    /* signature starts after ASN wrapped padding [00,01,FF..FF,00] */
    (*psig) = s + padlen + 3;

    /* verify padding contents */
    {
        const u_char *p;
        size_t cnt_ffs = 0;

        for (p = s+2; p < s+padlen+2; p++)
            if (*p == 0xFF)
                cnt_ffs ++;

        if (cnt_ffs != padlen)
            return "4" "invalid Padding String";
    }
CVE-2021-3815 (JavaScript, published 2021-12-08T17:15Z)
Description: value: utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/fabiocaccamo/utils.js
Files changed:
src/utils/ObjectUtil.js
test/test_object.js
Commit message: Fixed prototype pollution. #6


Vulnerable code:

Fixed code:
                if (key === '__proto__') {
                    break;
                }
        it('test prototype pollution', function() {
            f(o, '__proto__.polluted', true);
            test.assertUndefined(o['polluted']);
            test.assertUndefined({}.polluted);
        });
CVE-2021-23558 (JavaScript, published 2022-01-28T22:15Z)
Description: value: The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/b-heilman/bmoor
Files changed:
package.json
src/core.js
src/core.spec.js
Commit message: fix: bug with [__proto__]


Vulnerable code:
  "version": "0.10.0",
    "test": "npm run prettier && mocha --recursive \"./src/**/*.spec.js\"",
    "prettier": "npx prettier --write ./src && npm run lint"
		nextSpace = space[i];
			nextSpace = space[i];

Fixed code:
  "version": "0.10.1",
    "test": "mocha --recursive \"./src/**/*.spec.js\"",
    "prettier": "npx prettier --write ./src",
    "finalize": "npm run lint && npm run prettier && npm run test"
		nextSpace = String(space[i]);
	property = String(property);

			nextSpace = String(space[i]);
	property = String(property);


		it('should not allow __proto__ when in array', function () {
			var t = {};

			bmoor.set(t, [['__proto__'], 'polluted'], 'polluted');

			expect(t.polluted).to.not.equal('polluted');
		});