hitoshura25/cvefixes huggingface dataset:
CVE-2023-5511 (PHP, published 2023-10-11T01:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/ReportsController.php
resources/views/reports/unaccepted_assets.blade.php
routes/web.php
Commit message: Set resend acceptance to POST

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
    public function sentAssetAcceptanceReminder($acceptanceId = null)
        if (!$acceptance = CheckoutAcceptance::pending()->find($acceptanceId)) {
        if(!$assetItem->assignedTo->locale){
                    <td>
                            @if ($item['acceptance']->assignedTo)<a href="{{ route('reports/unaccepted_assets_sent_reminder', ['acceptanceId' => $item['acceptance']->id]) }}" class="btn btn-sm bg-purple" data-tooltip="true">{{ trans('admin/reports/general.send_reminder') }}</a>@endif
    Route::get(
        'reports/unaccepted_assets/{acceptanceId}/sent_reminder',

Fixed code:
    public function sentAssetAcceptanceReminder(Request $request)
        if (!$acceptance = CheckoutAcceptance::pending()->find($request->input('acceptance_id'))) {
            \Log::debug('No pending acceptances');

        \Log::debug(print_r($assetItem, true));

            \Log::debug('No acceptance created_at');

            \Log::debug('Acceptance created at: '.$acceptance->created_at);
            \Log::debug(print_r($logItem_res, true));

                \Log::debug('Acceptance date mismatch');
        if (!$assetItem->assignedTo->locale){
                    <td class="white-space: nowrap;">
                        <nobr>
                           <form method="post" class="white-space: nowrap;" action="{{ route('reports/unaccepted_assets_sent_reminder') }}">
                            @if ($item['acceptance']->assignedTo)
                                @csrf
                               <input type="hidden" name="acceptance_id" value="{{ $item['acceptance']->id }}">
                                <button class="btn btn-sm btn-warning" data-tooltip="true" data-title="{{ trans('admin/reports/general.send_reminder') }}">
                                    <i class="fa fa-repeat" aria-hidden="true"></i>
                                </button>

                            @endif
                           </form>

                        </nobr>
    Route::post(
        'reports/unaccepted_assets/sent_reminder',
CVE-2024-5685 (PHP, published 2024-06-14T10:15Z)
Description: value: Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/Api/UsersController.php
Commit message: Re-order gating and refactor group syncing

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
            // Strip out the superuser permission if the API user isn't a superadmin
            // Check if the request has groups passed and has a value
            if ($request->filled('groups')) {
                
                if ($validator->fails()){
                    return response()->json(Helper::formatStandardApiResponse('error', null, $user->getErrors()));
                }
                // Only save groups if the user is a superuser
                if (Auth::user()->isSuperUser()) {
                    $user->groups()->sync($request->input('groups'));
                }
            // The groups field has been passed but it is null, so we should blank it out
            } elseif ($request->has('groups')) {
                
                // Only save groups if the user is a superuser
                if (Auth::user()->isSuperUser()) {
                    $user->groups()->sync($request->input('groups'));
            }


Fixed code:
            // Strip out the individual superuser permission if the API user isn't a superadmin
            // Check if the request has groups passed and has a value, AND that the user us a superuser
            if (($request->has('groups')) && (Auth::user()->isSuperUser())) {
                $user->groups()->sync($request->input('groups'));
                if ($validator->fails()) {
                    return response()->json(Helper::formatStandardApiResponse('error', null, $user->getErrors()));
            }
CVE-2020-10595 (Other, published 2020-03-31T13:15Z)
Description: value: pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library, with unknown effects but possibly including code execution. This code path is not used for normal authentication, but only when the Kerberos library does supplemental prompting, such as with PKINIT or when using the non-standard no_prompt PAM configuration option.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/rra/pam-krb5
Files changed:
NEWS
Commit message: Add CVE for buffer overflow security fix


Vulnerable code:

Fixed code:
    (CVE-2020-10595)
CVE-2013-7351 (PHP, published 2020-01-02T20:15Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the (1) showRSS, (2) showATOM, or (3) showDailyRSS function; a (4) file name to the importFile function; or (5) vectors related to bookmarks.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sebsauvage/Shaarli
Files changed:
index.php
Commit message: XSS flaw correction

Closes issue https://github.com/sebsauvage/Shaarli/issues/134


Vulnerable code:
    echo '</channel></rss><!-- Cached version of '.pageUrl().' -->';
    $feed.='</feed><!-- Cached version of '.pageUrl().' -->';
    echo '</channel></rss><!-- Cached version of '.pageUrl().' -->';
        echo '<script language="JavaScript">alert("File '.$filename.' ('.$filesize.' bytes) was successfully processed: '.$import_count.' links imported.");document.location=\'?\';</script>';
        echo '<script language="JavaScript">alert("File '.$filename.' ('.$filesize.' bytes) has an unknown file format. Nothing was imported.");document.location=\'?\';</script>';

Fixed code:
    echo '</channel></rss><!-- Cached version of '.htmlspecialchars(pageUrl()).' -->';
    $feed.='</feed><!-- Cached version of '.htmlspecialchars(pageUrl()).' -->';
    echo '</channel></rss><!-- Cached version of '.htmlspecialchars(pageUrl()).' -->';
        echo '<script language="JavaScript">alert("File '.json_encode($filename).' ('.$filesize.' bytes) was successfully processed: '.$import_count.' links imported.");document.location=\'?\';</script>';
        echo '<script language="JavaScript">alert("File '.json_encode($filename).' ('.$filesize.' bytes) has an unknown file format. Nothing was imported.");document.location=\'?\';</script>';
CVE-2017-6307 (C, published 2017-02-24T04:59Z)
Description: value: An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/verdammelt/tnef
Files changed:
src/mapi_attr.c
Commit message: Use asserts on lengths to prevent invalid reads/writes.


Vulnerable code:

Fixed code:
    assert((num_properties+1) != 0);
		    assert((idx+(a->names[i].len*2)) <= len);
		assert(v->len + idx <= len);

		    assert(v->len != 0);
CVE-2017-6308 (C, published 2017-02-24T04:59Z)
Description: value: An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can lead to Heap Overflows, have been identified in the functions that wrap memory allocation.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/verdammelt/tnef
Files changed:
src/alloc.c
src/alloc.h
Commit message: Fix integer overflows and harden memory allocator.


Vulnerable code:
    fprintf (stderr, 
             (unsigned long)alloc_limit, 
	alloc_limit_failure (fn_name, size);
	exit (-1);
xmalloc (size_t size)
    void *ptr = malloc (size);
    if (!ptr 
checked_xmalloc (size_t size)
    alloc_limit_assert ("checked_xmalloc", size);
    return xmalloc (size);
    void *ptr = malloc(num * size);
        memset (ptr, '\0', (num * size));
    alloc_limit_assert ("checked_xcalloc", (num *size));



extern void* checked_xmalloc (size_t size);
extern void* xmalloc (size_t size);
        ((_type*)xmalloc((_num)*sizeof(_type)))
        ((_type*)checked_xmalloc((_num)*sizeof(_type)))
	do { if (_ptr) { free (_ptr); _ptr = 0; } } while (0)

Fixed code:
size_t
check_mul_overflow(size_t a, size_t b, size_t* res)
{
    size_t tmp = a * b;
    if (a != 0 && tmp / a != b) return 1;
    *res = tmp;
    return 0;
}

    fprintf (stderr,
             (unsigned long)alloc_limit,
        alloc_limit_failure (fn_name, size);
        exit (-1);
xmalloc (size_t num, size_t size)
    size_t res;
    if (check_mul_overflow(num, size, &res))
        abort();

    void *ptr = malloc (res);
    if (!ptr
checked_xmalloc (size_t num, size_t size)
    size_t res;
    if (check_mul_overflow(num, size, &res))
        abort();

    alloc_limit_assert ("checked_xmalloc", res);
    return xmalloc (num, size);
    size_t res;
    if (check_mul_overflow(num, size, &res))
        abort();

    void *ptr;
    ptr = malloc(res);
        memset (ptr, '\0', (res));
    size_t res;
    if (check_mul_overflow(num, size, &res))
        abort();

    alloc_limit_assert ("checked_xcalloc", (res));
extern void* checked_xmalloc (size_t num, size_t size);
extern void* xmalloc (size_t num, size_t size);
        ((_type*)xmalloc((_num), sizeof(_type)))
        ((_type*)checked_xmalloc((_num),sizeof(_type)))
        do { if (_ptr) { free (_ptr); _ptr = 0; } } while (0)
CVE-2017-6309 (C, published 2017-02-24T04:59Z)
Description: value: An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/verdammelt/tnef
Files changed:
src/file.c
src/tnef.c
Commit message: Check types to avoid invalid reads/writes.


Vulnerable code:
	body[j] = XMALLOC(VarLenData, 1);
	body[j]->len = a->values[j].len;
	body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
			    
			if (a->name == MAPI_BODY_HTML)
			else if (a->name == MAPI_RTF_COMPRESSED)

Fixed code:
		assert(a->type == szMAPI_STRING);
		assert((a->type == szMAPI_BINARY) || (a->type == szMAPI_OBJECT));
		assert(a->type == szMAPI_STRING);
                    assert(a->type == szMAPI_STRING);
        if (a->type == szMAPI_BINARY) {
 	    body[j] = XMALLOC(VarLenData, 1);
	    body[j]->len = a->values[j].len;
	    body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	    memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
        }
		
			if (a->type == szMAPI_BINARY && a->name == MAPI_BODY_HTML)
			else if (a->type == szMAPI_BINARY && a->name == MAPI_RTF_COMPRESSED)
CVE-2017-6309 (C, published 2017-02-24T04:59Z)
Description: value: An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/verdammelt/tnef
Files changed:
src/file.c
src/tnef.c
Commit message: Check types to avoid invalid reads/writes.


Vulnerable code:
	body[j] = XMALLOC(VarLenData, 1);
	body[j]->len = a->values[j].len;
	body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
			    
			if (a->name == MAPI_BODY_HTML)
			else if (a->name == MAPI_RTF_COMPRESSED)

Fixed code:
		assert(a->type == szMAPI_STRING);
		assert((a->type == szMAPI_BINARY) || (a->type == szMAPI_OBJECT));
		assert(a->type == szMAPI_STRING);
                    assert(a->type == szMAPI_STRING);
        if (a->type == szMAPI_BINARY) {
 	    body[j] = XMALLOC(VarLenData, 1);
	    body[j]->len = a->values[j].len;
	    body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	    memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
        }
		
			if (a->type == szMAPI_BINARY && a->name == MAPI_BODY_HTML)
			else if (a->type == szMAPI_BINARY && a->name == MAPI_RTF_COMPRESSED)
CVE-2017-6310 (C, published 2017-02-24T04:59Z)
Description: value: An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/verdammelt/tnef
Files changed:
src/file.c
src/tnef.c
Commit message: Check types to avoid invalid reads/writes.


Vulnerable code:
	body[j] = XMALLOC(VarLenData, 1);
	body[j]->len = a->values[j].len;
	body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
			    
			if (a->name == MAPI_BODY_HTML)
			else if (a->name == MAPI_RTF_COMPRESSED)

Fixed code:
		assert(a->type == szMAPI_STRING);
		assert((a->type == szMAPI_BINARY) || (a->type == szMAPI_OBJECT));
		assert(a->type == szMAPI_STRING);
                    assert(a->type == szMAPI_STRING);
        if (a->type == szMAPI_BINARY) {
 	    body[j] = XMALLOC(VarLenData, 1);
	    body[j]->len = a->values[j].len;
	    body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	    memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
        }
		
			if (a->type == szMAPI_BINARY && a->name == MAPI_BODY_HTML)
			else if (a->type == szMAPI_BINARY && a->name == MAPI_RTF_COMPRESSED)
CVE-2017-6310 (C, published 2017-02-24T04:59Z)
Description: value: An issue was discovered in tnef before 1.4.13. Four type confusions have been identified in the file_add_mapi_attrs() function. These might lead to invalid read and write operations, controlled by an attacker.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/verdammelt/tnef
Files changed:
src/file.c
src/tnef.c
Commit message: Check types to avoid invalid reads/writes.


Vulnerable code:
	body[j] = XMALLOC(VarLenData, 1);
	body[j]->len = a->values[j].len;
	body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
			    
			if (a->name == MAPI_BODY_HTML)
			else if (a->name == MAPI_RTF_COMPRESSED)

Fixed code:
		assert(a->type == szMAPI_STRING);
		assert((a->type == szMAPI_BINARY) || (a->type == szMAPI_OBJECT));
		assert(a->type == szMAPI_STRING);
                    assert(a->type == szMAPI_STRING);
        if (a->type == szMAPI_BINARY) {
 	    body[j] = XMALLOC(VarLenData, 1);
	    body[j]->len = a->values[j].len;
	    body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
	    memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
        }
		
			if (a->type == szMAPI_BINARY && a->name == MAPI_BODY_HTML)
			else if (a->type == szMAPI_BINARY && a->name == MAPI_RTF_COMPRESSED)
CVE-2022-21647 (Unknown, published 2022-01-04T20:15Z)
Description: value: CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-w6jr-wj64-mc9x

fix: Deserialization of Untrusted Data in old()

Vulnerable code:

Fixed code:
CVE-2022-21715 (Unknown, published 2022-01-24T20:15Z)
Description: value: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-7528-7jg5-6g62

Hotfix 4.1.8

Vulnerable code:

Fixed code:
CVE-2022-23556 (Unknown, published 2022-12-22T19:15Z)
Description: value: CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-ghw3-5qvm-3mqc

fix: proxyIPs

Vulnerable code:

Fixed code:
CVE-2022-24711 (Unknown, published 2022-02-28T16:15Z)
Description: value: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-xjp4-6w75-qrj7

Hotfix 4.1.9

Vulnerable code:

Fixed code:
CVE-2022-46170 (Unknown, published 2022-12-22T19:15Z)
Description: value: CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)  a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-6cq5-8cj7-g558

Fix session handlers bug

Vulnerable code:

Fixed code:
CVE-2023-46240 (Unknown, published 2023-10-31T16:15Z)
Description: value: CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-hwxf-qxj7-7rfj

fix: detailed error report is displayed in production environment

Vulnerable code:

Fixed code:
CVE-2024-29904 (Unknown, published 2024-03-29T16:15Z)
Description: value: CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. 

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/codeigniter4/CodeIgniter4
Files changed:
Commit message: Merge pull request from GHSA-39fp-mqmm-gxj6

fix: Language, Router, and Filters

Vulnerable code:

Fixed code: