hitoshura25/cvefixes huggingface dataset:
CVE-2022-1813 (Python, published 2022-05-22T16:15Z)
Description: value: OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/yogeshojha/rengine
Files changed:
web/reNgine/common_func.py
Commit message: Fix command injection issue on detect cms


Vulnerable code:
    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py -u {} --random-agent --batch --follow-redirect'.format(url)
    os.system(cms_detector_command)

Fixed code:
import subprocess
    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py --random-agent --batch --follow-redirect'
    subprocess_splitted_command = cms_detector_command.split()
    subprocess_splitted_command.append('-u')
    subprocess_splitted_command.append(url)
    process = subprocess.Popen(subprocess_splitted_command)
    process.wait()
CVE-2020-24711 (Go, published 2020-10-28T20:15Z)
Description: value: The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/gophish/gophish
Files changed:
controllers/route.go
middleware/middleware.go
middleware/middleware_test.go
Commit message: Added a simple Content-Security-Policy to mitigate clickjacking attempts.


Vulnerable code:
	adminHandler = mid.Use(adminHandler.ServeHTTP, mid.CSRFExceptions, mid.GetContext)

Fixed code:
	adminHandler = mid.Use(adminHandler.ServeHTTP, mid.CSRFExceptions, mid.GetContext, mid.ApplySecurityHeaders)
// ApplySecurityHeaders applies various security headers according to best-
// practices.
func ApplySecurityHeaders(next http.Handler) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		csp := "frame-ancestors 'none';"
		w.Header().Set("Content-Security-Policy", csp)
		w.Header().Set("X-Frame-Options", "DENY")
		next.ServeHTTP(w, r)
	}
}


func TestApplySecurityHeaders(t *testing.T) {
	expected := map[string]string{
		"Content-Security-Policy": "frame-ancestors 'none';",
		"X-Frame-Options":         "DENY",
	}
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	response := httptest.NewRecorder()
	ApplySecurityHeaders(successHandler).ServeHTTP(response, req)
	for header, value := range expected {
		got := response.Header().Get(header)
		if got != value {
			t.Fatalf("incorrect security header received for %s: expected %s got %s", header, value, got)
		}
	}
}
CVE-2020-1732 (Unknown, published 2020-05-04T17:15Z)
Description: value: A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.
Severity: MEDIUM (CVSS v3 base score: 4.2)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wildfly-security/soteria
Files changed:
Commit message: Merge pull request #1 from darranl/CVE-2020-1732

[CVE-2020-1732] Adjust JASPIC integration to create a new ServerAuthModule for each request.

Vulnerable code:

Fixed code:
CVE-2019-17544 (C++, published 2019-10-14T02:15Z)
Description: value: libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/GNUAspell/aspell
Files changed:
common/config.cpp
common/file_util.cpp
common/getdata.cpp
Commit message: Fix various bugs found by OSS-Fuze.


Vulnerable code:
    if (res.back() == ':') res.pop_back();
      if (*src == '\\') {

Fixed code:
    if (!res.empty() && res.back() == ':') res.pop_back();
      if (path.empty()) continue;
      if (*src == '\\' && src[1]) {
CVE-2015-9235 (JavaScript, published 2018-05-29T20:29Z)
Description: value: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/auth0/node-jsonwebtoken
Files changed:
.jshintrc
index.js
test/wrong_alg.tests.js
Commit message: Verification with an asymmetric key of a token signed with a symmetric key

There is a vulnerability in this module when the verification part is expecting a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).

The issue is because this library has the very same signature to verify both type of tokens (parameter: `secretOrPublicKey`).

This change adds a new parameter to the verify called `algorithms`. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string `BEGIN CERTIFICATE` the default is `[ 'RS256','RS384','RS512','ES256','ES384','ES512' ]` otherwise is `[ 'HS256','HS384','HS512' ]`.


Vulnerable code:
    "escape": true

Fixed code:
    "escape": true,
    "before": true
  if (!options.algorithms) {
    options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') ?
                        [ 'RS256','RS384','RS512','ES256','ES384','ES512' ] :
                        [ 'HS256','HS384','HS512' ];
  }

  var header = jws.decode(jwtString).header;
  if (!~options.algorithms.indexOf(header.alg)) {
    return done(new JsonWebTokenError('invalid signature'));
  }

var fs = require('fs');
var path = require('path');
var jwt = require('../index');
var JsonWebTokenError = require('../lib/JsonWebTokenError');
var expect = require('chai').expect;


var pub = fs.readFileSync(path.join(__dirname, 'pub.pem'), 'utf8');
// priv is never used
// var priv = fs.readFileSync(path.join(__dirname, 'priv.pem'));

var TOKEN = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmb28iOiJiYXIiLCJpYXQiOjE0MjY1NDY5MTl9.ETgkTn8BaxIX4YqvUWVFPmum3moNZ7oARZtSBXb_vP4';

describe('signing with pub key as symmetric', function () {
  it('should not verify', function () {
    expect(function () {
      jwt.verify(TOKEN, pub);
    }).to.throw(JsonWebTokenError, /invalid signature/);
  });
});
CVE-2022-4902 (Other, published 2023-02-06T19:15Z)
Description: value: A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220212.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/exoplatform/chat-application
Files changed:
application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue
Commit message: Task-56304 : XSS issue in chat

Before this fix, when sending a message with a mention, there is an XSS issue
This commit encode html entities in the message before adding markup related to the mention so that, the malicious html is not evaluated

Vulnerable code:
        this.text = (e.originalEvent || e).clipboardData.getData('text/plain');
</script>

Fixed code:
      message = this.encodeHTMLEntities(message);
    encodeHTMLEntities(text) {
      const textArea = document.createElement('p');
      textArea.innerText = text;
      return textArea.innerHTML;
    },
        this.text = this.encodeHTMLEntities((e.originalEvent || e).clipboardData.getData('text/plain'));
</script>
CVE-2023-45292 (Go, published 2023-12-11T22:15Z)
Description: value: When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/mojocn/base64Captcha
Files changed:
store_memory.go
Commit message: feat(inmemory): verify method must check the empty id and answer.


Vulnerable code:
	return v == answer

Fixed code:
	return v != "" && v == answer
CVE-2023-45292 (Go, published 2023-12-11T22:15Z)
Description: value: When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/mojocn/base64Captcha
Files changed:
store_memory.go
store_memory_test.go
Commit message: fix verify bug


Vulnerable code:

Fixed code:
	if id == "" || answer == "" {
		return false
	}
	got = DefaultMemStore.Verify("saaf", "", true)
	if got {
		t.Error("CVE-2023-45292 GO-2023-2386")
	}
CVE-2014-1869 (Other, published 2014-02-08T00:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zeroclipboard/zeroclipboard
Files changed:
src/flash/ZeroClipboard.as
Commit message: Hardening sanitization technique in Flash


Vulnerable code:
        var origins:Array = flashvars.trustedOrigins.split("\\").join("\\\\").split(",");
        jsModuleId = flashvars.jsModuleId.split("\\").join("\\\\");
        text: clipText.split("\\").join("\\\\")

Fixed code:
        var origins:Array = ZeroClipboard.sanitizeString(flashvars.trustedOrigins).split(",");
        jsModuleId = ZeroClipboard.sanitizeString(flashvars.jsModuleId);
    // sanitizeString
    //
    // This private function will accept a string, and return a sanitized string
    // to avoid XSS vulnerabilities
    //
    // returns an XSS safe String
    private static function sanitizeString(dirty:String): String {
      return dirty.replace(/\\/g,"\\\\")
    }

        text: ZeroClipboard.sanitizeString(clipText)
CVE-2021-4315 (Python, published 2023-01-28T23:15Z)
Description: value: A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/NYUCCL/psiTurk
Files changed:
psiturk/experiment.py
tests/test_psiturk.py
Commit message: Fix SSTI vulnerability in ad and consent pages (#517)

* Fix SSTI vulnerability in ad and consent pages

Fixed an issue where users could pass arbitrary Python code to be executed on the server to the mode HTTP arg

More information about this type of vulnerability: https://secure-cookie.io/attacks/ssti/

Vulnerable code:
        ad_string = insert_mode(ad_string, mode)
    consent_string = insert_mode(consent_string, mode)
def insert_mode(page_html, mode):
        new_html = page_html[:match.end()] + "&mode=" + mode +\
    insert_mode(ad_string, 'debug')

Fixed code:
        ad_string = insert_mode(ad_string)
            mode=mode,
    consent_string = insert_mode(consent_string)
        mode=mode,
def insert_mode(page_html):
        new_html = page_html[:match.end()] + '&mode={{ mode }}' +\
    insert_mode(ad_string)
CVE-2015-4671 (PHP, published 2016-01-12T19:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opencart/opencart
Files changed:
upload/catalog/controller/account/address.php
Commit message: Fixed low risk XSS issue with user account address edit. Thanks to @robert81 for the find.

Close #3721


Vulnerable code:
			$data['country_id'] = $this->request->post['country_id'];
			$data['zone_id'] = $this->request->post['zone_id'];
		if ($this->request->post['country_id'] == '') {
		if (!isset($this->request->post['zone_id']) || $this->request->post['zone_id'] == '') {

Fixed code:
			$data['country_id'] = (int)$this->request->post['country_id'];
			$data['zone_id'] = (int)$this->request->post['zone_id'];
		if ($this->request->post['country_id'] == '' || !is_int($this->request->post['country_id'])) {
		if (!isset($this->request->post['zone_id']) || $this->request->post['zone_id'] == '' || !is_int($this->request->post['zone_id'])) {
CVE-2016-10509 (PHP, published 2017-08-31T20:29Z)
Description: value: SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/opencart/opencart
Files changed:
upload/admin/model/openbay/amazon.php
Commit message: https://github.com/opencart/opencart/issues/4114


Vulnerable code:
			SET `courier_id` = '" . $courier_id . "',
				`tracking_no` = '" . $tracking_no . "'

Fixed code:
			SET `courier_id` = '" . $this->db->escape($courier_id) . "',
				`tracking_no` = '" . $this->db->escape($tracking_no) . "'
CVE-2023-2315 (PHP, published 2023-09-27T15:18Z)
Description: value: Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/opencart/opencart
Files changed:
upload/admin/controller/tool/log.php
Commit message: Update log.php


Vulnerable code:
			$filename = (string)basename($this->request->get['filename']);
			$filename = (string)$this->request->get['filename'];

Fixed code:
			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
CVE-2024-21515 (PHP, published 2024-06-22T05:15Z)
Description: value: This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality.**Notes:**1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is "admin" by default but there is a pop-up in the dashboard warning users to rename it.2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opencart/opencart
Files changed:
upload/admin/controller/common/login.php
upload/admin/view/template/common/login.twig
Commit message: removed a xss vunribility if the attack knows the admin path


Vulnerable code:
		if (isset($this->request->get['route']) && $this->request->get['route'] != 'common/login') {
			$args = $this->request->get;

			$route = $args['route'];

			unset($args['route']);
			unset($args['user_token']);

			$url = '';

			$url .= http_build_query($args);

			$data['redirect'] = $this->url->link($route, $url);
		} else {
			$data['redirect'] = '';
		}

			if ($this->request->post['redirect'] && str_starts_with(html_entity_decode($this->request->post['redirect'], ENT_QUOTES, 'UTF-8'), HTTP_SERVER)) {
				$json['redirect'] = html_entity_decode($this->request->post['redirect'], ENT_QUOTES, 'UTF-8') . '&user_token=' . $this->session->data['user_token'];
			} else {
				$json['redirect'] = $this->url->link('common/dashboard', 'user_token=' . $this->session->data['user_token'], true);
			}
              {% if redirect %}
                <input type="hidden" name="redirect" value="{{ redirect }}"/>
              {% endif %}

Fixed code:
			$json['redirect'] = $this->url->link('common/dashboard', 'user_token=' . $this->session->data['user_token'], true);
CVE-2024-21516 (PHP, published 2024-06-22T05:15Z)
Description: value: This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the directory parameter of admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login and redirected again upon authentication with the payload automatically executing. If the attacked user has admin privileges, this vulnerability could be used as the start of a chain of exploits like Zip Slip or arbitrary file write vulnerabilities in the admin functionality.**Notes:**1) This is only exploitable if the attacker knows the name or path of the admin directory. The name of the directory is "admin" by default but there is a pop-up in the dashboard warning users to rename it.2) The fix for this vulnerability is incomplete. The redirect is removed so that it is not possible for an attacker to control the redirect post admin login anymore, but it is still possible to exploit this issue in admin if the user is authenticated as an admin already.
Severity: nan (CVSS v3 base score: 4.7)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/opencart/opencart
Files changed:
upload/admin/controller/common/login.php
upload/admin/view/template/common/login.twig
Commit message: removed a xss vunribility if the attack knows the admin path


Vulnerable code:
		if (isset($this->request->get['route']) && $this->request->get['route'] != 'common/login') {
			$args = $this->request->get;

			$route = $args['route'];

			unset($args['route']);
			unset($args['user_token']);

			$url = '';

			$url .= http_build_query($args);

			$data['redirect'] = $this->url->link($route, $url);
		} else {
			$data['redirect'] = '';
		}

			if ($this->request->post['redirect'] && str_starts_with(html_entity_decode($this->request->post['redirect'], ENT_QUOTES, 'UTF-8'), HTTP_SERVER)) {
				$json['redirect'] = html_entity_decode($this->request->post['redirect'], ENT_QUOTES, 'UTF-8') . '&user_token=' . $this->session->data['user_token'];
			} else {
				$json['redirect'] = $this->url->link('common/dashboard', 'user_token=' . $this->session->data['user_token'], true);
			}
              {% if redirect %}
                <input type="hidden" name="redirect" value="{{ redirect }}"/>
              {% endif %}

Fixed code:
			$json['redirect'] = $this->url->link('common/dashboard', 'user_token=' . $this->session->data['user_token'], true);