hitoshura25/cvefixes huggingface dataset:
CVE-2020-26232 (Unknown, published 2020-11-24T21:15Z)
Description: value: Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
Commit message: Merge pull request from GHSA-grfj-wjv9-4f9v

[1.0.x] Fix GHSA-grfj-wjv9-4f9v

Vulnerable code:

Fixed code:
CVE-2020-26275 (Unknown, published 2020-12-21T18:15Z)
Description: value: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/".
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
Commit message: Merge pull request from GHSA-9f66-54xg-pc2c

sync _redirect_safe with upstream

Vulnerable code:

Fixed code:
CVE-2022-24757 (Python, published 2022-03-23T21:15Z)
Description: value: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
jupyter_server/log.py
Commit message: Merge pull request from GHSA-p737-p57g-4cpr



Vulnerable code:
        # log all headers if it caused an error
        log_method(json.dumps(dict(request.headers), indent=2))

Fixed code:
        # Log a subset of the headers if it caused an error.
        headers = {}
        for header in ['Host', 'Accept', 'Referer', 'User-Agent']:
            if header in request.headers:
                headers[header] = request.headers[header]
        log_method(json.dumps(headers, indent=2))
CVE-2023-39968 (Python, published 2023-08-28T21:15Z)
Description: value: jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
jupyter_server/auth/login.py
tests/auth/test_login.py
Commit message: Merge pull request from GHSA-r726-vmfq-j9j3

Co-authored-by: Zachary Sailer <zsailer@apple.com>

Vulnerable code:
        if parsed.netloc or not (parsed.path + "/").startswith(self.base_url):
            if parsed.netloc:

Fixed code:
        # urllib and browsers interpret extra '/' in the scheme separator (`scheme:///host/path`)
        # differently.
        # urllib gives scheme=scheme, netloc='', path='/host/path', while
        # browsers get scheme=scheme, netloc='host', path='/path'
        # so make sure ':///*' collapses to '://' by splitting and stripping any additional leading slash
        # don't allow any kind of `:/` shenanigans by splitting on ':' only
        # and replacing `:/*` with exactly `://`
        if ":" in url:
            scheme, _, rest = url.partition(":")
            url = f"{scheme}://{rest.lstrip('/')}"
        # full url may be `//host/path` (empty scheme == same scheme as request)
        # or `https://host/path`
        # or even `https:///host/path` (invalid, but accepted and ambiguously interpreted)
        if (parsed.scheme or parsed.netloc) or not (parsed.path + "/").startswith(self.base_url):
            if parsed.scheme or parsed.netloc:
        "https:///a%40b/extra/slash",
CVE-2023-40170 (Python, published 2023-08-28T21:15Z)
Description: value: jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
jupyter_server/base/handlers.py
Commit message: Merge pull request from GHSA-64x5-55rw-9974

lost in forward-port PR 478

Co-authored-by: Zachary Sailer <zsailer@apple.com>

Vulnerable code:

Fixed code:
        self.check_xsrf_cookie()
CVE-2023-40170 (Python, published 2023-08-28T21:15Z)
Description: value: jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
jupyter_server/base/handlers.py
Commit message: Merge pull request from GHSA-64x5-55rw-9974

lost in forward-port PR 478

Co-authored-by: Zachary Sailer <zsailer@apple.com>

Vulnerable code:

Fixed code:
        self.check_xsrf_cookie()
CVE-2023-49080 (Python, published 2023-12-04T21:15Z)
Description: value: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/jupyter-server/jupyter_server
Files changed:
jupyter_server/base/handlers.py
jupyter_server/services/kernels/handlers.py
Commit message: Merge pull request from GHSA-h56g-gq9v-vc8r

Co-authored-by: Steven Silvester <steven.silvester@ieee.org>

Vulnerable code:
import traceback
                reply["traceback"] = "".join(traceback.format_exception(*exc_info))
from traceback import format_tb
                traceback = format_tb(e.__traceback__)
                self.write(json.dumps({"message": message, "traceback": traceback}))

Fixed code:
                # backward-compatibility: traceback field is present,
                # but always empty
                reply["traceback"] = ""
                self.write(json.dumps({"message": message, "traceback": ""}))
CVE-2020-19626 (Markdown, published 2021-03-26T15:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG-v3.md
src/templates/settings/sections/_edit.html
Commit message: Fixed an XSS vulnerability.


Vulnerable code:
                heading: site.name|t('site'),

Fixed code:
## Unreleased

### Security
- Fixed an XSS vulnerability.

                heading: site.name|t('site')|e,
CVE-2021-27902 (Markdown, published 2021-06-30T12:15Z)
Description: value: An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG-v3.6.md
CHANGELOG.md
src/config/GeneralConfig.php
Commit message: Stop allowing .htm + .html by default


Vulnerable code:
        'htm',
        'html',

Fixed code:

### Security
- The default `allowedFileExtensions` config setting value no longer includes `htm` or `html`.
### Security
- The default `allowedFileExtensions` config setting value no longer includes `htm` or `html`.
CVE-2021-27903 (PHP, published 2021-06-30T12:15Z)
Description: value: An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/volumes/Local.php
Commit message: Don’t allow pointing a Local volume to a system directory


Vulnerable code:

Fixed code:
### Security
- It’s no longer possible to save a Local volume with the File System Path setting set to a system directory (e.g. the `templates/` or `vendor/` folders).

use yii\validators\InlineValidator;
        $rules[] = [['path'], 'validatePath'];
    /**
     * @param string $attribute
     * @param array|null $params
     * @param InlineValidator $validator
     * @param string $path
     * @return void
     * @since 3.6.7
     */
    public function validatePath(string $attribute, ?array $params, InlineValidator $validator, string $path): void
    {
        if ($created = !file_exists($path)) {
            FileHelper::createDirectory($path);
        }

        $path = realpath($this->getRootPath());

        if ($path === false) {
            return;
        }

        // Make sure it’s not within any of the system directories
        $pathService = Craft::$app->getPath();
        $systemDirs = [
            Craft::getAlias('@contentMigrations'),
            Craft::getAlias('@lib'),
            $pathService->getComposerBackupsPath(false),
            $pathService->getConfigBackupPath(false),
            $pathService->getConfigDeltaPath(false),
            $pathService->getConfigPath(),
            $pathService->getDbBackupPath(false),
            $pathService->getLogPath(false),
            $pathService->getRebrandPath(false),
            $pathService->getRuntimePath(false),
            $pathService->getSiteTemplatesPath(),
            $pathService->getSiteTranslationsPath(),
            $pathService->getTestsPath(),
            $pathService->getVendorPath(),
        ];

        foreach ($systemDirs as $dir) {
            $dir = realpath($dir);
            if ($dir !== false && strpos($path . DIRECTORY_SEPARATOR, $dir . DIRECTORY_SEPARATOR) === 0) {
                $validator->addError($this, $attribute, Craft::t('app', 'Local volumes cannot be located within system directories.'));
                if ($created) {
                    FileHelper::removeDirectory($path);
                }
                break;
            }
        }
    }
CVE-2022-37247 (PHP, published 2022-09-16T22:15Z)
Description: value: Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/helpers/Cp.php
src/templates/settings/fields/index.twig
Commit message: More XSS vulnerabilities


Vulnerable code:
- Fixed an XSS vulnerability.
            Html::tag('span', $tab->name) .
            Html::tag('h6', $groupName) .
        group: group ? group.name|t('site') : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",

Fixed code:
- Fixed XSS vulnerabilities.
            Html::tag('span', Html::encode($tab->name)) .
            Html::tag('h6', Html::encode($groupName)) .
        group: group ? group.name|t('site')|e : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",
CVE-2022-37248 (PHP, published 2022-09-16T16:15Z)
Description: value: Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/helpers/Cp.php
src/templates/settings/fields/index.twig
Commit message: More XSS vulnerabilities


Vulnerable code:
- Fixed an XSS vulnerability.
            Html::tag('span', $tab->name) .
            Html::tag('h6', $groupName) .
        group: group ? group.name|t('site') : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",

Fixed code:
- Fixed XSS vulnerabilities.
            Html::tag('span', Html::encode($tab->name)) .
            Html::tag('h6', Html::encode($groupName)) .
        group: group ? group.name|t('site')|e : "<span class=\"error\">#{'(Ungrouped)'|t('app')}</span>",
CVE-2022-37250 (PHP, published 2022-09-16T15:15Z)
Description: value: Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
src/helpers/Cp.php
Commit message: Another XSS


Vulnerable code:
        $label = $address->title;
            Html::tag('h2', $address->title, [
                    !$label ? 'hidden' : null,
                        'label' => sprintf('%s %s', $label ?? Craft::t('app', 'New Address'), Craft::t('app', 'Settings')),

Fixed code:
            Html::tag('h2', Html::encode($address->title), [
                    !$address->title ? 'hidden' : null,
                        'label' => sprintf('%s %s', $address->title ? Html::encode($address->title) : Craft::t('app', 'New Address'), Craft::t('app', 'Settings')),
CVE-2023-30177 (PHP, published 2023-04-25T18:15Z)
Description: value: CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/elements/Asset.php
Commit message: Fixed an XSS vulnerability.


Vulnerable code:
                $loc = [Craft::t('site', $volume->name)];

Fixed code:
- Fixed an XSS vulnerability.
                $loc = [Html::encode(Craft::t('site', $volume->name))];
CVE-2023-31144 (PHP, published 2023-05-09T16:15Z)
Description: value: Craft CMS is a content management system. Starting in version 3.0.0 and prior to versions 3.8.4 and 4.4.4, a malformed title in the feed widget can deliver a cross-site scripting payload. This issue is fixed in version 3.8.4 and 4.4.4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/fields/Table.php
src/web/assets/cp/CpAsset.php
Commit message: Merge branch 'v3' of https://github.com/craftcms/cms into develop

# Conflicts:
#	src/fields/Table.php


Vulnerable code:
             Json::encode($view->namespaceInputName('columns'), JSON_UNESCAPED_UNICODE) . ', ' .
             Json::encode($view->namespaceInputName('defaults'), JSON_UNESCAPED_UNICODE) . ', ' .
             Json::encode($this->columns, JSON_UNESCAPED_UNICODE) . ', ' .
             Json::encode($this->defaults ?? [], JSON_UNESCAPED_UNICODE) . ', ' .
             Json::encode($columnSettings, JSON_UNESCAPED_UNICODE) . ', ' .
             Json::encode($dropdownSettingsHtml, JSON_UNESCAPED_UNICODE) . ', ' .
             Json::encode($dropdownSettingsCols, JSON_UNESCAPED_UNICODE) .
         $craftJson = Json::encode($this->_craftData(), JSON_UNESCAPED_UNICODE);

Fixed code:
 - `craft\helpers\Json::encode()` no longer sets the `JSON_UNESCAPED_SLASHES` flag by default.
+- Fixed an XSS vulnerability.
             Json::encode($view->namespaceInputName('columns')) . ', ' .
             Json::encode($view->namespaceInputName('defaults')) . ', ' .
             Json::encode($this->columns) . ', ' .
+            Json::encode($this->defaults ?? []) . ', ' .
             Json::encode($columnSettings) . ', ' .
             Json::encode($dropdownSettingsHtml) . ', ' .
             Json::encode($dropdownSettingsCols) .
         $craftJson = Json::encode($this->_craftData());
CVE-2023-33195 (Other, published 2023-05-27T04:15Z)
Description: value: Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.



Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/templates/_components/widgets/CraftSupport/body.twig
src/templates/_includes/links.twig
Commit message: Fixed an XSS vulnerability


Vulnerable code:
- Fixed an XSS vulnerability.
                        text: documentationLinkHtml
                        text: knowledgeBaseLinkHtml
        html: config.text ~ _self.externalLinkIcon()
{% endmacro %}

Fixed code:
- Fixed XSS vulnerabilities.
                        html: documentationLinkHtml
                        html: knowledgeBaseLinkHtml
        html: (config.html ?? config.text|e) ~ _self.externalLinkIcon()
{% endmacro %}
CVE-2023-40035 (PHP, published 2023-08-23T21:15Z)
Description: value: Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can lead to potential remote code execution. This vulnerability can lead to malicious control of vulnerable systems and data exfiltrations. Although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution). This issue has been patched in version 4.4.15 and version 3.8.15.

Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/helpers/FileHelper.php
Commit message: Fixed a potential RCE vulnerability


Vulnerable code:

Fixed code:
## Unreleased

- Fixed an RCE vulnerability.

        // Remove any file protocol wrappers
        $path = StringHelper::removeLeft($path, 'file://');