hitoshura25/cvefixes huggingface dataset:
CVE-2021-46249 (PHP, published 2022-02-15T23:15Z)
Description: value: An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Files changed:
includes/api/SpecificApps.php
Commit message: SECURITY: Deny modification of flags using REST API
Authorization bypass by user-controlled key in SpecificApps REST API in 
ScratchOAuth2 allows app owners to set flags that indicate whether an 
app is verified on their own apps.


Vulnerable code:

Fixed code:
		// Users may not modify flags, thus 403
		if (array_key_exists('flags', $data)) return $this->getResponseFactory()->createHttpError(403);
CVE-2021-46250 (PHP, published 2022-02-15T23:15Z)
Description: value: An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.
Severity: HIGH (CVSS v3 base score: 10)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Files changed:
includes/common/login.php
Commit message: SECURITY: Use strict comparison when authenticating
Incorrect comparison (autocasting) in SOA2Login::commented in 
ScratchOAuth2 allows unprivileged attackers to authorize as other users 
on downstream components that rely on ScratchOAuth2, as demonstrated by 
"1234567890" and "123456789e1".


Vulnerable code:
			if (strtolower($matches[1][$i]) != $username) continue;

Fixed code:
			if (strtolower($matches[1][$i]) !== $username) continue;
CVE-2021-46251 (PHP, published 2022-02-15T23:15Z)
Description: value: A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ScratchVerifier/ScratchOAuth2
Files changed:
includes/special/SpecialScratchOAuth2.php
Commit message: SECURITY: Escape username in invalid username error
POST request with invalid usernames to SpecialScratchOAuth2 page in 
ScratchOAuth2 may lead to reflected cross-site scripting.


Vulnerable code:
					wfMessage('soa2-invalid-username', $username)->plain()

Fixed code:
					wfMessage('soa2-invalid-username')->plaintextParams($username)->parse()
CVE-2021-46898 (Python, published 2023-10-22T19:15Z)
Description: value: views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //example.com) attack.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/sehmaschine/django-grappelli
Files changed:
grappelli/views/switch.py
Commit message: Update switch.py

This will fix issue #975 (I referred to this https://github.com/django/django/blob/main/django/views/i18n.py#L41-L45)

Vulnerable code:
    if redirect_url is None or not redirect_url.startswith("/"):

            return redirect(request.GET.get("redirect"))
        return redirect(request.GET.get("redirect"))
            return redirect(request.GET.get("redirect"))
        return redirect(request.GET.get("redirect"))
    return redirect(request.GET.get("redirect"))

Fixed code:
from django.utils.http import url_has_allowed_host_and_scheme
    if redirect_url is None or not \
        url_has_allowed_host_and_scheme(
            url=redirect_url,
            allowed_hosts={request.get_host()},
            require_https=request.is_secure(),
        ):
        
            return redirect(redirect_url)
        return redirect(redirect_url)
            return redirect(redirect_url)
        return redirect(redirect_url)
    return redirect(redirect_url)
CVE-2011-4344 (Java, published 2011-12-01T11:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/jenkinsci/winstone
Files changed:
src/java/winstone/ErrorServlet.java
src/java/winstone/URIUtil.java
src/java/winstone/WinstoneResponse.java
Commit message: escape error messages which are supposed be plain text and not markup


Vulnerable code:
                new String[] { sc + "", (msg == null ? "" : msg), sw.toString(),
                new String[] { sc + "", (msg == null ? "" : msg), "",

Fixed code:
                new String[] { sc + "", URIUtil.htmlEscape(msg == null ? "" : msg), URIUtil.htmlEscape(sw.toString()),
    /**
     * Performs necessary escaping to render arbitrary plain text as plain text without any markup.
     */
    public static String htmlEscape(String text) {
        StringBuilder buf = new StringBuilder(text.length()+64);
        for( int i=0; i<text.length(); i++ ) {
            char ch = text.charAt(i);
            if(ch=='<')
                buf.append("&lt;");
            else
            if(ch=='&')
                buf.append("&amp;");
            else
                buf.append(ch);
        }
        return buf.toString();
    }
                new String[] { sc + "", URIUtil.htmlEscape(msg == null ? "" : msg), "",
CVE-2013-2012 (Shell, published 2019-10-31T20:15Z)
Description: value: autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.
Severity: MEDIUM (CVSS v3 base score: 7.3)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/wting/autojump
Files changed:
bin/autojump
bin/autojump.sh
install.sh
Commit message: better fix for custom installation directories


Vulnerable code:
VERSION = 'release-v21.5.6'
elif [ -s /destdir_${RANDOM}_install/autojump.${shell} ]; then
	source /destdir_${RANDOM}_install/autojump.${shell}
    sed -i "s:/destdir_.*_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh

Fixed code:
VERSION = 'release-v21.5.7'
#custom#	elif [ -s destdir_install/autojump.${shell} ]; then
#custom#		source destdir_install/autojump.${shell}
    sed -i "s:#custom#\t::g" ${destdir}etc/profile.d/autojump.sh
    sed -i "s:destdir_install\t:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
CVE-2013-2012 (Shell, published 2019-10-31T20:15Z)
Description: value: autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.
Severity: MEDIUM (CVSS v3 base score: 7.3)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/wting/autojump
Files changed:
bin/autojump
bin/autojump.sh
install.sh
Commit message: Fix security bug that allows running arbitrary user code.

https://bugzilla.redhat.com/show_bug.cgi?id=950777


Vulnerable code:
VERSION = 'release-v21.5.5'
elif [ -s custom_install/autojump.${shell} ]; then
	source custom_install/autojump.${shell}
    sed -i "s:custom_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh

Fixed code:
VERSION = 'release-v21.5.6'
elif [ -s /destdir_${RANDOM}_install/autojump.${shell} ]; then
	source /destdir_${RANDOM}_install/autojump.${shell}
    sed -i "s:/destdir_.*_install:${destdir}etc/profile.d:g" ${destdir}etc/profile.d/autojump.sh
CVE-2015-1428 (SQL, published 2015-02-03T16:59Z)
Description: value: Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/sefrengo-cms/sefrengo-1.x
Files changed:
changelog.md
setup/index.php
setup/sql/config.sql
setup/sql/updates_from.01.06.01.sql
Commit message: Updated version number to v1.6.2


Vulnerable code:
							'updates_from.01.06.00.sql');
		$this -> version['fix']   = '01';
INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.01', '0', NULL, NULL, '', NULL, NULL, '0');

Fixed code:
Sefrengo v1.6.2
------------------------------------------------------------------------------------------------
Internal versionnumber: 01.06.02<br/>
Release: 25.01.2015

See full changelog at <https://github.com/sefrengo-cms/sefrengo-1.x/commits/v1.6.2>

* FIXED: Escaped strings for session ids and name
* ADDED: Sortable CSS and JS files for layouts (thanks to sidd)



							'updates_from.01.06.00.sql',
							'updates_from.01.06.01.sql');
		$this -> version['fix']   = '02';
INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.02', '0', NULL, NULL, '', NULL, NULL, '0');
# 25.01.2015 set new versionnumber - Sefrengo 1.6.2
UPDATE cms_values  SET value =  '01.06.02' WHERE group_name =  'cfg' AND key1 =  'version';
CVE-2015-1428 (PHP, published 2015-02-03T16:59Z)
Description: value: Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/sefrengo-cms/sefrengo-1.x
Files changed:
backend/external/phplib/local.php
Commit message: Escaped strings for session ids and name


Vulnerable code:
													sid = '" . $this->cache_id . "'";
									 name = '" . $this->cache_name . "'
									 sid =  '" . $cache_id . "'";
            $id,
            $name);
            $id,
                $str,
                $id));
                $id,
                $name);
                $id,

Fixed code:
													sid = '" . addslashes( $this->cache_id ) . "'";
									 name = '" . addslashes( $this->cache_name ) . "'
									 sid =  '" . addslashes( $cache_id ) . "'";
            addslashes($id),
            addslashes($name));
            addslashes($id),
                addslashes($str),
                addslashes($id)));
                addslashes($id),
                addslashes($name));
                addslashes($id),
CVE-2013-4562 (Ruby, published 2014-05-13T15:55Z)
Description: value: The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/mkdynamic/omniauth-facebook
Files changed:
README.md
lib/omniauth/facebook/version.rb
lib/omniauth/strategies/facebook.rb
test/support/shared_examples.rb
test/test.rb
Commit message: fix CSRF vulnerability. prepare 1.5.0 release


Vulnerable code:
You can also pass through a `state` param which will be passed along to the callback url.

    VERSION = "1.4.1"
      # You can pass +display+, +state+ or +scope+ params to the auth request, if
          %w[display state scope].each do |v|

              # to support omniauth-oauth2's auto csrf protection
              session['omniauth.state'] = params[:state] if v == 'state'
    test 'should store state in the session when present in authorize params vs. a random one' do
      assert_equal 'bar', strategy.authorize_params[:state]
      assert_equal 'bar', strategy.session['omniauth.state']
    test 'should store state in the session when present in request params vs. a random one' do
      assert_equal 'foo', strategy.authorize_params[:state]
      assert_equal 'foo', strategy.session['omniauth.state']
  test 'includes state parameter from request when present' do
    @request.stubs(:params).returns({ 'state' => 'some_state' })
    assert strategy.authorize_params.is_a?(Hash)
    assert_equal 'some_state', strategy.authorize_params[:state]
  end


Fixed code:
    VERSION = "1.5.0"
      # You can pass +display+ or +scope+ params to the auth request, if
          %w[display scope].each do |v|
    test 'should not store state in the session when present in authorize params vs. a random one' do
      refute_equal 'bar', strategy.authorize_params[:state]
      refute_equal 'bar', strategy.session['omniauth.state']
    test 'should not store state in the session when present in request params vs. a random one' do
      refute_equal 'foo', strategy.authorize_params[:state]
      refute_equal 'foo', strategy.session['omniauth.state']
CVE-2022-31094 (Unknown, published 2022-06-27T21:15Z)
Description: value: ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affected versions anybody who uses the Recently Viewed Projects feature is vulnerable to having their account taken over if they view a project that tries to. The issue is that if a user visits a project that includes Javascript in the title, then when the Recently Viewed Projects feature displays it, it could run the Javascript. This issue has been addressed in the 2.5.2 release. Users having issues scratching should open an issue in the project issue tracker https://github.com/STForScratch/ScratchTools/
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/STForScratch/ScratchTools
Files changed:
Commit message: Merge pull request #55 from STForScratch/fix-project-recently-viewed-security-issue

Fix Security Bug with Recently Viewed Projects

Vulnerable code:

Fixed code:
CVE-2022-36020 (PHP, published 2022-09-13T17:15Z)
Description: value: The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TYPO3/html-sanitizer
Files changed:
composer.json
tests/ScenarioTest.php
Commit message: [SECURITY] Correctly handle comment end bang state (#86)

Upgrade to https://github.com/Masterminds/html5-php/releases/tag/2.7.6

Security-References: CVE-2022-36020

Vulnerable code:
		"masterminds/html5": "^2.7",

Fixed code:
		"masterminds/html5": "^2.7.6",
    public static function allTagsAreRemovedOnMissingDeclarationDataProvider(): array
    {
        return [
            ['<div class="content">value</div><span class="content">value</span>', ''],
            ['<!--any--><div class="content">value</div>', '<!--any-->'],
            ['<!--any--!><div class="content">value</div>', '<!--any-->'],
        ];
    }

    /**
     * @test
     * @dataProvider allTagsAreRemovedOnMissingDeclarationDataProvider
     */
    public function allTagsAreRemovedOnMissingDeclaration(string $payload, string $expectation): void
    {
        $behavior = new Behavior();
        $sanitizer = new Sanitizer(
            new CommonVisitor($behavior)
        );
        self::assertSame($expectation, $sanitizer->sanitize($payload));
    }
CVE-2023-47125 (PHP, published 2023-11-14T20:15Z)
Description: value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TYPO3/html-sanitizer
Files changed:
src/Behavior.php
src/Builder/CommonBuilder.php
src/Visitor/CommonVisitor.php
tests/CommonBuilderTest.php
Commit message: [SECURITY] Deny processing instructions

XML processing instructions (e.g. `<?xml>`)
are denied during the sanitization process.


Vulnerable code:
            ->withFlags(Behavior::ENCODE_INVALID_TAG | Behavior::REMOVE_UNEXPECTED_CHILDREN)

Fixed code:
    /**
     * in case an unexpected processing instruction (e.g. `<?xml>`) was found, encode the whole node as HTML
     */
    public const ENCODE_INVALID_PROCESSING_INSTRUCTION = 64;

    public function shallEncodeInvalidProcessingInstruction(): bool
    {
        return ($this->flags & self::ENCODE_INVALID_PROCESSING_INSTRUCTION) === self::ENCODE_INVALID_PROCESSING_INSTRUCTION;
    }

            ->withFlags(
                Behavior::ENCODE_INVALID_TAG
                | Behavior::REMOVE_UNEXPECTED_CHILDREN
                | Behavior::ENCODE_INVALID_PROCESSING_INSTRUCTION
            )
use DOMProcessingInstruction;
        if ($domNode instanceof DOMProcessingInstruction) {
            return $this->handleInvalidNode($domNode);
        }

            || ($domNode instanceof DOMProcessingInstruction && $this->behavior->shallEncodeInvalidProcessingInstruction())
            '#912' => [
                '<!---><p>',
                '<!---&gt;&lt;p&gt;-->',
            ],
            '#913' => [
                '<!---!><p>',
                '<!---!&gt;&lt;p&gt;-->',
            ],
            '#941' => [
                '<?xml >s<img src=x onerror=alert(1)> ?>',
                '&lt;?xml &gt;s&lt;img src=x onerror=alert(1)&gt; ?&gt;',
            ],
CVE-2021-24666 (PHP, published 2021-09-27T16:15Z)
Description: value: The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/podlove/podlove-publisher
Files changed:
lib/modules/social/model/contributor_service.php
lib/modules/social/model/show_service.php
readme.txt
Commit message: fix(security): sql injection in "Social & Donations" module


Vulnerable code:

Fixed code:
        $contributor_id = (int) $contributor_id;
        $category = $category == 'social' ? 'social' : 'donation';

        $category = $category == 'social' ? 'social' : 'donation';

= 2021-08-22 =

* fix(security): sql injection in "Social & Donations" module