hitoshura25/cvefixes huggingface dataset:
CVE-2022-31047 (PHP, published 2022-06-14T21:15Z)
Description: value: TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/core/Classes/Error/AbstractExceptionHandler.php
typo3/sysext/core/Classes/Error/DebugExceptionHandler.php
Commit message: [SECURITY] Do not log stacktrace in exception handlers

When a TYPO3 exception is handled through registered exception
handlers, log writers may log sensitive information to logs,
since the full stacktrace is logged.

With this change, exception handlers that extend
AbstractExceptionHandler except DebugExceptionHandler will
by default not include the exception object any more and
thereby not log the full stacktrace.

Resolves: #96866
Releases: main, 11.5, 10.4
Change-Id: Iaf233eefc9a1a60334a47753baf457e8282e68c0
Security-Bulletin: TYPO3-CORE-SA-2022-002
Security-References: CVE-2022-31047
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74903
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
                    'exception' => $exception,

Fixed code:
    protected bool $logExceptionStackTrace = false;

                    'exception' => $this->logExceptionStackTrace ? $exception : null,
    protected bool $logExceptionStackTrace = true;
CVE-2022-31048 (JavaScript, published 2022-06-14T21:15Z)
Description: value: TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/form/Resources/Public/JavaScript/backend/form-editor/stage-component.js
Commit message: [SECURITY] Ensure text preview of multivalue items in form editor

Multivalue items in the form editor user interface were previewed
as HTML, but should be treated as scalar text only.

Resolves: #96743
Releases: main, 11.5, 10.4
Change-Id: I5e8dab26119490ecf19ac5d48c2bc7a5a00daaad
Security-Bulletin: TYPO3-CORE-SA-2022-003
Security-References: CVE-2022-31048
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/73297
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
        title = buildTitleByFormElement();
      $(getHelper().getDomElementDataIdentifierSelector('stageHeadline')).html(title);
        .append(getFormElementDefinition(formElement, 'label'));
        .append(formElement.get('identifier'));
              .append(collectionElementConfiguration['label']);
        getHelper().getTemplatePropertyDomElement('_label', rowTemplate).append(label);

Fixed code:
        title = buildTitleByFormElement().text();
      $(getHelper().getDomElementDataIdentifierSelector('stageHeadline')).text(title);
        .append(document.createTextNode(getFormElementDefinition(formElement, 'label')));
        .append(document.createTextNode(formElement.get('identifier')));
              .append(document.createTextNode(collectionElementConfiguration['label']));
        getHelper().getTemplatePropertyDomElement('_label', rowTemplate).append(document.createTextNode(label));
CVE-2022-31049 (HTML, published 2022-06-14T21:15Z)
Description: value: TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/felogin/Resources/Private/Email/Templates/PasswordRecovery.html
Commit message: [SECURITY] Avoid HTML injection in password recovery mail

The `receiverName` variable used in the password recovery mail of the
Extbase felogin plugin was susceptible to HTML injection due to
missing sanitization. The variable is now passed thru the
`f:format.htmlspecialchars` ViewHelper.

Resolves: #96559
Releases: main, 11.5, 10.4
Change-Id: I60e23c161f7f2fcc87b8870345b10a4c31d7b8db
Security-Bulletin: TYPO3-CORE-SA-2022-004
Security-References: CVE-2022-31049
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74904
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
        arguments: '{ 0: receiverName, 1: recoveryLink, 2: validUntil }'

Fixed code:
        arguments: '{ 0: "{receiverName -> f:format.htmlspecialchars()}", 1: recoveryLink, 2: validUntil }'
CVE-2022-36104 (PHP, published 2022-09-13T18:15Z)
Description: value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/core/Classes/Error/PageErrorHandler/PageContentErrorHandler.php
Commit message: [SECURITY] Mitigate denial-of-service scenarios in page error handler

This fixes TYPO3-CORE-SA-2021-005 again, which accidentally had
been removed during TYPO3 v11 development. An inaccessible error
page amplified potential denial-of-service scenarios.

Resolves: #97818
Releases: main, 11.5
Change-Id: Ia9c666731f70db5e0a60572cd008f1d0c541af37
Security-Bulletin: TYPO3-CORE-SA-2022-006
Security-References: CVE-2022-36104
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75715
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:

Fixed code:
            // avoid denial-of-service amplification scenario
            if ($resolvedUrl === (string)$request->getUri()) {
                return new HtmlResponse(
                    'The error page could not be resolved, as the error page itself is not accessible',
                    $this->statusCode
                );
            }
CVE-2022-36106 (PHP, published 2022-09-13T18:15Z)
Description: value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be used to perform a password reset even if the default expiry time of two hours has been exceeded. Update to TYPO3 version 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/backend/Classes/Authentication/PasswordReset.php
Commit message: [SECURITY] Respect expiration time of password reset token

When a TYPO3 backend user performs a password reset request, a
password reset link including an expiration time is sent to the
user. The expiration time is included in HMAC calculation of
the saved password reset hash, but it is never evaluated if the
expiration time is exceeded.

This change adds the missing validity check for the expiration
time included in the password reset link.

Resolves: #97998
Releases: main, 11.5, 10.4
Change-Id: I8a1730faf6489e5c5eebb44ff4f82606785bd637
Security-Bulletin: TYPO3-CORE-SA-2022-008
Security-References: CVE-2022-36106
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75717
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:

Fixed code:
        // Early return if token expired
        if ($expirationTimestamp < time()) {
            return null;
        }
CVE-2022-36107 (PHP, published 2022-09-13T18:15Z)
Description: value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/core/Classes/Controller/FileDumpController.php
Commit message: [SECURITY] Mitigate cross-site-scripting in FileDumpController

FileDumpController is used to expose stored files from the backend
user interface through a corresponding service-side process. Since
content-security-policy settings for files served directly by the
web server won't be applied, FileDumpController has to take care.

Resolves: #98221
Releases: main, 11.5, 10.4
Change-Id: I4fde10e48e33fa08452eddf876172f56b4f38e28
Security-Bulletin: TYPO3-CORE-SA-2022-009
Security-References: CVE-2022-36107
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75718
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
            return $event->getResponse();
        return $file->getStorage()->streamFile(
            (bool)($parameters['dl'] ?? false),
            $parameters['fn'] ?? null

Fixed code:
use TYPO3\CMS\Core\Resource\ResourceInterface;
use TYPO3\CMS\Core\Utility\PathUtility;
            return $this->applyContentSecurityPolicy($event->getFile(), $event->getResponse());
        return $this->applyContentSecurityPolicy(
            $file->getStorage()->streamFile(
                $file,
                (bool)($parameters['dl'] ?? false),
                $parameters['fn'] ?? null
            )

    /**
     * Applies hard-coded content-security-policy (CSP) for file to be dumped.
     */
    protected function applyContentSecurityPolicy(ResourceInterface $file, ResponseInterface $response): ResponseInterface
    {
        $extension = PathUtility::pathinfo($file->getName(), PATHINFO_EXTENSION);
        // same as in `typo3/sysext/install/Resources/Private/FolderStructureTemplateFiles/resources-root-htaccess`
        $policy = $extension === 'pdf' || $response->getHeaderLine('content-type') === 'application/pdf'
            ? "default-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'self'; plugin-types application/pdf;"
            : "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';";
        return $response->withAddedHeader('content-security-policy', $policy);
    }
CVE-2023-47126 (PHP, published 2023-11-14T20:15Z)
Description: value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/install/Classes/Controller/LoginController.php
typo3/sysext/install/Classes/Service/EnableFileService.php
Commit message: [SECURITY] Do not display full path to ENABLE_INSTALL_TOOL file

Using the Install Tool in composer mode, the login
displays a hint, where the ENABLE_INSTALL_TOOL file
must be placed to unlock the Install Tool.

This hint does not show the full path anymore.
Only the path relative to the project root is shown.

Resolves: #102242
Releases: main, 12.4
Change-Id: I1e9cbfe3ef7d4cc6af9635da71d0c7450fe44aa6
Security-Bulletin: TYPO3-CORE-SA-2023-005
Security-References: CVE-2023-47126
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81736
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
use TYPO3\CMS\Core\Core\Environment;
        $path = str_replace(Environment::getPublicPath() . '/', '', dirname(EnableFileService::getBestLocationForInstallToolEnableFile())) . '/';
        $view->assign('enableInstallToolPath', $path);

Fixed code:
        $view->assign('enableInstallToolPath', EnableFileService::getStaticLocationForInstallToolEnableFileDirectory());
    /**
     * Returns a static directory path that is suitable to be presented to
     * unauthenticated visitors, in order to circumvent "Full Path Disclosure" issues.
     */
    public static function getStaticLocationForInstallToolEnableFileDirectory(): string
    {
        return Environment::isComposerMode() ? 'var/transient/' : 'typo3conf/';
    }
CVE-2024-34355 (HTML, published 2024-05-14T16:17Z)
Description: value: TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/backend/Resources/Private/Partials/RecordHistory/History.html
Commit message: [SECURITY] Prevent HTML Injection in History Backend Module

Encode non prepared output of BackendUtility::getRecordTitle.
The string returned by getRecordTitle is only HTML encoded if
the third parameter (`$prep`) is set to true. ensure that
non-prepared usages are encoded on render.

Resolves: #103406
Releases: main, 13.1
Change-Id: I2aeefc20d526078ef905905b136dcd405fda337a
Security-Bulletin: TYPO3-CORE-SA-2024-007
Security-References: CVE-2024-34355
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/84264
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
                            {historyRow.title -> f:format.raw()} ({historyRow.recordTable}:{historyRow.recordUid})

Fixed code:
                            {historyRow.title} ({historyRow.recordTable}:{historyRow.recordUid})
CVE-2015-5719 (PHP, published 2016-09-03T20:59Z)
Description: value: app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MISP/MISP
Files changed:
VERSION.json
app/Controller/TemplatesController.php
Commit message: Fix to an incorrect validation of temporary filenames


Vulnerable code:
{"major":2, "minor":3, "hotfix":91}
					if (isset($attribute['data'])) {

Fixed code:
{"major":2, "minor":3, "hotfix":92}
					if (isset($attribute['data']) && preg_match('/^[a-zA-Z0-9]{12}$/', $attribute['data'])) {
CVE-2015-5720 (Other, published 2016-09-03T20:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Templates/add.ctp
app/View/Templates/edit.ctp
app/webroot/js/ajaxification.js
Commit message: Fix to XSS in the template creation process


Vulnerable code:
			echo "{'id' : '" . $tag['Tags']['id'] . "', 'name' : '" . $tag['Tags']['name'] . "', 'colour' : '" . $tag['Tags']['colour'] . "'},";
			echo "{'id' : '" . $tag['Tags']['id'] . "', 'name' : '" . $tag['Tags']['name'] . "', 'colour' : '" . $tag['Tags']['colour'] . "'},";

Fixed code:
			echo "{'id' : '" . h($tag['Tags']['id']) . "', 'name' : '" . h($tag['Tags']['name']) . "', 'colour' : '" . h($tag['Tags']['colour']) . "'},";
			echo "{'id' : '" . h($tag['Tags']['id']) . "', 'name' : '" . h($tag['Tags']['name']) . "', 'colour' : '" . h($tag['Tags']['colour']) . "'},";
function htmlEncode(value){
	return $('<div/>').text(value).html();
}

	filename = htmlEncode(filename);
	tmp_name = htmlEncode(tmp_name);
CVE-2015-5721 (PHP, published 2016-09-03T20:59Z)
Description: value: Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/TemplatesController.php
app/View/Templates/populate_event_from_template_attributes.ctp
Commit message: Security fix: Fix to a possible PHP Object injection

- unserialized user input replaced with json_decode


Vulnerable code:
		$this->Security->unlockedActions = array('saveElementSorting', 'populateEventFromTemplate', 'uploadFile', 'deleteTemporaryFile');
	public function fetchFormFromTemplate($id) {
		
	}
				$attributes = unserialize($this->request->data['Template']['attributes']);
							'value' => serialize($attributes),

Fixed code:
		$this->Security->unlockedActions = array('uploadFile', 'deleteTemporaryFile');
		if (!$this->userRole['perm_template']) throw new MethodNotAllowedException('You are not authorised to do that.');
				$attributes = json_decode($this->request->data['Template']['attributes'], true);
							'value' => json_encode($attributes),
CVE-2017-14337 (PHP, published 2017-09-12T16:29Z)
Description: value: When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/MISP/MISP
Files changed:
app/Plugin/CertAuth/Controller/Component/Auth/CertificateAuthenticate.php
Commit message: fix: Fix to certauth pains


Vulnerable code:
					self::getRestUser();
				$existingUser = $this->User->find('first', array(
					'conditions' => array($userModelKey => self::$user[$userModelKey]),
					'recursive' => false
				));

Fixed code:
					if (!self::getRestUser()) return false;
				if (!empty(self::$user[$userModelKey])) {
					$existingUser = $this->User->find('first', array(
						'conditions' => array($userModelKey => self::$user[$userModelKey]),
						'recursive' => false
					));
				}