hitoshura25/cvefixes huggingface dataset:
CVE-2021-39186 (PHP, published 2021-09-01T21:15Z)
Description: value: GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/miraheze/GlobalNewFiles
Files changed:
extension.json
includes/GlobalNewFilesHooks.php
includes/GlobalNewFilesPager.php
includes/SpecialGlobalNewFiles.php
Commit message: SECURITY: Fix XSS issues GlobalNewFilesPager

Fix XSS issues in GlobalNewFilesPager by using MediaWiki's LinkRenderer
and Html utilities instead of constructing (unescaped) HTML messages
directly.

For more details, see https://phabricator.miraheze.org/T7935.


Vulnerable code:
		"GlobalNewFiles": "SpecialGlobalNewFiles"
				__DIR__ . '/../sql/patches/patch-gnf_files-binary.sql' 
	function __construct() {
		if ( $this->getRequest()->getText( 'sort', 'files_date' ) == 'files_date' ) {

		parent::__construct( $this->getContext() );
		$wiki = $row->files_dbname;

				$formatted = "<img src=\"{$row->files_url}\" style=\"width:135px;height:135px;\">";
				$formatted = "<a href=\"{$row->files_page}\">{$row->files_name}</a>";
				$formatted = "<a href=\"/wiki/Special:CentralAuth/{$row->files_user}\">{$row->files_user}</a>";
	function __construct() {
		$pager = new GlobalNewFilesPager();
		

Fixed code:
		"GlobalNewFiles": {
			"class": "SpecialGlobalNewFiles",
			"services": [
				"LinkRenderer"
			]
		}
				__DIR__ . '/../sql/patches/patch-gnf_files-binary.sql'
use MediaWiki\Linker\LinkRenderer;
	/** @var LinkRenderer */
	private $linkRenderer;

	function __construct( RequestContext $context, LinkRenderer $linkRenderer ) {
		parent::__construct( $context );

		$this->linkRenderer = $linkRenderer;

		if ( $context->getRequest()->getText( 'sort', 'files_date' ) == 'files_date' ) {
				$formatted = Html::element(
					'img',
					[
						'src' => $row->files_url,
						'style' => 'width: 135px; height: 135px;'
					]
				);
				$formatted = Html::element(
					'a',
					[
						'href' => $row->files_page,
					],
					$row->files_name
				);

				$formatted = $this->linkRenderer->makeLink(
					SpecialPage::getTitleFor( 'CentralAuth', $row->files_user ),
					$row->files_user
				);
use MediaWiki\Linker\LinkRenderer;

	/** @var LinkRenderer */
	private $linkRenderer;
	function __construct( LinkRenderer $linkRenderer ) {
		$this->linkRenderer = $linkRenderer;
		$pager = new GlobalNewFilesPager( $this->getContext(), $this->linkRenderer );
CVE-2013-4584 (C, published 2019-11-15T15:15Z)
Description: value: Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/horms/perdition
Files changed:
perdition/perdition.c
Commit message: Use specified ciphers for outgoing STARTLS connections

Perdition(8) says:

        --ssl_outgoing_ciphers STRING:

              Cipher list when making outgoing SSL or TLS connections as
              per ciphers(1). If empty ("") then openssl's default will
              be used.  (default "")

However, this is only the case for outgoing connections that do not use
STARTTLS (the perdition terminology is confusing here, since what it
calls "TLS" actually means "start as cleartext, negotiate to encrypted
via STARTTLS" and what it calls "SSL" actually means "start SSL or TLS
session, run service inside that").


This is a security concern because it means that perdition is not
obeying the specifications of the administrator, and may accept weaker
ciphersuites than instructed on its backhaul connections.

Consider the case where an administrator wants to offer relatively
promiscuous IMAP connections to their end users -- if the user's MUA
only has some weak cipher suite or cleartext IMAP, we want to accept the
weak ciphersuite as better than nothing.  However, the admin's backend
IMAP servers are all under her control, and she knows that they are
capable of stronger ciphersuites.  in this case, ssl_listen_ciphers will
allow weak ciphers, and ssl_outgoing_ciphers will be strict and require
high security, to at least protect the link between perdition and the
backend IMAP server.

However, if this outgoing connection happens to use IMAP+STARTTLS
instead of IMAPS, the bug described here will offer weak ciphersuites to
the backend IMAP server.

This is CVE-2013-4584
This is Debian Bug #729028

Signed-off-by: Simon Horman <horms@verge.net.au>


Vulnerable code:
		      opt.ssl_ca_path, opt.ssl_listen_ciphers, servername);

Fixed code:
		      opt.ssl_ca_path, opt.ssl_outgoing_ciphers, servername);
CVE-2021-4253 (Perl, published 2022-12-18T22:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ticket Handler. The manipulation of the argument site_id leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 7a1f90bd2a0ce95b8338ec0926902da975ec64d9. It is recommended to apply a patch to fix this issue. VDB-216210 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/ctrlo/lenio
Files changed:
lib/Lenio.pm
Commit message: Fix reflected XSS


Vulnerable code:
                    site_id     => query_parameters->get('site_id') || session('site_id'),
                site_id => query_parameters->get('site_id') || session('site_id'),

Fixed code:
        my $site_id = query_parameters->get('site_id')
            ? int(query_parameters->get('site_id'))
            : session('site_id');
                    site_id     => $site_id,
                site_id => $site_id,
CVE-2021-4254 (Other, published 2022-12-18T22:15Z)
Description: value: A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The manipulation of the argument notice.notice.text leads to cross site scripting. The attack can be launched remotely. The name of the patch is aa300555343c1c081951fcb68bfb6852fbba7451. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216211.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/ctrlo/lenio
Files changed:
views/layouts/main.tt
Commit message: Fix XSS in notices


Vulnerable code:
        [% notice.notice.text %]

Fixed code:
        [% notice.notice.text | html %]
CVE-2021-4255 (Other, published 2022-12-18T22:15Z)
Description: value: A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. The manipulation of the argument contractor.name leads to cross site scripting. The attack may be launched remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216212.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-707 \u2014 Improper Neutralization
The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Repository: https://github.com/ctrlo/lenio
Files changed:
views/contractor.tt
views/index.tt
Commit message: Fix more XSS issues


Vulnerable code:
		<td class="col-sm-10">[% contractor.name %]</td>
                    <td>[% task.name %]
                    <td>[% task.site.org.name %] ([% task.site.name %])</td>

Fixed code:
		<td class="col-sm-10">[% contractor.name | html %]</td>
                    <td>[% task.name | html %]
                    <td>[% task.site.org.name | html %] ([% task.site.name | html %])</td>
CVE-2021-4256 (Other, published 2022-12-18T22:15Z)
Description: value: A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of the argument task.name/task.site.org.name leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier VDB-216213 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ctrlo/lenio
Files changed:
views/contractor.tt
views/index.tt
Commit message: Fix more XSS issues


Vulnerable code:
		<td class="col-sm-10">[% contractor.name %]</td>
                    <td>[% task.name %]
                    <td>[% task.site.org.name %] ([% task.site.name %])</td>

Fixed code:
		<td class="col-sm-10">[% contractor.name | html %]</td>
                    <td>[% task.name | html %]
                    <td>[% task.site.org.name | html %] ([% task.site.name | html %])</td>
CVE-2021-4257 (Other, published 2022-12-18T22:15Z)
Description: value: A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.name/check.name/task.tasktype.name/task.name leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 698c5fa465169d6f23c6a41ca4b1fc9a7869013a. It is recommended to apply a patch to fix this issue. VDB-216214 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ctrlo/lenio
Files changed:
views/task.tt
Commit message: Fix XSS issues in tasks


Vulnerable code:
            <h3>Site Manager Checks ([% site.org.name %] - [% site.name %])
                            <td><a href="/check_edit/[% check.id %]">[% check.name %]</a></td>

Fixed code:
            <h3>Site Manager Checks ([% site.org.name | html %] - [% site.name | html %])
                            <td><a href="/check_edit/[% check.id %]">[% check.name | html %]</a></td>
CVE-2019-25102 (JavaScript, published 2023-02-12T14:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. The patch is identified as 015a719bf5cdc561feea05500ecb3274ef609cd2. It is recommended to upgrade the affected component. VDB-220638 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/ariabuckles/simple-markdown
Files changed:
simple-markdown.js
Commit message: Fix ReDoS with autolink

Patterns like <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ currently exhibit O(n^3) complexity, allowing a 5KB document to take 7174ms to parse. With this change, it drops to O(n^2) and 73ms.

Vulnerable code:
        match: inlineRegex(/^<([^ >]+:\/[^ >]+)>/),

Fixed code:
        match: inlineRegex(/^<([^: >]+:\/[^ >]+)>/),
CVE-2019-25103 (JavaScript, published 2023-02-12T15:15Z)
Description: value: A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to version 0.5.2 is able to address this issue. The patch is named 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220639.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/ariabuckles/simple-markdown
Files changed:
__tests__/simple-markdown-test.js
simple-markdown.js
Commit message: inlineCode: Fix ReDoS & improve escape semantics

Our inline code regex had overlapping parts in the case of spaces;
spaces could be parsed as part of the `\s*`s or as part of the
`[\S\s]*`, which leads to catastrophic backtracking in the case of
a string with many spaces.

The `\s*` parts were attempting to allow for escaping of backticks
within the start/end of inline code blocks, so this commit removes
the `\s*` parts of the regex, and then after parsing the code block,
checks for the case where a single space is being used to escape
a backtick, and removes that space.

Test plan:

1. Added a test for the semantics change.
2. Added a test for the exponential backtracking to match the test
   case in issue #71


Vulnerable code:
        match: inlineRegex(/^(`+)\s*([\s\S]*?[^`])\s*\1(?!`)/),
                content: capture[2]

Fixed code:
        it("should ignore a single space at the start and end of an inline code block separating a '`'", function() {
            var parsed1 = inlineParse(
                "test `` ` `` escaping a code block"
            );
            validateParse(parsed1, [
                {type: "text", content: "test "},
                {type: "inlineCode", content: "`"},
                {type: "text", content: " escaping a code block"},
            ]);

            var parsed1 = inlineParse(
                "test ``  `  `` escaping a code block"
            );
            validateParse(parsed1, [
                {type: "text", content: "test "},
                {type: "inlineCode", content: " ` "},
                {type: "text", content: " escaping a code block"},
            ]);
        });

var INLINE_CODE_ESCAPE_BACKTICKS_R = /^ ( *` *) $|^ ( *`)|(` *) $/g;
        match: inlineRegex(/^(`+)([\s\S]*?[^`])\1(?!`)/),
                content: capture[2].replace(INLINE_CODE_ESCAPE_BACKTICKS_R, "$1")
CVE-2016-9126 (HTML, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
lib/templates/admin/dashboard/audit.html
Commit message: Fix h1 report 97073

Persistent XSS
--------------

Tengku Zahasman has reported via HackerOne that usernames were not properly
escaped when displayed in the audit trail widget of the dashboard upon login,
allowing persistent XSS attacks. An authenticated user with enough privileges
to create other users could exploit the vulnerability to access the
administrator account.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 5.6 (AV:N/AC:H/Au:S/C:C/I:P/A:N)


Vulnerable code:
                        {$aValue.desc}

Fixed code:
                        {$aValue.desc|escape}
CVE-2016-9127 (PHP, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
lib/OA/Admin/PasswordRecovery.php
Commit message: Fix h1 report 99452

Cross-Site Request Forgery (CSRF)
---------------------------------

An undisclosed user has reported via HackerOne that the password recovery form
in Revive Adserver was vulnerable to CSRF attacks. Such vulnerability could be
exploited to send a large number of password recovery emails to the
registered users, especially in conjunction with a bug that caused recovery
emails to be sent to all the users at once. Both issues have been fixed.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)


Vulnerable code:

Fixed code:
        OA_Permission::checkSessionToken();

        echo "<input type='hidden' name='token' value='".phpAds_SessionGetToken()."'/>\n";

        echo "<input type='hidden' name='token' value='".phpAds_SessionGetToken()."'/>\n";
CVE-2016-9128 (XML, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
plugins_repo/openXInvocationTags/plugins/etc/openXInvocationTags.xml
plugins_repo/openXInvocationTags/plugins/etc/oxInvocationTags/oxInvocationTags.xml
Commit message: Bumped openXInvocationTags version


Vulnerable code:
    <creationDate>2015-05-25</creationDate>
    <version>1.4.4</version>
    <creationDate>2015-05-25</creationDate>
    <version>1.4.4</version>

Fixed code:
    <creationDate>2016-02-23</creationDate>
    <version>1.4.5</version>
    <creationDate>2016-02-23</creationDate>
    <version>1.4.5</version>
CVE-2016-9128 (PHP, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
plugins_repo/openXInvocationTags/plugins/invocationTags/oxInvocationTags/spc.class.php
Commit message: Fix h1 report 99004

Reflected XSS
-------------

The HackerOne user @decidedlygray has reported that the affiliate-preview.php
script in www/admin is vulnerable to a reflected XSS attack via the "charset"
parameter. If the target system is running a Revive Adserver version older
than 3.2.2, such a vulnerability could be used by an attacker to steal the
session ID of an authenticated user, by tricking them into visiting a
specifically crafted URL.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)


Vulnerable code:
                        $optionValue = empty($mi->$feature) ? $GLOBALS['strAutoDetect'] : $mi->$feature;

Fixed code:
                        $optionValue = empty($mi->$feature) ? $GLOBALS['strAutoDetect'] : htmlspecialchars($mi->$feature);
CVE-2016-9129 (PHP, published 2017-03-28T02:59Z)
Description: value: Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/revive-adserver/revive-adserver
Files changed:
lib/OA/Admin/PasswordRecovery.php
lib/max/language/en/default.lang.php
Commit message: Fix h1 report 98612

Information Exposure Through Discrepancy
----------------------------------------

Karan M. Tank and Smit B. Shah have reported via HackerOne that it was
possible to check whether or not an email address was associated to one or
more user accounts on a target Revive Adserver instance by examining the
message printed by the password recovery system. Such information cannot
however be used directly to log in to the system, which requires usernames
instead.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-203
CVSSv2: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)


Vulnerable code:
                if ($sent) {
                    $this->displayMessage($GLOBALS['strNotifyPageMessage']);
                } else {
                $this->displayRecoveryRequestForm($GLOBALS['strPwdRecEmailNotFound']);
                }
$GLOBALS['strPwdRecEmailNotFound'] = "Email address not found";

Fixed code:

                // Always pretend an email was sent, even if not to avoid information disclosure
                $this->displayMessage($GLOBALS['strNotifyPageMessage']);