hitoshura25/cvefixes huggingface dataset:
CVE-2022-2595 (JavaScript, published 2022-08-01T15:15Z)
Description: value: Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
Severity: nan (CVSS v3 base score: 10)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/kromitgmbh/titra
Files changed:
imports/api/customfields/server/methods.js
imports/api/extensions/methods.js
imports/api/globalsettings/methods.js
imports/ui/components/projectTasks.js
imports/ui/pages/administration.js
package.json
Commit message: 🐛 fixed a bug in the oidc configuration preventing saving changes
🔒 fixed admin authorization validation for all administration pages
🔒 fixed a stored XSS vulnerability in the task functionality


Vulnerable code:
import { checkAuthentication } from '../../../utils/server_method_helpers'
    checkAuthentication(this)
    checkAuthentication(this)
    checkAuthentication(this)
import { checkAuthentication } from '../../utils/server_method_helpers'
    checkAuthentication(this)
    checkAuthentication(this)
    checkAuthentication(this)
    checkAuthentication(this)
  }
          name: task.name,
    Oidc.fields.forEach((field) => {
  "version": "0.79.0",

Fixed code:
import { checkAdminAuthentication } from '../../../utils/server_method_helpers'
    checkAdminAuthentication(this)
    checkAdminAuthentication(this)
    checkAdminAuthentication(this)
import { checkAdminAuthentication } from '../../utils/server_method_helpers'
    checkAdminAuthentication(this)
    checkAdminAuthentication(this)
    checkAdminAuthentication(this)
    checkAdminAuthentication(this)
    check(configuration, Object)
  },
          name: $('span').text(task.name).get(0).innerHTML,
    oidcFields.forEach((field) => {
  "version": "0.79.1",
CVE-2022-4523 (Unknown, published 2022-12-15T21:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in vexim2. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 21c0a60d12e9d587f905cd084b2c70f9b1592065. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215903.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/vexim/vexim2
Files changed:
Commit message: Merge pull request #274 from rimas-kudelis/xss-prevention

Use `htmlspecialchars()` to escape user-provided vars before output

Vulnerable code:

Fixed code:
CVE-2023-29566 (JSON, published 2023-04-24T18:15Z)
Description: value: huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/rona-dinihari/dawnsparks-node-tesseract
Files changed:
lib/tesseract.js
package-lock.json
package.json
test/tesseract.js
Commit message: exec() to execFile()


Vulnerable code:
var exec = require('child_process').exec;
var { glob, } = require("glob");
    
      command.push('-l ' + options.l);
      command.push('--psm ' + options.psm);
    command = command.join(' ');

    exec(command, opts, function(err, stdout, stderr) {
      glob(output + '.+(html|hocr|txt)', function(err, files){
        if (err) {
          callback(err, null);
          return;
        }
      })
  "name": "dawnsparks-tesseract",
  "version": "0.4.0",
      "name": "dawnsparks-tesseract",
      "version": "0.4.0",
  "version": "0.4.0",
    "url": "https://rona_dinihari@bitbucket.org/dawnsparks/dawnsparks-node-tesseract.git"
    var testImage = "\"" + __dirname + '/test.png' + "\"";
      text.trim().should.equal('node-tesseract');
      done();

    done();
    var testImage = "\"" + __dirname + '/test.png' + "\"";
      extra.orientation.should.equal(0);
      done();

    done();

Fixed code:
var execFile = require('child_process').execFile;
var { globSync, } = require("glob");

      command.push('-l')
      command.push(options.l);
      command.push('--psm')
      command.push(options.psm);
    execFile(command[0], command.slice(1), opts, function(err, stdout, stderr) {
      try {
        const files = globSync(output + '.{html,hocr,txt}');
        const readFiles = function(files) {
        };
        readFiles(files);
      } catch (err) {
        callback(err, null);
      }
  "name": "dawnsparks-node-tesseract",
  "version": "0.4.1",
      "name": "dawnsparks-node-tesseract",
      "version": "0.4.1",
  "version": "0.4.1",
    "url": "https://github.com/rona-dinihari/dawnsparks-node-tesseract.git"
    var testImage = path.join(__dirname, 'test with spaces.png');
      if (err) {
        done(err);
      } else {
        text.trim().should.equal('node-tesseract');
        done();
      }
    var testImage = path.join(__dirname, 'test with spaces.png');
      if (err) {
        done(err);
      } else {
        extra.orientation.should.equal(0);
        done();
      }
CVE-2024-36070 (PHP, published 2024-05-19T19:15Z)
Description: value: tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php. (An update is also available for the 2022.11 series.)
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tine-groupware/tine
Files changed:
tine20/Setup/Frontend/Json.php
Commit message: fix(Setup/Frontend/Json): don't show auth data in anonymous call

thx @Christian Pöschl of usd AG

see usd-2024-0002 | Tine 2023.11.2 - Password Leakage


Vulnerable code:
     * .
     * @see Tinebase_Application_Json_Abstract
     * 
     * @return mixed array 'variable name' => 'data'
     * 
     * @todo add 'titlePostfix'    => Tinebase_Config::getInstance()->getConfig(Tinebase_Config::PAGETITLEPOSTFIX, NULL, '')->value here?
    public function getRegistryData()
            'authenticationData'   => $this->loadAuthenticationData(),
        // authenticated or non existent config
                'acceptedTermsVersion' => (! empty($registryData['checkDB']) && $this->_controller->isInstalled('Tinebase')) ? Setup_Controller::getInstance()->getAcceptedTerms() : 0,
                'emailData'            => (! empty($registryData['checkDB']) && $this->_controller->isInstalled('Tinebase')) ? $this->getEmailConfig() : array(),
    
     * 
        
                'locale'   => $locale->toString(), 

Fixed code:
     *
     * @return array
     * @throws Tinebase_Exception_InvalidArgument
    public function getRegistryData(): array
        // authenticated or non-existent config
                'authenticationData'   => Setup_Core::isRegistered(Setup_Core::USER)
                    ? $this->loadAuthenticationData() : [],
                'acceptedTermsVersion' => (! empty($registryData['checkDB']) &&
                    $this->_controller->isInstalled(''))
                    ? Setup_Controller::getInstance()->getAcceptedTerms() : 0,
                'emailData'            => (! empty($registryData['checkDB'])
                    && $this->_controller->isInstalled() && Setup_Core::isRegistered(Setup_Core::USER))
                        ? $this->getEmailConfig() : array(),

     *

                'locale'   => $locale->toString(),
CVE-2014-7264 (Other, published 2014-12-11T23:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/chyrp/chyrp
Files changed:
admin/themes/default/pages/manage_users.twig
Commit message: Fixed a potential XSS vulnerability.

Thanks JPCERT for reporting it to us.


Vulnerable code:
                            <a href="mailto:$user.email">$user.full_name</a> <span class="sub">($user.login)</span>
                            <a href="mailto:$user.email">$user.login</a>
                        <td>{% if user.website != "" %}<a href="$user.website">$user.website</a>{% endif %}</td>

Fixed code:
                            <a href="mailto:${ user.email | escape }">$user.full_name</a> <span class="sub">($user.login)</span>
                            <a href="mailto:${ user.email | escape }">$user.login</a>
                        <td>{% if user.website != "" %}<a href="${ user.website | escape }">$user.website</a>{% endif %}</td>
CVE-2020-22784 (JSON, published 2021-04-28T21:15Z)
Description: value: In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-697 \u2014 Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Repository: https://github.com/ether/ueberDB
Files changed:
mysql_db.js
package.json
Commit message: go go gadget mysql fix for 2877


Vulnerable code:
  this.db.query("SELECT `value` FROM `store` WHERE  `key` = ?", [key], function(err,results)
  var query="SELECT `key` FROM `store` WHERE  `key` LIKE ?"
  "version": "0.4.3",

Fixed code:
  this.db.query("SELECT `value` FROM `store` WHERE BINARY `key` = ?", [key], function(err,results)
  var query="SELECT `key` FROM `store` WHERE BINARY `key` LIKE ?"
  "version": "0.4.4",
CVE-2019-5892 (C, published 2019-01-10T17:29Z)
Description: value: bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABLE_BGP_VNC is used for Virtual Network Control, allows remote attackers to cause a denial of service (peering session flap) via attribute 255 in a BGP UPDATE packet. This occurred during Disco in January 2019 because FRR does not implement RFC 7606, and therefore the packets with 255 were considered invalid VNC data and the BGP session was closed.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-436 \u2014 Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Repository: https://github.com/FRRouting/frr
Files changed:
bgpd/bgp_attr.c
bgpd/bgpd.h
Commit message: bgpd: don't use BGP_ATTR_VNC(255) unless ENABLE_BGP_VNC_ATTR is defined

Signed-off-by: Lou Berger <lberger@labn.net>


Vulnerable code:
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC
#if ENABLE_BGP_VNC

Fixed code:
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
#if ENABLE_BGP_VNC_ATTR
CVE-2022-37032 (C, published 2022-09-19T22:15Z)
Description: value: An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_packet.c.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/FRRouting/frr
Files changed:
bgpd/bgp_packet.c
Commit message: bgpd: Make sure hdr length is at a minimum of what is expected

Ensure that if the capability length specified is enough data.

Signed-off-by: Donald Sharp <sharpd@nvidia.com>


Vulnerable code:

Fixed code:
		if (hdr->length < sizeof(struct capability_mp_data)) {
			zlog_info(
				"%pBP Capability structure is not properly filled out, expected at least %zu bytes but header length specified is %d",
				peer, sizeof(struct capability_mp_data),
				hdr->length);
			return BGP_Stop;
		}
CVE-2018-1000119 (Ruby, published 2018-03-07T14:29Z)
Description: value: Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/sinatra/sinatra
Files changed:
rack-protection/lib/rack/protection/authenticity_token.rb
rack-protection/lib/rack/protection/base.rb
Commit message: Use secure_compare when checking CSRF token

Since string comparisions may return early we want to use a constant
time comparsion function to protect the CSRF token against timing
attacks. Rack::Utils provides a such function.


Vulnerable code:
          env['HTTP_X_CSRF_TOKEN'] == token ||
          Request.new(env).params[options[:authenticity_param]] == token

Fixed code:
          secure_compare(env['HTTP_X_CSRF_TOKEN'], token) ||
          secure_compare(Request.new(env).params[options[:authenticity_param]], token)
require 'rack/utils'
      def secure_compare(a, b)
        Rack::Utils.secure_compare(a.to_s, b.to_s)
      end
CVE-2018-11627 (Ruby, published 2018-05-31T19:29Z)
Description: value: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sinatra/sinatra
Files changed:
lib/sinatra/base.rb
Commit message: escape invalid query params, fixes #1428


Vulnerable code:
      raise BadRequest, "Invalid query parameters: #{e.message}"

Fixed code:
      raise BadRequest, "Invalid query parameters: #{Rack::Utils.escape_html(e.message)}"
CVE-2018-7212 (Unknown, published 2018-02-18T06:29Z)
Description: value: An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/sinatra/sinatra
Files changed:
Commit message: Merge pull request #1387 from namusyaka/update-changelog

bump versions to 2.0.1.rc1

Vulnerable code:

Fixed code:
CVE-2022-45442 (Ruby, published 2022-11-28T21:15Z)
Description: value: Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-494 \u2014 Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Repository: https://github.com/sinatra/sinatra
Files changed:
lib/sinatra/base.rb
test/helpers_test.rb
Commit message: escape filename in the Content-Disposition header

According the multipart form data spec in WHATWG living standard.
Ref: https://html.spec.whatwg.org/#multipart-form-data


Vulnerable code:
      params = format('; filename="%s"', File.basename(filename))

Fixed code:
    # https://html.spec.whatwg.org/#multipart-form-data
    MULTIPART_FORM_DATA_REPLACEMENT_TABLE = {
      '"'  => '%22',
      "\r" => '%0D',
      "\n" => '%0A'
    }.freeze

      params = format('; filename="%s"', File.basename(filename).gsub(/["\r\n]/, MULTIPART_FORM_DATA_REPLACEMENT_TABLE))
    it 'escapes filename in the Content-Disposition header according to the multipart form data spec in WHATWG living standard' do
      mock_app do
        get('/attachment') do
          attachment "test.xml\";\r\next=.txt"
          response.write("<sinatra></sinatra>")
        end
      end

      get '/attachment'
      assert_equal 'attachment; filename="test.xml%22;%0D%0Aext=.txt"', response['Content-Disposition']
      assert_equal '<sinatra></sinatra>', body
    end
CVE-2018-17104 (PHP, published 2018-09-16T21:29Z)
Description: value: An issue was discovered in Microweber 1.0.7. There is a CSRF attack (against the admin user) that can add an administrative account via api/save_user.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/microweber/microweber
Files changed:
src/Microweber/Providers/UserManager.php
userfiles/modules/users/edit_user.php
userfiles/modules/users/profile/confirm_edit.php
Commit message: fix of issue #484

editing user now requires csrf token


Vulnerable code:
        <input type="hidden" class="mw-ui-field" name="id" value="<?php print $data['id']; ?>">

Fixed code:


            if (isset($params['id'])) {
                $validate_token = mw()->user_manager->csrf_validate($params);

                if ($validate_token == false) {

                    return array(
                        'error' => _e('Confirm edit of profile', true),
                        'form_data_required' => 'token',
                        'form_data_module' => 'users/profile/confirm_edit'
                    );

                }
            }




        <input type="hidden"   name="id" value="<?php print $data['id']; ?>">
        <input type="hidden"   name="token" value="<?php print csrf_token() ?>"  autocomplete="off">
<div class="row" style="margin-top: 20px;margin-bottom: 20px;">
    <div class="col-xs-12">
        <div class="form-group">
            <h5><?php _e('Confirm edit of profile'); ?></h5>
            <label class="mw-ui-check">
                <input type="checkbox" name="token" value="<?php print csrf_token() ?>" autocomplete="off"/> &nbsp;
                <span><?php _e('Confirm'); ?></span>
            </label>
        </div>
    </div>
</div>
CVE-2020-13405 (PHP, published 2020-07-16T19:15Z)
Description: value: userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/microweber/microweber
Files changed:
userfiles/modules/users/controller.php
Commit message: update


Vulnerable code:
dd(User::all());

Fixed code:
CVE-2020-28337 (CSS, published 2021-02-15T20:15Z)
Description: value: A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Utils/Zip/Unzip.php
userfiles/modules/admin/backup_v2/css/style.css
Commit message: update


Vulnerable code:


            return $file_locations;

Fixed code:


                if (strpos($file,'..') !== false) {
                    continue;
                }

                if (strpos($is_dir_there,'..') !== false) {
                   continue;
                }



                    if (strpos($target_file_to_save,'..') !== false) {
                        continue;
                    }

            if (!empty($file_locations)) {
                $file_locations = array_unique($file_locations);
            }
        if (strpos($target_file_name,'..') !== false) {
            return false;
        }

        if (strpos($compressed_file_name,'..') !== false) {
            return false;
        }

    overflow-y: scroll;
CVE-2021-32856 (PHP, published 2023-02-21T15:15Z)
Description: value: Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/Content/ContentManagerHelpers.php
Commit message: update


Vulnerable code:
                        $html_to_save = $content = $this->app->parser->make_tags($html_to_save);

Fixed code:
use voku\helper\AntiXSS;
                        $html_to_save = $this->app->parser->make_tags($html_to_save);

                        $antixss = new AntiXSS();
                        $html_to_save = $content = $antixss->xss_clean($html_to_save);