hitoshura25/cvefixes huggingface dataset:
CVE-2022-25839 (JavaScript, published 2022-03-11T20:15Z)
Description: value: The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/duzun/URL.js
Files changed:
bower.json
package-lock.json
package.json
test.js
url.d.ts
url.js
url/URL.d.ts
url/URL.js
url/parseUrl.js
Commit message: Fix potential vulnerability for "http://\\\\localhost"


Vulnerable code:
  "version": "2.0.0",
  "version": "2.0.0",
  "version": "2.0.0",
 *  @version 2.0.0
 *  @version 2.0.0
 *  @version 2.0.0
 *  @version 2.0.0
        throw new SyntaxError(`Failed to construct 'URL': Invalid URL`);
    , '(([^:/?#]*)(?::(\\d+))?)'      // host == hostname:port
    , '(/[^?#]*|)'                    // pathname
            if (part == 'pathname') {
                if (!ret) ret = '/';
            }
            if (parseQuery && part == 'query') {
                ret = toObject(ret || NIL);

Fixed code:
  "version": "2.1.0",
  "version": "2.1.0",
  "version": "2.1.0",
            // Potential vulnerbility
            var v = new URLJS('http://\\\\localhost\\');

            expect(String(v)).toBe('http://localhost/');
            expect(v.hostname).toBe('localhost');
            expect(v.pathname).toBe('/');

            v = new URLJS('http://\\\\localhost/\\');

            expect(String(v)).toBe('http://localhost//');
            expect(v.pathname).toBe('//');

 *  @version 2.1.0
 *  @version 2.1.0
 *  @version 2.1.0
 *  @version 2.1.0
        throw new SyntaxError(`Failed to construct 'URLJS': Invalid URL`);
// const _hostname_norm_exp = /^\\/g;
const _pathname_norm_exp = /\\+/;

    , '\\\\*(([^:/\\\\?#]*)(?::(\\d+))?)' // host == hostname:port
    , '([/\\\\][^?#]*|)'              // pathname
        // if (i = match[map.hostname]) {
        //     match[map.hostname] = i.replace(_hostname_norm_exp, '');
        // }
        if (i = match[map.pathname]) {
            match[map.pathname] = i.replace(_pathname_norm_exp, '/');
        }

            switch (part) {
                case 'pathname':
                    if (!ret) ret = '/';
                break;

                case 'query':
                    if (parseQuery) {
                        ret = toObject(ret || NIL);
                    }
                break;
CVE-2014-9528 (PHP, published 2015-01-06T15:59Z)
Description: value: SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/humhub/humhub
Files changed:
protected/extensions/CmsInput.php
protected/modules_core/admin/controllers/LoggingController.php
protected/modules_core/admin/views/logging/index.php
protected/modules_core/notification/controllers/ListController.php
Commit message: Added option to flush log entries


Vulnerable code:
        return $this->xssClean($this->stripTags($str));
            <span
                class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
                            <span class="label <?php echo $labelClass; ?>"><?php echo $entry->level; ?></span>&nbsp;
                            <span class="pull-right"><?php echo $entry->category; ?></span>
                        <?php echo $entry->message; ?>
        $lastEntryId = Yii::app()->request->getParam('from');
            $criteria->condition = 'id<' . $lastEntryId;

Fixed code:
        return $this->stripTags($this->xssClean($str));
    public function actionFlush()
    {
        $this->forcePostRequest();
        Logging::model()->deleteAll();
        $this->redirect($this->createUrl('index'));
    }

        
            
            <span class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
        
        
                            <span class="label <?php echo $labelClass; ?>"><?php echo CHtml::encode($entry->level); ?></span>&nbsp;
                            <span class="pull-right"><?php echo CHtml::encode($entry->category); ?></span>
                        <?php echo CHtml::encode($entry->message); ?>
        <?php if ($itemCount != 0): ?>
            <div class="pull-right"><?php echo HHtml::postLink('Flush entries', array('flush'), array('class'=>'btn btn-danger')); ?></div>
        <?php endif; ?>
    
        $lastEntryId = (int) Yii::app()->request->getParam('from');
            $criteria->condition = 'id<:lastEntryId';
            $criteria->params = array(':lastEntryId' => $lastEntryId);
CVE-2022-24865 (PHP, published 2022-04-20T20:15Z)
Description: value: HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/humhub/humhub
Files changed:
CHANGELOG.md
protected/humhub/components/behaviors/AccessControl.php
Commit message: Fix must change password (#5638)

* Fix must change password

* Update CHANGELOG.md (#5638)

* Improve access validation

* Update CHANGELOG.md

Co-authored-by: Lucas Bartholemy <luke-@users.noreply.github.com>

Vulnerable code:
use yii\helpers\Url;
use yii\web\Response;
                return call_user_func([$this, $this->controllerAccess->codeCallback]);
                return $this->loginRequired();
     * @return bool forces user login

        return false;
     * @return Response Redirect user to force to change password
            return Yii::$app->getResponse()->redirect(Url::toRoute(Yii::$app->user->mustChangePasswordRoute));
     *
     * @return Response Redirect to home page
            return Yii::$app->getResponse()->redirect(['/user/auth/login']);

Fixed code:
- Fix #5638: Removed return values from `codeCallback`
                call_user_func([$this, $this->controllerAccess->codeCallback]);
                $this->loginRequired();
            return false;
     * Force user to log in
     * Force user to redirect to change password
            Yii::$app->getResponse()->redirect([Yii::$app->user->mustChangePasswordRoute]);
            Yii::$app->getResponse()->redirect(['/user/auth/login']);
CVE-2022-31133 (PHP, published 2022-07-07T18:15Z)
Description: value: HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/humhub/humhub
Files changed:
protected/humhub/modules/user/widgets/PeopleFilters.php
Commit message: Fix format of displaying user profile title field on "People" page (#5797)



Vulnerable code:
            'title' => Yii::t($profileField->getTranslationCategory(), $profileField->title),

Fixed code:
            'title' => Html::encode(Yii::t($profileField->getTranslationCategory(), $profileField->title)),
CVE-2022-31133 (PHP, published 2022-07-07T18:15Z)
Description: value: HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/humhub/humhub
Files changed:
protected/humhub/modules/space/widgets/FollowButton.php
protected/humhub/modules/space/widgets/MembershipButton.php
protected/humhub/modules/user/widgets/UserFollowButton.php
Commit message: Fix space name in membership confirmation (#5790)

* Fix space name in membership confirmation

* Fix space name in membership confirmation

* Fix user name in unfollow confirmation

Vulnerable code:
            '{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>'
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to withdraw your request to join Space {spaceName}?', ['{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>']),
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to end your membership in Space {spaceName}?', ['{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>']),
use humhub\modules\friendship\models\Friendship;
            '{userName}' => '<strong>' . $this->user->getDisplayName() . '</strong>'

Fixed code:
            '{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>'
use yii\helpers\Html;
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to withdraw your request to join Space {spaceName}?', ['{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>']),
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to end your membership in Space {spaceName}?', ['{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>']),
            '{userName}' => '<strong>' . Html::encode($this->user->getDisplayName()) . '</strong>'
CVE-2016-1000232 (JavaScript, published 2018-09-05T17:29Z)
Description: value: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/salesforce/tough-cookie
Files changed:
lib/cookie.js
test/parsing_test.js
Commit message: Reduce parse time for many semicolons.

Bug Credit To: David Kirchner <dpk@stream.me>


Vulnerable code:
// Used for checking whether or not there is a trailing semi-colon
var TRAILING_SEMICOLON = /;+$/;

  // S4.1.1 Trailing semi-colons are not part of the specification.
  var semiColonCheck = TRAILING_SEMICOLON.exec(str);
  if (semiColonCheck) {
    str = str.slice(0, semiColonCheck.index);
  }

  var unparsed = str.slice(firstSemi).replace(/^\s*;\s*/,'').trim();
  var cookie_avs = unparsed.split(/\s*;\s*/);
    var av = cookie_avs.shift();

Fixed code:
  var unparsed = str.slice(firstSemi + 1).trim();
  var cookie_avs = unparsed.split(';');
    var av = cookie_avs.shift().trim();
    if (av.length === 0) { // happens if ";;" appears
      continue;
    }
    },
    "way too many semicolons followed by non-semicolon": {
      topic: function() {
        // takes abnormally long due to semi-catastrophic regexp backtracking
        var str = 'foo=bar' + (';'.repeat(65535)) + ' domain=example.com';
        return Cookie.parse(str) || null;
      },
      "parsed": function(c) { assert.ok(c) },
      "key": function(c) { assert.equal(c.key, 'foo') },
      "value": function(c) { assert.equal(c.value, 'bar') },
      "no path": function(c) { assert.equal(c.path, null) },
      "no domain": function(c) { assert.equal(c.domain, 'example.com') },
      "no extensions": function(c) { assert.ok(!c.extensions) }
CVE-2016-1000232 (Unknown, published 2018-09-05T17:29Z)
Description: value: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/salesforce/tough-cookie
Files changed:
Commit message: Merge pull request #68 from SalesforceEng/fix-too-many-semicolons

Reduce parse time for many semicolons.

Vulnerable code:

Fixed code:
CVE-2023-26136 (JavaScript, published 2023-07-01T05:15Z)
Description: value: Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/salesforce/tough-cookie
Files changed:
lib/memstore.js
test/cookie_jar_test.js
Commit message: Prevent prototype pollution in cookie memstore (#283)

All occurrences of new object creation in `memstore.js` have been changed from `{}` (i.e.; `Object.create(Object.prototype)` to `Object.create(null)` so that we are using object instances that do not have a prototype property that can be polluted.

@fixes #282

Vulnerable code:
    this.idx = {};
      this.idx[cookie.domain] = {};
      this.idx[cookie.domain][cookie.path] = {};
    this.idx = {};
    return "{}";
  let result = "{\n";
  let result = `${indent}'${domainName}': {\n`;
  let result = `${indent}'${pathName}': {\n`;

Fixed code:
    this.idx = Object.create(null);
      this.idx[cookie.domain] = Object.create(null);
      this.idx[cookie.domain][cookie.path] = Object.create(null);
    this.idx = Object.create(null);
    return "[Object: null prototype] {}";
  let result = "[Object: null prototype] {\n";
  let result = `${indent}'${domainName}': [Object: null prototype] {\n`;
  let result = `${indent}'${pathName}': [Object: null prototype] {\n`;
  .addBatch({
    "Issue #282 - Prototype pollution": {
      "when setting a cookie with the domain __proto__": {
        topic: function() {
          const jar = new tough.CookieJar(undefined, {
            rejectPublicSuffixes: false
          });
          // try to pollute the prototype
          jar.setCookieSync(
            "Slonser=polluted; Domain=__proto__; Path=/notauth",
            "https://__proto__/admin"
          );
          jar.setCookieSync(
            "Auth=Lol; Domain=google.com; Path=/notauth",
            "https://google.com/"
          );
          this.callback();
        },
        "results in a cookie that is not affected by the attempted prototype pollution": function() {
          const pollutedObject = {};
          assert(pollutedObject["/notauth"] === undefined);
        }
      }
    }
  })
CVE-2022-3422 (TypeScript, published 2022-10-07T11:15Z)
Description: value: Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/tooljet/tooljet
Files changed:
server/src/services/group_permissions.service.ts
server/test/controllers/group_permissions.e2e-spec.ts
Commit message: Hide user data in group permissions get user API (#4141)

* Hide user data from group permission user API

* test case fix

* fix

Vulnerable code:
      .innerJoinAndSelect('users.groupPermissions', 'group_permissions')
      .innerJoinAndSelect('users.userGroupPermissions', 'user_group_permissions')
      expect(user.default_organization_id).toBe(organization.id);

Fixed code:
      .select(['users.id', 'users.firstName', 'users.lastName', 'users.email'])
      .innerJoin('users.groupPermissions', 'group_permissions')
      .innerJoin('users.userGroupPermissions', 'user_group_permissions')
      expect(Object.keys(user).sort()).toEqual(['id', 'email', 'first_name', 'last_name'].sort());
      expect(user.first_name).toBe('test');
      expect(user.last_name).toBe('test');
CVE-2021-31800 (Unknown, published 2021-05-05T11:15Z)
Description: value: Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/SecureAuthCorp/impacket
Files changed:
Commit message: Merge pull request #1066 from omriinbar/master

Fix Path Traversal vulnerabilities by checking path prefix against in…

Vulnerable code:

Fixed code:
CVE-2024-21485 (Unknown, published 2024-02-02T05:15Z)
Description: value: Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.**Note:**This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/plotly/dash
Files changed:
Commit message: Merge pull request #2732 from plotly/fix/xss-props

Sanitize html props with xss vulnerability.

Vulnerable code:

Fixed code:
CVE-2020-9395 (Unknown, published 2020-07-06T22:15Z)
Description: value: An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.
Severity: MEDIUM (CVSS v3 base score: 8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ambiot/amb1_sdk
Files changed:
Commit message: [WLAN] Update wlan library

Change Notes:
	bug fixed

Revision Notes:
	r22259+r40932


Vulnerable code:

Fixed code: