hitoshura25/cvefixes huggingface dataset:
CVE-2024-30262 (PHP, published 2024-04-09T17:16Z)
Description: value: Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/contao/contao
Files changed:
core-bundle/src/Repository/RememberMeRepository.php
core-bundle/src/Resources/config/services.yml
core-bundle/src/Resources/contao/modules/ModuleChangePassword.php
core-bundle/src/Resources/contao/modules/ModulePassword.php
core-bundle/src/Resources/contao/modules/ModulePersonalData.php
Commit message: Merge pull request from GHSA-r4r6-j2j3-7pp5

Co-authored-by: Leo Feyer <1192057+leofeyer@users.noreply.github.com>

Vulnerable code:

Fixed code:

    public function deleteByUsername(string $username): void
    {
        $qb = $this->_em->createQueryBuilder();
        $qb
            ->delete($this->_entityName, 'rm')
            ->where('rm.username = :username')
            ->setParameter('username', $username)
        ;

        $qb->getQuery()->execute();
    }
        public: true
			System::getContainer()->get('contao.repository.remember_me')->deleteByUsername($objMember->username);

				System::getContainer()->get('contao.repository.remember_me')->deleteByUsername($objMember->username);


						if ($objWidget instanceof FormPassword)
						{
							System::getContainer()->get('contao.repository.remember_me')->deleteByUsername($objMember->username);
						}
CVE-2022-39275 (Python, published 2022-10-06T18:16Z)
Description: value: Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/saleor/saleor
Files changed:
saleor/graphql/account/mutations/account.py
saleor/graphql/account/mutations/base.py
saleor/graphql/menu/mutations.py
saleor/graphql/product/bulk_mutations/products.py
Commit message: Merge pull request from GHSA-xhq8-8c5v-w8ff

* Fix improper ID type validation

* Fix failing test cases

- `ProductVariantBulkCreate` mutation was not able to determine whether Product type ID was passed
- `ShippingPriceTranslate` mutation uses a QuerySet with ID type ShippingMethodType

Vulnerable code:
        address = cls.get_node_or_error(info, data.get("id"), Address)
        instance = cls.get_node_or_error(info, node_id, Address)
            menu = cls.get_node_or_error(info, menu, field="menu")
        product = cls.get_node_or_error(info, data["product_id"], models.Product)

Fixed code:
        address = cls.get_node_or_error(info, data.get("id"), only_type=Address)
        instance = cls.get_node_or_error(info, node_id, only_type=Address)
            menu = cls.get_node_or_error(info, menu, field="menu", only_type=Menu)
        product = cls.get_node_or_error(info, data["product_id"], only_type="Product")
CVE-2024-31205 (Python, published 2024-04-08T15:15Z)
Description: value: Saleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attacker may bypass cross-set request forgery (CSRF) validation when calling refresh token mutation with empty string. When a user provides an empty string in `refreshToken` mutation, while the token persists in `JWT_REFRESH_TOKEN_COOKIE_NAME` cookie, application omits validation against CSRF token and returns valid access token. Versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19 contain a patch for the issue. As a workaround, one may replace `saleor.graphql.account.mutations.authentication.refresh_token.py.get_refresh_token`. This will fix the issue, but be aware, that it returns `JWT_MISSING_TOKEN` instead of `JWT_INVALID_TOKEN`.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/saleor/saleor
Files changed:
saleor/graphql/account/mutations/authentication/refresh_token.py
saleor/graphql/account/tests/mutations/authentication/test_token_refresh.py
Commit message: Advisory fix merx-280.


Vulnerable code:
        refresh_token = refresh_token or request.COOKIES.get(
            JWT_REFRESH_TOKEN_COOKIE_NAME, None
        )
        if not refresh_token:

Fixed code:
        if refresh_token is None:
            refresh_token = request.COOKIES.get(JWT_REFRESH_TOKEN_COOKIE_NAME, None)
        if refresh_token is None:
import pytest


@pytest.mark.parametrize("token", ["incorrect-token", ""])
def test_refresh_token_incorrect_token_provided(api_client, customer_user, token):
    # given
    csrf_token = _get_new_csrf_token()
    refresh_token = create_refresh_token(customer_user, {"csrfToken": csrf_token})
    api_client.cookies[JWT_REFRESH_TOKEN_COOKIE_NAME] = refresh_token
    api_client.cookies[JWT_REFRESH_TOKEN_COOKIE_NAME]["httponly"] = True

    variables = {"token": token, "csrf_token": csrf_token}

    # when
    response = api_client.post_graphql(MUTATION_TOKEN_REFRESH, variables)
    content = get_graphql_content(response)

    # then
    data = content["data"]["tokenRefresh"]
    errors = data["errors"]
    assert not data.get("token")
    assert len(errors) == 1
    assert errors[0]["code"] == AccountErrorCode.JWT_DECODE_ERROR.name
CVE-2023-1000 (Python, published 2024-04-27T09:15Z)
Description: value: A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/cyanomiko/dcnnt-py
Files changed:
dcnnt/plugins/notifications.py
Commit message: Fix command ijection vulnerability

Fix passing of unescaped text to the arguments of notification command
in dcnnt/plugins/notifications.py

This is a high-risk vulnerability that can lead to RCE and allow arbitrary code
execution on the server while the notification showing.

All text received over the network MUST be escaped before being transmitted to
the database or to the shell command arguments.


Vulnerable code:
                    command = cmd.format(uin=uin, name=name, icon=icon, text=text, title=title, package=package)

Fixed code:
from shlex import quote
                    command = cmd.format(uin=quote(uin), name=quote(name), icon=quote(icon), text=quote(text), title=quote(title), package=quote(package))
CVE-2023-32695 (JavaScript, published 2023-05-27T16:15Z)
Description: value: socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/socketio/socket.io-parser
Files changed:
lib/index.ts
test/parser.js
Commit message: fix: check the format of the event name

A packet like '2[{"toString":"foo"}]' was decoded as:

{
  type: EVENT,
  data: [ { "toString": "foo" } ]
}

Which would then throw an error when passed to the EventEmitter class:

> TypeError: Cannot convert object to primitive value
>    at Socket.emit (node:events:507:25)
>    at .../node_modules/socket.io/lib/socket.js:531:14

History of the isPayloadValid() method:

- added in [78f9fc2](https://github.com/socketio/socket.io-parser/commit/78f9fc2999b15804b02f2c22a2b4007734a26af9) (v4.0.1, socket.io@3.0.0)
- updated in [1c220dd](https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9) (v4.0.4, socket.io@3.1.0)


Vulnerable code:
        return Array.isArray(payload) && payload.length > 0;

Fixed code:
        return (
          Array.isArray(payload) &&
          (typeof payload[0] === "string" || typeof payload[0] === "number")
        );
    isInvalidPayload('2[{"toString":"foo"}]');
    isInvalidPayload('2[true,"foo"]');
    isInvalidPayload('2[null,"bar"]');
CVE-2018-3723 (JavaScript, published 2018-06-07T02:29Z)
Description: value: defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/jonschlinkert/defaults-deep
Files changed:
index.js
Commit message: exclude __proto__


Vulnerable code:

Fixed code:
      if (key === '__proto__') {
        return;
      }
CVE-2022-21697 (Unknown, published 2022-01-25T14:15Z)
Description: value: Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/jupyterhub/jupyter-server-proxy
Files changed:
Commit message: Merge pull request from GHSA-gcv9-6737-pjqw

validate proxied paths starting with /

Vulnerable code:

Fixed code:
CVE-2024-28179 (Unknown, published 2024-03-20T20:15Z)
Description: value: Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jupyterhub/jupyter-server-proxy
Files changed:
Commit message: Merge pull request from GHSA-w3vc-fx9p-wp4v

Check authentication when websockets open

Vulnerable code:

Fixed code:
CVE-2024-35225 (Unknown, published 2024-06-11T22:15Z)
Description: value: Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the `jupyter-server-proxy` extension.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jupyterhub/jupyter-server-proxy
Files changed:
Commit message: Merge pull request from GHSA-fvcq-4x64-hqxr

Escape invalid host when displayed in html

Vulnerable code:

Fixed code:
CVE-2023-49508 (PHP, published 2024-02-16T08:15Z)
Description: value: Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/YetiForceCompany/YetiForceCRM
Files changed:
config/version.php
layouts/basic/modules/Settings/Dependencies/LibraryMoreInfo.tpl
modules/Settings/Dependencies/views/LibraryLicense.php
modules/Settings/Dependencies/views/LibraryMoreInfo.php
Commit message: Improved loading of details and licenses of dependent libraries


Vulnerable code:
	'appVersion' => '6.4.270',
	'patchVersion' => '2023.07.14',
				<pre>{$FILE_CONTENT}</pre>
			$filePath = $dir . $request->getByType('license', 'Text') . '.txt';
			if (file_exists($filePath)) {
		if ($request->isEmpty('type') || $request->isEmpty('libraryName')) {
			$result = false;
		} else {
			if ('public' === $request->getByType('type', 1)) {
				$libraryName = $request->getByType('libraryName', 'Text');
					if ($fileContent) {
						continue;
					}
					if (file_exists($packageFile)) {
					} else {
						$result = false;
			} elseif ('vendor' === $request->getByType('type', 1)) {
				$filePath = 'vendor' . DIRECTORY_SEPARATOR . $request->getByType('libraryName', 'Text') . DIRECTORY_SEPARATOR . 'composer.json';
				if (file_exists($filePath)) {
				} else {
					$result = false;
			} else {
				$result = false;

Fixed code:
	'appVersion' => '6.4.271',
	'patchVersion' => '2023.07.17',
				<pre>{$FILE_CONTENT|escape}</pre>
 * @author    Radosław Skrzypczak <r.skrzypczak@yetiforce.com>
			$filePath = $dir . $request->getByType('license', \App\Purifier::PATH) . '.txt';
			if (file_exists($filePath) && \App\Fields\File::isAllowedFileDirectory($filePath)) {
 * @author    Radosław Skrzypczak <r.skrzypczak@yetiforce.com>
		if (!$request->isEmpty('type') && !$request->isEmpty('libraryName')) {
			$type = $request->getByType('type', \App\Purifier::STANDARD);
			if ('public' === $type) {
				$libraryName = $request->getByType('libraryName', \App\Purifier::PATH);
					if (file_exists($packageFile) && \App\Fields\File::isAllowedFileDirectory($packageFile)) {
						break;
			} elseif ('vendor' === $type) {
				$filePath = ROOT_DIRECTORY . DIRECTORY_SEPARATOR . 'vendor' . DIRECTORY_SEPARATOR . $request->getByType('libraryName', \App\Purifier::PATH) . DIRECTORY_SEPARATOR . 'composer.json';
				if (file_exists($filePath) && \App\Fields\File::isAllowedFileDirectory($filePath)) {
CVE-2020-36625 (Unknown, published 2022-12-22T10:15Z)
Description: value: A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/destinygg/chat
Files changed:
Commit message: Merge pull request #35 from 11k/fix-origin-check

Fix WebSocket upgrade CSRF vulnerability

Vulnerable code:

Fixed code:
CVE-2019-6777 (PHP, published 2019-01-24T15:29Z)
Description: value: An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mnoorenberghe/ZoneMinder
Files changed:
web/skins/classic/views/plugin.php
Commit message: plugin.php: Fix XSS and directory traversal bugs. Fixes #2436

This view seems like dead code so maybe it should be removed instead.


Vulnerable code:
$plugin = $_REQUEST['pl'];
      <h2><?php echo translate('Monitor') ?> <?php echo $monitor['Name'] ?> - <?php echo translate('Zone') ?> <?php echo $newZone['Name'] ?> - <?php echo translate('Plugin') ?> <?php echo $plugin ?></h2>
        <input type="hidden" name="pl" value="<?php echo $plugin ?>"/>

Fixed code:
// Only allow certain filename characters (not including a period) to prevent directory traversal.
$plugin = preg_replace('/[^-a-zA-Z0-9]/', '', $_REQUEST['pl']);
      <h2><?php echo translate('Monitor') ?> <?php echo $monitor['Name'] ?> - <?php echo translate('Zone') ?> <?php echo $newZone['Name'] ?> - <?php echo translate('Plugin') ?> <?php echo validHtmlStr($plugin) ?></h2>
        <input type="hidden" name="pl" value="<?php echo validHtmlStr($plugin) ?>"/>
CVE-2015-7580 (Ruby, published 2016-02-16T02:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rails/rails-html-sanitizer
Files changed:
lib/rails/html/scrubbers.rb
test/sanitizer_test.rb
Commit message: convert CDATA nodes to TEXT nodes to avoid XSS issues

CDATA nodes will not be html escaped.  Users shouldn't be submitting
CDATA nodes in the first place, so we should convert them to text nodes
before escaping

CVE-2015-7580


Vulnerable code:
        node.text? || node.cdata?

Fixed code:
        if node.cdata?
          text = node.document.create_text_node node.text
          node.replace text
          return CONTINUE
        end
        node.text?
  def test_sanitize_nested_script
    sanitizer = Rails::Html::WhiteListSanitizer.new
    assert_equal '&lt;script&gt;alert("XSS");&lt;/script&gt;', sanitizer.sanitize('<script><script></script>alert("XSS");<script><</script>/</script><script>script></script>', tags: %w(em))
  end

  def test_sanitize_nested_script_in_style
    sanitizer = Rails::Html::WhiteListSanitizer.new
    assert_equal '&lt;script&gt;alert("XSS");&lt;/script&gt;', sanitizer.sanitize('<style><script></style>alert("XSS");<style><</style>/</style><style>script></style>', tags: %w(em))
  end