hitoshura25/cvefixes huggingface dataset:
CVE-2023-5844 (PHP, published 2023-10-30T11:15Z)
Description: value: Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
CHANGELOG.md
src/Controller/Admin/UserController.php
Commit message: [Improvement]: Check if new password is NOT the same as the old one when resetting (#285)

* add check that new passoword is different than old one

* refactor empty old password check

* add CHANGELOG

* Update CHANGELOG.md

---------

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>

Vulnerable code:

Fixed code:
 - [User -> Settings] When resetting password, setting the new password same as the old one would throw an error.

                        if (Tool\Authentication::verifyPassword($user, $values['new_password'])) {
                            throw new \Exception('The new password cannot be the same as the old one');
                        }
CVE-2024-23648 (PHP, published 2024-01-24T18:15Z)
Description: value: Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able to retrieve it would be able to resets the user's password. Prior to version 1.2.3, the reset-password URL is crafted using the "Host" HTTP header of the request sent to request a password reset. This way, an external attacker could send password requests for users, but specify a "Host" header of a website that they control. If the user receiving the mail clicks on the link, the attacker would retrieve the reset token of the victim and perform account takeover. Version 1.2.3 fixes this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
src/Controller/Admin/LoginController.php
Commit message: Password reset - fix for possible host header injection (#362)

* Password reset - fix for possible host header injection

* Update src/Controller/Admin/LoginController.php

Co-authored-by: Sebastian Blank <blank@data-factory.net>

---------

Co-authored-by: Sebastian Blank <blank@data-factory.net>

Vulnerable code:
    public function lostpasswordAction(Request $request, CsrfProtectionHandler $csrfProtection, Config $config, RateLimiterFactory $resetPasswordLimiter): Response
                $loginUrl = $this->generateUrl('pimcore_admin_login_check', [
                    'token' => $token,
                    'reset' => 'true',
                ], UrlGeneratorInterface::ABSOLUTE_URL);


Fixed code:
use Pimcore\SystemSettingsConfig;
use Symfony\Component\Routing\RouterInterface;
    public function lostpasswordAction(
        Request $request,
        CsrfProtectionHandler $csrfProtection,
        Config $config,
        RateLimiterFactory $resetPasswordLimiter,
        RouterInterface $router
    ): Response
                    $domain = SystemSettingsConfig::get()['general']['domain'];
                    if (!$domain) {
                        throw new \Exception('No main domain set in system settings, unable to generate reset password link');
                    }

                    $context = $router->getContext();
                    $context->setHost($domain);

                    $loginUrl = $this->generateUrl('pimcore_admin_login_check', [
                        'token' => $token,
                        'reset' => 'true',
                    ], UrlGeneratorInterface::ABSOLUTE_URL);
CVE-2024-24822 (PHP, published 2024-02-07T18:15Z)
Description: value: Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
src/Controller/Admin/TagsController.php
Commit message: Fix: Tag access rights (#412)



Vulnerable code:

Fixed code:
        $this->checkPermission('tags_configuration');

        $this->checkPermission('tags_configuration');

        $this->checkPermission('tags_configuration');
CVE-2024-25625 (PHP, published 2024-02-19T16:15Z)
Description: value: Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input.  The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Files changed:
src/Controller/Admin/UserController.php
Commit message: [Security]: Prevent potential host injection in invitation link (#428)



Vulnerable code:
    public function invitationLinkAction(Request $request, TranslatorInterface $translator): JsonResponse

Fixed code:
use Pimcore\SystemSettingsConfig;
use Symfony\Component\Routing\RouterInterface;
    public function invitationLinkAction(Request $request, TranslatorInterface $translator, RouterInterface $router): JsonResponse

                $domain = SystemSettingsConfig::get()['general']['domain'];
                if (!$domain) {
                    throw new \Exception('No main domain set in system settings, unable to generate login invitation link');
                }

                $context = $router->getContext();
                $context->setHost($domain);
CVE-2021-27815 (C, published 2021-04-14T14:15Z)
Description: value: NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libexif/exif
Files changed:
exif/actions.c
Commit message: actually return empty stringand not 'em,pty string' as expected


Vulnerable code:
	if (!strlen(text)) return "empty string";

Fixed code:
	if (!strlen(text)) return "";
CVE-2021-27815 (C, published 2021-04-14T14:15Z)
Description: value: NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libexif/exif
Files changed:
exif/actions.c
Commit message: added empty strign check, which would lead to NULL ptr deref/crash in exif XML display. fixes https://github.com/libexif/exif/issues/4


Vulnerable code:

Fixed code:
	if (!strlen(text)) return "empty string";
CVE-2022-0355 (Unknown, published 2022-01-26T04:15Z)
Description: value: Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.


Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/feross/simple-get
Files changed:
Commit message: Merge pull request #73 from ranjit-git/master



Vulnerable code:

Fixed code:
CVE-2018-11363 (C, published 2018-05-22T04:29Z)
Description: value: jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/AndreRenaud/PDFGen
Files changed:
pdfgen.c
Commit message: jpeg: Fix another possible buffer overrun

Found via the clang libfuzzer


Vulnerable code:
                block_length = data[i] * 256 + data[i+1];

Fixed code:
                if (i + 1 < data_size)
                    block_length = data[i] * 256 + data[i+1];
CVE-2021-4293 (PHP, published 2022-12-28T09:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menu_list_update.php. The manipulation of the argument me_link leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.4.5.2 is able to address this issue. The name of the patch is 70daa537adfa47b87af12d85f1e698fff01785ff. It is recommended to upgrade the affected component. VDB-216954 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/youngcart5
Files changed:
adm/menu_list_update.php
Commit message: [KVE-2020-1616]그누보드 메인화면 XSS 취약점 수정


Vulnerable code:
    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes($_POST['me_link'][$i], 1)) : '';

Fixed code:
    if(preg_match('/^javascript/i', preg_replace('/[ ]{1,}|[\t]/', '', $_POST['me_link'][$i]))){
        $_POST['me_link'][$i] = G5_URL;
    }

    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes(preg_replace('/[ ]{2,}|[\t]/', '', $_POST['me_link'][$i]), 1)) : '';
CVE-2010-4264 (PHP, published 2021-06-22T14:15Z)
Description: value: It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/vanilla/vanilla
Files changed:
applications/dashboard/controllers/class.entrycontroller.php
library/core/class.dispatcher.php
Commit message: Fixed XSS vulnerability where filename could contain abitrary code to execute on the client side.


Vulnerable code:
                  $this->SelfUrl = Gdn::Request()->Path();
      $this->Request = $Request->Path();

Fixed code:
                  $this->SelfUrl = Url('');//Gdn::Request()->Path();
      $this->Request = Url('');//$Request->Path();
CVE-2018-12976 (Go, published 2018-07-05T18:29Z)
Description: value: In Go Doc Dot Org (gddo) through 2018-06-27, an attacker could use specially crafted <go-import> tags in packages being fetched by gddo to cause a directory traversal and remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/golang/gddo
Files changed:
gosrc/gosrc.go
gosrc/gosrc_test.go
Commit message: gosrc: validate repo from meta

Fixes CVE-2018-12976.

Change-Id: I6b87ab692915d46ba4f668ab848473de9b054c8a
Reviewed-on: https://go-review.googlesource.com/121358
Reviewed-by: Filippo Valsorda <filippo@golang.org>


Vulnerable code:
				t.Errorf("getDynamic(client, %q, etag) did not return expected error", tt.importPath)
			t.Errorf("getDynamic(client, %q, etag) return unexpected error: %v", tt.importPath, err)

Fixed code:
	if !IsValidRemotePath(repo) {
		return nil, fmt.Errorf("bad path from meta: %s", repo)
	}

	// The repo element of go-import includes "../"
	"http://my.host/pkg": `<head> <meta name="go-import" content="my.host/pkg git http://vcs.net/myhost/../../tmp/pkg.git"></head>`,
	{"my.host/pkg", nil},
				t.Errorf("getDynamic(ctx, client, %q, etag) did not return expected error", tt.importPath)
			t.Errorf("getDynamic(ctx, client, %q, etag) return unexpected error: %v", tt.importPath, err)
CVE-2022-4527 (Python, published 2022-12-15T21:15Z)
Description: value: A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of the file src/collective/task/browser/table.py. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is 1aac7f83fa2c2b41d59ba02748912953461f3fac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215907.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/collective/collective.task
Files changed:
CHANGES.rst
setup.py
src/collective/task/browser/table.py
Commit message: Escaped some column rendering to avoid xss


Vulnerable code:
- Nothing changed yet.

        'z3c.table',


            return member.getUser().getProperty('fullname').decode('utf-8')




            return group.getProperty('title').decode('utf-8')





            return translate(PMF(state_title), context=self.request)


Fixed code:
- Required z3c.table 2.2 to include escaping, to avoid xss.
  Escaped some columns.
  [sgeulette]
        'future',
        'z3c.table>=2.2',
from html import escape
from imio.helpers.adapters import NoEscapeLinkColumn
            return escape(member.getUser().getProperty('fullname').decode('utf-8'))
            return escape(group.getProperty('title').decode('utf-8'))
            return escape(translate(PMF(state_title), context=self.request))
CVE-2023-27054 (JavaScript, published 2023-03-22T22:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/miroslavpejic85/mirotalk
Files changed:
public/js/client.js
public/views/client.html
Commit message: [mirotalk] - #139 prevent XSS through DC


Vulnerable code:
 * @param {object} dataMessage chat messages
function handleDataChannelChat(dataMessage) {
    if (!dataMessage) return;
        let pMsg = checkMsg(msgerPrivateMsgInput.value.trim());
        if (!pMsg) {
            msgerPrivateMsgInput.value = '';
            isChatPasteTxt = false;
            return;
        }

Fixed code:
 * @param {object} data chat messages
function handleDataChannelChat(data) {
    if (!data) return;

    // prevent XSS injection from remote peer through Data Channel
    const dataMessage = JSON.parse(filterXSS(JSON.stringify(data)));
        let pMsg = msgerPrivateMsgInput.value.trim();

        // let pMsg = checkMsg(msgerPrivateMsgInput.value.trim());
        // if (!pMsg) {
        //     msgerPrivateMsgInput.value = '';
        //     isChatPasteTxt = false;
        //     return;
        // }
        - https://github.com/leizongmin/js-xss                              (https://www.npmjs.com/package/xss)
        <script defer src="https://rawgit.com/leizongmin/js-xss/master/dist/xss.js"></script>
CVE-2016-8869 (PHP, published 2016-11-04T21:59Z)
Description: value: The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/joomla/joomla-cms
Files changed:
administrator/manifests/files/joomla.xml
components/com_users/controllers/user.php
libraries/cms/version/version.php
Commit message: Prepare 3.6.4 Stable Release


Vulnerable code:
	<version>3.6.4-dev</version>
	/**
	 * Method to register a user.
	 *
	 * @return  boolean
	 *
	 * @since   1.6
	 */
	public function register()
	{
		JSession::checkToken('post') or jexit(JText::_('JINVALID_TOKEN'));

		// Get the application
		$app = JFactory::getApplication();

		// Get the form data.
		$data = $this->input->post->get('user', array(), 'array');

		// Get the model and validate the data.
		$model  = $this->getModel('Registration', 'UsersModel');

		$form = $model->getForm();

		if (!$form)
		{
			JError::raiseError(500, $model->getError());

			return false;
		}

		$return = $model->validate($form, $data);

		// Check for errors.
		if ($return === false)
		{
			// Get the validation messages.
			$errors = $model->getErrors();

			// Push up to three validation messages out to the user.
			for ($i = 0, $n = count($errors); $i < $n && $i < 3; $i++)
			{
				if ($errors[$i] instanceof Exception)
				{
					$app->enqueueMessage($errors[$i]->getMessage(), 'notice');

					continue;
				}

				$app->enqueueMessage($errors[$i], 'notice');
			}

			// Save the data in the session.
			$app->setUserState('users.registration.form.data', $data);

			// Redirect back to the registration form.
			$this->setRedirect('index.php?option=com_users&view=registration');

			return false;
		}

		// Finish the registration.
		$return = $model->register($data);

		// Check for errors.
		if ($return === false)
		{
			// Save the data in the session.
			$app->setUserState('users.registration.form.data', $data);

			// Redirect back to the registration form.
			$message = JText::sprintf('COM_USERS_REGISTRATION_SAVE_FAILED', $model->getError());
			$this->setRedirect('index.php?option=com_users&view=registration', $message, 'error');

			return false;
		}

		// Flush the data from the session.
		$app->setUserState('users.registration.form.data', null);

		return true;
	}

	const DEV_LEVEL = '4-dev';
	const DEV_STATUS = 'Development';
	const RELDATE = '18-October-2016';
	const RELTIME = '16:37';

Fixed code:
	<version>3.6.4</version>
	const DEV_LEVEL = '4';
	const DEV_STATUS = 'Stable';
	const RELDATE = '21-October-2016';
	const RELTIME = '16:33';