hitoshura25/cvefixes huggingface dataset:
CVE-2016-9130 (PHP, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
lib/max/Delivery/adRender.php
lib/templates/admin/campaign-zone-zones.html
Commit message: Fix h1 reports 107550 and 107634

Persistent XSS
--------------
Johan Caluwe has reported via HackerOne two vectors for persistent XSS
Revive Adserver user interface, both requiring a trusted (non-admin) account:

1. the website name wasn't properly escaped when displayed in the
   campaign-zone.php script;
2. the banner image url for external banners wasn't properly escaped when
   displayed in most of the banner related pages.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)


Vulnerable code:
        $beacon = "$div<img src='".htmlspecialchars($logUrl)."' width='0' height='0' alt=''{$style} />{$divEnd}";
        $clickTag = "<a href='$clickUrl' target='{target}'$status>";
        $imageTag = "$clickTag<img src='$imageUrl' width='$width' height='$height' alt='$alt' title='$alt' border='0'$imgStatus />$clickTagEnd";
        $clickTag = "<a href='$clickUrl' target='$target'$status>";
          <a title="{t str=EditWebsite} {$website.name}" class="website-icon" href="affiliate-edit.php?affiliateid={$websiteid}">&nbsp;</a>
            <a title="{t str=EditZone} {$website.name}" class="zone-icon" href="zone-edit.php?affiliateid={$websiteid}&zoneid={$zoneid}">&nbsp;</a>

Fixed code:
        $beacon = "$div<img src='".htmlspecialchars($logUrl, ENT_QUOTES)."' width='0' height='0' alt=''{$style} />{$divEnd}";
        $clickTag = "<a href='".htmlspecialchars($clickUrl, ENT_QUOTES)."' target='{target}'$status>";
        $imageTag = "$clickTag<img src='".htmlspecialchars($imageUrl, ENT_QUOTES)."' width='$width' height='$height' alt='$alt' title='$alt' border='0'$imgStatus />$clickTagEnd";
        $clickTag = "<a href='".htmlspecialchars($clickUrl, ENT_QUOTES)."' target='$target'$status>";
          <a title="{t str=EditWebsite} {$website.name|escape}" class="website-icon" href="affiliate-edit.php?affiliateid={$websiteid}">&nbsp;</a>
            <a title="{t str=EditZone} {$website.name|escape}" class="zone-icon" href="zone-edit.php?affiliateid={$websiteid}&zoneid={$zoneid}">&nbsp;</a>
CVE-2016-9454 (PHP, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
lib/max/Delivery/adRender.php
lib/templates/admin/campaign-zone-zones.html
Commit message: Fix h1 reports 107550 and 107634

Persistent XSS
--------------
Johan Caluwe has reported via HackerOne two vectors for persistent XSS
Revive Adserver user interface, both requiring a trusted (non-admin) account:

1. the website name wasn't properly escaped when displayed in the
   campaign-zone.php script;
2. the banner image url for external banners wasn't properly escaped when
   displayed in most of the banner related pages.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)


Vulnerable code:
        $beacon = "$div<img src='".htmlspecialchars($logUrl)."' width='0' height='0' alt=''{$style} />{$divEnd}";
        $clickTag = "<a href='$clickUrl' target='{target}'$status>";
        $imageTag = "$clickTag<img src='$imageUrl' width='$width' height='$height' alt='$alt' title='$alt' border='0'$imgStatus />$clickTagEnd";
        $clickTag = "<a href='$clickUrl' target='$target'$status>";
          <a title="{t str=EditWebsite} {$website.name}" class="website-icon" href="affiliate-edit.php?affiliateid={$websiteid}">&nbsp;</a>
            <a title="{t str=EditZone} {$website.name}" class="zone-icon" href="zone-edit.php?affiliateid={$websiteid}&zoneid={$zoneid}">&nbsp;</a>

Fixed code:
        $beacon = "$div<img src='".htmlspecialchars($logUrl, ENT_QUOTES)."' width='0' height='0' alt=''{$style} />{$divEnd}";
        $clickTag = "<a href='".htmlspecialchars($clickUrl, ENT_QUOTES)."' target='{target}'$status>";
        $imageTag = "$clickTag<img src='".htmlspecialchars($imageUrl, ENT_QUOTES)."' width='$width' height='$height' alt='$alt' title='$alt' border='0'$imgStatus />$clickTagEnd";
        $clickTag = "<a href='".htmlspecialchars($clickUrl, ENT_QUOTES)."' target='$target'$status>";
          <a title="{t str=EditWebsite} {$website.name|escape}" class="website-icon" href="affiliate-edit.php?affiliateid={$websiteid}">&nbsp;</a>
            <a title="{t str=EditZone} {$website.name|escape}" class="zone-icon" href="zone-edit.php?affiliateid={$websiteid}&zoneid={$zoneid}">&nbsp;</a>
CVE-2017-12904 (C++, published 2017-08-23T14:29Z)
Description: value: Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-943 \u2014 Improper Neutralization of Special Elements in Data Query Logic
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Repository: https://github.com/akrennmair/newsbeuter
Files changed:
src/controller.cpp
Commit message: Sanitize inputs to bookmark-cmd (#591)

Newsbeuter didn't properly shell-escape the arguments passed to
bookmarking command, which allows a remote attacker to perform remote
code execution by crafting an RSS item whose title and/or URL contain
something interpretable by the shell (most notably subshell
invocations.)

This has been reported by Jeriko One <jeriko.one@gmx.us>, complete with
PoC and a patch.

This vulnerability was assigned CVE-2017-12904.


Vulnerable code:
		std::string cmdline = strprintf::fmt("%s '%s' %s %s %s",
		                                       quote_empty(stfl::quote(title)),
		                                       quote_empty(stfl::quote(description)),
		                                       quote_empty(stfl::quote(feed_title)));

Fixed code:
		std::string cmdline = strprintf::fmt("%s '%s' '%s' '%s' '%s'",
		                                       utils::replace_all(title,"'", "%27"),
		                                       utils::replace_all(description,"'", "%27"),
		                                       utils::replace_all(feed_title,"'", "%27"));
CVE-2017-14500 (C++, published 2017-09-17T05:29Z)
Description: value: Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/akrennmair/newsbeuter
Files changed:
src/pb_controller.cpp
src/queueloader.cpp
Commit message: Work around shell code in podcast names (#598)


Vulnerable code:
	cmdline.append(" \"");
	cmdline.append(utils::replace_all(file,"\"", "\\\""));
	cmdline.append("\"");
		fn.append(base);

Fixed code:
	cmdline.append(" '");
	cmdline.append(utils::replace_all(file,"'", "%27"));
	cmdline.append("'");
		fn.append(utils::replace_all(base, "'", "%27"));
CVE-2014-8540 (Ruby, published 2018-01-05T16:29Z)
Description: value: The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://gitlab.com/gitlab-org/gitlab-ce
Files changed:
lib/api/group_members.rb
spec/requests/api/group_members_spec.rb
Commit message: Dont allow guests..developers to manage group members

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>


Vulnerable code:
        group = find_group(params[:id])
        member =  group.group_members.find_by(user_id: params[:user_id])
        count_before=group_with_members.group_members.count
        delete api("/groups/#{group_with_members.id}/members/#{guest.id}", owner)
        group_with_members.group_members.count.should == count_before - 1

Fixed code:
        group = find_group(params[:id])
        authorize! :manage_group, group



        authorize! :manage_group, group
        member = group.group_members.find_by(user_id: params[:user_id])

        expect {
          delete api("/groups/#{group_with_members.id}/members/#{guest.id}", owner)
        }.to change { group_with_members.members.count }.by(-1)


      it "should not allow guest to modify group members" do
        delete api("/groups/#{group_with_members.id}/members/#{master.id}", guest)
        response.status.should == 403
      end
CVE-2022-4927 (Ruby, published 2023-03-05T20:15Z)
Description: value: A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/_refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be initiated remotely. Upgrading to version 1.0.71 is able to address this issue. The patch is named abe9f57123e0c278ae190cd7402a623d66c51375. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222287.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/ualbertalib/NEOSDiscovery
Files changed:
app/views/bookmarks/_refworks.html.erb
Commit message: Reverse Tabnabbing

When opening a link in a new tab without setting rel: "noopener noreferrer", the new tab can control the parent tab's location. For example, an attacker could redirect to a phishing page.


Vulnerable code:
    <%= link_to t('blacklight.tools.refworks'), refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), :class => "btn btn-default", :id => "refworksLink", :target => "_blank" %>

Fixed code:
    <%= link_to t('blacklight.tools.refworks'), 
                refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), 
                class: "btn btn-default", 
                id: "refworksLink", 
                rel: 'noopener noreferrer',
                target: "_blank" %>
CVE-2018-25096 (PHP, published 2023-12-30T10:15Z)
Description: value: A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/MdAlAmin-aol/ownhealthrecord
Files changed:
includes/logout.php
Commit message: added CSRF check and fixed broken redirect link from login.php to index.php


Vulnerable code:
header("Location: ../login.php");

Fixed code:
 
 // check whether csrf token in _SESSION is valid, if not, die and stop script
if($_POST['csrf'] !== $_SESSION['csrf_token']) {
  die("invalid Token");
}
header("Location: ../index.php");
CVE-2019-3553 (C, published 2020-03-10T21:15Z)
Description: value: C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/facebook/fbthrift
Files changed:
thrift/lib/cpp2/protocol/BinaryProtocol-inl.h
thrift/lib/cpp2/protocol/CompactProtocol-inl.h
thrift/test/ProtocolTruncatedData.thrift
thrift/test/ProtocolTruncatedDataTest.cpp
Commit message: Better handling of truncated data when reading strings

Summary:
Currently we read string size and blindly pre-allocate it. This allows malicious attacker to send a few bytes message and cause server to allocate huge amount of memory (>1GB).

This diff changes the logic to check if we have enough data in the buffer before allocating the string.

This is a second part of a fix for CVE-2019-3553.

Reviewed By: vitaut

Differential Revision: D14393393

fbshipit-source-id: e2046d2f5b087d3abc9a9d2c6c107cf088673057


Vulnerable code:

Fixed code:
    if (!in_.canAdvance(size)) {
      protocol::TProtocolException::throwTruncatedData();
    }
    if (!in_.canAdvance(size)) {
      protocol::TProtocolException::throwTruncatedData();
    }
  4: optional string a_string,

TEST(ProtocolTruncatedDataTest, TuncatedString_Compact) {
  TestStruct s;
  s.a_string_ref() = "foobarbazstring";

  testPartialDataHandling<CompactSerializer>(
      s, 2 /* field & length header */ + s.a_string_ref()->size());
}

TEST(ProtocolTruncatedDataTest, TuncatedString_Binary) {
  TestStruct s;
  s.a_string_ref() = "foobarbazstring";

  testPartialDataHandling<BinarySerializer>(
      s, 7 /* field & length header */ + s.a_string_ref()->size());
}
CVE-2019-3559 (Java, published 2019-05-06T16:29Z)
Description: value: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/facebook/fbthrift
Files changed:
thrift/lib/java/thrift/src/main/java/com/facebook/thrift/protocol/TProtocolUtil.java
Commit message: Throw on bad types during skipping data

Summary:
The current code silently returns on bad types. In case when we have an invalid data, we may get a container of a large size with a bad type, this would lead to us running long loop doing nothing (though we already can say that the data is invalid).

The new code would throw an exception as soon as we try to skip a value of invalid type.

Fixes CVE-2019-3552

Reviewed By: stevegury

Differential Revision: D13892370

fbshipit-source-id: 582c81f90cf40c105383083cb38815816140e3ad


Vulnerable code:
      break;

Fixed code:
      {
        throw new TProtocolException(
              TProtocolException.INVALID_DATA, "Invalid type encountered during skipping: " + type);
      }
CVE-2019-3564 (Go, published 2019-05-06T16:29Z)
Description: value: Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/facebook/fbthrift
Files changed:
thrift/lib/go/thrift/binary_protocol_test.go
thrift/lib/go/thrift/protocol.go
Commit message: Properly error when asked to skip an unknown field type

Summary:
We weren't returning an error when asked to skip over a field with and
unknown type.  In this particular test case the code attempts to skip
over a map with a large number of fields of unknown type and the ~3B
noop calls take almost 30s.  A misbehaving client could DoS a server
by sending short messages that take a long time to parse.  There may
have been other failure modes as well.

The test covers the binary protocol because that is where the issue
was found.  However, the issue is common to all protocols.

This fixes CVE-2019-3552.

Reviewed By: spalamarchuk

Differential Revision: D14088980

fbshipit-source-id: 8a9d63260db717347217a8d2ac883c4ce331d964


Vulnerable code:
	case STOP:
		return
	return nil

Fixed code:
	"strings"
	"time"

func TestSkipUnknownTypeBinaryProtocol(t *testing.T) {
	var m MyTestStruct
	d := NewDeserializer()
	f := NewBinaryProtocolFactoryDefault()
	d.Protocol = f.GetProtocol(d.Transport)
	// skip over a map with invalid key/value type and 1.7B entries
	data := []byte("\n\x10\rO\t6\x03\n\n\n\x10\r\n\tslice\x00")
	start := time.Now()
	err := d.Read(&m, data)
	if err == nil {
		t.Fatalf("Parsed invalid message correctly")
	} else if !strings.Contains(err.Error(), "unknown type") {
		t.Fatalf("Failed for reason besides unknown type")
	}

	if time.Now().Sub(start).Seconds() > 5 {
		t.Fatalf("It should not take seconds to parse a small message")
	}
}
	"fmt"
	default:
		return fmt.Errorf("unable to skip over unknown type id %d", fieldType)
CVE-2019-3565 (C, published 2019-05-06T16:29Z)
Description: value: Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.05.06.00.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/facebook/fbthrift
Files changed:
thrift/lib/cpp/protocol/TProtocol.h
Commit message: Throw on skipping an invalid type.

Summary:
Certain values (e.g.) T_STOP should not appear as a skip type. Allowing them to
can cause thrift to loop unboundedly.

Reviewed By: spalamarchuk

Differential Revision: D15102451

fbshipit-source-id: c08d52f44f37e9c212d3480233ac217105586c9f


Vulnerable code:
    default:
      return 0;

Fixed code:
    default: {
      TProtocolException::throwInvalidSkipType(arg_type);
    }
CVE-2009-3627 (Other, published 2009-10-29T14:30Z)
Description: value: The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/gisle/html-parser
Files changed:
t/entities.t
util.c
Commit message: decode_entities confused by trailing incomplete entity

Mark Martinec reported crashed when running SpamAssassin, given a
particular HTML junk mail to parse.  The problem was caused by
HTML::Parsers decode_entities function confusing itself when it
encountered strings with incomplete entities at the end of the string.


Vulnerable code:
use Test::More tests => 16;
	if (*s == '#') {
	    if (*s == 'x' || *s == 'X') {
		while (*s) {
		while (isDIGIT(*s)) {
	    while (isALNUM(*s))
	    if (*s == ';')

Fixed code:
use Test::More tests => 17;
is(decode_entities("Attention Home&#959&#969n&#1257rs...1&#1109t T&#1110&#1084e E&#957&#1257&#1075"),
  "Attention Home\x{3BF}\x{3C9}n\x{4E9}rs...1\x{455}t T\x{456}\x{43C}e E\x{3BD}\x{4E9}\x{433}");
	if (s < end && *s == '#') {
	    if (s < end && (*s == 'x' || *s == 'X')) {
		while (s < end) {
		while (s < end && isDIGIT(*s)) {
	    while (s < end && isALNUM(*s))
	    if (s < end && *s == ';')
CVE-2022-31508 (Unknown, published 2022-07-11T01:15Z)
Description: value: The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Severity: MEDIUM (CVSS v3 base score: 9.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/idayrus/evoting
Files changed:
Commit message: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability

Vulnerable code:

Fixed code:
CVE-2021-3858 (Unknown, published 2021-10-19T13:15Z)
Description: value: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/snipe/snipe-it
Files changed:
Commit message: Merge pull request #10165 from snipe/fixes/set_restore_actions_to_POST_requests

Set restore actions to POST requests instead of GET

Vulnerable code:

Fixed code: