hitoshura25/cvefixes huggingface dataset:
CVE-2022-0277 (PHP, published 2022-01-20T10:15Z)
Description: value: Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/helpers/api_user.php
Commit message: search_authors only admins


Vulnerable code:
api_expose('users/search_authors', function ($params = false) {
    $return = array();

Fixed code:
api_expose_admin('users/search_authors', function ($params = false) {
    $return = array();
CVE-2022-0278 (PHP, published 2022-01-20T10:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
userfiles/modules/admin/notifications/notif_form_entry.php
Commit message: xss on contact form fix


Vulnerable code:

                                    <p><?php print $val1; ?></p>
                                    <p><?php print $val1_1 . '<br />'; ?></p>

Fixed code:
                                    <p><?php print htmlentities($val1); ?></p>
                                    <p><?php print htmlentities($val1_1) . '<br />'; ?></p>
CVE-2022-0281 (PHP, published 2022-01-20T11:15Z)
Description: value: Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/helpers/api_user.php
Commit message: search_authors only admins


Vulnerable code:
api_expose('users/search_authors', function ($params = false) {
    $return = array();

Fixed code:
api_expose_admin('users/search_authors', function ($params = false) {
    $return = array();
CVE-2022-0282 (PHP, published 2022-01-20T12:15Z)
Description: value: Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.


Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Comment/Models/Comment.php
src/MicroweberPackages/Comment/Models/CommentsCrud.php
src/MicroweberPackages/Comment/resources/views/admin/comments/comment_item.blade.php
userfiles/modules/comments/src/Controllers/Admin.php
Commit message: fix comments xss


Vulnerable code:
                    $comments[$i]['comment_body'] = $item['comment_body']; // mw()->format->autolink($item['comment_body']);
                        <div class="js-comment-body-text"><?php print $comment['comment_body']; ?></div>
                            <textarea name="comment_body" class="form-control"><?php print $comment['comment_body']; ?></textarea>




Fixed code:

                    $comments[$i]['comment_body'] = htmlentities($item['comment_body']);
                        <div class="js-comment-body-text">{{ $comment['comment_body'] }}</div>
                            <textarea name="comment_body" class="form-control">{{ $comment['comment_body'] }}</textarea>
CVE-2022-0378 (PHP, published 2022-01-26T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/Http/Controllers/ApiController.php
Commit message: fix xss on module api call in value parameters


Vulnerable code:

Fixed code:

                $v = $antixss->xss_clean($v);
CVE-2022-0379 (PHP, published 2022-01-26T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Checkout/Http/Middleware/CheckoutV2.php
src/MicroweberPackages/Checkout/routes/web.php
Commit message: update


Vulnerable code:

    ->middleware([\MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class, \MicroweberPackages\Checkout\Http\Middleware\CheckoutV2::class])

Fixed code:
    ->middleware([
        \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
       \MicroweberPackages\Checkout\Http\Middleware\CheckoutV2::class,
       \MicroweberPackages\App\Http\Middleware\XSS::class
   ])
CVE-2022-0504 (JavaScript, published 2022-02-08T09:15Z)
Description: value: Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/microweber/microweber
Files changed:
userfiles/modules/admin/backup/js/restore.js
userfiles/modules/microweber/api/api.js
Commit message: update


Vulnerable code:

Fixed code:

                mw.restore.reload_mw_db();
                mw.clear_cache();

    reload_mw_db: function () {
        $.post(mw.settings.api_url + 'mw_post_update');
        mw.notification.success("The DB was reloaded");
    },
CVE-2022-0505 (PHP, published 2022-02-08T09:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Content/routes/api.php
Commit message: Update api.php


Vulnerable code:
        });

Fixed code:
        });
CVE-2022-0506 (PHP, published 2022-02-08T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/routes/api.php
src/MicroweberPackages/User/routes/web.php
Commit message: add css middleware


Vulnerable code:
Route::name('api.user.')->prefix('api/user')->middleware(['public.api'])->namespace('\MicroweberPackages\User\Http\Controllers')->group(function () {
    ->middleware(['api'])
    ->middleware(['admin'])

Fixed code:
Route::name('api.user.')
    ->prefix('api/user')
    ->middleware([
        'public.api',
      //  \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
        \MicroweberPackages\App\Http\Middleware\XSS::class
    ])
    ->namespace('\MicroweberPackages\User\Http\Controllers')
    ->group(function () {
    ->middleware([
        'api',
      //  \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
        \MicroweberPackages\App\Http\Middleware\XSS::class
    ])
    ->middleware([
        'admin',
       // \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
        \MicroweberPackages\App\Http\Middleware\XSS::class
    ])
CVE-2022-0557 (PHP, published 2022-02-11T09:15Z)
Description: value: OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
Severity: HIGH (CVSS v3 base score: 7.2)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/functions/plupload.php
Commit message: Update plupload.php


Vulnerable code:
                                case 'php':
                                case 'php6':

Fixed code:
                                case 'php':
CVE-2022-0558 (PHP, published 2022-02-10T10:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Helper/HTMLClean.php
userfiles/modules/tags/TaggingTagsManager.php
Commit message: xss fix on tagging module


Vulnerable code:

Fixed code:
    public function cleanArray($array) {
        if (is_array($array)) {

            $cleanedArray = [];
            foreach ($array as $key=>$value) {
                $cleanedArray[$key] = $this->clean($value);
            }

            return $cleanedArray;
        }
    }

    $cleanInput = new \MicroweberPackages\Helper\HTMLClean();
    $newData = $cleanInput->cleanArray($newData);
CVE-2022-0560 (PHP, published 2022-02-11T13:15Z)
Description: value: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Page/routes/web.php
tests/Browser/AdminXssTest.php
Commit message: update


Vulnerable code:
        Route::resource('page', 'PageController');
                    $browser->pause(2000);

Fixed code:
        Route::resource('page', 'PageController', ['except' => ['show']]);
                 //   $browser->pause(2000);
CVE-2022-0596 (PHP, published 2022-02-15T14:15Z)
Description: value: Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/microweber/microweber
Files changed:
tests/Browser/Components/AdminMakeInstall.php
Commit message: Update AdminMakeInstall.php


Vulnerable code:
        $siteUrl = site_url();

Fixed code:
        $siteUrl = 'http://127.0.0.1:8000/';
CVE-2022-0597 (Unknown, published 2022-02-15T14:15Z)
Description: value: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/microweber/microweber
Files changed:
Commit message: Merge branch 'dev' of https://github.com/microweber/microweber into dev


Vulnerable code:

Fixed code:
CVE-2022-0638 (PHP, published 2022-02-17T17:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/User/Http/Controllers/UserLogoutController.php
Commit message: Update UserLogoutController.php


Vulnerable code:
        return logout();

Fixed code:
use Illuminate\Support\Facades\Auth;
        Auth::logout();

        $url = site_url();

        return app()->url_manager->redirect($url);
CVE-2022-0660 (PHP, published 2022-02-18T11:15Z)
Description: value: Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Comment/Models/Comment.php
Commit message: Update Comment.php


Vulnerable code:

Fixed code:
use MicroweberPackages\Core\Models\HasSearchableTrait;
    use HasSearchableTrait;
    protected $searchable = [
        'comment_name',
        'comment_email',
        'comment_website',
        'comment_body',
    ];
CVE-2022-0666 (PHP, published 2022-02-18T15:15Z)
Description: value: CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Helper/UrlManager.php
Commit message: Update UrlManager.php


Vulnerable code:
        if (!filter_var($redirectUrl, FILTER_VALIDATE_URL)) {
            $redirectUrl = site_url();
        }

Fixed code:
        $redirectUrl = str_replace("\r", "", $redirectUrl);
        $redirectUrl = str_replace("\n", "", $redirectUrl);
CVE-2022-0678 (PHP, published 2022-02-19T11:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Helper/UrlManager.php
Commit message: Update UrlManager.php


Vulnerable code:

Fixed code:
        $clearInput = new HTMLClean();
        $redirectUrl = $clearInput->clean($redirectUrl);
CVE-2022-0688 (PHP, published 2022-02-20T15:15Z)
Description: value: Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Cart/CartManager.php
Commit message: update


Vulnerable code:
        if ($this->app->user_manager->is_admin() == false) {
            $cart['session_id'] = mw()->user_manager->session_id();
        }

Fixed code:
       // if ($this->app->user_manager->is_admin() == false) {
        $cart['session_id'] = mw()->user_manager->session_id();
       // }
CVE-2022-0690 (PHP, published 2022-02-19T17:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Content/Http/Controllers/Admin/ContentController.php
src/MicroweberPackages/Page/Http/Controllers/Admin/PageController.php
src/MicroweberPackages/Post/Http/Controllers/Admin/PostController.php
src/MicroweberPackages/Product/Http/Controllers/Admin/ProductController.php
Commit message: update


Vulnerable code:
            'content_id'=>$id
            'content_id'=>$id
            'content_id'=>$id
            'content_id'=>$id

Fixed code:
            'content_id'=>intval($id)
            'content_id'=>intval($id)
            'content_id'=>intval($id)
            'content_id'=>intval($id)
CVE-2022-0719 (PHP, published 2022-02-23T11:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Helper/UrlManager.php
Commit message: Update UrlManager.php


Vulnerable code:
        $u1 = $cleanParam->cleanArray($u1);

Fixed code:
        $u1 = $cleanParam->clean($u1);
CVE-2022-0721 (PHP, published 2022-02-23T11:15Z)
Description: value: Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/Exceptions/Handler.php
Commit message: Update Handler.php


Vulnerable code:
//    protected $dontReport = [
//        //
//    ];
                 
}

Fixed code:
    protected $dontReport = [
        \BadMethodCallException::class,
    ];

}
CVE-2022-0723 (Unknown, published 2022-02-26T11:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
Commit message: update


Vulnerable code:

Fixed code:
CVE-2022-0724 (PHP, published 2022-02-23T11:15Z)
Description: value: Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/functions/plupload.php
Commit message: Update plupload.php


Vulnerable code:
                    imagejpeg($imgCreatedFromJpeg, $filePath,100);
                    imagepng($imgCreatedFromPng, $filePath,100);
                    imagegif($imgCreatedFromGif, $filePath,100);

Fixed code:
                    imagejpeg($imgCreatedFromJpeg, $filePath,100);  // this will create fresh new image without exif sensitive data
                    imagepng($imgCreatedFromPng, $filePath,100);  // this will create fresh new image without exif sensitive data
                    imagegif($imgCreatedFromGif, $filePath,100); // this will create fresh new image without exif sensitive data
CVE-2022-0762 (PHP, published 2022-02-26T10:15Z)
Description: value: Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.


Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Cart/CartManager.php
Commit message: check product is deleted before add to cart


Vulnerable code:

Fixed code:


            if (isset($cont['is_active'])) {
                if ($cont['is_active'] != 1) {
                    $cont = false;
                }
            }

            if (isset($cont['is_deleted'])) {
                if ($cont['is_deleted'] > 0) {
                    $cont = false;
                }
            }
CVE-2022-0763 (PHP, published 2022-02-26T10:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Media/MediaManager.php
Commit message: add xss clean to create media dir method


Vulnerable code:
        if (!isset($_REQUEST['name'])) {

Fixed code:
use MicroweberPackages\Helper\HTMLClean;

        $clean = new HTMLClean();
        $_REQUEST = $clean->cleanArray($_REQUEST);

        if (!isset($_REQUEST['name']) || empty($_REQUEST['name'])) {