hitoshura25/cvefixes huggingface dataset:
CVE-2017-1000188 (JavaScript, published 2017-11-17T03:29Z)
Description: value: nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mde/ejs
Files changed:
lib/ejs.js
test/ejs.js
Commit message: Blacklist a few other unsafe opts from passing in data obj


Vulnerable code:
      // Disallow setting the root opt for includes via a passed data obj
      // Unsanitized, parameterized use of `render` could allow the
      // include directory to be reset, opening up the possibility of
      // remote code execution
      if (p == 'root') {

    assert.equal(ejs.render(template, options),

Fixed code:
var _OPTS_IN_DATA_BLACKLIST = {
      cache: true,
      filename: true,
      root: true,
      localsName: true
    };
      // Disallow passing potentially dangerous opts in the data
      // These opts should not be settable via a `render` call
      if (_OPTS_IN_DATA_BLACKLIST[p]) {
/* Old API -- remove when this shim goes away */
suite('ejs.render(str, dataAndOpts)', function () {
  test('render the template with data/opts passed together', function () {
    assert.equal(ejs.render('<p><?= foo ?></p>', {foo: 'yay', delimiter: '?'}),
        '<p>yay</p>');
  });

  test('disallow unsafe opts passed along in data', function () {
    assert.equal(ejs.render('<p><?= locals.foo ?></p>',
        // localsName should not get reset because it's blacklisted
        {_with: false, foo: 'yay', delimiter: '?', localsName: '_'}),
        '<p>yay</p>');
  });
});

    assert.equal(ejs.render(template, {}, options),
CVE-2017-1000189 (JavaScript, published 2017-11-17T03:29Z)
Description: value: nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mde/ejs
Files changed:
lib/ejs.js
test/ejs.js
Commit message: Blacklist a few other unsafe opts from passing in data obj


Vulnerable code:
      // Disallow setting the root opt for includes via a passed data obj
      // Unsanitized, parameterized use of `render` could allow the
      // include directory to be reset, opening up the possibility of
      // remote code execution
      if (p == 'root') {

    assert.equal(ejs.render(template, options),

Fixed code:
var _OPTS_IN_DATA_BLACKLIST = {
      cache: true,
      filename: true,
      root: true,
      localsName: true
    };
      // Disallow passing potentially dangerous opts in the data
      // These opts should not be settable via a `render` call
      if (_OPTS_IN_DATA_BLACKLIST[p]) {
/* Old API -- remove when this shim goes away */
suite('ejs.render(str, dataAndOpts)', function () {
  test('render the template with data/opts passed together', function () {
    assert.equal(ejs.render('<p><?= foo ?></p>', {foo: 'yay', delimiter: '?'}),
        '<p>yay</p>');
  });

  test('disallow unsafe opts passed along in data', function () {
    assert.equal(ejs.render('<p><?= locals.foo ?></p>',
        // localsName should not get reset because it's blacklisted
        {_with: false, foo: 'yay', delimiter: '?', localsName: '_'}),
        '<p>yay</p>');
  });
});

    assert.equal(ejs.render(template, {}, options),
CVE-2024-33883 (JavaScript, published 2024-04-28T16:15Z)
Description: value: The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/mde/ejs
Files changed:
lib/ejs.js
lib/utils.js
Commit message: Basic pollution protection


Vulnerable code:
function Template(text, opts) {
  opts = opts || utils.createNullProtoObjWherePossible();

Fixed code:
function Template(text, optsParam) {
  var opts = utils.hasOwnOnlyObject(optsParam);

exports.hasOwnOnlyObject = function (obj) {
  var o = exports.createNullProtoObjWherePossible();
  for (var p in obj) {
    if (hasOwn(obj, p)) {
      o[p] = obj[p];
    }
  }
  return o;
};
CVE-2016-5100 (PHP, published 2017-02-13T18:59Z)
Description: value: Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
index.php
lib/functions/system/function.randomStr.php
Commit message: avoid rand() if possible as it is not generating cryptographically secure values, thx to Hanno for putting some effort into this

Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>


Vulnerable code:
					$first = substr(md5($user['loginname'] . $timestamp . rand(0, $timestamp)), 0, 15);
					$third = substr(md5($user['email'] . $timestamp . rand(0, $timestamp)), -15);

Fixed code:
					$first = substr(md5($user['loginname'] . $timestamp . randomStr(16)), 0, 15);
					$third = substr(md5($user['email'] . $timestamp . randomStr(16)), -15);
<?php

/**
 * This file is part of the Froxlor project.
 * Copyright (c) 2010 the Froxlor Team (see authors).
 *
 * For the full copyright and license information, please view the COPYING
 * file that was distributed with this source code. You can also view the
 * COPYING file online at http://files.froxlor.org/misc/COPYING.txt
 *
 * @copyright  (c) the authors
 * @author     Froxlor team <team@froxlor.org> (2016-)
 * @license    GPLv2 http://files.froxlor.org/misc/COPYING.txt
 * @package    Functions
 *
 */

/**
 * Function randomStr
 *
 * generate a pseudo-random string of bytes
 *
 * @param int $length            
 *
 * @return string
 */
function randomStr($length)
{
    if (version_compare(PHP_VERSION, '7.0.0') >= 0) {
        return random_bytes($length);
    } elseif (function_exists('openssl_random_pseudo_bytes')) {
        return openssl_random_pseudo_bytes($length);
    } else {
        $pr_bits = '';
        $fp = @fopen('/dev/urandom', 'rb');
        if ($fp !== false) {
            $pr_bits .= @fread($fp, $length);
            @fclose($fp);
        } else {
            $pr_bits = substr(rand(time()).rand(time()), 0, $length);
        }
        return $pr_bits;
    }
}
CVE-2020-10235 (PHP, published 2020-03-09T16:15Z)
Description: value: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
install/lib/class.FroxlorInstall.php
Commit message: secure shell-execution of mysqldump on installation if given database-name exists

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
				$command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;

Fixed code:
				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
CVE-2020-10235 (PHP, published 2020-03-09T16:15Z)
Description: value: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
install/lib/class.FroxlorInstall.php
Commit message: secure shell-execution of mysqldump on installation if given database-name exists

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
				$command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;

Fixed code:
				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
CVE-2020-10235 (PHP, published 2020-03-09T16:15Z)
Description: value: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
install/lib/class.FroxlorInstall.php
Commit message: forgot one escapeshellarg() and enhanced security on userdata.inc.php creation when installing

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
		if ($fp = @fopen($userdata_file, 'w')) {
			$result = @fputs($fp, $userdata, strlen($userdata));
			chmod($userdata_file, 0440);
			$temp_file = tempnam(sys_get_temp_dir(), 'fx');
			if (touch($temp_file)) {
				$result = @fputs($fp, $userdata, strlen($userdata));
						$result = $db->query($sql_query[$i]);
				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;

Fixed code:
		if (@touch($userdata_file) && @chmod($userdata_file, 0400) && @is_writable($userdata_file)) {
			$fp = @fopen($userdata_file, 'w');
			@fputs($fp, $userdata, strlen($userdata));
			$temp_file = @tempnam(sys_get_temp_dir(), 'fx');
			if ($temp_file) {
				@fputs($fp, $userdata, strlen($userdata));
						$db->query($sql_query[$i]);
				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . escapeshellarg($this->_data['mysql_root_pass']) . "' --result-file=" . $filename;
CVE-2020-10235 (PHP, published 2020-03-09T16:15Z)
Description: value: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
install/lib/class.FroxlorInstall.php
Commit message: forgot one escapeshellarg() and enhanced security on userdata.inc.php creation when installing

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
		if ($fp = @fopen($userdata_file, 'w')) {
			$result = @fputs($fp, $userdata, strlen($userdata));
			chmod($userdata_file, 0440);
			$temp_file = tempnam(sys_get_temp_dir(), 'fx');
			if (touch($temp_file)) {
				$result = @fputs($fp, $userdata, strlen($userdata));
						$result = $db->query($sql_query[$i]);
				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;

Fixed code:
		if (@touch($userdata_file) && @chmod($userdata_file, 0400) && @is_writable($userdata_file)) {
			$fp = @fopen($userdata_file, 'w');
			@fputs($fp, $userdata, strlen($userdata));
			$temp_file = @tempnam(sys_get_temp_dir(), 'fx');
			if ($temp_file) {
				@fputs($fp, $userdata, strlen($userdata));
						$db->query($sql_query[$i]);
				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . escapeshellarg($this->_data['mysql_root_pass']) . "' --result-file=" . $filename;
CVE-2020-10236 (PHP, published 2020-03-09T16:15Z)
Description: value: An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the installation directory was not writable. This allowed local attackers to cause DoS or disclose information out of the config files, because of _createUserdataConf in install/lib/class.FroxlorInstall.php.
Severity: LOW (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
install/lib/class.FroxlorInstall.php
install/lng/english.lng.php
install/lng/french.lng.php
install/lng/german.lng.php
Commit message: use unpredictable tmpfile-name in installation if lib/userdata.inc.php cannot be written due to permission

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
		} elseif ($fp = @fopen('/tmp/userdata.inc.php', 'w')) {
			$result = @fputs($fp, $userdata, strlen($userdata));
			@fclose($fp);
			$content .= $this->_status_message('orange', $this->_lng['install']['creating_configfile_temp']);
			chmod('/tmp/userdata.inc.php', 0440);
			$content .= $this->_status_message('red', $this->_lng['install']['creating_configfile_failed']);
			$escpduserdata = nl2br(htmlspecialchars($userdata));
			eval("\$content .= \"" . $this->_getTemplate("textarea") . "\";");
$lng['install']['creating_configfile_temp'] = 'File was saved in /tmp/userdata.inc.php, please move to ' . dirname(dirname(__DIR__)) . '/lib/.';
$lng['install']['creating_configfile_temp'] = 'Le fichier a été enregistré dans /tmp/userdata.inc.php, merci de le déplacer dans ' . dirname(dirname(__DIR__)) . '/lib/.';
$lng['install']['creating_configfile_temp'] = 'Datei wurde in /tmp/userdata.inc.php gespeichert, bitte nach ' . dirname(dirname(__DIR__)) . '/lib/ verschieben.';

Fixed code:
			// try creating it in a temporary file
			$temp_file = tempnam(sys_get_temp_dir(), 'fx');
			if (touch($temp_file)) {
				chmod($temp_file, 0400);
				$fp = @fopen($temp_file, 'w');
				$result = @fputs($fp, $userdata, strlen($userdata));
				@fclose($fp);
				$content .= $this->_status_message('orange', sprintf($this->_lng['install']['creating_configfile_temp'], $temp_file));
			} else {
				$content .= $this->_status_message('red', $this->_lng['install']['creating_configfile_failed']);
				$escpduserdata = nl2br(htmlspecialchars($userdata));
				eval("\$content .= \"" . $this->_getTemplate("textarea") . "\";");
			}
$lng['install']['creating_configfile_temp'] = 'File was saved in %s, please move to ' . dirname(dirname(__DIR__)) . '/lib/userdata.inc.php';
$lng['install']['creating_configfile_temp'] = 'Le fichier a été enregistré dans %s, merci de le déplacer dans ' . dirname(dirname(__DIR__)) . '/lib/userdata.inc.php';
$lng['install']['creating_configfile_temp'] = 'Datei wurde in %s gespeichert, bitte nach ' . dirname(dirname(__DIR__)) . '/lib/userdata.inc.php verschieben.';
CVE-2021-42325 (PHP, published 2021-10-12T20:15Z)
Description: value: Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
lib/Froxlor/Database/Manager/DbManagerMySQL.php
Commit message: use prepared statement for creating databases to avoid sql injections in custom db-names

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
		Database::query("CREATE DATABASE `" . $dbname . "`");

Fixed code:
		$stmt = Database::prepare("CREATE DATABASE :dbname");
		Database::pexecute($stmt, [
			'dbname' => $dbname
		]);
CVE-2023-50256 (PHP, published 2024-01-03T23:15Z)
Description: value: Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements (e.g. surname, company name) established by the system. Version 2.1.2 fixes this issue.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/Froxlor/Froxlor
Files changed:
lib/Froxlor/Api/Commands/Customers.php
templates/Froxlor/assets/js/jquery/validation.js
Commit message: Merge pull request from GHSA-625g-fm5w-w7w4

* fix possibility to have empty name/surname and empty company

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

* let js validation for customer add/edit form also trim() entered data to avoid empty values pass the client-side validation

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

---------

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Vulnerable code:
			$company_required = empty($result['company']) && ((!empty($name) && empty($firstname)) || (empty($name) && !empty($firstname)) || (empty($name) && empty($firstname)));
							return $('#company').val().length === 0 || $('#firstname').val().length > 0;
							return $('#company').val().length === 0 || $('#name').val().length > 0;
							return $('#name').val().length === 0
								&& $('#firstname').val().length === 0;

Fixed code:
			$company_required = (!empty($name) && empty($firstname)) || (empty($name) && !empty($firstname)) || (empty($name) && empty($firstname));
							return $('#company').val().trim().length === 0 || $('#firstname').val().trim().length > 0;
							return $('#company').val().trim().length === 0 || $('#name').val().trim().length > 0;
							return $('#name').val().trim().length === 0
								&& $('#firstname').val().trim().length === 0;
CVE-2022-24753 (Go, published 2022-03-09T23:15Z)
Description: value: Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/stripe/stripe-cli
Files changed:
pkg/config/config.go
pkg/open/open.go
Commit message: replace exec package (#820)



Vulnerable code:
	"os/exec"
	"os/exec"

Fixed code:
	exec "golang.org/x/sys/execabs"


	exec "golang.org/x/sys/execabs"
CVE-2013-1942 (Other, published 2013-08-15T17:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/happyworm/jPlayer
Files changed:
actionscript/Jplayer.as
actionscript/happyworm/jPlayer/JplayerStatus.as
jquery.jplayer/jquery.jplayer.js
Commit message: Security Fix of Flash SWF that had enabled cookie theft


Vulnerable code:
 * Version: 2.2.19
 * Date: 29th January 2013
		private var directAccess:Boolean = false; // When SWF visited directly with no parameters
			if(i === 0) {
			var illegals:String = "' \" ( ) { } * + /";
 * Date: 29th January 2013
		public static const VERSION:String = "2.2.19"; // The version of the Flash jPlayer entity.
 * Version: 2.2.19
 * Date: 29th January 2013
			script: "2.2.19",
			needFlash: "2.2.19",

Fixed code:
 * Version: 2.2.20
 * Date: 21st March 2013
		private var directAccess:Boolean = false; // When SWF visited directly with no parameters (or when security issue detected)
			if(i === 0 || securityIssue) {
			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
 * Date: 21st March 2013
		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
 * Version: 2.2.20
 * Date: 21st March 2013
			script: "2.2.20",
			needFlash: "2.2.20",