hitoshura25/cvefixes huggingface dataset:
CVE-2022-3525 (PHP, published 2022-11-20T05:15Z)
Description: value: Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/librenms/librenms
Files changed:
doc/Extensions/Applications.md
includes/polling/applications/memcached.inc.php
includes/polling/unix-agent.inc.php
misc/notifications.rss
Commit message: Fix memcached unserialize vulnerability (#14459)

Allows code injection, so remove it entirely.
This requires a memcached application script to restore functionality.

https://github.com/librenms/librenms-agent/pull/428

Vulnerable code:
   script](https://github.com/librenms/librenms-agent/blob/master/agent-local/memcached)
wget https://raw.githubusercontent.com/librenms/librenms-agent/master/agent-local/memcached -O /etc/snmp/memcached
    $data = $agent_data['app']['memcached'][$app['app_instance']];
    $oid = '.1.3.6.1.4.1.8072.1.3.2.3.1.2.9.109.101.109.99.97.99.104.101.100';
    $result = snmp_get($device, $oid, '-Oqv');
    $data = trim($result, '"');
    $data = unserialize(stripslashes(str_replace("<<<app-memcached>>>\n", '', $data)));
    $data = reset($data);
}
echo ' memcached(' . $app['app_instance'] . ')';
            $agent_data['app']['memcached'] = unserialize($agent_data['app']['memcached']);

Fixed code:
   script](https://github.com/librenms/librenms-agent/blob/master/snmp/memcached)
wget https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/memcached -O /etc/snmp/memcached
use LibreNMS\Exceptions\JsonAppException;
    $data = $agent_data['app']['memcached'];
    try {
        $data = json_app_get($device, $name, '1.1')['data'];
        $data = $data['data'][$app->app_instance] ?? reset($data['data']);
    } catch (JsonAppException $e) {
        echo PHP_EOL . $name . ':' . $e->getCode() . ':' . $e->getMessage() . PHP_EOL;
        update_application($app, $e->getCode() . ':' . $e->getMessage(), []); // Set empty metrics and error message
        return;
    }
}
echo ' memcached(' . $app->app_instance . ')';
$data = $data[$app->app_instance] ?? reset($data);  // specified instance or just the first one
            $agent_data['app']['memcached'] = json_decode($agent_data['app']['memcached'], true);
  <item>
    <title>Memcached application compatibility break</title>
    <description>Due to a security vulnerability, you must upgrade your memcached application scripts to the latest version. (1.1)</description>
    <pubDate>Fri, 10 Oct 2022 18:00:00 +0000</pubDate>
  </item>
CVE-2022-3561 (PHP, published 2022-11-20T05:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/print-alert-rules.php
Commit message: Fix alert rules XSS (#14471)

Fixes html injection for map items

Vulnerable code:
            $locations .= $except_device_or_group . '<a href="' . url('devices/location=' . $location_map['id']) . '" data-container="body" data-toggle="popover" data-placement="' . $popover_position . '" data-content="View Devices for Location" target="_blank">' . $location_map['location'] . '</a><br>';
            $groups .= $except_device_or_group . '<a href="' . url('device-groups/' . $group_map['id'] . '/edit') . '" data-container="body" data-toggle="popover" data-placement="' . $popover_position . ' data-content="' . $group_map['name'] . '" title="' . $groups_msg . '" target="_blank">' . $group_map['name'] . '</a><br>';
            $devices .= $except_device_or_group . '<a href="' . url('device/device=' . $device_map['device_id'] . '/tab=edit/') . '" data-container="body" data-toggle="popover" data-placement="' . $popover_position . '" data-content="' . $device_map['hostname'] . '" title="' . $devices_msg . '" target="_blank">' . $device_map['hostname'] . '</a><br>';

Fixed code:
            $locations .= $except_device_or_group . '<a href="' . url('devices/location=' . $location_map['id']) . '" data-container="body" data-toggle="popover" data-placement="' . $popover_position . '" data-content="View Devices for Location" target="_blank">' . htmlentities($location_map['location']) . '</a><br>';
            $groups .= $except_device_or_group . '<a href="' . url('device-groups/' . $group_map['id'] . '/edit') . '" data-container="body" data-toggle="popover" data-placement="' . $popover_position . ' data-content="' . htmlentities($group_map['name']) . '" title="' . $groups_msg . '" target="_blank">' . htmlentities($group_map['name']) . '</a><br>';
            $devices .= $except_device_or_group . '<a href="' . url('device/device=' . $device_map['device_id'] . '/tab=edit/') . '" data-container="body" data-toggle="popover" data-placement="' . $popover_position . '" data-content="' . htmlentities($device_map['hostname']) . '" title="' . $devices_msg . '" target="_blank">' . htmlentities($device_map['hostname']) . '</a><br>';
CVE-2022-3562 (PHP, published 2022-11-20T05:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/bill.inc.php
includes/html/pages/bill/addoreditbill.inc.php
includes/html/table/bills.inc.php
Commit message: Fix billing xss (#14465)

bill_name and bill_notes fields allow html injection

Vulnerable code:
    <h2><?php   echo "Bill: ${bill_data['bill_name']}"; ?></h2>
    <input class="form-control input-sm" type="text" id="bill_name" name="bill_name" value="<?php echo $bill_data['bill_name']; ?>">
        <input class="form-control input-sm" type="text" name="bill_custid" value="<?php echo $bill_data['bill_custid'] ?>">
        <input class="form-control input-sm" type="text" name="bill_ref" value="<?php echo $bill_data['bill_ref']; ?>">
        <input class="form-control input-sm" type="textarea" name="bill_notes" value="<?php echo $bill_data['bill_notes']; ?>">
    $notes = $bill['bill_notes'];
    $bill_name = "<a href='$url'><span style='font-weight: bold;' class='interface'>${bill['bill_name']}</span></a><br />" .

Fixed code:
    <h2>Bill: <?php echo htmlentities($bill_data['bill_name']); ?></h2>
    <input class="form-control input-sm" type="text" id="bill_name" name="bill_name" value="<?php echo htmlentities($bill_data['bill_name']); ?>">
        <input class="form-control input-sm" type="text" name="bill_custid" value="<?php echo htmlentities($bill_data['bill_custid']); ?>">
        <input class="form-control input-sm" type="text" name="bill_ref" value="<?php echo htmlentities($bill_data['bill_ref']); ?>">
        <input class="form-control input-sm" type="textarea" name="bill_notes" value="<?php echo htmlentities($bill_data['bill_notes']); ?>">
    $notes = htmlentities($bill['bill_notes']);
    $bill_name = "<a href='$url'><span style='font-weight: bold;' class='interface'>" . htmlentities($bill['bill_name']) . '</span></a><br />' .
CVE-2022-4067 (PHP, published 2022-11-20T05:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/notifications.inc.php
Commit message: Fix possible RSS XSS (#14457)

Escape titles when shown.  Body was already cleaned.

Vulnerable code:
        echo "<strong><i class='fa fa-bell-o'></i>&nbsp;${notif['title']}</strong>";
        echo "<h4 class='$class' id='${notif['notifications_id']}'>${notif['title']}<span class='pull-right'>";
        echo  " id='${notif['notifications_id']}'>${notif['title']}";

Fixed code:
        echo "<strong><i class='fa fa-bell-o'></i>&nbsp;" . htmlentities($notif['title']) . '</strong>';
        echo "<h4 class='$class' id='${notif['notifications_id']}'>" . htmlentities($notif['title']) . "<span class='pull-right'>";
        echo  " id='${notif['notifications_id']}'>" . htmlentities($notif['title']);
CVE-2022-4068 (PHP, published 2022-11-20T05:15Z)
Description: value: A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
app/Http/Controllers/UserController.php
app/Http/Requests/UpdateUserRequest.php
Commit message: Fix authentication mass assignment vulnerability (#14468)

Users were able to submit changes to fields they should not have access to change by bypassing the frontend validation.  Correct backend validation to prevent that.

Vulnerable code:
        $user->fill($request->all());
            'level' => 'int',

Fixed code:
        $user->fill($request->validated());
        if ($this->user()->isAdmin()) {
            return [
                'realname' => 'nullable|max:64|alpha_space',
                'email' => 'nullable|email|max:64',
                'descr' => 'nullable|max:30|alpha_space',
                'new_password' => 'nullable|confirmed|min:' . Config::get('password.min_length', 8),
                'new_password_confirmation' => 'nullable|same:new_password',
                'dashboard' => 'int',
                'level' => 'int',
                'enabled' => 'nullable',
                'can_modify_passwd' => 'nullable',
            ];
        }
CVE-2023-48294 (PHP, published 2023-11-17T22:15Z)
Description: value: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/graphs/graph.inc.php
Commit message: Fix graphs device check before auth (#15551)

It should be after the auth check.

Vulnerable code:
        if (empty($device['device_id'])) {
            throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
        DeviceCache::setPrimary($device['device_id']);

Fixed code:
        if (isset($device['device_id'])) {
            DeviceCache::setPrimary($device['device_id']);
    // check after auth
    if (isset($vars['device']) && empty($device['device_id'])) {
        throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
    }
CVE-2023-48295 (PHP, published 2023-11-17T21:15Z)
Description: value: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting (XSS) vulnerability in the device group popups. This issue has been addressed in commit `faf66035ea` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
app/Http/Controllers/DeviceGroupController.php
Commit message: Fix a few XSS vulnerabilities in device group popups (#15581)

I can't tell if the flasher ones are vulnerable, as flasher is still broken.

Vulnerable code:
        $flasher->addSuccess(__('Device Group :name created', ['name' => $deviceGroup->name]));
                    $flasher->addSuccess(__('Device Group :name updated', ['name' => $deviceGroup->name]));
            $msg = __('Device Group :name still has Service Templates associated with it. Please remove or update the Service Template accordingly', ['name' => $deviceGroup->name]);

Fixed code:
        $flasher->addSuccess(__('Device Group :name created', ['name' => htmlentities($deviceGroup->name)]));
                    $flasher->addSuccess(__('Device Group :name updated', ['name' => htmlentities($deviceGroup->name)]));
            $msg = __('Device Group :name still has Service Templates associated with it. Please remove or update the Service Template accordingly', ['name' => htmlentities($deviceGroup->name)]);
CVE-2023-4977 (PHP, published 2023-09-15T01:15Z)
Description: value:  Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/search.inc.php
includes/html/pages/search/ipv4.inc.php
Commit message: Fix injection in search pages ipv4, etc (#15311)

Reported by: https://huntr.dev/users/hainguyen0207

Vulnerable code:
    echo report_this("Unknown search type $search_type");
            interface: '<?php echo $_POST['interface']; ?>',
            address: '<?php echo $_POST['address']; ?>'

Fixed code:
    echo report_this('Unknown search type ' . htmlspecialchars($search_type));
            interface: '<?php echo htmlspecialchars($_POST['interface']); ?>',
            address: '<?php echo htmlspecialchars($_POST['address']); ?>'
CVE-2023-4978 (PHP, published 2023-09-15T01:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/search/ipv4.inc.php
Commit message: Fix another injection in ipv4 search page (#15312)

Reported by: https://huntr.dev/users/trunggg02

Vulnerable code:
                  "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo $_POST['address']; ?>\" class=\"form-control input-sm\" placeholder=\"IPv4 Address\"/>"+

Fixed code:
                  "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo htmlspecialchars($_POST['address']); ?>\" class=\"form-control input-sm\" placeholder=\"IPv4 Address\"/>"+
CVE-2023-4979 (PHP, published 2023-09-15T01:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/common/outages.inc.php
Commit message: Fix improperly escaped output in outages page (#15310)

Fixes XSS reported by https://huntr.dev/users/hainguyen0207

Vulnerable code:
            to: "' . addcslashes($vars['to'], '"') . '",
            from: "' . addcslashes($vars['from'], '"') . '",

Fixed code:
            to: "' . htmlspecialchars($vars['to']) . '",
            from: "' . htmlspecialchars($vars['from']) . '",
CVE-2023-4980 (PHP, published 2023-09-15T01:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/ports.inc.php
Commit message: Fix injection vulnerability in ports pages (#15314)

* Fix injection vulnerability in ports pages
Unescaped output
reported by: https://huntr.dev/users/hainguyen0207

* fix style

Vulnerable code:
    $hasvalue = ! empty($vars['hostname']) ? "value='" . $vars['hostname'] . "'" : '';
    $ifaliasvalue = isset($vars['ifAlias']) ? "value='" . $vars['ifAlias'] . "'" : '';
            echo "<div class='alert alert-danger'>Port ID {$vars['purge']} not found! Could not purge port.</div>";

Fixed code:
    $hasvalue = ! empty($vars['hostname']) ? "value='" . htmlspecialchars($vars['hostname']) . "'" : '';
    $ifaliasvalue = isset($vars['ifAlias']) ? "value='" . htmlspecialchars($vars['ifAlias']) . "'" : '';
            echo "<div class='alert alert-danger'>Port ID " . htmlspecialchars($vars['purge']) . ' not found! Could not purge port.</div>';
CVE-2023-4981 (PHP, published 2023-09-15T01:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/common/eventlog.inc.php
includes/html/common/syslog.inc.php
includes/html/pages/eventlog.inc.php
includes/html/pages/syslog.inc.php
Commit message: Fix another addcslashes incorrect escape in eventlog (#15313)

and many more
reported by: https://huntr.dev/users/hainguyen0207

Vulnerable code:
            eventtype: "' . addcslashes($vars['eventtype'] ?? '', '"') . '",
            device: "' . addcslashes($vars['device'] ?? '', '"') . '",
            program: "' . addcslashes($vars['program'] ?? '', '"') . '",
            priority: "' . addcslashes($vars['priority'] ?? '', '"') . '",
            to: "' . addcslashes($vars['to'] ?? '', '"') . '",
            from: "' . addcslashes($vars['from'] ?? '', '"') . '",
    })<?php echo Request::get('eventtype') ? ".val('" . addcslashes(Request::get('eventtype'), "'") . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['program']) ? ".val('" . addcslashes($vars['program'], "'") . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['priority']) ? ".val('" . addcslashes($vars['priority'], "'") . "').trigger('change');" : ''; ?>;

Fixed code:
$vars['eventtype'] = 'test\"-alert(document.cookie)//';

            eventtype: "' . htmlspecialchars($vars['eventtype'] ?? '') . '",
            device: "' . htmlspecialchars($vars['device'] ?? '') . '",
            program: "' . htmlspecialchars($vars['program'] ?? '') . '",
            priority: "' . htmlspecialchars($vars['priority'] ?? '') . '",
            to: "' . htmlspecialchars($vars['to'] ?? '') . '",
            from: "' . htmlspecialchars($vars['from'] ?? '') . '",
    })<?php echo Request::get('eventtype') ? ".val('" . htmlspecialchars(Request::get('eventtype')) . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['program']) ? ".val('" . htmlspecialchars($vars['program']) . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['priority']) ? ".val('" . htmlspecialchars($vars['priority']) . "').trigger('change');" : ''; ?>;
CVE-2023-4982 (PHP, published 2023-09-15T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/search/fdb.inc.php
Commit message: Fix injection vulnerability in fdb search page (#15315)

unescaped search output
reported by: https://huntr.dev/users/hainguyen0207

Vulnerable code:
echo '"' . $vars['searchPhrase'] . '"+';

Fixed code:
echo '"' . htmlspecialchars($vars['searchPhrase']) . '"+';
CVE-2023-5060 (PHP, published 2023-09-19T03:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/search/ipv6.inc.php
Commit message: Fix unescaped output in ipv6 search page (#15327)



Vulnerable code:
                "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo $_POST['address']; ?>\" class=\"form-control input-sm\" placeholder=\"IPv6 Address\"/>"+
            interface: '<?php echo $_POST['interface']; ?>',
            address: '<?php echo $_POST['address']; ?>'

Fixed code:
                "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo htmlspecialchars($_POST['address']); ?>\" class=\"form-control input-sm\" placeholder=\"IPv6 Address\"/>"+
            interface: '<?php echo htmlspecialchars($_POST['interface']); ?>',
            address: '<?php echo htmlspecialchars($_POST['address']); ?>'