hitoshura25/cvefixes huggingface dataset:
CVE-2018-14056 (C++, published 2018-07-15T01:29Z)
Description: value: ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/znc/znc
Files changed:
src/WebModules.cpp
Commit message: Don't let web skin name ../../../../ access files outside of usual skins directories.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.


Vulnerable code:
    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkinName;
        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkinName;
            sRet = CString(_SKINDIR_) + "/" + sSkinName;

Fixed code:
    const CString sSkin = sSkinName.Replace_n("/", "_").Replace_n(".", "_");

    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkin;
        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkin;
            sRet = CString(_SKINDIR_) + "/" + sSkin;
CVE-2019-12816 (C++, published 2019-06-15T16:29Z)
Description: value: Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/znc/znc
Files changed:
include/znc/Modules.h
src/Modules.cpp
Commit message: Fix remote code execution and privilege escalation vulnerability.

To trigger this, need to have a user already.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.

CVE-2019-12816


Vulnerable code:
    for (unsigned int a = 0; a < sModule.length(); a++) {
        if (((sModule[a] < '0') || (sModule[a] > '9')) &&
            ((sModule[a] < 'a') || (sModule[a] > 'z')) &&
            ((sModule[a] < 'A') || (sModule[a] > 'Z')) && (sModule[a] != '_')) {
            sRetMsg =
                t_f("Module names can only contain letters, numbers and "
                    "underscores, [{1}] is invalid")(sModule);
            return nullptr;
        }

Fixed code:
    static bool ValidateModuleName(const CString& sModule, CString& sRetMsg);
bool CModules::ValidateModuleName(const CString& sModule, CString& sRetMsg) {
    for (unsigned int a = 0; a < sModule.length(); a++) {
        if (((sModule[a] < '0') || (sModule[a] > '9')) &&
            ((sModule[a] < 'a') || (sModule[a] > 'z')) &&
            ((sModule[a] < 'A') || (sModule[a] > 'Z')) && (sModule[a] != '_')) {
            sRetMsg =
                t_f("Module names can only contain letters, numbers and "
                    "underscores, [{1}] is invalid")(sModule);
            return false;
        }
    }

    return true;
}

    if (!ValidateModuleName(sModule, sRetMsg)) {
        return false;
    }

    if (!ValidateModuleName(sModule, sRetMsg)) {
        return false;
    }

    if (!ValidateModuleName(sModule, sRetMsg)) {
        return false;
    }

    if (!ValidateModuleName(sModule, sRetMsg)) {
        return nullptr;
CVE-2019-9917 (C++, published 2019-03-27T06:29Z)
Description: value: ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/znc/znc
Files changed:
modules/controlpanel.cpp
src/IRCNetwork.cpp
src/User.cpp
src/znc.cpp
test/integration/tests/scripting.cpp
Commit message: Don't crash if user specified invalid encoding.

This is CVE-2019-9917


Vulnerable code:
            PutModule("ClientEncoding = " + sValue);
    m_sEncoding = s;
        GetIRCSock()->SetEncoding(s);
    m_sClientEncoding = s;
        pClient->SetEncoding(s);
        if (pSock->GetEncoding().empty()) {
            pSock->SetEncoding("UTF-8");
        }
    if (sEncoding.empty() && m_uiForceEncoding) {

Fixed code:
            PutModule("ClientEncoding = " + pUser->GetClientEncoding());
    m_sEncoding = CZNC::Get().FixupEncoding(s);
        GetIRCSock()->SetEncoding(m_sEncoding);
    m_sClientEncoding = CZNC::Get().FixupEncoding(s);
        pClient->SetEncoding(m_sClientEncoding);
        pSock->SetEncoding(FixupEncoding(pSock->GetEncoding()));
    if (!m_uiForceEncoding) {
        return sEncoding;
    }
    if (sEncoding.empty()) {
        return "UTF-8";
    }
    const char* sRealEncoding = sEncoding.c_str();
    if (sEncoding[0] == '*' || sEncoding[0] == '^') {
        sRealEncoding++;
    }
    if (!*sRealEncoding) {
#ifdef HAVE_ICU
    UErrorCode e = U_ZERO_ERROR;
    UConverter* cnv = ucnv_open(sRealEncoding, &e);
    if (cnv) {
        ucnv_close(cnv);
    }
    if (U_FAILURE(e)) {
        return "UTF-8";
    }
#endif

    // Non-existing encoding
    client.Write("PRIVMSG *controlpanel :Set ClientEncoding $me Western");
    client.Write("JOIN #a\342");
    client.ReadUntil(
        ":*controlpanel!znc@znc.in PRIVMSG nick :ClientEncoding = UTF-8");
    ircd.ReadUntil("JOIN #a\xEF\xBF\xBD");
CVE-2020-13775 (C++, published 2020-06-02T23:15Z)
Description: value: ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/znc/znc
Files changed:
src/Client.cpp
test/integration/tests/core.cpp
Commit message: Fix null pointer dereference in echo-message

The bug was introduced while fixing #1705. If a client did not enable
echo-message, and doesn't have a network, it crashes.

Thanks to LunarBNC for reporting this


Vulnerable code:
            (pClient != this && (m_pNetwork->IsChan(Message.GetParam(0)) ||

Fixed code:
            (pClient != this && ((m_pNetwork && m_pNetwork->IsChan(Message.GetParam(0))) ||
    client.Write("znc delnetwork test");
    client.ReadUntil("Network deleted");
    auto client2 = LoginClient();
    client2.Write("PRIVMSG *status :blah2");
    client2.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
    auto client3 = LoginClient();
    client3.Write("PRIVMSG *status :blah3");
    client3.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
CVE-2020-13775 (C++, published 2020-06-02T23:15Z)
Description: value: ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.
Severity: LOW (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/znc/znc
Files changed:
src/Client.cpp
test/integration/tests/core.cpp
Commit message: Fix echo-message for *status

Close #1705


Vulnerable code:
#include "znctest.h"
    ASSERT_THAT(cap_ls.toStdString(), AllOf(HasSubstr("cap-notify"), Not(HasSubstr("away-notify"))));

Fixed code:
            EchoMessage(Message);

#include "znctest.h"

    ASSERT_THAT(cap_ls.toStdString(),
                AllOf(HasSubstr("cap-notify"), Not(HasSubstr("away-notify"))));
TEST_F(ZNCTest, StatusEchoMessage) {
    auto znc = Run();
    auto ircd = ConnectIRCd();
    auto client = LoginClient();
    client.Write("CAP REQ :echo-message");
    client.Write("PRIVMSG *status :blah");
    client.ReadUntil(":nick!user@irc.znc.in PRIVMSG *status :blah");
    client.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
}
CVE-2018-25072 (HTML, published 2023-01-08T13:15Z)
Description: value: A vulnerability classified as critical has been found in lojban jbovlaste. This affects an unknown part of the file dict/listing.html. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The patch is named 6ff44c2e87b1113eb07d76ea62e1f64193b04d15. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217647.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/lojban/jbovlaste
Files changed:
dict/listing.html
Commit message: ... Seriously we still had an SQL injection?  ;_;

( http://jbovlaste.lojban.org/dict/listing.html?initial=u%27i failed with
an obvious injection error. )


Vulnerable code:
   push @conditions, "word LIKE '$initial%'";

Fixed code:
   push @conditions, "word LIKE ?";
   push @args, ($initial . "%");
CVE-2023-5375 (PHP, published 2023-10-04T09:15Z)
Description: value: Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/mosparo/mosparo
Files changed:
src/Controller/ProjectController.php
Commit message: Fixed an open redirect in the project switch functionality.
Reported by @tomorroisnew on huntr.dev


Vulnerable code:
        if ($targetPath) {

Fixed code:
        if ($targetPath && $this->isLocalUrl($request, $targetPath)) {

    protected function isLocalUrl(Request $request, $url): bool
    {
        // If the first character is a slash, the URL is relative (only the path) and is local
        if (str_starts_with($url, '/')) {
            return true;
        }

        // If the URL is absolute but starts with the host of mosparo, we can redirect it.
        // Add the slash to prevent a redirect when a similar top-level domain is used.
        // For example, mosparo.com should not allow a redirect to mosparo.com.au
        if (str_starts_with($url, $request->getSchemeAndHttpHost() . '/')) {
            return true;
        }

        // The URL does not match the two checks because it's an external URL; no redirect in that case.
        return false;
    }
CVE-2023-5687 (Other, published 2023-10-20T17:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository mosparo/mosparo prior to 1.0.3.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/mosparo/mosparo
Files changed:
config/packages/security.yaml
templates/base.html.twig
templates/security/login.html.twig
Commit message: Security: Added the CSRF token to the logout URL
As reported by @qqliunian2001 on huntr.dev, it is possible to force the logout of a user. This is because we did not set up any protection against direct access to the logout route.

With this fix, we use the CSRF option from Symfony to protect the logout functionality. If no CSRF token is provided, the logout will not work.


Vulnerable code:
                                    <a href="{{ path('security_logout') }}" class="dropdown-item">
                {{ 'security.login.youAreLoggedIn'|trans({'%username%': app.user.username}, 'mosparo') }}. <a href="{{ path('security_logout') }}">{{ 'security.logout.title'|trans }}</a>

Fixed code:
                csrf_parameter: token
                csrf_token_generator: security.csrf.token_manager
                                    <a href="{{ path('security_logout', {'token' : csrf_token('logout')}) }}" class="dropdown-item">
                {{ 'security.login.youAreLoggedIn'|trans({'%username%': app.user.username}, 'mosparo') }} <a href="{{ path('security_logout', {'token' : csrf_token('logout')}) }}">{{ 'security.logout.title'|trans }}</a>
CVE-2023-26150 (Python, published 2023-10-03T05:15Z)
Description: value: Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.**Note:**This issue is a result of missing checks for services that require an active session.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/FreeOpcUa/opcua-asyncio
Files changed:
tests/test_crypto_connect.py
Commit message: Revert "releax test_secure_channel_key_expiration test"

This reverts commit e02aed2909fbfd142059d30db0abb63947ab33f6.


Vulnerable code:
        await asyncio.sleep(timeout * 1.2)

Fixed code:
        await asyncio.sleep(timeout)
CVE-2022-2553 (C, published 2022-07-28T15:15Z)
Description: value: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ClusterLabs/booth
Files changed:
src/main.c
Commit message: Revert "Refactor: main: substitute is_auth_req macro"

This reverts commit da79b8ba28ad4837a0fee13e5f8fb6f89fe0e24c.

authfile != authkey

Signed-off-by: Jan Friesse <jfriesse@redhat.com>


Vulnerable code:
	if (is_auth_req()) {

Fixed code:
	if (booth_conf->authfile[0] != '\0') {
CVE-2015-2972 (Ruby, published 2015-07-19T15:59Z)
Description: value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/sysphonic/thetis
Files changed:
app/controllers/application_controller.rb
Commit message: Some trivial bug-fixes.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>


Vulnerable code:
    @login_user = User.find(session[:login_user_id])

Fixed code:
    SqlHelper.validate_token([session[:login_user_id]])
    begin
      @login_user = User.find(session[:login_user_id])
    rescue => evar
      @login_user = nil
    end
CVE-2015-2972 (Ruby, published 2015-07-19T15:59Z)
Description: value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/sysphonic/thetis
Files changed:
app/controllers/equipment_controller.rb
app/controllers/groups_controller.rb
Commit message: x ApplicationHelper.get_sql_like() -> o SqlHelper.get_sql_like()
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>


Vulnerable code:
        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
          con = ApplicationHelper.get_sql_like([:groups], "|#{display_id}|")
          con = ApplicationHelper.get_sql_like([:teams], "|#{display_id}|")
        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")

Fixed code:
        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
          con = SqlHelper.get_sql_like([:groups], "|#{display_id}|")
          con = SqlHelper.get_sql_like([:teams], "|#{display_id}|")
        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
CVE-2020-13249 (C, published 2020-05-20T19:15Z)
Description: value: libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Oracle.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mariadb-corporation/mariadb-connector-c
Files changed:
libmariadb/mariadb_lib.c
Commit message: sanity checks for client-supplied OK packet content

reported by Matthias Kaiser, Apple Information Security


Vulnerable code:
  if (pos < mysql->net.read_pos+length)
        if (pos < mysql->net.read_pos + length)
          size_t item_len= net_field_length(&pos);  /* length for all items */
          while (item_len > 0)
            old_pos= pos;
              {
                ma_clear_session_state(mysql);
                SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, SQLSTATE_UNKNOWN, 0);
                return -1;
              }
                {
                  ma_clear_session_state(mysql);
                  SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, SQLSTATE_UNKNOWN, 0);
                  return -1;
                }
                if (set_charset &&
                  char cs_name[64];
                  MARIADB_CHARSET_INFO *cs_info;
                  if ((cs_info = (MARIADB_CHARSET_INFO *)mysql_find_charset_name(cs_name)))
            item_len-= (pos - old_pos);

Fixed code:
#define CHARSET_NAME_LEN 64

  uchar *end= mysql->net.read_pos+length;
  if (pos > end)
    goto corrupted;
  if (pos < end)
    if (pos + item_len > end)
      goto corrupted;
        if (pos < end)

          item_len= net_field_length(&pos);  /* length for all items */
          if (pos + item_len > end)
            goto corrupted;
          end= pos + item_len;
          while (pos < end)
              if (pos + plen > end)
                goto corrupted;
                  goto oom;
                if (pos + plen > end)
                  goto corrupted;
                  goto oom;
                if (set_charset && str->length < CHARSET_NAME_LEN &&
                  char cs_name[CHARSET_NAME_LEN];
                  const MARIADB_CHARSET_INFO *cs_info;
                  if ((cs_info = mysql_find_charset_name(cs_name)))
              if (pos + plen > end)
                goto corrupted;

oom:
  ma_clear_session_state(mysql);
  SET_CLIENT_ERROR(mysql, CR_OUT_OF_MEMORY, SQLSTATE_UNKNOWN, 0);
  return -1;

corrupted:
  ma_clear_session_state(mysql);
  SET_CLIENT_ERROR(mysql, CR_MALFORMED_PACKET, SQLSTATE_UNKNOWN, 0);
  return -1;
CVE-2021-23353 (JavaScript, published 2021-03-09T19:15Z)
Description: value: This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MrRio/jsPDF
Files changed:
src/modules/addimage.js
Commit message: fix ReDoS-vulnerable regexp in addImage (#3091)



Vulnerable code:
      var extractedInfo = /^data:(\w*\/\w*);*(charset=[\w=-]*)*;*$/.exec(

Fixed code:
      var extractedInfo = /^data:(\w*\/\w*);*(charset=(?!charset=)[\w=-]*)*;*$/.exec(
CVE-2022-4928 (JavaScript, published 2023-03-06T01:15Z)
Description: value: A vulnerability was found in icplayer up to 0.819. It has been declared as problematic. Affected by this vulnerability is the function AddonText_Selection_create of the file addons/Text_Selection/src/presenter.js. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.820 is able to address this issue. The identifier of the patch is 2223628e6db1df73f6d633d2c0422d995990f0a3. It is recommended to upgrade the affected component. The identifier VDB-222289 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/icplayer/icplayer
Files changed:
addons/Text_Selection/src/presenter.js
changelog.txt
Commit message: Secure Text Selection addon against xss attacks, re #8593 (#881)

* sanitize Wiris response against XSS in the Wiris addon

* added tests

* Secure Text Selection addon against xss attacks

Co-authored-by: Maciej Zawłocki <mzawlocki@solwit.com>
Co-authored-by: maciej-zawlocki-solwit <34648176+maciej-zawlocki-solwit@users.noreply.github.com>
Co-authored-by: Michal-sw-solwit <100777673+Michal-sw-solwit@users.noreply.github.com>

Vulnerable code:
        var $clone = $element.clone();
        $clone.find('.selectable').each(function(){
        var textArray = presenter.getTextFromElementWithAltTexts($clone).split(SPLIT);
        var $clone = $element.clone();
        $clone.find('.selectable').each(function(index){
        var textArray = presenter.getTextFromElementWithAltTexts($clone).split(SPLIT);


Fixed code:
        var sanitizedHTML = window.xssUtils.sanitize($element[0].outerHTML);
        var $sanitizedElement = $(sanitizedHTML);

        $($sanitizedElement).find('.selectable').each(function(){
        var textArray = presenter.getTextFromElementWithAltTexts($sanitizedElement).split(SPLIT);
        var sanitizedHTML = window.xssUtils.sanitize($element[0].outerHTML);
        var $sanitizedElement = $(sanitizedHTML);
        $sanitizedElement.find('.selectable').each(function(index){

        var textArray = presenter.getTextFromElementWithAltTexts($sanitizedElement).split(SPLIT);
2022-11-22 Secured Text Selection addon against xss attacks