hitoshura25/cvefixes huggingface dataset:
CVE-2022-24774 (Other, published 2022-03-22T17:15Z)
Description: value: CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/CycloneDX/cyclonedx-bom-repo-server
Files changed:
semver.txt
Commit message: Security release - remediation of CVE-2022-24774

Signed-off-by: Patrick Dwyer <patrick.dwyer@owasp.org>


Vulnerable code:
2.0.0

Fixed code:
2.0.1
CVE-2018-19837 (C++, published 2018-12-04T09:29Z)
Description: value: In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/sass/libsass
Files changed:
src/parser.cpp
Commit message: Remove legacy workaround for parsing modulo operator

Fixes #2659


Vulnerable code:
    // Special case handling for `%` proceeding an interpolant.
    if (lex< sequence< exactly<'%'>, optional< percentage > > >())
    { return SASS_MEMORY_NEW(String_Constant, pstate, lexed); }


Fixed code:
CVE-2021-43090 (Other, published 2022-03-25T16:15Z)
Description: value: An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/membrane/soa-model
Files changed:
core/src/main/groovy/com/predic8/schema/Include.groovy
core/src/main/groovy/com/predic8/soamodel/AbstractParser.groovy
Commit message: Fixes #281.


Vulnerable code:
  	
    def incToken = XMLInputFactory.newInstance().createXMLStreamReader(resource)
		XMLInputFactory.newInstance().createXMLStreamReader(res)

Fixed code:

    def inputFactory = XMLInputFactory.newInstance()
    inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
    inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
    def incToken = inputFactory.createXMLStreamReader(resource)
		def inputFactory = XMLInputFactory.newInstance()
		inputFactory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false)
		inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false)
		inputFactory.createXMLStreamReader(res)
CVE-2012-10009 (Other, published 2023-03-21T00:15Z)
Description: value: A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/404like
Files changed:
404Like.php
readme.txt
Commit message: Check for sql injection by '";
Plugin work automatic without code in 404 template

git-svn-id: https://plugins.svn.wordpress.org/404like/trunk@503776 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 Version: 1.0
    post_status = 'publish' AND (post_name like '%".$title."%' OR post_title like '%".$title."%')";
    post_status = 'publish' AND (post_title like '%".$title."%')";
  		if (count($pageposts) == 1) { 
      echo '<div id="errorresults"><h2 class="twost">Folgendes Gesucht ?</h2><ul>';
Tested up to: 3.0
3. Place `<?php checkPage(); ? >` in first line of your 404 template page.

Fixed code:
 Version: 1.0.2
	$title = strtolower($title);
    post_status = 'publish' AND (LOWER(post_name) like '%".$title."%' OR post_title like '%".$title."%')";
	$title = strtolower($title);
    post_status = 'publish' AND (LOWER(post_title) like '%".$title."%')";
	
	if ( !is_404() )
	return;
  //schuetzen
    $searchWord = stripslashes($searchWord);
    $searchWord = str_replace ("'", "", $searchWord);
    $searchWord = str_replace ('"', "", $searchWord);
    $searchWord = str_replace (';', "", $searchWord);
      
  		if (count($pageposts) == 1 || ($searchWord == "404Like" || $searchWord == "404like")) { 
          break;
      echo '<div id="errorresults"><h2 class="twost">'.__("Folgendes Gesucht").' ?</h2><ul>';

function plugin404Like_filter($redirect, $request) {

	if ( is_404() ) {return false;}
	return $redirect;
}

add_action( 'template_redirect', 'checkPage' );
add_filter( 'redirect_canonical', 'plugin404Like_filter', 10, 2 );
Tested up to: 3.3.0
3. Nothing, it works without any other activities - you can test it
CVE-2023-41048 (Unknown, published 2023-09-21T15:15Z)
Description: value: plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/plone/plone.namedfile
Files changed:
Commit message: Merge pull request from GHSA-jj7c-jrv4-c65x

Force download of image scales when inline is not allowed for mime type [master]

Vulnerable code:

Fixed code:
CVE-2020-15178 (PHP, published 2020-09-15T18:15Z)
Description: value: In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/PrestaShop/contactform
Files changed:
contactform.php
Commit message: Merge pull request from GHSA-95hx-62rh-gg96

Do not unescape form message data

Vulnerable code:
                     '{message}' => Tools::nl2br(Tools::stripslashes($message)),

Fixed code:
                     '{message}' => Tools::nl2br(Tools::htmlentitiesUTF8(Tools::stripslashes($message))),
CVE-2019-10260 (HTML, published 2019-03-28T17:29Z)
Description: value: Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/totaljs/cms
Files changed:
themes/admin/views/index.html
Commit message: Fixed XSS.


Vulnerable code:

Fixed code:

			if (item.message)
				item.message = Thelpers.encode(item.message);
CVE-2019-10260 (JavaScript, published 2019-03-28T17:29Z)
Description: value: Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/totaljs/cms
Files changed:
themes/admin/public/ui.js
Commit message: Fixed XSS.


Vulnerable code:
				m.value = column.template ? column.template(items[i], column) : column.render ? column.render(val, column, items[i]) : val == null ? '' : (column.format ? val.format(column.format) : val);

Fixed code:
				m.value = column.template ? column.template(items[i], column) : column.render ? column.render(val, column, items[i]) : val == null ? '' : Thelpers.encode((column.format ? val.format(column.format) : val));
CVE-2022-31072 (Unknown, published 2022-06-15T23:15Z)
Description: value: Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-276 \u2014 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
Repository: https://github.com/octokit/octokit.rb
Files changed:
Commit message: Merge pull request #1446 from octokit/updates-release-steps-ic

Adds details on how to run a manual file integrity check

Vulnerable code:

Fixed code:
CVE-2022-21675 (Java, published 2022-01-12T19:15Z)
Description: value: Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (AKA "Zip Slip"). The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The Zip Slip vulnerability can affect numerous archive formats, including zip, jar, tar, war, cpio, apk, rar and 7z. The attacker can then overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine. The impact of a Zip Slip vulnerability would allow an attacker to create or overwrite existing files on the filesystem. In the context of a web application, a web shell could be placed within the application directory to achieve code execution. All users should upgrade to BCV v2.11.0 when possible to receive a patch. There are no recommended workarounds aside from upgrading.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Konloch/bytecode-viewer
Files changed:
src/main/java/the/bytecode/club/bytecodeviewer/util/ZipUtils.java
Commit message: Mitigate Zip Slip exlpoit



Vulnerable code:
             ZipOutputStream zip = new ZipOutputStream(fileWriter)){
             ZipOutputStream zip = new ZipOutputStream(fileWriter)){
}

Fixed code:
    // TODO: Maybe migrate to org.apache.commons.compress.archivers.examples.Expander?
                if (!f.getCanonicalPath().startsWith(destinationDir)) {
                    System.out.println("Zip Slip exploit detected. Skipping entry " + entry.getName());
                    continue;
                }

             ZipOutputStream zip = new ZipOutputStream(fileWriter)) {
             ZipOutputStream zip = new ZipOutputStream(fileWriter)) {
}
CVE-2022-21675 (Java, published 2022-01-12T19:15Z)
Description: value: Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (AKA "Zip Slip"). The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The Zip Slip vulnerability can affect numerous archive formats, including zip, jar, tar, war, cpio, apk, rar and 7z. The attacker can then overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine. The impact of a Zip Slip vulnerability would allow an attacker to create or overwrite existing files on the filesystem. In the context of a web application, a web shell could be placed within the application directory to achieve code execution. All users should upgrade to BCV v2.11.0 when possible to receive a patch. There are no recommended workarounds aside from upgrading.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Konloch/bytecode-viewer
Files changed:
src/main/java/the/bytecode/club/bytecodeviewer/util/ZipUtils.java
Commit message: Improve Zip Slip detection



Vulnerable code:
                if (!f.getCanonicalPath().startsWith(destinationDir)) {

Fixed code:
        String canonicalDestDir = new File(destinationDir).getCanonicalPath();
        if (!canonicalDestDir.endsWith(File.separator)) {
            canonicalDestDir += File.separator;
        }

                if (!f.getCanonicalPath().startsWith(canonicalDestDir)) {
CVE-2022-25851 (JavaScript, published 2022-06-10T20:15Z)
Description: value: The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/jpeg-js/jpeg-js
Files changed:
lib/decoder.js
test/index.js
Commit message: fix: validate sampling factors (#106)



Vulnerable code:
        var maxH = 0, maxV = 0;
const SUPER_LARGE_JPEG_BASE64 =
  '/9j/wJ39sP//DlKWvX+7xPlXkJa9f7v8DoDVAAD//zb6QAEAI2cBv3P/r4ADpX8Jf14AAAAAgCPE+VeQlr1/uwCAAAAVALNOjAGP2lIS';
  expect(() => jpeg.decode(SUPER_LARGE_JPEG_BUFFER)).toThrow(
    'maxResolutionInMP limit exceeded by 141MP',

Fixed code:
        // According to the JPEG standard, the sampling factor must be between 1 and 4
        // See https://github.com/libjpeg-turbo/libjpeg-turbo/blob/9abeff46d87bd201a952e276f3e4339556a403a3/libjpeg.txt#L1138-L1146
        var maxH = 1, maxV = 1;

              if ( h <= 0 || v <= 0 ) {
                throw new Error('Invalid sampling factor, expected values above 0');
              }

const SUPER_LARGE_JPEG_BASE64 = '/9j/wfFRBf//BdgC/9p/2P/E4d4=';

const SUPER_LARGE_RESOLUTION_JPEG_BASE64 = '/9j/wfFR2PDh3g==';
const SUPER_LARGE_RESOLUTION_JPEG_BUFFER = Buffer.from(SUPER_LARGE_RESOLUTION_JPEG_BASE64, 'base64');
  expect(() => jpeg.decode(SUPER_LARGE_RESOLUTION_JPEG_BUFFER)).toThrow(
    'maxResolutionInMP limit exceeded by 3405MP',

// See https://github.com/jpeg-js/jpeg-js/issues/105
it('invalid sampling factor should error out', function () {
  expect(() => jpeg.decode(Buffer.from('/9j/wfFR2AD/UdgA/9r/3g==', 'base64')).toThrow(
    'Invalid sampling factor, expected values above 0'))
});
CVE-2024-1520 (Python, published 2024-04-10T17:15Z)
Description: value: An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/parisneo/lollms-webui
Files changed:
endpoints/lollms_advanced.py
Commit message: Update lollms_advanced.py

Vulnerable code:
        subprocess.Popen(["start", path], shell=True)
        subprocess.Popen(["code", str(root_folder)], shell=True)
                subprocess.run(['start', str(root_folder)], check=True, shell=True)
                subprocess.run(['start', str(root_folder)], check=True, shell=True)

Fixed code:
        subprocess.Popen(["start", path])
        subprocess.Popen(["code", str(root_folder)])
                subprocess.run(['start', str(root_folder)], check=True)
                subprocess.run(['start', str(root_folder)], check=True)
CVE-2024-2288 (Unknown, published 2024-06-06T19:15Z)
Description: value: A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/parisneo/lollms-webui
Files changed:
Commit message: Merge pull request #506 from ParisNeo/ParisNeo-patch-3

Update README.md

Vulnerable code:

Fixed code:
CVE-2019-1010247 (Other, published 2019-07-19T15:15Z)
Description: value: ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zmartzone/mod_auth_openidc
Files changed:
ChangeLog
configure.ac
src/mod_auth_openidc.c
Commit message: release 2.3.10.2: fix XSS vulnerability for poll parameter

in OIDC Session Management RP iframe; CSNC-2019-001; thanks Mischa
Bachmann

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>

Vulnerable code:
AC_INIT([mod_auth_openidc],[2.3.10.1],[hans.zandbelt@zmartzone.eu])
			"        timerID = setInterval('checkSession()', %s);\n"
	if (s_poll_interval == NULL)
		s_poll_interval = "3000";
			session_state, op_iframe_id, s_poll_interval, redirect_uri,

Fixed code:
01/22/2019
- fix XSS vulnerability CSNC-2019-001 wrt. poll parameter in OIDC Session Management RP iframe; thanks Mischa Bachmann
- release 2.3.10.2

AC_INIT([mod_auth_openidc],[2.3.10.2],[hans.zandbelt@zmartzone.eu])
			"        timerID = setInterval('checkSession()', %d);\n"
	int poll_interval = s_poll_interval ? strtol(s_poll_interval, NULL, 10) : 0;
	if ((poll_interval <= 0) || (poll_interval > 3600 * 24))
		poll_interval = 3000;
			session_state, op_iframe_id, poll_interval, redirect_uri,