hitoshura25/cvefixes huggingface dataset:
CVE-2023-41892 (PHP, published 2023-09-13T20:15Z)
Description: value: Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/craftcms/cms
Files changed:
src/controllers/ConditionsController.php
Commit message: Take two


Vulnerable code:
        $baseConfig = Json::decodeIfJson($this->request->getBodyParam('config'));

Fixed code:
        $baseConfig = Component::cleanseConfig(Json::decodeIfJson($this->request->getBodyParam('config')));
CVE-2023-41892 (PHP, published 2023-09-13T20:15Z)
Description: value: Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/craftcms/cms
Files changed:
CHANGELOG.md
src/controllers/ConditionsController.php
src/helpers/Component.php
tests/unit/helpers/ComponentHelperTest.php
Commit message: Fixed an RCE vulnerability


Vulnerable code:
        $config = $this->request->getBodyParam($baseConfig['name']);

Fixed code:
- Added `craft\helpers\Component::cleanseConfig()`.
- Fixed an RCE vulnerability.
use craft\helpers\Component;
        $config = Component::cleanseConfig($this->request->getBodyParam($baseConfig['name']));
    /**
     * Cleanses a component config of any `on X` or `as X` keys.
     *
     * @param array $config
     * @return array
     * @since 4.4.15
     */
    public static function cleanseConfig(array $config): array
    {
        foreach ($config as $key => $value) {
            if (is_string($key) && (str_starts_with($key, 'on ') || str_starts_with($key, 'as '))) {
                unset($config[$key]);
                continue;
            }
            if (is_array($value)) {
                $config[$key] = static::cleanseConfig($value);
            }
        }
        return $config;
    }

    /**
     * @dataProvider cleanseConfigDataProvider
     * @param array $expected
     * @param array $config
     */
    public function testCleanseConfig(array $expected, array $config)
    {
        self::assertSame($expected, Component::cleanseConfig($config));
    }


    /**
     * @return array
     */
    public function cleanseConfigDataProvider(): array
    {
        return [
            [
                ['f' => 'foo', 'b' => 'bar'],
                ['f' => 'foo', 'b' => 'bar', 'as f' => 'f', 'on b' => 'b'],
            ],
            [
                ['nested' => ['f' => 'foo', 'b' => 'bar']],
                ['nested' => ['f' => 'foo', 'b' => 'bar', 'as f' => 'f', 'on b' => 'b']],
            ],
        ];
    }
CVE-2024-21622 (Unknown, published 2024-01-03T17:15Z)
Description: value: Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/craftcms/cms
Files changed:
Commit message: Merge pull request #13932 from craftcms/bugfix/element-pe

Fixed a potential privilege escalation bug

Vulnerable code:

Fixed code:
CVE-2024-21622 (Unknown, published 2024-01-03T17:15Z)
Description: value: Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/craftcms/cms
Files changed:
Commit message: Merge pull request #13931 from craftcms/bugfix/user-perms

Fixed a potential privilege escalation bug

Vulnerable code:

Fixed code:
CVE-2023-23607 (PHP, published 2023-01-20T21:15Z)
Description: value: erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/erohtar/Dasherr
Files changed:
www/include/filesave.php
Commit message: Update filesave.php


Vulnerable code:
	if(substr($fname, -1, 5) != '.json') {

Fixed code:
	if(substr($fname, -5) != '.json') {
CVE-2016-10969 (PHP, published 2019-09-16T13:15Z)
Description: value: The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SupportFlow/supportflow
Files changed:
classes/class-supportflow-admin.php
Commit message: Admin: Escape ticket title on Discussion screen to avoid XSS.

If `run_wptexturize` is disabled, the following subject title would allow an attacker to perform cross-site scripting:

`"><script>alert('hi');</script>`

That attack has a CVSS score of 4.7 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

The rest of the output was reformatted to improve readability and make it easier to spot missing escaping functions or other problems.

Props https://hackerone.com/whitehatter for discovering and disclosing responsibly.

Fixes https://hackerone.com/reports/145086


Vulnerable code:
		$placeholder = __( 'What is your conversation about?', 'supportflow' );
		echo '<h4>' . __( 'Subject', 'supportflow' ) . '</h4>';
		echo '<input type="text" id="subject" name="post_title" class="sf_autosave" placeholder="' . $placeholder . '" value="' . get_the_title() . '" autocomplete="off" />';
		echo '<p class="description">' . __( 'Please describe what this ticket is about in several words', 'supportflow' ) . '</p>';

Fixed code:
		?>

		<h4><?php _e( 'Subject', 'supportflow' ); ?></h4>
		<input
			type="text"
			id="subject"
			name="post_title"
			class="sf_autosave"
			placeholder="<?php _e( 'What is your conversation about?', 'supportflow' ); ?>"
			value="<?php echo esc_attr( get_the_title() ); ?>"
			autocomplete="off"
		/>
		<p class="description">
			<?php _e( 'Please describe what this ticket is about in several words', 'supportflow' ) ?>
		</p>

		<?php
CVE-2016-10970 (PHP, published 2019-09-16T13:15Z)
Description: value: The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/SupportFlow/supportflow
Files changed:
classes/class-supportflow-admin.php
Commit message: Admin: Escape ticket excerpt on Tickets screen to avoid XSS.

An attacker could submit the following payload via `[supportflow_submissionform]` to perform cross-site-scripting:

`<script>alert('XSS');</script>`

That attack has a CVSS score of 6.1 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Props https://hackerone.com/whitehatter for discovering and disclosing responsibly.

Fixes https://hackerone.com/reports/145091


Vulnerable code:
				echo $first_reply;

Fixed code:
				echo esc_html( $first_reply );
CVE-2021-32434 (C, published 2022-03-10T17:42Z)
Description: value: abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/leesavide/abcm2ps
Files changed:
parse.c
Commit message: fix: array overflow when wrong duration in voice overlay

Issue #83,


Vulnerable code:
		if (p_voice->time != over_mxtime)
			error(1, s, tx_wrong_dur);

Fixed code:
		if (p_voice->time != over_mxtime) {
			error(1, s, tx_wrong_dur);
			if (p_voice->time > over_mxtime)
				curvoice->time = p_voice->time;
			else
				p_voice->time = curvoice->time;
		}
CVE-2021-32435 (C, published 2022-03-10T17:42Z)
Description: value: Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/leesavide/abcm2ps
Files changed:
abcparse.c
Commit message: fix: crash when accidental without a note at start of line after K:

Issue #84.


Vulnerable code:
			parse.last_sym->u.note.slur_st = slur;
			slur = 0;
			if (parse.last_sym->u.note.notes[0].len > 0) /* if not space */
				curvoice->last_note = parse.last_sym;
				parse.last_sym->u.note.slur_st = slur;
				slur = 0;
				curvoice->last_note = parse.last_sym;

Fixed code:
			if (slur && parse.last_sym->u.note.notes[0].len) {
				parse.last_sym->u.note.slur_st = slur;
				slur = 0;
			}
				if (slur && parse.last_sym->u.note.notes[0].len) {
					parse.last_sym->u.note.slur_st = slur;
					slur = 0;
				}
	if (s->u.note.notes[0].len > 0) /* if not space */
		curvoice->last_note = s;
CVE-2021-32436 (C, published 2022-03-10T17:42Z)
Description: value: An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/leesavide/abcm2ps
Files changed:
parse.c
Commit message: fix: array overflow when wrong duration in voice overlay

Issue #83,


Vulnerable code:
		if (p_voice->time != over_mxtime)
			error(1, s, tx_wrong_dur);

Fixed code:
		if (p_voice->time != over_mxtime) {
			error(1, s, tx_wrong_dur);
			if (p_voice->time > over_mxtime)
				curvoice->time = p_voice->time;
			else
				p_voice->time = curvoice->time;
		}
CVE-2022-46147 (Unknown, published 2022-11-28T21:15Z)
Description: value: Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openedx/xblock-drag-and-drop-v2
Files changed:
Commit message: Merge pull request from GHSA-qv6c-367r-3w6q

feat: sanitize HTML tags to prevent XSS vulnerabilities

Vulnerable code:

Fixed code:
CVE-2024-23826 (Python, published 2024-01-29T16:15Z)
Description: value: spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS.  This vulnerability was fixed in the 2024.01.29 release.
Severity: nan (CVSS v3 base score: 5.7)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/spbu-se/spbu_se_site
Files changed:
src/flask_se_auth.py
Commit message: Fix possible server-size DoS vulnerability

Signed-off-by: Kirill K. Smirnov <kirill.k.smirnov@gmail.com>


Vulnerable code:

Fixed code:
        # Sanity check: limit uploadable filename
        # to avoid excessive burden to NFKD normalization
        # in secure_filename() method
        if len(file.filename) > 1000:
            flash("Filename too long")
            return redirect(request.url)
CVE-2023-0739 (Go, published 2023-02-08T05:15Z)
Description: value: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerdev/answer prior to 1.0.4.
Severity: nan (CVSS v3 base score: 6.8)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/answerdev/answer
Files changed:
docs/docs.go
docs/swagger.json
docs/swagger.yaml
internal/repo/collection/collection_repo.go
Commit message: update add db session


Vulnerable code:
                "bio_html": {
                    "description": "bio",
                    "type": "string",
                    "maxLength": 4096
                },
                "bio_html": {
                    "description": "bio",
                    "type": "string",
                    "maxLength": 4096
                },
      bio_html:
        description: bio
        maxLength: 4096
        type: string
	id, err := cr.uniqueIDRepo.GenUniqueIDStr(ctx, collection.TableName())
	if err == nil {
		collection.ID = id
		_, err = cr.data.DB.Insert(collection)
			return errors.InternalServer(reason.DatabaseError).WithError(err).WithStack()
	}
	return nil

Fixed code:
	"xorm.io/xorm"
	_, err = cr.data.DB.Transaction(func(session *xorm.Session) (result any, err error) {
		var has bool
		dbcollection := &entity.Collection{}
		result = nil
		has, err = session.Where("user_id = ? and object_id = ?", collection.UserID, collection.ObjectID).Get(dbcollection)
			return
		if has {
			return
		}
		id, err := cr.uniqueIDRepo.GenUniqueIDStr(ctx, collection.TableName())
		if err == nil {
			collection.ID = id
			_, err = session.Insert(collection)
			if err != nil {
				return result, errors.InternalServer(reason.DatabaseError).WithError(err).WithStack()
			}
		}
		return
	})
	return err
CVE-2023-0740 (Unknown, published 2023-02-08T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/answerdev/answer
Files changed:
Commit message: Merge branch 'release/1.0.4' into 'main'

fix(i18n): Resolve an issue that causes unexpected errors when translation...

See merge request opensource/answer!438

Vulnerable code:

Fixed code:
CVE-2023-0741 (Unknown, published 2023-02-08T08:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/answerdev/answer
Files changed:
Commit message: Merge branch 'release/1.0.4' into 'main'

fix(i18n): Resolve an issue that causes unexpected errors when translation...

See merge request opensource/answer!438

Vulnerable code:

Fixed code:
CVE-2023-0742 (Unknown, published 2023-02-08T08:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/answerdev/answer
Files changed:
Commit message: Merge branch 'release/1.0.4' into 'main'

fix(i18n): Resolve an issue that causes unexpected errors when translation...

See merge request opensource/answer!438

Vulnerable code:

Fixed code:
CVE-2023-0743 (Go, published 2023-02-08T08:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.
Severity: nan (CVSS v3 base score: 9)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/answerdev/answer
Files changed:
internal/base/middleware/avatar.go
Commit message: update img header


Vulnerable code:

Fixed code:
	"path"
			ext := strings.ToLower(path.Ext(filePath)[1:])
			ctx.Header("content-type", fmt.Sprintf("image/%s", ext))
		} else {
			uUrl, err := url.Parse(u)
			if err != nil {
				ctx.Next()
				return
			}
			_, urlfileName := filepath.Split(uUrl.Path)
			uploadPath := am.serviceConfig.UploadPath
			filePath := fmt.Sprintf("%s/%s", uploadPath, urlfileName)
			ext := strings.ToLower(path.Ext(filePath)[1:])
			ctx.Header("content-type", fmt.Sprintf("image/%s", ext))
CVE-2023-0744 (Go, published 2023-02-08T08:15Z)
Description: value: Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/answerdev/answer
Files changed:
internal/controller/user_controller.go
Commit message: fix  RetrievePassWord code


Vulnerable code:
	code, err := uc.userService.RetrievePassWord(ctx, req)
	handler.HandleResponse(ctx, err, code)

Fixed code:
	_, err := uc.userService.RetrievePassWord(ctx, req)
	handler.HandleResponse(ctx, err, nil)
CVE-2023-0934 (Go, published 2023-02-21T15:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/answerdev/answer
Files changed:
internal/base/validator/validator.go
internal/controller_admin/siteinfo_controller.go
internal/schema/siteinfo_schema.go
Commit message: add input sanitizer


Vulnerable code:
	handler.HandleResponse(ctx, err, nil)
	Name             string `validate:"required,gt=1,lte=128" form:"name" json:"name"`
	ShortDescription string `validate:"omitempty,gt=3,lte=255" form:"short_description" json:"short_description"`
	Description      string `validate:"omitempty,gt=3,lte=2000" form:"description" json:"description"`
	SiteUrl          string `validate:"required,gt=1,lte=512,url" form:"site_url" json:"site_url"`
	ContactEmail     string `validate:"required,gt=1,lte=512,email" form:"contact_email" json:"contact_email"`

Fixed code:
	"github.com/microcosm-cc/bluemonday"
func Sanitizer(fl validator.FieldLevel) (res bool) {
	field := fl.Field()
	switch field.Kind() {
	case reflect.String:
		filter := bluemonday.UGCPolicy()
		field.SetString(filter.Sanitize(field.String()))
		return true
	case reflect.Chan, reflect.Map, reflect.Slice, reflect.Array:
		return field.Len() > 0
	case reflect.Ptr, reflect.Interface, reflect.Func:
		return !field.IsNil()
	default:
		return field.IsValid() && field.Interface() != reflect.Zero(field.Type()).Interface()
	}
}

	_ = validate.RegisterValidation("sanitizer", Sanitizer)
	handler.HandleResponse(ctx, err, req)
	Name             string `validate:"required,sanitizer,gt=1,lte=128" form:"name" json:"name"`
	ShortDescription string `validate:"omitempty,sanitizer,gt=3,lte=255" form:"short_description" json:"short_description"`
	Description      string `validate:"omitempty,sanitizer,gt=3,lte=2000" form:"description" json:"description"`
	SiteUrl          string `validate:"required,sanitizer,gt=1,lte=512,url" form:"site_url" json:"site_url"`
	ContactEmail     string `validate:"required,sanitizer,gt=1,lte=512,email" form:"contact_email" json:"contact_email"`