hitoshura25/cvefixes huggingface dataset:
CVE-2021-3863 (Unknown, published 2021-10-19T13:15Z)
Description: value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10171 from snipe/fixes/xss_svg_in_file_uploads

Fixed SVG XSS vuln

Vulnerable code:

Fixed code:
CVE-2021-3879 (PHP, published 2021-10-19T13:15Z)
Description: value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
resources/views/partials/bootstrap-table.blade.php
Commit message: Fixes possible XSS on all-file-types export

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:

Fixed code:
            exportOptions: {
                htmlContent: true,
            },
CVE-2021-3931 (PHP, published 2021-11-13T09:15Z)
Description: value: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/snipe/snipe-it
Files changed:
resources/views/custom_fields/fieldsets/view.blade.php
routes/web/fields.php
Commit message: Turn cusotm fields required/optional/remove into POST requests

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
                        <a href="{{ route('fields.optional', [$custom_fieldset->id, $field->id]) }}">
                            <i class="fa fa-check text-success" aria-hidden="true"></i>
                            <span class="sr-only">Required - click to make optional</span>
                        </a>
                        <a href="{{ route('fields.required', [$custom_fieldset->id, $field->id]) }}">
                            <i class="fa fa-times text-danger" aria-hidden="true"></i>
                            <span class="sr-only">Optional - click to make required</span>
                        </a>
                <a href="{{ route('fields.disassociate', [$field, $custom_fieldset->id]) }}" class="btn btn-sm btn-danger">Remove</a>
    Route::get('required/{fieldset_id}/{field_id}',
    Route::get('optional/{fieldset_id}/{field_id}',
    Route::get('{field_id}/fieldset/{fieldset_id}/disassociate',

Fixed code:
                  
                    <form method="post" action="{{ route('fields.optional', [$custom_fieldset->id, $field->id]) }}">
                      @csrf 
                      <button type="submit" class="btn btn-link"><i class="fa fa-check text-success" aria-hidden="true"></i></button>
                      </form>


                      <form method="post" action="{{ route('fields.required', [$custom_fieldset->id, $field->id]) }}">
                      @csrf 
                      <button type="submit" class="btn btn-link"><i class="fa fa-times text-danger" aria-hidden="true"></i></button>
                      </form>
                    
                <form method="post" action="{{ route('fields.disassociate', [$field, $custom_fieldset->id]) }}">
                  @csrf 
                  <button type="submit" class="btn btn-sm btn-danger">Remove</button>
                </form>
    Route::post('required/{fieldset_id}/{field_id}',
    Route::post('optional/{fieldset_id}/{field_id}',
    Route::post('{field_id}/fieldset/{fieldset_id}/disassociate',
CVE-2021-3938 (Unknown, published 2021-11-13T09:15Z)
Description: value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10286 from uberbrady/fix_bulk_audit_xss

Escape asset_tag attribute at controller level for bulk checkout

Vulnerable code:

Fixed code:
CVE-2021-3961 (Unknown, published 2021-11-19T12:15Z)
Description: value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10315 from snipe/fixes/escape_custom_fields_in_api_response

Escape custom field values in API response

Vulnerable code:

Fixed code:
CVE-2021-4018 (Unknown, published 2021-12-01T10:15Z)
Description: value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10361 from snipe/fixes/xss_in_accessories_checkout_notes

Escape notes in transformCheckedOutAccessory

Vulnerable code:

Fixed code:
CVE-2021-4075 (Unknown, published 2021-12-06T21:15Z)
Description: value: snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10394 from snipe/fixes/add_stricter_validation_for_slack_hooks

Adds stricter validation for slack hooks

Vulnerable code:

Fixed code:
CVE-2021-4089 (PHP, published 2021-12-10T20:15Z)
Description: value: snipe-it is vulnerable to Improper Access Control
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/AssetModelsController.php
Commit message: Update AssetModelsController.php

Vulnerable code:
        $this->authorize('view', AssetModel::class);

Fixed code:
        $this->authorize('create', AssetModel::class);
CVE-2021-4108 (PHP, published 2021-12-14T20:15Z)
Description: value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Transformers/AssetsTransformer.php
Commit message: Added escape to assigned_to API response

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
            'name' => $asset->assigned->display_name,

Fixed code:
            'name' => e($asset->assigned->display_name),
CVE-2021-4130 (PHP, published 2021-12-18T05:15Z)
Description: value: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/ViewAssetsController.php
resources/lang/en/admin/hardware/message.php
resources/views/partials/bootstrap-table.blade.php
routes/web.php
Commit message: Switch GET to POST for asset request

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
                ->with('success')->with('success', trans('admin/hardware/message.requests.cancel-success'));
        'canceled'      => 'Checkout request successfully canceled'
            return '<form action="{{ url('/') }}/account/request-asset/'+ value.id + '" method="GET"><button class="btn btn-danger btn-sm" data-toggle="tooltip" title="Cancel this item request">{{ trans('button.cancel') }}</button></form>';
            return '<form action="{{ url('/') }}/account/request-asset/'+ value.id + '" method="GET"><button class="btn btn-primary btn-sm" data-toggle="tooltip" title="Request this item">{{ trans('button.request') }}</button></form>';
    Route::get(

Fixed code:
                ->with('success')->with('success', trans('admin/hardware/message.requests.cancel'));
        'cancel'      => 'Checkout request successfully canceled'
            return '<form action="{{ url('/') }}/account/request-asset/'+ value.id + '" method="POST">@csrf<button class="btn btn-danger btn-sm" data-toggle="tooltip" title="Cancel this item request">{{ trans('button.cancel') }}</button></form>';
            return '<form action="{{ url('/') }}/account/request-asset/'+ value.id + '" method="POST">@csrf<button class="btn btn-primary btn-sm" data-toggle="tooltip" title="Request this item">{{ trans('button.request') }}</button></form>';
    Route::post(
CVE-2022-0178 (Unknown, published 2022-01-13T23:15Z)
Description: value: Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.


Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10504 from snipe/fixes/auth_controls_on_api_key_creation

Fixes auth controls on api key creation

Vulnerable code:

Fixed code:
CVE-2022-0179 (Unknown, published 2022-01-12T05:15Z)
Description: value: snipe-it is vulnerable to Missing Authorization
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10498 from Haxatron/master

Fix access control

Vulnerable code:

Fixed code:
CVE-2022-0569 (PHP, published 2022-02-14T12:15Z)
Description: value: Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.


Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/snipe/snipe-it
Files changed:
resources/lang/en/passwords.php
Commit message: Updated language string

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
    'sent'	        => 'Your password link has been sent!',

Fixed code:
    'sent'	        => 'Success: If that email address exists in our system, a password recovery email has been sent.',
CVE-2022-0579 (Unknown, published 2022-02-14T19:15Z)
Description: value: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.


Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10665 from snipe/fixes/adds_gate_to_supplier_view

Adds gate to supplier

Vulnerable code:

Fixed code:
CVE-2022-0611 (Unknown, published 2022-02-16T00:15Z)
Description: value: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.


Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10672 from snipe/fixes/missing_gates_for_maintenances

Added Asset edit/delete gates to maintenances

Vulnerable code:

Fixed code:
CVE-2022-0622 (PHP, published 2022-02-17T02:15Z)
Description: value: Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/Auth/ForgotPasswordController.php
Commit message: Added usleep :(

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:

Fixed code:
        // Prevent timing attack to enumerate users.
        usleep(500000 + random_int(0, 1500000));
CVE-2022-1155 (PHP, published 2022-03-30T13:15Z)
Description: value: Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Kernel.php
app/Http/Middleware/CheckUserIsActivated.php
resources/lang/en/auth/message.php
Commit message: Logout user when their activated status is switched to off

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
class Authenticate
        if ($this->auth->guest()) {
            if ($request->ajax()) {
                return response('Unauthorized.', 401);
            } else {
                return redirect()->guest('login');
            }
    'account_not_found'      => 'The username or password is incorrect.',

Fixed code:
            \App\Http\Middleware\CheckUserIsActivated::class,
use Auth;
class CheckUserIsActivated

        // If there is a user AND the user is NOT activated, send them to the login page
        // This prevents people who still have active sessions logged in and their status gets toggled
        // to inactive (aka unable to login)
        if (($request->user()) && (!$request->user()->isActivated())) {
            Auth::logout();
            return redirect()->guest('login');

    'account_not_found'      => 'The username or password is incorrect or this user is not approved to login.',
CVE-2022-1380 (Unknown, published 2022-04-16T12:15Z)
Description: value: Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10942 from snipe/fixes/xss_user_requested

Fixes potential XSS vuln in user requestable results

Vulnerable code:

Fixed code:
CVE-2022-1445 (PHP, published 2022-04-24T15:15Z)
Description: value: Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Transformers/DepreciationReportTransformer.php
Commit message: Escape checkout target name

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
            'checked_out_to' => $checkout_target,

Fixed code:
            'checked_out_to' => ($checkout_target) ? e($checkout_target) : null,
CVE-2022-1511 (PHP, published 2022-04-28T15:15Z)
Description: value: Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/Assets/AssetsController.php
Commit message: Added access gate to the requested assets index

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:

Fixed code:
        $this->authorize('index', Asset::class);
CVE-2022-23064 (PHP, published 2022-05-02T13:15Z)
Description: value: In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This leads to account take over.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/snipe/snipe-it
Files changed:
.env.example
app/Providers/AppServiceProvider.php
Commit message: Force UrlGenerator's Root URL to be the base of APP_URL unless overriden
(For v5)


Vulnerable code:

Fixed code:
APP_ALLOW_INSECURE_HOSTS=false

        // TODO - isn't it somehow 'gauche' to check the environment directly; shouldn't we be using config() somehow?
        if ( ! env('APP_ALLOW_INSECURE_HOSTS')) {  // unless you set APP_ALLOW_INSECURE_HOSTS, you should PROHIBIT forging domain parts of URL via Host: headers
            $url_parts = parse_url(config('app.url'));
            $root_url = $url_parts['scheme'].'://'.$url_parts['host'].( isset($url_parts['port']) ? ':'.$url_parts['port'] : '');
            \URL::forceRootUrl($root_url);
        }
CVE-2022-2997 (PHP, published 2022-08-25T21:15Z)
Description: value: Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
Severity: nan (CVSS v3 base score: 8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/ProfileController.php
app/Http/Kernel.php
Commit message: Log user out of other devices when they change their password

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
use Auth;


Fixed code:
use Illuminate\Support\Facades\Auth;
        

            // Log the user out of other devices
            Auth::logoutOtherDevices($request->input('password'));
            \Illuminate\Session\Middleware\AuthenticateSession::class,
CVE-2022-3173 (PHP, published 2022-09-17T07:15Z)
Description: value: Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Http/Controllers/Licenses/LicenseFilesController.php
app/Policies/LicensePolicy.php
app/Policies/SnipePermissionsPolicy.php
app/Providers/AuthServiceProvider.php
resources/lang/en/admin/licenses/message.php
resources/views/licenses/view.blade.php
Commit message: Check for licenses.files permissions

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
        return redirect()->route('license.index')->with('error', trans('admin/licenses/message.does_not_exist', ['id' => $fileId]));
    public function files(User $user)
        return $user->hasAccess($this->columnName().'.files');
    'does_not_exist' => 'License does not exist.',
        
        @can('files', $license)

Fixed code:
            $this->authorize('licenses.files', $license);
        return redirect()->route('licenses.index')->with('error', trans('admin/licenses/message.does_not_exist', ['id' => $fileId]));
    public function viewFiles(User $user)
        if ($user->hasAccess('licenses.files'))  {
            return true;
        }
        return false;

    public function files(User $user, $item = null)
    {
        return $user->hasAccess($this->columnName().'.files');
    }

        Gate::define('licenses.files', function ($user) {
            if ($user->hasAccess('licenses.files')) {
                return true;
            }
        });


    'does_not_exist' => 'License does not exist or you do not have permission to view it.',

        @can('licenses.files', $license)
        @endcan
        @can('licenses.files', $license)