hitoshura25/cvefixes huggingface dataset:
CVE-2020-23915 (C++, published 2021-04-21T18:15Z)
Description: value: An issue was discovered in cpp-peglib through v0.1.12. peg::resolve_escape_sequence() in peglib.h has a heap-based buffer over-read.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/yhirose/cpp-peglib
Files changed:
peglib.h
test/test1.cc
Commit message: Fix #122


Vulnerable code:
    } else if ((b & 0xE0) == 0xC0) {
    } else if ((b & 0xF0) == 0xE0) {
    } else if ((b & 0xF8) == 0xF0) {

Fixed code:
    } else if ((b & 0xE0) == 0xC0 && l >= 2) {
    } else if ((b & 0xF0) == 0xE0 && l >= 3) {
    } else if ((b & 0xF8) == 0xF0 && l >= 4) {
TEST_CASE("Invalid UTF-8 text test", "[general]")
{
    std::string s = "a <- '";
    s += static_cast<char>(0xe8); // Make invalid utf8 text...

    parser parser(s.c_str());

    bool ret = parser;
    REQUIRE(ret == false);
}
CVE-2022-4953 (JavaScript, published 2023-08-14T20:15Z)
Description: value: The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/elementor/elementor
Files changed:
assets/dev/js/frontend/utils/lightbox/lightbox.js
Commit message: Tweak: Lightbox - only play a video if it has a registered provider [ED-6293] (#17527)



Vulnerable code:
			let apiProvider = elementorFrontend.utils.baseVideoLoader;

Fixed code:
			let apiProvider;
			} else {
				return;
CVE-2015-5232 (Shell, published 2017-06-07T20:29Z)
Description: value: Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Severity: HIGH (CVSS v3 base score: 8.1)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/01org/opa-fm
Files changed:
Esm/ib/src/linux/startup/fm_config/config_diff.sh
Esm/ib/src/linux/startup/fm_config/config_generate.sh
Commit message: Fix scripts that use well-known temp files.


Vulnerable code:
TEMP1=/tmp/smdiffa$$
TEMP2=/tmp/smdiffb$$
TEMP=/tmp/smgen$$

Fixed code:
TEMP1=`mktemp`
TEMP2=`mktemp`
trap "rm -f $TEMP1 $TEMP2" EXIT
TEMP=`mktemp`
trap "rm -f $TEMP" EXIT
CVE-2023-34104 (JavaScript, published 2023-06-06T18:15Z)
Description: value: fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/NaturalIntelligence/fast-xml-parser
Files changed:
spec/entities_spec.js
src/xmlparser/DocTypeReader.js
Commit message: fix security bug


Vulnerable code:
                        entities[ entityName ] = {

Fixed code:
    it("should throw error if an entity name contains special char", function() {
        const xmlData = `
        <?xml version="1.0" encoding="UTF-8"?>

        <!DOCTYPE note [
        <!ENTITY nj$ "writer;">
        <!ENTITY wr?er "Writer: Donald Duck.">
        ]>`;

        const options = {
            processEntities: true,
        };

        expect(() =>{
            const parser = new XMLParser(options);
            parser.parse(xmlData);
        }).toThrowError("Invalid character $ in entity name")
    });
                        entities[ validateEntityName(entityName) ] = {
//an entity name should not contains special characters that may be used in regex
//Eg !?\\\/[]$%{}^&*()<>
const specialChar = "!?\\\/[]$%{}^&*()<>";

function validateEntityName(name){
    for (let i = 0; i < specialChar.length; i++) {
        const ch = specialChar[i];
        if(name.indexOf(ch) !== -1) throw new Error(`Invalid character ${ch} in entity name`);
    }
    return name;
}
CVE-2016-10083 (PHP, published 2016-12-30T07:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/plugin.php
Commit message: fixes #575, sanitize user input before display on die()


Vulnerable code:
  die('Missing file '.$filename);

Fixed code:
  die('Missing file '.htmlentities($filename));
CVE-2016-10084 (PHP, published 2016-12-30T07:59Z)
Description: value: admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/batch_manager.php
Commit message: fixes #572, check $_GET['mode'] against hacking attempt


Vulnerable code:

Fixed code:
  check_input_parameter('mode', $_GET, false, '/^(global|unit)$/');
CVE-2016-10085 (PHP, published 2016-12-30T07:59Z)
Description: value: admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/languages.php
Commit message: fixes #573, check $_GET['tab'] against hacking attempt


Vulnerable code:

Fixed code:
{
  check_input_parameter('tab', $_GET, false, '/^(installed|update|new)$/');
}
{
}
CVE-2016-10105 (PHP, published 2017-01-03T06:59Z)
Description: value: admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/plugin.php
Commit message: fixes #574, new checks on plugin section in URL


Vulnerable code:
  if (empty($sections[$i]) or $sections[$i]=='..')

Fixed code:
  if (empty($sections[$i]))
    continue;
  }

  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
  {
    die('invalid section token ['.htmlentities($sections[$i]).']');
CVE-2016-10105 (PHP, published 2017-01-03T06:59Z)
Description: value: admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/plugin.php
Commit message: fixes #574, new checks on plugin section in URL


Vulnerable code:
  if (empty($sections[$i]) or $sections[$i]=='..')

Fixed code:
  if (empty($sections[$i]))
    continue;
  }

  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
  {
    die('invalid section token ['.htmlentities($sections[$i]).']');
CVE-2016-10513 (PHP, published 2017-10-10T20:29Z)
Description: value: Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
include/functions_search.inc.php
Commit message: fixes #548, escape HTML chars from search expression

before sending them to HTML comment on frontend


Vulnerable code:
  $debug[] = "<!--\nparsed: ".$expression;
    $debug[] = $expression->stokens[$i].': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.implode(', ',$expression->stokens[$i]->variants): '');

Fixed code:
  $debug[] = "<!--\nparsed: ".htmlspecialchars($expression);
    $debug[] = htmlspecialchars($expression->stokens[$i]).': '.count($qsr->tag_ids[$i]).' tags, '.count($qsr->tag_iids[$i]).' tiids, '.count($qsr->images_iids[$i]).' iiids, '.count($qsr->iids[$i]).' iids'
      .( !empty($expression->stokens[$i]->variants) ? ' variants: '.htmlspecialchars(implode(', ',$expression->stokens[$i]->variants)): '');
CVE-2016-10514 (PHP, published 2017-10-10T20:29Z)
Description: value: url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
include/functions.inc.php
Commit message: fixes #547, strong checks on url format


Vulnerable code:

Fixed code:
  if (strpos($url, '"') !== false)
  {
    return false;
  }

  if (strncmp($url, 'http://', 7) !== 0 and strncmp($url, 'https://', 8) !== 0)
  {
    return false;
  }
CVE-2017-10678 (PHP, published 2017-06-29T21:29Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/cat_options.php
admin/permalinks.php
admin/themes/default/template/cat_options.tpl
admin/themes/default/template/permalinks.tpl
Commit message: adding pwg_token on permalink & cat_options

and therefor solving issue:721


Vulnerable code:
// print '<pre>';
// print_r($_POST);
// print '</pre>';
        array( 'delete_permanent'=> $row['permalink'] )
$template->assign('deleted_permalinks', $deleted_permalinks);
$template->assign('U_HELP', get_root_url().'admin/popuphelp.php?page=permalinks');

Fixed code:

  check_pwg_token();
$template->assign('PWG_TOKEN',get_pwg_token());
  check_pwg_token();
  check_pwg_token();
$pwg_token = get_pwg_token();
        array('delete_permanent'=> $row['permalink'],'pwg_token'=>$pwg_token)

$template->assign(array(
  'PWG_TOKEN' => $pwg_token,
  'U_HELP' => get_root_url().'admin/popuphelp.php?page=permalinks',
  'deleted_permalinks' => $deleted_permalinks,
  ));
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
CVE-2017-10680 (PHP, published 2017-06-29T21:29Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/cat_options.php
admin/permalinks.php
admin/themes/default/template/cat_options.tpl
admin/themes/default/template/permalinks.tpl
Commit message: adding pwg_token on permalink & cat_options

and therefor solving issue:721


Vulnerable code:
// print '<pre>';
// print_r($_POST);
// print '</pre>';
        array( 'delete_permanent'=> $row['permalink'] )
$template->assign('deleted_permalinks', $deleted_permalinks);
$template->assign('U_HELP', get_root_url().'admin/popuphelp.php?page=permalinks');

Fixed code:

  check_pwg_token();
$template->assign('PWG_TOKEN',get_pwg_token());
  check_pwg_token();
  check_pwg_token();
$pwg_token = get_pwg_token();
        array('delete_permanent'=> $row['permalink'],'pwg_token'=>$pwg_token)

$template->assign(array(
  'PWG_TOKEN' => $pwg_token,
  'U_HELP' => get_root_url().'admin/popuphelp.php?page=permalinks',
  'deleted_permalinks' => $deleted_permalinks,
  ));
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
CVE-2017-10681 (PHP, published 2017-06-29T21:29Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/cat_options.php
admin/permalinks.php
admin/themes/default/template/cat_options.tpl
admin/themes/default/template/permalinks.tpl
Commit message: adding pwg_token on permalink & cat_options

and therefor solving issue:721


Vulnerable code:
// print '<pre>';
// print_r($_POST);
// print '</pre>';
        array( 'delete_permanent'=> $row['permalink'] )
$template->assign('deleted_permalinks', $deleted_permalinks);
$template->assign('U_HELP', get_root_url().'admin/popuphelp.php?page=permalinks');

Fixed code:

  check_pwg_token();
$template->assign('PWG_TOKEN',get_pwg_token());
  check_pwg_token();
  check_pwg_token();
$pwg_token = get_pwg_token();
        array('delete_permanent'=> $row['permalink'],'pwg_token'=>$pwg_token)

$template->assign(array(
  'PWG_TOKEN' => $pwg_token,
  'U_HELP' => get_root_url().'admin/popuphelp.php?page=permalinks',
  'deleted_permalinks' => $deleted_permalinks,
  ));
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
CVE-2017-10682 (PHP, published 2017-06-29T21:29Z)
Description: value: SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/cat_options.php
Commit message: check input parameter for cat_options pages

solving https://github.com/Piwigo/Piwigo/issues/724


Vulnerable code:

Fixed code:
  check_input_parameter('cat_true', $_POST, true, PATTERN_ID);
  check_input_parameter('cat_false', $_POST, true, PATTERN_ID);
CVE-2017-5608 (PHP, published 2017-01-28T18:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the image upload function in Piwigo before 2.8.6 allows remote attackers to inject arbitrary web script or HTML via a crafted image filename.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
action.php
admin/include/functions_upload.inc.php
Commit message: fixes #600, avoid html in web uploaded filenames


Vulnerable code:
  $http_headers[] = 'Content-Disposition: attachment; filename="'.$element_info['file'].'";';

Fixed code:
  $http_headers[] = 'Content-Disposition: attachment; filename="'.htmlspecialchars_decode($element_info['file']).'";';
  if (!is_null($original_filename))
  {
    $original_filename = htmlspecialchars($original_filename);
  }
CVE-2023-37270 (PHP, published 2023-07-07T22:15Z)
Description: value: Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header `User-Agent` is vulnerable at the endpoint that records user information when logging in to the administrator screen. It is possible to execute arbitrary SQL statements. Someone who wants to exploit the vulnerability must be log in to the administrator screen, even with low privileges. Any SQL statement can be executed. Doing so may leak information from the database. Version 13.8.0 contains a fix for this issue. As another mitigation, those who want to execute a SQL statement verbatim with user-enterable parameters should be sure to escape the parameter contents appropriately.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
include/functions.inc.php
Commit message: Merge pull request from GHSA-934w-qj9p-3qcx



Vulnerable code:
      'user_agent' => $user_agent,

Fixed code:
      'user_agent' => pwg_db_real_escape_string($user_agent),
CVE-2023-44393 (PHP, published 2023-10-09T15:15Z)
Description: value: Piwigo is an open source photo gallery application. Prior to version 14.0.0beta4, a reflected cross-site scripting (XSS) vulnerability is in the` /admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page. This vulnerability can be exploited by an attacker to inject malicious HTML and JS code into the HTML page, which could then be executed by admin users when they visit the URL with the payload. The vulnerability is caused by the insecure injection of the `plugin_id` value from the URL into the HTML page. An attacker can exploit this vulnerability by crafting a malicious URL that contains a specially crafted `plugin_id` value. When a victim who is logged in as an administrator visits this URL, the malicious code will be injected into the HTML page and executed. This vulnerability can be exploited by any attacker who has access to a malicious URL. However, only users who are logged in as administrators are affected. This is because the vulnerability is only present on the `/admin.php?page=plugins&tab=new&installstatus=ok&plugin_id=[here]` page, which is only accessible to administrators. Version 14.0.0.beta4 contains a patch for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Piwigo/Piwigo
Files changed:
admin/plugins_new.php
Commit message: fixes GHSA-qg85-957m-7vgg providing plugin_id in URL is useless since Piwigo 12


Vulnerable code:
      $activate_url = get_root_url().'admin.php?page=plugins'
        . '&amp;plugin=' . $_GET['plugin_id']
        . '&amp;pwg_token=' . get_pwg_token()
        . '&amp;action=activate'
        . '&amp;filter=deactivated';

Fixed code:
      // since Piwigo 12, you need to be on the page of installed plugins to active a plugin with
      // a JS action, no need to provide plugin_id in URL, just link to the page of installed
      // plugins, filtered on deactivated plugins. The webmaster will have to find its newly
      // installed plugin and click on the activation switch.
      $activate_url = get_root_url().'admin.php?page=plugins&amp;filter=deactivated';