hitoshura25/cvefixes huggingface dataset:
CVE-2017-15216 (Other, published 2017-10-10T18:29Z)
Description: value: MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp
app/webroot/js/misp.js
Commit message: fix: Fix to a potential reflected XSS on the quickDelete

- low impact, XSS required user confirmation of malicious payload

- as reported by Or Hanuka (PALANTIR)


Vulnerable code:
					<span id="PromptYesButton" role="button" tabindex="0" aria-label="Remove sighting" title="Remove sighting" class="btn btn-primary" onClick="removeSighting('<?php echo h($id); ?>', '<?php echo h($rawId); ?>', '<?php echo h($context); ?>');">Yes</span>
function submitEventDeletion() {
	var formData = $('#PromptForm').serialize();
	$.ajax({
		beforeSend: function (XMLHttpRequest) {
			$(".loading").show();
		},
		data: formData,
		success:function (data, textStatus) {
			updateIndex(context_id, context);
			handleGenericAjaxResponse(data);
		},
		complete:function() {
			$(".loading").hide();
			$("#confirmation_box").fadeOut();
			$("#gray_out").fadeOut();
		},
		type:"post",
		cache: false,
		url:"/" + type + "/" + action + "/" + id,
	});
}

function removeSighting(id, rawid, context) {
		},
		complete:function() {
			$(".loading").hide();
			$("#confirmation_box").fadeOut();

Fixed code:
					<span id="PromptYesButton" role="button" tabindex="0" aria-label="Remove sighting" title="Remove sighting" class="btn btn-primary" data-id="<?php echo h($id); ?>" data-rawid="<?php echo h($rawId); ?>" data-context="<?php echo h($context); ?>" onClick="removeSighting(this);">Yes</span>
function removeSighting(caller) {
	var id = $(caller).data('id');
	var rawid = $(caller).data('rawid');
	var context = $(caller).data('context');
		complete:function() {
			$(".loading").hide();
			$("#confirmation_box").fadeOut();
		},
CVE-2017-16802 (PHP, published 2017-11-13T16:29Z)
Description: value: In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/AppController.php
app/webroot/js/misp.js
Commit message: fix: Fixed a reflected XSS in the sharing group creator tool

- Fixed a reflected XSS in the sharing group editor that requires malicious organisation names

- Low impact due to the following requirements:
  - organisation names with malicious org names (JS in the orgname)
  - sharing group editor user has to manually add an organisation to the list that has javascript in the org name
  - only vulnerable view is the editor itself, so the impact is limited to
    users that manually add organisations with malicious names to the list themselves / edit such sharing groups

- As reported by Dawid Czarnecki


Vulnerable code:
	private $__queryVersion = '23';
		html += '<td>' + org.name + '&nbsp;</td>';

Fixed code:
	private $__queryVersion = '24';
		html += '<td>' + $('<div>').text(org.name).html() + '&nbsp;</td>';
CVE-2017-16946 (PHP, published 2017-11-25T18:29Z)
Description: value: The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
Commit message: fix: Leaking of hashed passwords in the audit logs fixed

- Scope was limited due to the audit log access restrictions to site/org admins


Vulnerable code:
							if ($field != 'confirm_password') {

Fixed code:
							if ($field != 'confirm_password' && $field != 'enable_password') {
CVE-2017-7215 (JavaScript, published 2017-03-21T19:59Z)
Description: value: Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in app/View/Organisations/ajax/landingpage.ctp of MISP before 2.4.69 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/misp2.4.68.js
Commit message: fix: Tightened sanitisation in some view elements
- on the index filter tool
- organisation landing page

as reported by Tien Phan and David Maciejak of Fortinet's FortiGuard Labs


Vulnerable code:
			if (filtering.date.from != "") text = "From: " + filtering.date.from;
				text += "Until: " + filtering.date.until;
				$('#value_' + differentFilters[i]).html(text);
				$('#value_' + differentFilters[i]).html("");
	$('#generatedURLContent').html(indexCreateFilters());
				text += filtering[field].OR[i];
						text += typeArray[field][j].value;
				text += filtering[field].NOT[i];
						text += typeArray[field][j].value;

Fixed code:
			if (filtering.date.from != "") text = "From: " + $('<span>').text(filtering.date.from).html();
				text += "Until: " + $('<span>').text(filtering.date.until).html();
				$('#value_' + differentFilters[i]).text(text);
				$('#value_' + differentFilters[i]).text("");
	$('#generatedURLContent').text(indexCreateFilters());
				text += $('<span>').text(filtering[field].OR[i]).html();
						text += $('<span>').text(typeArray[field][j].value).html();
				text += $('<span>').text(filtering[field].NOT[i]).html();
						text += $('<span>').text(typeArray[field][j].value).html();
CVE-2017-7215 (Other, published 2017-03-21T19:59Z)
Description: value: Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in app/View/Organisations/ajax/landingpage.ctp of MISP before 2.4.69 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Organisations/ajax/landingpage.ctp
Commit message: fix: Tightened sanitisation in some view elements
- on the index filter tool
- organisation landing page

as reported by Tien Phan and David Maciejak of Fortinet's FortiGuard Labs.


Vulnerable code:
<h3>Landing page for <?php echo $org;?></h3>

Fixed code:
<h3>Landing page for <?php echo h($org);?></h3>
CVE-2018-11245 (JavaScript, published 2018-05-18T18:29Z)
Description: value: app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/misp.js
Commit message: fix: Fixed a DOM based XSS with cortex type attributes

- as reported by Dawid Czarnecki (dawid@pz.pl)


Vulnerable code:
	cortex_data = JSON.stringify(cortex_data, null, 2);

Fixed code:
	cortex_data = htmlEncode(JSON.stringify(cortex_data, null, 2));
CVE-2018-11562 (Other, published 2018-05-30T20:29Z)
Description: value: An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Elements/eventattribute.ctp
Commit message: fix: Reflected XSS via the event view

- users arriving on an event view via a malicious URL with a javascript payload and then clicking on the show deleted attributes tab would trigger the payload

- as reported by Jarek Kozluk from zbp.pl


Vulnerable code:
			<div id="filter_deleted" title="Include deleted attributes" role="button" tabindex="0" aria-label="Include deleted attributes" class="attribute_filter_text<?php if ($deleted) echo '_active'; ?>" onClick="toggleDeletedAttributes('<?php echo Router::url( $this->here, true );?>');">Include deleted attributes</div>
		endif;

Fixed code:
	$urlHere = $this->here;
	$urlHere = explode('/', $urlHere);
	foreach ($urlHere as $k => $v) {
		$urlHere[$k] = urlencode($v);
	}
	$urlHere = implode('/', $urlHere);
	$urlHere = $baseurl . $urlHere;
			<div id="filter_deleted" title="Include deleted attributes" role="button" tabindex="0" aria-label="Include deleted attributes" class="attribute_filter_text<?php if ($deleted) echo '_active'; ?>" onClick="toggleDeletedAttributes('<?php echo $urlHere;?>');">Include deleted attributes</div>
				endif;
CVE-2018-12649 (PHP, published 2018-06-22T14:29Z)
Description: value: An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-307 \u2014 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
Repository: https://github.com/MISP/MISP
Files changed:
app/Controller/UsersController.php
Commit message: fix: [security] Brute force protection can be bypased with a PUT request

- fixes an issue where brute forcing the login would work by using PUT requests
- as reported by Silver Saks from CCDCOE


Vulnerable code:
		$this->Bruteforce = ClassRegistry::init('Bruteforce');
		if ($this->request->is('post') && isset($this->request->data['User']['email'])) {
			if ($this->Bruteforce->isBlacklisted($_SERVER['REMOTE_ADDR'], $this->request->data['User']['email'])) {
				throw new ForbiddenException('You have reached the maximum number of login attempts. Please wait ' . Configure::read('SecureAuth.expire') . ' seconds and try again.');
			}
		}

Fixed code:
			$this->Bruteforce = ClassRegistry::init('Bruteforce');
			if (!empty($this->request->data['User']['email'])) {
				if ($this->Bruteforce->isBlacklisted($_SERVER['REMOTE_ADDR'], $this->request->data['User']['email'])) {
					throw new ForbiddenException('You have reached the maximum number of login attempts. Please wait ' . Configure::read('SecureAuth.expire') . ' seconds and try again.');
				}
			}
CVE-2018-8948 (Other, published 2018-03-23T17:29Z)
Description: value: In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Events/resolved_attributes.ctp
Commit message: fix: Fixed various potential XSS issues in the resolved attributes view

- potentially exposed XSS if a malicious MISP module was loaded on the instance

- as reported by Christophe Vandeplas (@cvandeplas)


Vulnerable code:
								echo '<option value="' . $type . '" ';
								echo ($type == $item['default_type'] ? 'selected="selected"' : '') . '>' . $type . '</option>';
								echo '<option value="' . $sgKey . '">' . $sgValue . '</option>';
				<input type="text" class="freetextCommentField" id="<?php echo 'Attribute' . $k . 'Comment'; ?>" style="padding:0px;height:20px;margin-bottom:0px;" placeholder="<?php echo h($importComment); ?>" <?php if (isset($item['comment']) && $item['comment'] !== false) echo 'value="' . $item['comment'] . '"'?>/>
				<input type="text" class="freetextTagField" id="<?php echo 'Attribute' . $k . 'Tags'; ?>" style="padding:0px;height:20px;margin-bottom:0px;"<?php if (isset($item['tags']) && $item['tags'] !== false) echo 'value="' . htmlspecialchars(implode(",",$item['tags'])) . '"'?>/>
							<option><?php echo $fromElement; ?></option>

Fixed code:
								echo '<option value="' . h($type) . '" ';
								echo ($type == $item['default_type'] ? 'selected="selected"' : '') . '>' . h($type) . '</option>';
								echo '<option value="' . h($sgKey) . '">' . h($sgValue) . '</option>';
				<input type="text" class="freetextCommentField" id="<?php echo 'Attribute' . $k . 'Comment'; ?>" style="padding:0px;height:20px;margin-bottom:0px;" placeholder="<?php echo h($importComment); ?>" <?php if (isset($item['comment']) && $item['comment'] !== false) echo 'value="' . h($item['comment']) . '"'?>/>
				<input type="text" class="freetextTagField" id="<?php echo 'Attribute' . $k . 'Tags'; ?>" style="padding:0px;height:20px;margin-bottom:0px;"<?php if (isset($item['tags']) && $item['tags'] !== false) echo 'value="' . h(implode(",",$item['tags'])) . '"'?>/>
							<option><?php echo h($fromElement); ?></option>
CVE-2018-8949 (PHP, published 2018-03-23T17:29Z)
Description: value: An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-749 \u2014 Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Attribute.php
Commit message: fix: critical API integrity bug, potentially allowing users to delete attributes of other events

- a crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute


Vulnerable code:

Fixed code:
		unset($attribute['id']);
CVE-2019-10254 (Other, published 2019-03-28T15:29Z)
Description: value: In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Layouts/default.ctp
Commit message: fix: [security] Fix to a reflected XSS in the default layout template

- as reported by Tuscany Internet eXchange | Misp Team | TIX CyberSecurity


Vulnerable code:
                    echo $baseurl . '/admin/' . $this->params['controller'] . '/' . substr($this->params['action'], 6);
                    echo $baseurl . '/' . $this->params['controller'] . '/' . $this->params['action'];

Fixed code:
                    echo $baseurl . '/admin/' . h($this->params['controller']) . '/' . h(substr($this->params['action'], 6));
                    echo $baseurl . '/' . h($this->params['controller']) . '/' . h($this->params['action']);
CVE-2019-11812 (PHP, published 2019-05-08T13:29Z)
Description: value: A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Helper/CommandHelper.php
Commit message: fix: [security] Fix persistent xss via discussion links via javascript:// links

- low impact as it requires user interaction to trigger

- as reported by João Lucas Melo Brasio from Elytron Security S.A. (https://elytronsecurity.com)


Vulnerable code:
                                $replacement = $this->Html->link(
                                    str_replace('$1', $data, $this->__replacement[$trigger]['text']),
                                    str_replace('$1', $data, $this->__replacement[$trigger]['url'])
                                );

Fixed code:
                                if (substr($data, 0, 7) === 'http://' || substr($data, 0, 8) === 'https://') {
                                    $replacement = $this->Html->link(
                                        str_replace('$1', $data, $this->__replacement[$trigger]['text']),
                                        str_replace('$1', $data, $this->__replacement[$trigger]['url'])
                                    );
                                } else {
                                    $replacement = '%MALFORMED URL%';
                                }
CVE-2019-11814 (JavaScript, published 2019-05-08T13:29Z)
Description: value: An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/misp.js
Commit message: fix: [security] Fix persistent xss due to invalid sanitisation of image names in titles

- triggered by expanding a screenshot

- as reported by João Lucas Melo Brasio from Elytron Security S.A. (https://elytronsecurity.com)


Vulnerable code:
    popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>'

Fixed code:
    popupHtml = '<it class="fa fa-spin fa-spinner" style="font-size: xx-large; color: white; position: fixed; left: 50%; top: 50%;"></it>';
    url = $('<div>').text(url).html();
    title = $('<div>').text(title).html();
CVE-2019-12868 (PHP, published 2019-06-18T00:15Z)
Description: value: app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/MISP/MISP
Files changed:
app/Model/Server.php
Commit message: fix: [security] Fixed an RCE vulnerability with user controled entries being fed to file_exists

- phar protocol paths for php file instructions can lead to RCE via meta-data deserialization
- mitigated by the functionalities enabling this being only accessible to site admins

- Reported by Dawid Czarnecki


Vulnerable code:

Fixed code:
        if (substr($value, 0, 7) === "phar://") {
            return 'Phar protocol not allowed.';
        }
        if (substr($value, 0, 7) === "phar://") {
            return 'Phar protocol not allowed.';
        }
CVE-2019-14286 (JavaScript, published 2019-07-27T18:15Z)
Description: value: In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/webroot/js/event-graph.js
Commit message: fix: [security] Fix to stored XSS

- as reported by David Heise


Vulnerable code:
        $select.append('<option value="' + element + '">' + element + '</option>');

Fixed code:
        var $option = $('<option></option>');
        $option.text(element);
        $option.attr('value', $option.text());
        $select.append($option);
CVE-2020-10246 (Other, published 2020-03-09T19:15Z)
Description: value: MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/MISP/MISP
Files changed:
app/View/Users/statistics_orgs.ctp
Commit message: fix: [security] Fix reflected xss via unsanitized URL parameters

- As reported by an external pentest company on behalf of the Centre for Cyber security Belgium (CCB)


Vulnerable code:
        $types[$scope]['selected'] = true;

Fixed code:
        if (isset($types[$scope])) {
            $types[$scope]['selected'] = true;
        }