hitoshura25/cvefixes huggingface dataset:
CVE-2020-10174 (Other, published 2020-03-05T16:15Z)
Description: value: init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/teejee2008/timeshift
Files changed:
src/Core/Main.vala
src/Utility/TeeJee.FileSystem.vala
src/Utility/TeeJee.Process.vala
Commit message: Change TEMP_DIR permissions and path; Cleanup on exit;



Vulnerable code:
		TEMP_DIR = Environment.get_tmp_dir() + "/" + subdir_name + "/" + random_string();

		if ((std_out == null)||(std_out.strip() != "ok")){
			TEMP_DIR = Environment.get_home_dir() + "/.temp/" + subdir_name + "/" + random_string();
			exec_sync("rm -rf '%s'".printf(TEMP_DIR), null, null);

Fixed code:
		
		dir_delete(TEMP_DIR);
			
				
				
			
		
		
		
		TEMP_DIR = Environment.get_tmp_dir() + "/" + random_string();
		chmod(TEMP_DIR, "0750");
		
		
		if ((std_out == null) || (std_out.strip() != "ok")){
			
			TEMP_DIR = Environment.get_home_dir() + "/.temp/" + random_string();
			chmod(TEMP_DIR, "0750");
CVE-2020-10174 (Other, published 2020-03-05T16:15Z)
Description: value: init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location, an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success, an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/teejee2008/timeshift
Files changed:
src/Core/Main.vala
src/Utility/TeeJee.FileSystem.vala
src/Utility/TeeJee.Process.vala
Commit message: Change TEMP_DIR permissions and path; Cleanup on exit;



Vulnerable code:
		TEMP_DIR = Environment.get_tmp_dir() + "/" + subdir_name + "/" + random_string();

		if ((std_out == null)||(std_out.strip() != "ok")){
			TEMP_DIR = Environment.get_home_dir() + "/.temp/" + subdir_name + "/" + random_string();
			exec_sync("rm -rf '%s'".printf(TEMP_DIR), null, null);

Fixed code:
		
		dir_delete(TEMP_DIR);
			
				
				
			
		
		
		
		TEMP_DIR = Environment.get_tmp_dir() + "/" + random_string();
		chmod(TEMP_DIR, "0750");
		
		
		if ((std_out == null) || (std_out.strip() != "ok")){
			
			TEMP_DIR = Environment.get_home_dir() + "/.temp/" + random_string();
			chmod(TEMP_DIR, "0750");
CVE-2013-4879 (PHP, published 2013-08-14T13:49Z)
Description: value: SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/inc/bigtree/cms.php
Commit message: Fixed error when putting ' in a URL by accident.


Vulnerable code:
				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".implode("/",array_slice($path,0,$x))."'"));

Fixed code:
				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".sqlescape(implode("/",array_slice($path,0,$x)))."'"));
CVE-2013-4880 (PHP, published 2013-08-14T13:50Z)
Description: value: Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/admin/modules/developer/modules/views/add.php
Commit message: Fixed a potential cross-site scripting issue on the module view add page.
Thanks to High-Tech Bridge Security Research Lab for finding this and the Cross-Site Request Forgery issues.


Vulnerable code:
	$id = $_GET["module"];

Fixed code:
	$id = htmlspecialchars($_GET["module"]);
CVE-2016-10223 (PHP, published 2017-02-14T06:59Z)
Description: value: An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/admin/ajax/dashboard/check-module-integrity.php
Commit message: Fixing potential XSS attack vector. Thanks to Haojun Hou in ADLab of Venustech.


Vulnerable code:
		<a href="<?=ADMIN_ROOT.$module["route"]."/".$action["route"]."/".$_GET["id"]?>/" target="_blank">Edit</a>

Fixed code:
		<a href="<?=ADMIN_ROOT.$module["route"]."/".$action["route"]."/".htmlspecialchars($_GET["id"])?>/" target="_blank">Edit</a>
CVE-2017-7695 (PHP, published 2017-04-11T23:59Z)
Description: value: Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/inc/bigtree/apis/storage.php
Commit message: Fixing empty space at the end of a file name allowing dangerous files to be uploaded.
Thank you to math1as from l-team for the disclosure and fix.

https://github.com/bigtreecms/BigTree-CMS/issues/276


Vulnerable code:
		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)$/i';

Fixed code:
		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
CVE-2017-9364 (PHP, published 2017-06-02T05:29Z)
Description: value: Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/inc/bigtree/apis/storage.php
Commit message: Disabling phtml/pht files from being uploaded.
https://github.com/bigtreecms/BigTree-CMS/issues/280


Vulnerable code:
		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';

Fixed code:
		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
CVE-2017-9365 (PHP, published 2017-06-02T05:29Z)
Description: value: CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/admin/auto-modules/forms/_locked.php
core/admin/auto-modules/forms/edit.php
core/admin/modules/pages/_locked.php
core/admin/modules/pages/edit.php
core/admin/modules/pages/revisions.php
Commit message: Remove the possibility of a CSRF attack unlocking a page / module entry.
https://github.com/bigtreecms/BigTree-CMS/issues/281


Vulnerable code:
		<a href="?force=true<?=$view_data?>" class="button blue">Unlock</a>
	$force = isset($_GET["force"]) ? true : false;
		<a href="?force=true" class="button blue">Unlock</a>
	$force = isset($_GET["force"]) ? $_GET["force"] : false;
	$force = isset($_GET["force"]) ? $_GET["force"] : false;

Fixed code:
		<a href="?force=true<?=$view_data?><? $admin->drawCSRFTokenGET(); ?>" class="button blue">Unlock</a>
	if (!empty($_GET["force"])) {
		$admin->verifyCSRFToken();
		$force = true;
	} else {
		$force = false;
	}
	
		<a href="?force=true<? $admin->drawCSRFTokenGET() ?>" class="button blue">Unlock</a>
	if (!empty($_GET["force"])) {
		$admin->verifyCSRFToken();
		$force = true;
	} else {
		$force = false;
	}
	
	if (!empty($_GET["force"])) {
		$admin->verifyCSRFToken();
		$force = true;
	} else {
		$force = false;
	}
CVE-2017-9378 (PHP, published 2017-06-02T15:29Z)
Description: value: BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/inc/bigtree/admin.php
Commit message: Fixed a user potentially being able to delete themselves if they really really wanted to.
https://github.com/bigtreecms/BigTree-CMS/issues/282


Vulnerable code:
			if ($current["level"] > $this->Level) {

Fixed code:

			if ($current["level"] > $this->Level || $id == $this->ID) {
CVE-2018-10364 (PHP, published 2018-04-30T21:29Z)
Description: value: BigTree before 4.2.22 has XSS in the Users management page via the name or company field.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/inc/bigtree/admin.php
Commit message: Fixing XSS injection via user profile editing -- thanks zhzzhz:
https://github.com/bigtreecms/BigTree-CMS/issues/332


Vulnerable code:
			foreach ($data as $key => $val) {
				if (substr($key,0,1) != "_" && !is_array($val)) {
					$$key = sqlescape($val);
				}
			}


Fixed code:
			$name = sqlescape(htmlspecialchars($data["name"]));
			$company = sqlescape(htmlspecialchars($data["company"]));
			$daily_digest = $data["daily_digest"] ? "on" : "";
CVE-2018-10574 (PHP, published 2018-04-30T20:29Z)
Description: value: site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/bigtreecms/BigTree-CMS
Files changed:
core/inc/bigtree/apis/storage.php
Commit message: Rejecting htaccess files:
https://github.com/bigtreecms/BigTree-CMS/issues/335


Vulnerable code:
		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';

Fixed code:
		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht|htaccess)/i';
CVE-2023-5793 (PHP, published 2023-10-26T18:15Z)
Description: value: A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/customblock.php of the component Dashboard. The manipulation of the argument customblock_place leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 81252bc764e1de2422e79e36194bba1289e7a0a5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-243599.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flusity/flusity-CMS
Files changed:
core/tools/customblock.php
Commit message: Update customblock.php

Cross-Site Scripting (XSS): 

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>

Vulnerable code:
    $edit_customblock_id = $_GET['edit_customblock_id'];
    echo "<script>loadCustomBlockEditForm($edit_customblock_id);</script>";
    $customblock_place = $_GET['customblock_place'];
    echo "<script>loadCustomBlocCreateForm('$customblock_place');</script>";
<?php require_once ROOT_PATH . 'core/template/admin-footer.php';?>

Fixed code:
    $edit_customblock_id = filter_input(INPUT_GET, 'edit_customblock_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_edit_customblock_id = htmlspecialchars($edit_customblock_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadCustomBlockEditForm($safe_edit_customblock_id);</script>";

    $customblock_place = filter_input(INPUT_GET, 'customblock_place', FILTER_SANITIZE_STRING);
    $safe_customblock_place = htmlspecialchars($customblock_place, ENT_QUOTES, 'UTF-8');
    echo "<script>loadCustomBlocCreateForm('$safe_customblock_place');</script>";

<?php require_once ROOT_PATH . 'core/template/admin-footer.php';?>
CVE-2023-5810 (PHP, published 2023-10-27T01:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flusity/flusity-CMS
Files changed:
core/tools/posts.php
Commit message: Update posts.php

pataisyta kodo vieta 274 eilutė core/tools/posts.php 

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>

Vulnerable code:
    $edit_post_id = $_GET['edit_post_id'];
    echo "<script>loadPostEditForm($edit_post_id);</script>";
    $menu_id = $_GET['menu_id'];
    echo "<script>loadPostAddForm($menu_id);</script>";

Fixed code:
    $edit_post_id = filter_input(INPUT_GET, 'edit_post_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_edit_post_id = htmlspecialchars($edit_post_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostEditForm($safe_edit_post_id);</script>";

    $menu_id = filter_input(INPUT_GET, 'menu_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_menu_id = htmlspecialchars($menu_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostAddForm($safe_menu_id);</script>";
CVE-2023-5811 (PHP, published 2023-10-27T01:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menu_id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. VDB-243642 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flusity/flusity-CMS
Files changed:
core/tools/posts.php
Commit message: Update posts.php

pataisyta kodo vieta 274 eilutė core/tools/posts.php 

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>

Vulnerable code:
    $edit_post_id = $_GET['edit_post_id'];
    echo "<script>loadPostEditForm($edit_post_id);</script>";
    $menu_id = $_GET['menu_id'];
    echo "<script>loadPostAddForm($menu_id);</script>";

Fixed code:
    $edit_post_id = filter_input(INPUT_GET, 'edit_post_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_edit_post_id = htmlspecialchars($edit_post_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostEditForm($safe_edit_post_id);</script>";

    $menu_id = filter_input(INPUT_GET, 'menu_id', FILTER_SANITIZE_NUMBER_INT);
    $safe_menu_id = htmlspecialchars($menu_id, ENT_QUOTES, 'UTF-8');
    echo "<script>loadPostAddForm($safe_menu_id);</script>";
CVE-2023-47129 (PHP, published 2023-11-10T19:15Z)
Description: value: Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/statamic/cms
Files changed:
src/Http/Controllers/FormController.php
Commit message: [4.x] Front-end form asset field php file validation (#8968)



Vulnerable code:
                return [$field->handle().'.*' => 'file'];

Fixed code:
                return [$field->handle().'.*' => ['file', function ($attribute, $value, $fail) {
                    if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'phtml'])) {
                        $fail(__('validation.uploaded'));
                    }
                }]];
CVE-2023-48217 (PHP, published 2023-11-14T22:15Z)
Description: value: Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. Malicious users could leverage this vulnerability to upload and execute code. This issue has been patched in versions 3.4.14 and 4.34.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/statamic/cms
Files changed:
src/Http/Controllers/CP/Assets/AssetsController.php
src/Http/Controllers/CP/Fieldtypes/FilesFieldtypeController.php
src/Http/Controllers/FormController.php
Commit message: [4.x] More php file validation (#8991)



Vulnerable code:
                if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'phtml'])) {
                if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'phtml'])) {
                    if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'phtml'])) {

Fixed code:
                if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phar'])) {
                if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phar'])) {
                    if (in_array(trim(strtolower($value->getClientOriginalExtension())), ['php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phar'])) {