hitoshura25/cvefixes huggingface dataset:
CVE-2016-10700 (PHP, published 2017-11-24T05:29Z)
Description: value: auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/Cacti/cacti
Files changed:
auth_login.php
Commit message: fixing bug #2697

web basic for guest accounts


Vulnerable code:
		if (!$user && read_config_option('user_template') == '0') {
			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but a Template User is not defined in Cacti.  Exiting.", false, 'AUTH');
			auth_display_custom_error_message( __('%s authenticated by Web Server, but a Template User is not defined in Cacti.', $username) );

Fixed code:
		if (!$user && read_config_option('user_template') == '0' && read_config_option('guest_user') == '0') {
			cacti_log("ERROR: User '" . $username . "' authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.  Exiting.", false, 'AUTH');
			auth_display_custom_error_message( __('%s authenticated by Web Server, but both Template and Guest Users are not defined in Cacti.', $username) );
CVE-2017-11691 (PHP, published 2017-07-27T06:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cacti/cacti
Files changed:
auth_profile.php
docs/CHANGELOG
Commit message: Resolving Issue #867

Cross-site scripting (XSS) vulnerability in auth_profile.php


Vulnerable code:
	html_start_box( __('User Account Details'), '100%', true, '3', 'center', '');
			document.location = '<?php print $_SESSION['profile_referer'];?>';
	form_save_buttons(array(array('id' => 'return', 'value' => 'Return'), array('id' => 'save', 'value' => 'Save')));

Fixed code:
	html_start_box(__('User Account Details'), '100%', true, '3', 'center', '');
			document.location = '<?php print htmlspecialchars($_SESSION['profile_referer']);?>';
	form_save_buttons(array(array('id' => 'return', 'value' => __esc('Return')), array('id' => 'save', 'value' => __esc('Save'))));
-issue#867: Cross-site scripting (XSS) vulnerability in auth_profile.php
CVE-2017-12927 (Other, published 2017-08-18T02:29Z)
Description: value: A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cacti/cacti
Files changed:
docs/CHANGELOG
spikekill.php
Commit message: Resolving Issue #907

XSS in spikekill.php


Vulnerable code:
			echo __("FATAL: Spike Kill method '%s' is Invalid\n", get_nfilter_request_var('method'));
		WHERE graph_templates_item.local_graph_id = ?', array(get_filter_request_var('local_graph_id')));

Fixed code:
-issue#907: XSS issue in spikekill.php
			echo __("FATAL: Spike Kill method '%s' is Invalid\n", htmlspecialchars(get_nfilter_request_var('method'), ENT_QUOTES, 'UTF-8'));
		WHERE graph_templates_item.local_graph_id = ?',
		array(get_filter_request_var('local_graph_id')));
CVE-2017-15194 (PHP, published 2017-10-11T01:32Z)
Description: value: include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cacti/cacti
Files changed:
include/global_session.php
Commit message: XSS fix (#1017)

Fix for issue #1010

Vulnerable code:
	var refreshPage='<?php print $myrefresh['page'];?>';
	var requestURI='<?php print $_SERVER['REQUEST_URI'];?>';

Fixed code:
	var refreshPage='<?php print htmlspecialchars($myrefresh['page']);?>';
	var requestURI='<?php print htmlspecialchars($_SERVER['REQUEST_URI']);?>';
CVE-2018-20724 (Other, published 2019-01-16T16:29Z)
Description: value: A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cacti/cacti
Files changed:
CHANGELOG
pollers.php
Commit message: Resolving Issue #2212

Stored XSS in "Website Hostname" field


Vulnerable code:
			form_selectable_cell($poller['hostname'], $poller['id'], '', 'right');

Fixed code:
-issue#2212: Stored XSS in "Website Hostname" field
			form_selectable_cell(html_escape($poller['hostname']), $poller['id'], '', 'right');
CVE-2019-17358 (PHP, published 2019-12-12T14:15Z)
Description: value: Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/Cacti/cacti
Files changed:
lib/functions.php
Commit message: Resoving Issue #3026

Unsafe deserialization in of selected objects in Cacti


Vulnerable code:
		$items = unserialize(stripslashes($items));

		if (is_array($items)) {
			foreach ($items as $item) {
				if (is_array($item)) {
					return false;
				} elseif (!is_numeric($item) && ($item != '')) {
					return false;

Fixed code:
		$unstripped = stripslashes($items);

		// validate that sanitized string is correctly formatted
		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
			$items = unserialize($unstripped);

			if (is_array($items)) {
				foreach ($items as $item) {
					if (is_array($item)) {
						return false;
					} elseif (!is_numeric($item) && ($item != '')) {
						return false;
					}
			} else {
				return false;
CVE-2019-17358 (PHP, published 2019-12-12T14:15Z)
Description: value: Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/Cacti/cacti
Files changed:
lib/functions.php
Commit message: Resoving Issue #3026

Unsafe deserialization in of selected objects in Cacti


Vulnerable code:
		$items = unserialize(stripslashes($items));

		if (is_array($items)) {
			foreach ($items as $item) {
				if (is_array($item)) {
					return false;
				} elseif (!is_numeric($item) && ($item != '')) {
					return false;

Fixed code:
		$unstripped = stripslashes($items);

		// validate that sanitized string is correctly formatted
		if (preg_match('/^a:[0-9]+:{/', $unstripped) && !preg_match('/(^|;|{|})O:\+?[0-9]+:"/', $unstripped)) {
			$items = unserialize($unstripped);

			if (is_array($items)) {
				foreach ($items as $item) {
					if (is_array($item)) {
						return false;
					} elseif (!is_numeric($item) && ($item != '')) {
						return false;
					}
			} else {
				return false;
CVE-2020-25706 (Other, published 2020-11-12T14:15Z)
Description: value: A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cacti/cacti
Files changed:
CHANGELOG
lib/import.php
Commit message: Improper escaping of error message leads to XSS during template import preview (#3723)

Closes #3723


Vulnerable code:
			raise_message('resource_missing_' . $counter, __('Resource File: \'%s\' is missing or not readable.  Make sure you install it before using Data Query: \'%s\'', $path, $save['name']), MESSAGE_LEVEL_ERROR);
				print "<li>" . ($preview ? __("[preview] "):"") . $filename . " [" . $status . "]</li>\n";

Fixed code:
-issue#3723: Improper escaping of error message leads to XSS during template import preview
			raise_message('resource_missing_' . $counter, __esc('Resource File: \'%s\' is missing or not readable.  Make sure you install it before using Data Query: \'%s\'', $path, $save['name']), MESSAGE_LEVEL_ERROR);
				print "<li>" . ($preview ? __("[preview] "):"") . html_escape($filename) . " [" . $status . "]</li>\n";
CVE-2023-49086 (PHP, published 2023-12-22T00:15Z)
Description: value: Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. The impact of the vulnerability is execution of arbitrary JavaScript code in the attacked user's browser. This issue has been patched in version 1.2.27.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Cacti/cacti
Files changed:
data_debug.php
graphs_new.php
Commit message: QA: Fix 2 of 3 - Commits for CVE-2023-49088 and CVE-2023-48086

Missed here https://github.com/Cacti/cacti/security/advisories/GHSA-q7g7-gcf6-wh4x
and here:
https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr


Vulnerable code:
		$real_path = str_replace('<path_rra>', CACTI_PATH_RRA, $dtd['data_source_path']);
	if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], 'graphs_new') === false) {
		set_request_var('returnto', basename($_SERVER['HTTP_REFERER']));

Fixed code:
		$real_path = html_escape(str_replace('<path_rra>', $config['rra_path'], $dtd['data_source_path']));
	if (isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER'] != '') {
		$referer_url = parse_url($_SERVER['HTTP_REFERER']);

		if ($_SERVER['SERVER_NAME'] != $referer_url['host']) {
			/* Potential security exploit 1 */
			set_request_var('returnto', 'host.php');
		} elseif (strpos($_SERVER['HTTP_REFERER'], 'graphs_new') === false) {
			set_request_var('returnto', basename($_SERVER['HTTP_REFERER']));
		} else {
			set_request_var('returnto', 'host.php');
		}
	} elseif (isset_request_var('returnto') && get_nfilter_request_var('returnto') != '') {
		$returnto_url = parse_url(get_nfilter_request_var('returnto'));

		if ($_SERVER['SERVER_NAME'] != $returnto_url['host']) {
			/* Potential security exploit 2 */
			set_request_var('returnto', 'host.php');
		}
CVE-2024-25641 (PHP, published 2024-05-14T15:05Z)
Description: value: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cacti/cacti
Files changed:
lib/import.php
package_import.php
Commit message: Merge pull request from GHSA-7cmj-g5qc-pj88



Vulnerable code:
					cacti_log('Writing file: ' . $filename, false, 'IMPORT', POLLER_VERBOSITY_MEDIUM);
					if ((is_writeable(dirname($filename)) && !file_exists($filename)) || is_writable($filename)) {
				if (is_writeable(dirname($filename))) {

Fixed code:
		/* The xml file without path is the main template of the package. It is processed below using $debug_data */

					cacti_log('Checking filepath: ' . $filename, false, 'IMPORT', POLLER_VERBOSITY_MEDIUM);

					if (!preg_match('/^(scripts|resource)[a-zA-Z0-9_\-\/]*$/', dirname($name))) {
						cacti_log('FATAL: Incorrect path: ' . $filename, true, 'IMPORT', POLLER_VERBOSITY_LOW);

						$filestatus[$filename] = __('incorrect path, file not saved');
					} elseif ((is_writeable(dirname($filename)) && !file_exists($filename)) || is_writable($filename)) {
						cacti_log('Writing file: ' . $filename, false, 'IMPORT', POLLER_VERBOSITY_MEDIUM);
				if (!preg_match('/^(scripts|resource)[a-zA-Z0-9_\-\/]*$/', dirname($name))) {
					$filestatus[$filename] = 'incorrect path';
				} elseif (is_writeable(dirname($filename))) {

						} elseif ($s == 'incorrect path') {
							$nstatus .= ($nstatus != '' ? ', ':'') . __('Incorrect path, will not be imported');
CVE-2024-29895 (PHP, published 2024-05-14T15:17Z)
Description: value: Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cacti/cacti
Files changed:
cmd_realtime.php
Commit message: Merge pull request from GHSA-cr28-x256-xf5m



Vulnerable code:
$poller_id = $_SERVER['argv'][1];

Fixed code:
$poller_id = (int)$_SERVER['argv'][1];
if ($poller_id <= 0) {
	print "Invalid poller_id specified.\n\n";

	exit(-1);
}
CVE-2024-29895 (PHP, published 2024-05-14T15:17Z)
Description: value: Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cacti/cacti
Files changed:
cmd_realtime.php
Commit message: Revert "Merge pull request from GHSA-cr28-x256-xf5m"

This reverts commit 53e8014d1f082034e0646edc6286cde3800c683d.


Vulnerable code:
$poller_id = (int)$_SERVER['argv'][1];
if ($poller_id <= 0) {
	print "Invalid poller_id specified.\n\n";

	exit(-1);
}


Fixed code:
$poller_id = $_SERVER['argv'][1];
CVE-2024-30268 (PHP, published 2024-05-14T15:22Z)
Description: value: Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cacti/cacti
Files changed:
settings.php
Commit message: Merge pull request from GHSA-9m3v-whmr-pc2q



Vulnerable code:
	print '<td><input type="text" size="25" id="filter" value="' . get_request_var('filter') . '"></td>';

Fixed code:
get_filter_request_var('filter', FILTER_CALLBACK, array('options' => 'sanitize_search_string'));
	print '<td><input type="text" size="25" id="filter" value="' . html_escape_request_var('filter') . '"></td>';
CVE-2024-31443 (PHP, published 2024-05-14T15:25Z)
Description: value: Cacti provides an operational monitoring and fault management framework. Prior to 1.2.27, some of the data stored in `form_save()` function in `data_queries.php` is not thoroughly checked and is used to concatenate the HTML statement in `grow_right_pane_tree()` function from `lib/html.php` , finally resulting in cross-site scripting. Version 1.2.27 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cacti/cacti
Files changed:
lib/html_tree.php
Commit message: Merge pull request from GHSA-rqc8-78cm-85j3

Co-authored-by: ishgard <ishgard@njust.edu.cn>

Vulnerable code:

Fixed code:
		$name = html_escape($name);
		$name = html_escape($name);
		$name = html_escape($name);
CVE-2024-31445 (PHP, published 2024-05-14T15:25Z)
Description: value: Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, a SQL injection vulnerability in `automation_get_new_graphs_sql` function of `api_automation.php` allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. In `api_automation.php` line 856, the `get_request_var('filter')` is being concatenated into the SQL statement without any sanitization. In `api_automation.php` line 717, The filter of `'filter'` is `FILTER_DEFAULT`, which means there is no filter for it. Version 1.2.27 contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Cacti/cacti
Files changed:
lib/api_automation.php
Commit message: Merge pull request from GHSA-vjph-r677-6pcc



Vulnerable code:
				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE "%' . $filter . '%"';


Fixed code:
				$sql_having .= ($i == 0 ? '':' OR ') . '`' . implode('`.`', explode('.', $column['field_name'])) . '`' . ' LIKE ' . db_qstr('%' . $filter . '%');
CVE-2024-39935 (JavaScript, published 2024-07-04T21:15Z)
Description: value: jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/NginxProxyManager/nginx-proxy-manager
Files changed:
backend/internal/certificate.js
Commit message: Fix command injection when passing bash commands into the dns provider configuration

- Use built in node functions to write the file
- And to delete the file


Vulnerable code:
		// Escape single quotes and backslashes
		const escapedCredentials = certificate.meta.dns_provider_credentials.replaceAll('\'', '\\\'').replaceAll('\\', '\\\\');
		const credentialsCmd     = 'mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo \'' + escapedCredentials + '\' > \'' + credentialsLocation + '\' && chmod 600 \'' + credentialsLocation + '\'';
		logger.info('Command:', `${credentialsCmd} && && ${mainCmd}`);
			await utils.exec(credentialsCmd);
			// Don't fail if file does not exist
			const delete_credentialsCmd = `rm -f '${credentialsLocation}' || true`;
			await utils.exec(delete_credentialsCmd);

Fixed code:
		fs.mkdirSync('/etc/letsencrypt/credentials', { recursive: true });
		fs.writeFileSync(credentialsLocation, certificate.meta.dns_provider_credentials, {mode: 0o600});
		logger.info('Command:', mainCmd);
			// Don't fail if file does not exist, so no need for action in the callback
			fs.unlink(credentialsLocation, () => {});