hitoshura25/cvefixes huggingface dataset:
CVE-2021-3728 (PHP, published 2021-08-23T13:15Z)
Description: value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
public/v1/js/ff/budgets/index.js
resources/views/v1/budgets/index.twig
routes/web.php
Commit message: Fix vulnerability https://huntr.dev/bounties/dd54c5a1-0d4a-4f02-a111-7ce4ddc67a4d/


Vulnerable code:
    $.get(totalBudgetedUri.replace('REPLACEME',currencyId)).done(function (data) {
    var url = deleteBudgetLimitUrl.replace('REPLACEME', budgetId.toString();
                                                <div class="input-group">
                                                            <li><a href="{{ route('budget-limits.delete', [budgetLimit.id]) }}">{{ trans('firefly.remove_budgeted_amount', {currency: budgetLimit.currency_name }) }}</a></li>
        Route::get('delete/{budgetLimit}', ['uses' => 'Budget\BudgetLimitController@delete', 'as' => 'delete']);

Fixed code:
    $.get(totalBudgetedUri.replace('REPLACEME', currencyId)).done(function (data) {
    e.preventDefault();
    var url = deleteBudgetLimitUrl.replace('REPLACEME', budgetLimitId.toString());
    $.post(url, {_token: token}).then(function () {
        $('.bl_entry[data-budget-limit-id="' + budgetLimitId + '"]').remove();
        
    });
                                                <div class="input-group bl_entry" data-budget-limit-id="{{ budgetLimit.id }}">
                                                            <li>
                                                                <a class="delete_bl" href="#" data-budget-limit-id="{{ budgetLimit.id }}">{{ trans('firefly.remove_budgeted_amount', {currency: budgetLimit.currency_name }) }}</a>
                                                            </li>
        var deleteBudgetLimitUrl = "{{ route('budget-limits.delete', ['REPLACEME']) }}";
        Route::post('delete/{budgetLimit}', ['uses' => 'Budget\BudgetLimitController@delete', 'as' => 'delete']);
CVE-2021-3846 (PHP, published 2021-10-19T13:15Z)
Description: value: firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Helpers/Attachments/AttachmentHelper.php
Commit message: Make sure temp file is closed (and thus deleted)


Vulnerable code:

Fixed code:
            fclose($resource);
CVE-2021-3851 (PHP, published 2021-10-19T13:15Z)
Description: value: firefly-iii is vulnerable to URL Redirection to Untrusted Site
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Exceptions/Handler.php
app/Http/Middleware/StartFireflySession.php
app/Support/Http/Controllers/UserNavigation.php
Commit message: Fix unsecure redirect code.


Vulnerable code:
        // also stop remembering "delete" URL's.
        if ($default === $previous && (null === $errors || (0 === $errors->count())) && !Str::contains($return, $forbidden)) {

Fixed code:
use Illuminate\Contracts\Foundation\Application;
use Illuminate\Http\RedirectResponse;
use Illuminate\Routing\Redirector;

    /**
     * Convert a validation exception into a response.
     *
     * @param Request                    $request
     * @param LaravelValidationException $exception
     *
     * @return Application|RedirectResponse|Redirector
     */
    protected function invalid($request, LaravelValidationException $exception): Application|RedirectResponse|Redirector
    {
        // protect against open redirect when submitting invalid forms.
        $previous = $this->getPreviousUrl();
        $redirect = $this->getRedirectUrl($exception);

        return redirect($redirect ?? $previous)
            ->withInput(Arr::except($request->input(), $this->dontFlash))
            ->withErrors($exception->errors(), $request->input('_error_bag', $exception->errorBag));
    }

    /**
     * Only return the previousUrl() if it is a valid URL. Return default redirect otherwise.
     *
     * @return string
     */
    private function getPreviousUrl(): string
    {
        $safe         = route('index');
        $previous     = url()->previous();
        $previousHost = parse_url($previous, PHP_URL_HOST);
        $safeHost     = parse_url($safe, PHP_URL_HOST);

        return null !== $previousHost && $previousHost === $safeHost ? $previous : $safe;
    }

    /**
     * Only return the redirectTo property from the exception if it is a valid URL. Return NULL otherwise.
     *
     * @param LaravelValidationException $exception
     *
     * @return string|null
     */
    private function getRedirectUrl(LaravelValidationException $exception): ?string
    {
        if (null === $exception->redirectTo) {
            return null;
        }
        $safe         = route('index');
        $previous     = $exception->redirectTo;
        $previousHost = parse_url($previous, PHP_URL_HOST);
        $safeHost     = parse_url($safe, PHP_URL_HOST);

        return null !== $previousHost && $previousHost === $safeHost ? $previous : $safe;
    }
        if (null !== $previous && $default === $previous && (null === $errors || (0 === $errors->count())) && !Str::contains($return, $forbidden)) {
CVE-2021-3901 (PHP, published 2021-10-27T21:15Z)
Description: value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
resources/views/v1/bills/show.twig
routes/web.php
Commit message: Fix rescan


Vulnerable code:
                    <p><a id="billButtons" href="{{ route('bills.rescan',object.data.id) }}" class="btn btn-default">{{ 'rescan_old'|_ }}</a></p>
        Route::get('rescan/{bill}', ['uses' => 'Bill\ShowController@rescan', 'as' => 'rescan']);

Fixed code:
                    <form action="{{ route('bills.rescan',object.data.id) }}" method="post">
                        <input type="hidden" name="_token" value="{{ csrf_token() }}"/>
                        <p>
                            <input type="submit" name="submit" value="{{ 'rescan_old'|_ }}" class="btn btn-default" />
                        </p>
                    </form>

        Route::post('rescan/{bill}', ['uses' => 'Bill\ShowController@rescan', 'as' => 'rescan']);
CVE-2021-4005 (Other, published 2021-12-04T12:15Z)
Description: value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
resources/views/v1/profile/index.twig
Commit message: Fix.


Vulnerable code:
                            {% if enabled2FA == false %}
                                    <a class="btn btn-danger" href="{{ route('profile.delete-code') }}">
                                        <span class="fa fa-trash"></span>
                                        {{ 'pref_two_factor_auth_disable_2fa'|_ }}</a>

Fixed code:
                            {% if enabled2FA == true %}
                                <form method="post" action="{{ route('profile.delete-code') }}">
                                    <input type="hidden" name="_token" value="{{ csrf_token() }}" />
                                    <input class="btn btn-danger" style="margin-top:20px;" type="submit" name="submit" value="{{ 'pref_two_factor_auth_disable_2fa'|_ }}" />
                                </form>
CVE-2021-4015 (PHP, published 2021-12-01T11:15Z)
Description: value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
routes/web.php
Commit message: Fix CSRF issues


Vulnerable code:
        Route::get('rescan/{bill}', ['uses' => 'Bill\ShowController@rescan', 'as' => 'rescan']);
        Route::any('intro/finished/{route}/{specificPage?}', ['uses' => 'Json\IntroController@postFinished', 'as' => 'intro.finished']);
        Route::get('/delete-code', ['uses' => 'ProfileController@deleteCode', 'as' => 'delete-code']);
        Route::get('2fa/new-codes', ['uses' => 'ProfileController@newBackupCodes', 'as' => 'new-backup-codes']);
        Route::get('switch/{journalLink}', ['uses' => 'LinkController@switchLink', 'as' => 'switch']);

Fixed code:
        Route::post('rescan/{bill}', ['uses' => 'Bill\ShowController@rescan', 'as' => 'rescan']);
        Route::post('intro/finished/{route}/{specificPage?}', ['uses' => 'Json\IntroController@postFinished', 'as' => 'intro.finished']);
        Route::post('/delete-code', ['uses' => 'ProfileController@deleteCode', 'as' => 'delete-code']);
        Route::post('2fa/new-codes', ['uses' => 'ProfileController@newBackupCodes', 'as' => 'new-backup-codes']);
 * 
        Route::post('switch/{journalLink}', ['uses' => 'LinkController@switchLink', 'as' => 'switch']);
CVE-2023-0298 (Unknown, published 2023-01-14T08:15Z)
Description: value: Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
Commit message: Merge pull request #6850 from firefly-iii/fix-auth-issue

Expand authentication validation in API.

Vulnerable code:

Fixed code:
CVE-2023-1788 (Unknown, published 2023-04-05T16:15Z)
Description: value: Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
Commit message: Merge pull request #7062 from firefly-iii/JC5-patch-1

Update session.php

Vulnerable code:

Fixed code:
CVE-2023-1789 (Unknown, published 2023-04-01T02:15Z)
Description: value: Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
Commit message: Merge pull request #7043 from firefly-iii/fix-bad-escape

Catch escape in currencies

Vulnerable code:

Fixed code:
CVE-2015-1471 (PHP, published 2015-02-12T16:59Z)
Description: value: SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/delta/pragyan
Files changed:
index.php
Commit message: Update index.php

Vulnerable code:
	$userProfileId = $_GET['user'];

Fixed code:
	$userProfileId = safe_html(escape($_GET['user']));
CVE-2022-21711 (C, published 2022-01-24T20:15Z)
Description: value: elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/liyansong2018/elfspirit
Files changed:
parse.c
Commit message: Fix #1 about out-of-bounds


Vulnerable code:

Fixed code:
/**
 * @description: Judge whether the memory address is legal
 * @param {uint32_t} addr
 * @param {uint32_t} start
 * @param {uint32_t} end
 * @return {*}
 */
int validated_offset(uint32_t addr, uint32_t start, uint32_t end){
    return addr <= end && addr >= start? 0:-1;
}

            if (validated_offset(name, elf_map, elf_map + st.st_size)) {
                ERROR("Corrupt file format\n");
                return -1;
            }
            if (validated_offset(name, elf_map, elf_map + st.st_size)) {
                ERROR("Corrupt file format\n");
                return -1;
            }
CVE-2019-16161 (Unknown, published 2019-09-09T17:15Z)
Description: value: Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/k-takata/Onigmo
Files changed:
Commit message: Merge pull request #134 from k-takata/fix-segv-in-error-str

Fix SEGV in onig_error_code_to_str() (Fix #132)

Vulnerable code:

Fixed code:
CVE-2024-31451 (Python, published 2024-04-16T15:15Z)
Description: value: DocsGPT is a GPT-powered chat for documentation. DocsGPT is vulnerable to unauthenticated limited file write in routes.py. This vulnerability is fixed in 0.8.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/arc53/DocsGPT
Files changed:
application/api/user/routes.py
Commit message: advisory-fix


Vulnerable code:
        r = requests.get(base_path + vectorstore + "index.faiss")

        if r.status_code != 200:
            return {"status": "null"}
            if not os.path.exists(vectorstore):
                os.makedirs(vectorstore)
            with open(vectorstore + "index.faiss", "wb") as f:
                f.write(r.content)

            # download the store
            r = requests.get(base_path + vectorstore + "index.pkl")
            with open(vectorstore + "index.pkl", "wb") as f:
                f.write(r.content)

Fixed code:
from urllib.parse import urlparse
        file_url = urlparse(base_path + vectorstore + "index.faiss")
        
        if file_url.scheme in ['https'] and file_url.netloc == 'raw.githubusercontent.com' and file_url.path.startswith('/arc53/DocsHUB/main/'):
            
            r = requests.get(file_url.geturl())

            if r.status_code != 200:
                return {"status": "null"}
            else:
                if not os.path.exists(vectorstore):
                    os.makedirs(vectorstore)
                with open(vectorstore + "index.faiss", "wb") as f:
                    f.write(r.content)

                # download the store
                r = requests.get(base_path + vectorstore + "index.pkl")
                with open(vectorstore + "index.pkl", "wb") as f:
                    f.write(r.content)
            return {"status": "null"}
CVE-2021-41131 (Unknown, published 2021-10-19T18:15Z)
Description: value: python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.
Severity: HIGH (CVSS v3 base score: 8.7)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/theupdateframework/python-tuf
Files changed:
Commit message: Merge pull request from GHSA-wjw6-2cqr-j4qr

Fix client issue with rolenames as filenames

Vulnerable code:

Fixed code:
CVE-2022-31188 (Python, published 2022-08-01T20:15Z)
Description: value: CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/cvat-ai/cvat
Files changed:
CHANGELOG.md
cvat/apps/engine/task.py
cvat/requirements/base.txt
Commit message: Added validation for URLs which used as remote data source (#4387)



Vulnerable code:

Fixed code:
- Added validation for URLs which used as remote data source (<https://github.com/openvinotoolkit/cvat/pull/4387>)
from rest_framework.serializers import ValidationError
import ipaddress
import dns.resolver
def _validate_url(url):
    def _validate_ip_address(ip_address):
        if not ip_address.is_global:
            raise ValidationError('Non public IP address \'{}\' is provided!'.format(ip_address))

    ALLOWED_SCHEMES = ['http', 'https']

    parsed_url = urlparse.urlparse(url)

    if parsed_url.scheme not in ALLOWED_SCHEMES:
        raise ValueError('Unsupported URL sheme: {}. Only http and https are supported'.format(parsed_url.scheme))

    try:
        ip_address = ipaddress.ip_address(parsed_url.hostname)
        _validate_ip_address(ip_address)
    except ValueError as _:
        ip_v4_records = None
        ip_v6_records = None
        try:
            ip_v4_records = dns.resolver.query(parsed_url.hostname, 'A')
            for record in ip_v4_records:
                _validate_ip_address(ipaddress.ip_address(record.to_text()))
        except ValidationError:
            raise
        except Exception as e:
            slogger.glob.info('Cannot get A record for domain \'{}\': {}'.format(parsed_url.hostname, e))

        try:
            ip_v6_records = dns.resolver.query(parsed_url.hostname, 'AAAA')
            for record in ip_v6_records:
                _validate_ip_address(ipaddress.ip_address(record.to_text()))
        except ValidationError:
            raise
        except Exception as e:
            slogger.glob.info('Cannot get AAAA record for domain \'{}\': {}'.format(parsed_url.hostname, e))

        if not ip_v4_records and not ip_v6_records:
            raise ValidationError('Cannot resolve IP address for domain \'{}\''.format(parsed_url.hostname))

        _validate_url(url)
dnspython==2.2.0
CVE-2014-4668 (C, published 2014-07-02T04:14Z)
Description: value: The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/cherokee/webserver
Files changed:
cherokee/validator_ldap.c
Commit message: Prevent the LDAP validator from accepting an empty password.


Vulnerable code:
	    cherokee_buffer_is_empty (&conn->validator->user))

Fixed code:
	    cherokee_buffer_is_empty (&conn->validator->user) ||
	    cherokee_buffer_is_empty (&conn->validator->passwd))
CVE-2019-9870 (JavaScript, published 2019-03-21T16:01Z)
Description: value: plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-19 \u2014 Data Processing Errors
Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Repository: https://github.com/w8tcha/CKEditor-oEmbed-Plugin
Files changed:
oembed/plugin.js
Commit message: fixed #94


Vulnerable code:
                                'div(embeddedContent,oembed-provider-*) script': {
                                    attributes: '*'
                                },

Fixed code: