hitoshura25/cvefixes huggingface dataset:
CVE-2022-1988 (PHP, published 2022-06-03T08:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/Model/Cuenta.php
Core/Translation/gl_ES.json
Test/Core/Model/CuentaTest.php
Commit message: - Añadida comprobación de html en descripción al test unitario del modelo cuenta.
- Eliminado el test unitario de subcuenta por obsoleto. Se creará uno nuevo a continuación.


Vulnerable code:
        $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);
    "empty-contact-data": "El contacto debe tener nombre o email o dirección",
<?php
/**
 * This file is part of FacturaScripts
 * Copyright (C) 2017       Francesc Pineda Segarra <francesc.pineda.segarra@gmail.com>
 * Copyright (C) 2017-2018  Carlos Garcia Gomez     <carlos@facturascripts.com>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

namespace FacturaScripts\Test\Core\Model;

use FacturaScripts\Core\Model\Subcuenta;
use FacturaScripts\Test\Core\CustomTest;

/**
 * @covers \Subcuenta
 *
 * @author Francesc Pineda Segarra <francesc.pineda.segarra@gmail.com>
 */
final class SubcuentaTest extends CustomTest
{

    protected function setUp(): void
    {
        $this->model = new Subcuenta();
    }
}

Fixed code:
        $this->descripcion = $this->toolBox()->utils()->noHtml($this->descripcion);

    "empty-contact-data": "O contacto debe ter nome ou email ou dirección",
    public function testHtmlOnDescription()
    {
        $account = new Cuenta();
        $account->codcuenta = '9999';
        $account->codejercicio = $this->getRandomExercise()->codejercicio;
        $account->descripcion = '<b>Test</b>';
        $this->assertTrue($account->save(), 'can-not-create-account');

        // comprobamos que el html se ha escapado
        $this->assertEquals('&lt;b&gt;Test&lt;/b&gt;', $account->descripcion);

        // eliminamos
        $this->assertTrue($account->delete(), 'account-cant-delete');
    }
CVE-2022-2065 (PHP, published 2022-06-13T13:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/App/AppRouter.php
Commit message: Force to download SVG files to prevent security problems.
------
Forzamos a descargar los archivos SVG para evitar problemas de seguridad.


Vulnerable code:
                header('Content-Type: ' . $this->getMime($filePath));
                readfile($filePath);
            header('Content-Type: ' . $this->getMime($filePath));

            // disable the buffer if enabled
            if (ob_get_contents()) {
                ob_end_flush();
            }

            readfile($filePath);

Fixed code:
                $this->download($filePath);
            $this->download($filePath);
    private function download(string $filePath)
    {
        header('Content-Type: ' . $this->getMime($filePath));

        // disable the buffer if enabled
        if (ob_get_contents()) {
            ob_end_flush();
        }

        // force to download svg files to prevent XSS attacks
        if (strpos($filePath, '.svg') !== false) {
            header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
        }

        readfile($filePath);
    }
CVE-2022-2066 (PHP, published 2022-06-13T13:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/neorazorx/facturascripts
Files changed:
Core/App/AppController.php
Commit message: Sanitized username when showing user not found message.
------
Saneado nombre de usuario al mostrar el mensaje de usuario no encontrado.


Vulnerable code:
        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => $nick]);

Fixed code:
        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => htmlspecialchars($nick)]);
CVE-2015-10107 (PHP, published 2023-05-31T03:15Z)
Description: value: A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.3.5 is able to address this issue. The identifier of the patch is d588446844dd49232ab400ef213ff5b92121c33e. It is recommended to upgrade the affected component. The identifier VDB-230153 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/simplr-registration-form
Files changed:
lib/mod.php
readme.txt
simplr_reg_page.php
views/fields.php
Commit message: Addresses add_query_arg vulnerability

git-svn-id: https://plugins.svn.wordpress.org/simplr-registration-form/trunk@1154851 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
		$views['view_inactive'] = '<a href="'.add_query_arg(array('view_inactive' => 'true')).'" class="'.$class.'" >'. __('Inactive Users','simplr-reg') . ' ('.simplr_count_inactive().')</a>';
Tested up to: 4.2
Stable tag: 2.3.4
Version: 2.3.4
		<form action="<?php echo add_query_arg(array('action'=>'add')); ?>" method="post" id="add-field">

Fixed code:
		$views['view_inactive'] = '<a href="'.esc_url(add_query_arg(array('view_inactive' => 'true'))).'" class="'.$class.'" >'. __('Inactive Users','simplr-reg') . ' ('.simplr_count_inactive().')</a>';
Tested up to: 4.2.1
Stable tag: 2.3.5
= 2.3.5 =
* properly escape add_query_arg inputs

Version: 2.3.5
		<form action="<?php echo esc_url(add_query_arg(array('action'=>'add'))); ?>" method="post" id="add-field">
CVE-2015-10112 (Other, published 2023-06-05T08:15Z)
Description: value: A vulnerability classified as problematic has been found in WooFramework Branding Plugin up to 1.0.1 on WordPress. Affected is the function admin_screen_logic of the file wooframework-branding.php. The manipulation of the argument url leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is f12fccd7b5eaf66442346f748c901ef504742f78. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230652.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/wp-plugins/wooframework-branding
Files changed:
readme.txt
wooframework-branding.php
Commit message: V1.0.2 - Security Fix for _query_arg vulnerability.

git-svn-id: https://plugins.svn.wordpress.org/wooframework-branding/trunk@1142177 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Tested up to: 3.9.1
Stable tag: 1.0.1
 * Version: 1.0.1
 * Tested up to: 3.9.1
			wp_safe_redirect( $url );

Fixed code:
Tested up to: 4.1.1
Stable tag: 1.0.2
= 1.0.2 =
* 2015-04-22
* Security Fix for remove_query_arg vulnerability

= 1.0.2 =
* 2015-04-22
* Security Fix for remove_query_arg vulnerability

 * Version: 1.0.2
 * Tested up to: 4.1.1
			wp_safe_redirect( esc_url( $url ) );
CVE-2023-38403 (C, published 2023-07-17T21:15Z)
Description: value: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/esnet/iperf
Files changed:
src/iperf_api.c
Commit message: Fix memory allocation hazard (#1542). (#1543)

Reported by:	@someusername123 on GitHub

Vulnerable code:
	str = (char *) calloc(sizeof(char), hsize+1);	/* +1 for trailing null */

Fixed code:
    size_t strsize;
	strsize = hsize + 1;              /* +1 for trailing NULL */
	if (strsize) {
	str = (char *) calloc(sizeof(char), strsize);
	}
	else {
	    printf("WARNING:  Data length overflow\n");
	}
CVE-2013-2182 (C, published 2014-06-13T14:55Z)
Description: value: The Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers to bypass access restrictions via a crafted URI, as demonstrated by an encoded forward slash.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/monkey/monkey
Files changed:
plugins/mandril/mandril.c
Commit message: Mandril: check decoded URI (fix #92)

Signed-off-by: Eduardo Silva <eduardo@monkey.io>


Vulnerable code:
    if (mk_security_check_url(sr->uri) < 0) {

Fixed code:

    if (mk_security_check_url(sr->uri_processed) < 0) {
CVE-2014-5336 (C, published 2014-08-26T14:55Z)
Description: value: Monkey HTTP Server before 1.5.3, when the File Descriptor Table (FDT) is enabled and custom error messages are set, allows remote attackers to cause a denial of service (file descriptor consumption) via an HTTP request that triggers an error message.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/monkey/monkey
Files changed:
include/monkey/mk_request.h
src/mk_request.c
src/mk_vhost.c
Commit message: Request: new request session flag to mark those files opened by FDT

This patch aims to fix a potential DDoS problem that can be caused
in the server quering repetitive non-existent resources.

When serving a static file, the core use Vhost FDT mechanism, but if
it sends a static error page it does a direct open(2). When closing
the resources for the same request it was just calling mk_vhost_close()
which did not clear properly the file descriptor.

This patch adds a new field on the struct session_request called 'fd_is_fdt',
which contains MK_TRUE or MK_FALSE depending of how fd_file was opened.

Thanks to Matthew Daley <mattd@bugfuzz.com> for report and troubleshoot this
problem.

Signed-off-by: Eduardo Silva <eduardo@monkey.io>


Vulnerable code:
    /* file descriptors */
        mk_vhost_close(sr);
            sr->fd_file = fd;


Fixed code:
    /*
     * Static file file descriptor: the following twp fields represents an
     * opened file in the file system and a flag saying which mechanism
     * was used to open it.
     *
     *  - fd_file  : common file descriptor
     *  - fd_is_fdt: set to MK_TRUE if fd_file was opened using Vhost FDT, or
     *               MK_FALSE for the opposite case.
     */
    int fd_is_fdt;

        if (sr->fd_is_fdt == MK_TRUE) {
            mk_vhost_close(sr);
        }
        else {
            close(sr->fd_file);
        }
            sr->fd_file   = fd;
            sr->fd_is_fdt = MK_FALSE;
            sr->fd_is_fdt      = MK_TRUE;
CVE-2015-10069 (Python, published 2023-01-19T08:15Z)
Description: value: A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the patch is 62a6e24efdfa195b70d7df140d8287fdc38eb66d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218896.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/viakondratiuk/cash-machine
Files changed:
machine.py
Commit message: Prevent sql injection, refresh db.


Vulnerable code:
    q = "select * from cards where cc_number = '%s'" % cc_number.replace('-', '')
    row = request.db.execute(q).fetchone()
    request.db.execute("update cards set status = 'blocked' where id = %s" % card['id'])

Fixed code:
    row = request.db.execute("select * from cards where cc_number = ?", (cc_number.replace('-', ''),)).fetchone()
    request.db.execute("update cards set status = 'blocked' where id = ?", (card['id'],))
CVE-2023-2731 (C, published 2023-05-17T22:15Z)
Description: value: A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/libsdl-org/libtiff
Files changed:
libtiff/tif_lzw.c
Commit message: LZWDecode(): avoid crash when trying to read again from a strip whith a missing end-of-information marker (fixes #548)


Vulnerable code:

Fixed code:
        TIFFErrorExtR(tif, module,
                      "LZWDecode: Scanline %" PRIu32 " cannot be read due to "
                      "previous error",
                      tif->tif_row);
    sp->read_error = 1;
CVE-2020-28498 (JavaScript, published 2021-02-02T19:15Z)
Description: value: The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/indutny/elliptic
Files changed:
lib/elliptic/ec/key.js
test/ecdh-test.js
Commit message: ec: validate that a point before deriving keys

This update checks to make sure that the public key passed in to
ECDH is a point that actually exists on the curve. This is
important to prevent a twist attack that can be used to reveal
the private key of a party in an ECDH operation over a number of
occurances.

For more details on the attack see this blog post:
https://github.com/christianlundkvist/blog/blob/master/2020_05_26_secp256k1_twist_attacks/secp256k1_twist_attacks.md

CVE: CVE-2020-28498


Vulnerable code:

Fixed code:
  if(!pub.validate()) {
    assert(pub.validate(), 'public point not validated');
  }

describe('ECDH twist attack', () => {
  it('should be able to prevent a twist attack for secp256k1', () => {
    var bobEcdh = new elliptic.ec('secp256k1');
    var malloryEcdh = new elliptic.ec('secp256k1');
    var bob = bobEcdh.genKeyPair();
    // This is a bad point that shouldn't be able to be passed to derive.
    // If a bad point can be passed it's possible to perform a twist attack.
    var mallory = malloryEcdh.keyFromPublic({ x: 14, y: 16 });
    assert.throws(function () {
      bob.derive(mallory.getPublic());
    });
  });
});
CVE-2016-15014 (PHP, published 2023-01-07T20:15Z)
Description: value: A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functionality of the file cesnet/core/lostpassword/templates/resetpassword.php. The manipulation leads to insufficiently protected credentials. Attacking locally is a requirement. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 2b857f2233ce5083b4d5bc9bfc4152f933c3e4a6. It is recommended to upgrade the affected component. The identifier VDB-217633 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/CESNET/theme-cesnet
Files changed:
cesnet/core/lostpassword/templates/resetpassword.php
Commit message: Fix AutoComplete Not Disabled for 'Password' Field vulnerability


Vulnerable code:

Fixed code:
<?php
/**
 * @author Jan-Christoph Borchardt <hey@jancborchardt.net>
 * @author Lukas Reschke <lukas@owncloud.com>
 * @author Michael Gapczynski <GapczynskiM@gmail.com>
 * @author Morris Jobke <hey@morrisjobke.de>
 * @author Victor Dubiniuk <dubiniuk@owncloud.com>
 *
 * @copyright Copyright (c) 2015, ownCloud, Inc.
 * @license AGPL-3.0
 *
 * This code is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License, version 3,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License, version 3,
 * along with this program.  If not, see <http://www.gnu.org/licenses/>
 *
 */
style('lostpassword', 'resetpassword');
script('core', 'lostpassword');
?>

<form action="<?php print_unescaped($_['link']) ?>" id="reset-password" method="post">
	<fieldset>
		<p>
			<label for="password" class="infield"><?php p($l->t('New password')); ?></label>
			<input type="password" autocomplete="off" name="password" id="password" value="" placeholder="<?php p($l->t('New Password')); ?>" required />
		</p>
		<input type="submit" id="submit" value="<?php p($l->t('Reset password')); ?>" />
		<p class="text-center">
			<img class="hidden" id="float-spinner" src="<?php p(\OCP\Util::imagePath('core', 'loading-dark.gif'));?>"/>
		</p>
	</fieldset>
</form>
CVE-2023-40020 (TypeScript, published 2023-08-14T21:15Z)
Description: value: PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 8.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/PrivateUploader/PrivateUploader
Files changed:
app/controllers/v3/admin.controller.ts
app/controllers/v3/workspace.controller.ts
app/services/admin.service.ts
app/services/note.service.ts
app/validators/setup.ts
frontend/package.json
Commit message: 3.2.49


Vulnerable code:
@UseBefore(Auth("*"))
    await authSystem("admin", false, request, response, next)
    if (!request.user || !request.user.administrator) throw Errors.ADMIN_ONLY
    await authSystem("admin", false, request, response, next)
    )
        console.log(type)
        zip.file(`${dataValues.name.replaceAll("/", "-")}.${type}`, data)
    if (userId === 6 && planId === 6) {
      "folder"
  maintenance: z.boolean(),
  "version": "3.2.48",

Fixed code:
    const session = await authSystem(
      "admin",
      false,
      request,
      response,
      () => {}
    )
    if (!session || !session.user?.administrator) {
      throw Errors.ADMIN_ONLY
    } else {
      next()
    }
    await authSystem("admin", false, request, response, () => {})
    ) {
    } else {
      next()
    }
        zip.file(
          `${dataValues.name
            .replaceAll("/", "-")
            .replaceAll("\\", "-")}.${type}`,
          data
        )
    if (userId === 6 && planId === 6 && config.officialInstance) {
    console.log(folder.name)
      "workspace"
  maintenance: z.object({
    enabled: z.boolean(),
    message: z.string().nullable().optional(),
    statusPage: z.string().nullable().optional()
  }),
  "version": "3.2.49",
CVE-2022-1295 (Unknown, published 2022-04-11T12:15Z)
Description: value: Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/alvarotrigo/fullpage.js
Files changed:
Commit message: Merge pull request #4351 from alvarotrigo/dev

- Fixed bug: jquery adaptor didnt work

Vulnerable code:

Fixed code: