hitoshura25/cvefixes huggingface dataset:
CVE-2023-38511 (PHP, published 2024-04-15T17:15Z)
Description: value: iTop is an IT service management platform.  Dashboard editor : can load multiple files and URL, and full path disclosure on dashboard config file. This vulnerability is fixed in 3.0.4 and 3.1.1.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
application/dashboard.class.inc.php
Commit message: N°6552 - Security hardening


Vulnerable code:
			$sDashboardDefinition = @file_get_contents($sDashboardFile);
			$oDashboard->SetDefinitionFile($sDashboardFile);

Fixed code:
		$sDashboardFileSanitized = utils::RealPath($sDashboardFile, APPROOT);
		if (false === $sDashboardFileSanitized) {
			throw new SecurityException('Invalid dashboard file !');
		}

			$sDashboardDefinition = @file_get_contents($sDashboardFileSanitized);
			$oDashboard->SetDefinitionFile($sDashboardFileSanitized);
CVE-2023-43790 (Other, published 2024-04-15T17:15Z)
Description: value: iTop is an IT service management platform.  By manipulating HTTP queries, a user can inject malicious content in the fields used for the object friendlyname value. This vulnerability is fixed in 3.1.1 and 3.2.0.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
templates/base/components/datatable/row-actions/handler.js.twig
Commit message: N°6560 - Fix unescaped backtick in friendlyname breaking details page scripts


Vulnerable code:
            let sTitle = `{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s|raw  }}`;
                sTitle = `{{ aAction.confirmation.title|dict_s|raw }}`;
            let sMessage = `{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s|raw  }}`;
                sMessage = `{{ aAction.confirmation.message|dict_s|raw }}`;

Fixed code:
            let sTitle = '{{ 'UI:Datatables:RowActions:ConfirmationDialog'|dict_s  }}';
                sTitle = '{{ aAction.confirmation.title|dict_s }}';
            let sMessage = '{{ 'UI:Datatables:RowActions:ConfirmationMessage'|dict_s  }}';
                sMessage = '{{ aAction.confirmation.message|dict_s }}';
CVE-2023-45808 (PHP, published 2024-04-15T18:15Z)
Description: value: iTop is an IT service management platform.  When creating or updating an object, extkey values aren't checked to be in the current user silo. In other words, by forging an http request, the user can create objects pointing to out of silo objects (for example a UserRequest in an out of scope Organization). Fixed in iTop 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
Commit message: N°6458 Fix portal errors


Vulnerable code:
use Combodo\iTop\Portal\Helper\SecurityHelper;
			/** @var SecurityHelper $oSecurityHelper */
			$oSecurityHelper = $this->oContainer->get('security_helper');
			$bAllowWrite = $this->oFormHandlerHelper->getSecurityHelper()->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey());

Fixed code:
			$oSecurityHelper = $this->oFormHandlerHelper->getSecurityHelper();
			$bAllowWrite = $oSecurityHelper->IsActionAllowed($bIsNew ? UR_ACTION_CREATE : UR_ACTION_MODIFY, $sObjectClass, $this->oObject->GetKey());
CVE-2023-47123 (PHP, published 2024-04-15T18:15Z)
Description: value: iTop is an IT service management platform.  By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
sources/Service/Base/ObjectRepository.php
Commit message: N°6917 - Security hardening


Vulnerable code:
	static public function Search(string $sObjectClass, array $aFieldsToLoad, string $sSearch): ?array
	static public function SearchFromOql(string $sObjectClass, array $aFieldsToLoad, string $sOql, string $sSearch, DBObject $oThisObject = null): ?array
	static private function DBSetToObjectArray(iDBObjectSetIterator $oDbObjectSet, string $sObjectClass, array $aFieldsToLoad): array
	static public function GetDefaultFieldsToLoad(array $aComplementAttributeSpec, string $sObjectImageAttCode)
	static public function ComputeOthersData(DBObject $oDbObject, string $sClass, array $aData, array $aComplementAttributeSpec, string $sObjectImageAttCode): array
				$aData['full_description'] = "{$aData['friendlyname']}<br><i><small>{$aData['additional_field']}</small></i>";
				$aData['full_description'] = $aData['friendlyname'];
	static public function DeleteFromOql(string $sOql): bool

Fixed code:
	public static function Search(string $sObjectClass, array $aFieldsToLoad, string $sSearch): ?array
	public static function SearchFromOql(string $sObjectClass, array $aFieldsToLoad, string $sOql, string $sSearch, DBObject $oThisObject = null): ?array
	private static function DBSetToObjectArray(iDBObjectSetIterator $oDbObjectSet, string $sObjectClass, array $aFieldsToLoad): array
	public static function GetDefaultFieldsToLoad(array $aComplementAttributeSpec, string $sObjectImageAttCode)
	public static function ComputeOthersData(DBObject $oDbObject, string $sClass, array $aData, array $aComplementAttributeSpec, string $sObjectImageAttCode): array
			$sFriendlynameForHtml = utils::EscapeHtml($aData['friendlyname']);
				$sAdditionalFieldForHtml = utils::EscapeHtml($aData['additional_field']);
				$aData['full_description'] = "{$sFriendlynameForHtml}<br><i><small>{$sAdditionalFieldForHtml}</small></i>";
				$aData['full_description'] = $sFriendlynameForHtml;
	public static function DeleteFromOql(string $sOql): bool
CVE-2023-47622 (Other, published 2024-04-15T18:15Z)
Description: value: iTop is an IT service management platform.  When dashlet are refreshed, XSS attacks are possible.  This vulnerability is fixed in 3.0.4 and 3.1.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
templates/application/display-block/block-chart-ajax-bars/layout.js.twig
templates/application/display-block/block-chart-ajax-pie/layout.js.twig
templates/application/display-block/block-csv/layout.js.twig
Commit message: N°6908 - Security hardening


Vulnerable code:
var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
    '{{ oUIBlock.sAjaxLink|raw }}',

Fixed code:
var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|escape('js') }}&refresh='+idxChart+'","", function (data) {'+
var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|escape('js')}}&refresh='+idxChart+'","", function (data) {'+
    '{{ oUIBlock.sAjaxLink|escape('js') }}',
CVE-2023-48710 (PHP, published 2024-04-15T18:15Z)
Description: value: iTop is an IT service management platform.  Files from the `env-production` folder can be retrieved even though they should have restricted access.  Hopefully, there is no sensitive files stored in that folder natively, but there could be from a third-party module. 
 The `pages/exec.php` script as been fixed to limit execution of PHP files only.  Other file types won't be retrieved and exposed.  The vulnerability is fixed in 2.7.10, 3.0.4, 3.1.1, and 3.2.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Combodo/iTop
Files changed:
pages/exec.php
Commit message: N°6989 - Security hardening


Vulnerable code:
if (!file_exists($sTargetPage))
{

Fixed code:
if (!file_exists($sTargetPage)
    || (strtolower(pathinfo($sTargetPage, PATHINFO_EXTENSION)) !== "php")
) {
CVE-2014-125051 (PHP, published 2023-01-06T17:15Z)
Description: value: A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/himiklab/yii2-jqgrid-widget
Files changed:
JqGridAction.php
Commit message: fix potential SQL injection


Vulnerable code:

Fixed code:
            if (!$this->model->hasAttribute($rule['field'])) {
                throw new BadRequestHttpException('Unknown attribute');
            }
CVE-2017-5934 (Python, published 2018-10-15T19:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/moinwiki/moin-1.9
Files changed:
MoinMoin/action/fckdialog.py
docs/CHANGES
Commit message: security fix for CVE-2017-5934, XSS in GUI editor related code

Thanks to Nitin Venkatesh for discovering and reporting this!


Vulnerable code:
          <input id="txtPagename" name="pagename" size="30" value="%(name)s">

Fixed code:
    name_escaped = wikiutil.escape(name)
          <input id="txtPagename" name="pagename" size="30" value="%(name_escaped)s">
  * security fix for CVE-2017-5934, XSS in GUI editor related code
CVE-2020-15275 (Unknown, published 2020-11-11T16:15Z)
Description: value: MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/moinwiki/moin-1.9
Files changed:
Commit message: Merge pull request from GHSA-4q96-6xhq-ff43

security: fix stored XSS vulnerability via SVG attachment

Vulnerable code:

Fixed code:
CVE-2022-36086 (Unknown, published 2022-09-07T23:15Z)
Description: value: linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/rust-osdev/linked-list-allocator
Files changed:
Commit message: Merge pull request from GHSA-xg8p-34w2-j49j

Infallible extend

Vulnerable code:

Fixed code:
CVE-2017-5537 (Python, published 2017-03-15T15:59Z)
Description: value: The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/WeblateOrg/weblate
Files changed:
weblate/accounts/tests/test_registration.py
weblate/accounts/views.py
Commit message: Do not show validation error on password reset

This can leak information whether account exists or not.

Fixes #1317

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:

Fixed code:
    def test_reset_nonexisting(self):
        '''
        Test for password reset.
        '''
        response = self.client.get(
            reverse('password_reset'),
        )
        self.assertContains(response, 'Reset my password')
        response = self.client.post(
            reverse('password_reset'),
            {
                'email': 'test@example.com'
            }
        )
        self.assertRedirects(response, reverse('email-sent'))
        self.assertEqual(len(mail.outbox), 0)

        else:
            return redirect('email-sent')
CVE-2021-3767 (PHP, published 2021-09-06T12:15Z)
Description: value: bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bookstackapp/bookstack
Files changed:
app/Util/HtmlContentFilter.php
tests/Entity/PageContentTest.php
Commit message: Added filter for xlink:href svg xss

Simply remove all such attributes


Vulnerable code:
        foreach ($onAttributes as $attr) {
            /** @var \DOMAttr $attr */
            $attrName = $attr->nodeName;
            $attr->parentNode->removeAttribute($attrName);
        }
     * Removed all of the given DOMNodes.

Fixed code:
use DOMAttr;
        // Remove elements with a xlink:href attribute
        // Used in SVG but deprecated anyway, so we'll be a bit more heavy-handed here.
        $xlinkHrefAttributes = $xPath->query('//@*[contains(name(), \'xlink:href\')]');
        static::removeAttributes($xlinkHrefAttributes);

        static::removeAttributes($onAttributes);
     * Remove all the given DOMNodes.

    /**
     * Remove all the given attribute nodes.
     */
    protected static function removeAttributes(DOMNodeList $attrs): void
    {
        /** @var DOMAttr $attr */
        foreach ($attrs as $attr) {
            $attrName = $attr->nodeName;
            $attr->parentNode->removeAttribute($attrName);
        }
    }
    public function test_svg_xlink_hrefs_are_removed()
    {
        $checks = [
            '<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',
            '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>'
        ];

        $this->asEditor();
        $page = Page::query()->first();

        foreach ($checks as $check) {
            $page->html = $check;
            $page->save();

            $pageView = $this->get($page->getUrl());
            $pageView->assertStatus(200);
            $pageView->assertElementNotContains('.page-content', 'alert');
            $pageView->assertElementNotContains('.page-content', 'xlink:href');
            $pageView->assertElementNotContains('.page-content', 'application/xml');
        }
    }
CVE-2021-3906 (PHP, published 2021-10-27T22:15Z)
Description: value: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/bookstackapp/bookstack
Files changed:
app/Uploads/ImageRepo.php
Commit message: Update ImageRepo.php

fix image validation vulnerability

Vulnerable code:
        return in_array(trim($extension, '. \t\n\r\0\x0B'), static::$supportedExtensions);

Fixed code:
        return in_array(trim($extension, ". \t\n\r\0\x0B"), static::$supportedExtensions);
CVE-2021-3944 (PHP, published 2021-12-02T17:15Z)
Description: value: bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/bookstackapp/bookstack
Files changed:
app/Http/Controllers/Auth/ConfirmEmailController.php
app/Http/Controllers/Auth/UserInviteController.php
resources/lang/en/auth.php
tests/Auth/AuthTest.php
tests/Auth/UserInviteTest.php
Commit message: Prevented auto-login from direct email confirmation actions

Was done for convenience but could potentially be exploited by an
attacker using signing up via one of these routes, then forwarding
an email confirmation to another user so they unknowingly utilise
an account someone else controls.

Tweaks the flow of confirming email, and the user invite flow.

For #3050


Vulnerable code:
        $this->loginService->login($user, auth()->getDefaultDriver());
        return redirect('/');
use BookStack\Auth\Access\LoginService;
    protected $loginService;
    public function __construct(UserInviteService $inviteService, LoginService $loginService, UserRepo $userRepo)
        $this->loginService = $loginService;
        $this->showSuccessNotification(trans('auth.user_invite_success', ['appName' => setting('app-name')]));
        $this->loginService->login($user, auth()->getDefaultDriver());
        return redirect('/');
    'email_confirm_success' => 'Your email has been confirmed!',
    'user_invite_success' => 'Password set, you now have access to :appName!',
        $this->get('/register/confirm/' . $emailConfirmation->token)->assertRedirect('/');
        $this->get('/')->assertSee($user->name);
        $setPasswordResp->assertSee('Password set, you now have access to BookStack!');

Fixed code:
        return redirect('/login');
    public function __construct(UserInviteService $inviteService, UserRepo $userRepo)
        $this->showSuccessNotification(trans('auth.user_invite_success_login', ['appName' => setting('app-name')]));
        return redirect('/login');
    'email_confirm_success' => 'Your email has been confirmed! You should now be able to login using this email address.',
    'user_invite_success_login' => 'Password set, you should now be able to login using your set password to access :appName!',
        $this->get('/register/confirm/' . $emailConfirmation->token)->assertRedirect('/login');
        $this->get('/login')->assertSee('Your email has been confirmed! You should now be able to login using this email address.');
        $setPasswordResp->assertSee('Password set, you should now be able to login using your set password to access BookStack!');
CVE-2021-4194 (Unknown, published 2022-01-06T18:15Z)
Description: value: bookstack is vulnerable to Improper Access Control
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/bookstackapp/bookstack
Files changed:
Commit message: Merge branch 'sort_changes'

Related to #3134


Vulnerable code:

Fixed code: