hitoshura25/cvefixes huggingface dataset:
CVE-2024-25737 (PHP, published 2024-05-22T19:15Z)
Description: value: A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vufind-org/vufind
Files changed:
config/vufind/config.ini
module/VuFind/src/VuFind/Controller/CoverController.php
module/VuFind/src/VuFind/Controller/CoverControllerFactory.php
Commit message: Restrict hostnames for cover proxy. (#3385)



Vulnerable code:
        SessionSettings $ss
        if (!empty($url)) {
            $container->get(\VuFind\Session\Settings::class)

Fixed code:
; This setting controls which hosts are allowed to provide cover images through
; the built-in cover proxy. Images from hostnames that do not match the regular
; expressions below will not be proxied. Be sure to define regular expressions
; using an end of string ($) marker to prevent abuse.
coverproxyAllowedHosts[] = "/assets\.thirdiron\.com$/"
coverproxyAllowedHosts[] = "/\.summon\.serialssolutions\.com$/"

    /**
     * Configuration settings ([Content] section of config.ini)
     *
     * @var array
     */
    protected $config;

     * @param array           $config Configuration settings
        SessionSettings $ss,
        array $config = []
        $this->config = $config;
    /**
     * Is the provided URL included on the configured allow list?
     *
     * @param string $url URL to check
     *
     * @return bool
     */
    protected function proxyAllowedForUrl(string $url): bool
    {
        $host = parse_url($url, PHP_URL_HOST);
        if (!$host) {
            return false;
        }
        foreach ((array)($this->config['coverproxyAllowedHosts'] ?? []) as $regEx) {
            if (preg_match($regEx, $host)) {
                return true;
            }
        }
        return false;
    }

        if (!empty($url) && $this->proxyAllowedForUrl($url)) {
        $config = $container->get(\VuFind\Config\PluginManager::class)->get('config');
        $configArray = $config?->Content?->toArray() ?? [];
            $container->get(\VuFind\Session\Settings::class),
            $configArray
CVE-2024-25737 (Other, published 2024-05-22T19:15Z)
Description: value: A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/vufind-org/vufind
Files changed:
config/vufind/config.ini
module/VuFind/src/VuFind/Controller/CoverController.php
Commit message: Make cover proxy legal content types configurable. (#3388)



Vulnerable code:
                if (str_starts_with(strtolower($contentType), 'image/')) {

Fixed code:
; This setting controls the content types allowed through the cover proxy.
; Note that proxying SVG files is not recommended because of their potential for
; abuse in cross-site scripting attacks.
coverproxyAllowedTypes[] = "image/gif"
coverproxyAllowedTypes[] = "image/jpeg"
coverproxyAllowedTypes[] = "image/png"

use function in_array;

    /**
     * Is the content type allowed by the cover proxy?
     *
     * @param string $contentType Type to check
     *
     * @return bool
     */
    protected function isValidProxyImageContentType(string $contentType): bool
    {
        $validTypes = $this->config['coverproxyAllowedTypes']
            ?? ['image/gif', 'image/jpeg', 'image/png'];
        return in_array(strtolower($contentType), array_map('strtolower', $validTypes));
    }

                if ($this->isValidProxyImageContentType($contentType)) {
CVE-2016-5429 (PHP, published 2016-09-03T20:59Z)
Description: value: jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/nov/jose-php
Files changed:
src/JOSE/JWE.php
Commit message: one more hash_equals, and better CEK decryption error handling


Vulnerable code:
            $this->generateContentEncryptionKey(null);
        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {

Fixed code:
        $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
        $fake_content_encryption_key = $this->content_encryption_key;
            $this->content_encryption_key = $fake_content_encryption_key;
        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
CVE-2016-5429 (PHP, published 2016-09-03T20:59Z)
Description: value: jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
Severity: MEDIUM (CVSS v3 base score: 3.7)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/nov/jose-php
Files changed:
src/JOSE/JWS.php
Commit message: explicit alg check & secure hash comparison


Vulnerable code:
            # NOTE: might better to warn here
                return $this->signature === hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);

Fixed code:
            $using_autodetected_alg = true;
                if ($using_autodetected_alg) {
                    throw new JOSE_Exception_UnexpectedAlgorithm(
                        'HMAC algs MUST be explicitly specified as $expected_alg'
                    );
                }
                $hmac_hash = hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
                return hash_equals($this->signature, $hmac_hash);
CVE-2016-5430 (PHP, published 2016-09-03T20:59Z)
Description: value: The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/nov/jose-php
Files changed:
src/JOSE/JWE.php
Commit message: one more hash_equals, and better CEK decryption error handling


Vulnerable code:
            $this->generateContentEncryptionKey(null);
        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {

Fixed code:
        $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
        $fake_content_encryption_key = $this->content_encryption_key;
            $this->content_encryption_key = $fake_content_encryption_key;
        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
CVE-2016-5430 (PHP, published 2016-09-03T20:59Z)
Description: value: The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/nov/jose-php
Files changed:
src/JOSE/JWE.php
Commit message: one more hash_equals, and better CEK decryption error handling


Vulnerable code:
            $this->generateContentEncryptionKey(null);
        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {

Fixed code:
        $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
        $fake_content_encryption_key = $this->content_encryption_key;
            $this->content_encryption_key = $fake_content_encryption_key;
        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
CVE-2016-5431 (PHP, published 2019-08-07T15:15Z)
Description: value: The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/nov/jose-php
Files changed:
src/JOSE/JWS.php
Commit message: explicit alg check & secure hash comparison


Vulnerable code:
            # NOTE: might better to warn here
                return $this->signature === hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);

Fixed code:
            $using_autodetected_alg = true;
                if ($using_autodetected_alg) {
                    throw new JOSE_Exception_UnexpectedAlgorithm(
                        'HMAC algs MUST be explicitly specified as $expected_alg'
                    );
                }
                $hmac_hash = hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
                return hash_equals($this->signature, $hmac_hash);
CVE-2021-4236 (Go, published 2022-12-27T22:15Z)
Description: value: Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/ecnepsnai/web
Files changed:
websocket.go
Commit message: Fix: websocket requests were not authenticated


Vulnerable code:
			Params: ps,
			log:    s.log,

Fixed code:
	"encoding/json"
		var userData interface{}

		if options.AuthenticateMethod != nil {
			userData = options.AuthenticateMethod(r)
			if isUserdataNil(userData) {
				if options.UnauthorizedMethod == nil {
					s.log.Warn("Rejected authenticated request")
					w.Header().Set("Content-Type", "application/json")
					w.WriteHeader(http.StatusUnauthorized)
					json.NewEncoder(w).Encode(Error{401, "Unauthorized"})
					return
				}

				options.UnauthorizedMethod(w, r)
				return
			}
		}

			Params:   ps,
			UserData: userData,
			log:      s.log,
CVE-2022-1457 (PHP, published 2022-04-25T10:15Z)
Description: value: Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/Controller/EditPageOption.php
Core/Translation/gl_ES.json
Commit message: Solucionado bug XSS al colocar javascript como título en un page_option.


Vulnerable code:
 * Copyright (C) 2017-2020 Carlos Garcia Gomez <carlos@facturascripts.com>
     *
     *
     *
    /**
     * Returns basic page attributes
     *
     * @return array
     */
    public function getPageData()
    public function getUserList()
     * @param Response              $response
     * @param User                  $user
        if (false === \strpos($code, '-')) {
        $parts = \explode('-', $code);
            return true;  // Existen opciones para el usuario.
        if (false == $this->loadPageOptionsForAll()) {
            // No existe opciones general. Asignamos las opciones por defecto de la vista xml al usuario.
     *
     * @param array  $column
     * @param bool   $isWidget
     * @param bool   $allowEmpty
        $newValue = $this->request->request->get($name . '-' . $key);
    "desc-rate-code": "Código para uso interno da tarifa.",
    "rate": "Tarifa",
    "rates": "Tarifas",

Fixed code:
 * Copyright (C) 2017-2022 Carlos Garcia Gomez <carlos@facturascripts.com>

    public function getPageData(): array
    public function getUserList(): array
     * @param Response $response
     * @param User $user
        if (false === strpos($code, '-')) {
        $parts = explode('-', $code);
            // Existen opciones para el usuario.
            return true;
        if (false === $this->loadPageOptionsForAll()) {
            // No existe opciones generales. Asignamos las opciones por defecto de la vista xml al usuario.
     * @param array $column
     * @param bool $isWidget
     * @param bool $allowEmpty
        $newValue = self::toolBox()::utils()::noHtml($this->request->request->get($name . '-' . $key));
    "desc-rate-code": "Código para uso interno da taxa.",
    "rate": "Taxa",
    "rates": "Taxas",
CVE-2022-1514 (PHP, published 2022-04-28T16:15Z)
Description: value: Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/Base/PluginManager.php
Commit message: Sanitized the data read from the ini file to avoid security problems.
------
Saneados los datos leídos del archivo ini para evitar problemas de seguridad.


Vulnerable code:

        if ($ini !== false) {
            foreach (['name', 'version', 'description', 'min_version'] as $key) {
                $info[$key] = $ini[$key] ?? $info[$key];
            }
            if (isset($ini['require'])) {
                $info['require'] = explode(',', $ini['require']);
            }
            if ($info['min_version'] >= 2018 && $info['min_version'] <= self::CORE_VERSION) {
                $info['compatible'] = true;
                $info['description'] = ('Incompatible' === $info['description']) ? ToolBox::i18n()->trans('compatible') : $info['description'];
            } else {
                $info['description'] = ToolBox::i18n()->trans('incompatible-with-facturascripts', ['%version%' => self::CORE_VERSION]);
            $info['enabled'] = in_array($info['name'], $this->enabledPlugins());

Fixed code:
        if ($ini === false) {
            return $info;
        }
        $info['name'] = strip_tags($ini['name'] ?? $info['name']);
        $info['version'] = floatval($ini['version'] ?? $info['version']);
        $info['description'] = strip_tags($ini['description'] ?? $info['description']);
        $info['min_version'] = floatval($ini['min_version'] ?? $info['min_version']);
        if (isset($ini['require'])) {
            foreach (explode(',', $ini['require']) as $req) {
                $req = trim($req);
                if (!empty($req)) {
                    $info['require'][] = $req;
                }
        }
        if ($info['min_version'] <= self::CORE_VERSION && $info['min_version'] >= 2020) {
            $info['compatible'] = true;
        } else {
            $info['description'] = ToolBox::i18n()->trans('incompatible-with-facturascripts', ['%version%' => self::CORE_VERSION]);
        $info['enabled'] = in_array($info['name'], $this->enabledPlugins());
CVE-2022-1571 (PHP, published 2022-05-04T11:15Z)
Description: value: Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/Model/Subcuenta.php
Commit message: Escaped html code from model fields to improve security.
------
Escapado el html de los campos del modelo para mejorar la seguridad.


Vulnerable code:
        $this->codcuenta = trim($this->codcuenta);
        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : trim($this->codsubcuenta);
        if (!$this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {

Fixed code:
        // escape html
        foreach (['codcuenta', 'codsubcuenta', 'descripcion', 'codcuentaesp'] as $field) {
            $this->{$field} = self::toolBox()::utils()::noHtml($this->{$field});
        }

        $this->codsubcuenta = empty($this->idsubcuenta) ? $this->transformCodsubcuenta($this->codsubcuenta) : $this->codsubcuenta;
        if (false === $this->disableAdditionalTest && strlen($this->codsubcuenta) !== $exercise->longsubcuenta) {
CVE-2022-1682 (PHP, published 2022-05-12T09:15Z)
Description: value: Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/Controller/EditPageOption.php
Commit message: We check the url parameter of the link to ensure that it is a valid controller.
------
Comprobamos el parámetro url del enlace para asegurar que sea un controlador válido.


Vulnerable code:
        $this->backPage = $this->request->get('url') ?: $this->selectedViewName;

Fixed code:
use FacturaScripts\Dinamic\Model\Page;
        $this->setBackPage();
    private function setBackPage()
    {
        // check if the url is a real controller name
        $url = $this->request->get('url', '');
        $pageModel = new Page();
        foreach ($pageModel->all([], [], 0, 0) as $page) {
            if (substr($url, 0, strlen($page->name)) === $page->name) {
                $this->backPage = $url;
                return;
            }
        }

        // set the default back page
        $this->backPage = $this->selectedViewName;
    }
CVE-2022-1715 (PHP, published 2022-05-13T17:15Z)
Description: value: Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/App/AppController.php
Commit message: Fixed string comparison to avoid automatic cast during database password check.
------
Corregida la comparación de cadenas para evitar cast automático durante la comprobación de la contraseña de la basew de datos.


Vulnerable code:
            ToolBox::i18nLog()->warning('different-passwords', ['%userNick%' => $nick]);
        } elseif ($user->loadFromCode($nick) && $this->request->request->get('fsDbPasswd') == FS_DB_PASS) {

Fixed code:
            ToolBox::i18nLog()->warning('different-passwords', ['%userNick%' => htmlspecialchars($nick)]);
        } elseif ($user->loadFromCode($nick) && $this->request->request->get('fsDbPasswd') === FS_DB_PASS) {