hitoshura25/cvefixes huggingface dataset:
CVE-2022-4727 (Java, published 2022-12-27T15:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openmrs/openmrs-module-appointmentscheduling
Files changed:
api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java
api/src/test/java/org/openmrs/module/appointmentscheduling/api/AppointmentRequestServiceTest.java
Commit message: RA1865 - Fixing reflected XSS in the notes section (#39)

* Fixing reflective XSS in the notes section

* using owasp encoder for HTML encoding

* Escaping HTML using WebUtil

* Update api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java

Co-authored-by: Brandon Istenes <brandonesbox@gmail.com>

* Update api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java

Co-authored-by: Brandon Istenes <brandonesbox@gmail.com>

Co-authored-by: Anupam Devulapalli <anupam.8010@gmail.com>
Co-authored-by: Mark Goodrich <mgoodrich@pih.org>
Co-authored-by: Brandon Istenes <brandonesbox@gmail.com>

Vulnerable code:
        this.notes = notes;
        assertNull(appointmentRequest.getNotes());


Fixed code:
import org.openmrs.web.WebUtil;
        this.notes = WebUtil.escapeHTML(notes);
    @Test
    @Verifies(value="The text for notes should be sanitized", method="sanitizeNotes(String)")
    public void sanitizeAppointmentRequest_shouldSanitizeTheTextInputForAppointmentNotes() throws Exception {
        final String note = "<iframe>";
        final String sanitizedNote = "&lt;iframe&gt;";
        AppointmentRequest appointmentRequest = new AppointmentRequest();
        appointmentRequest.setNotes(note);
        assertEquals(appointmentRequest.getNotes(), sanitizedNote);
    }
CVE-2023-35846 (C, published 2023-06-19T03:15Z)
Description: value: VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performing port filtering.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/virtualsquare/picotcp
Files changed:
modules/pico_ipfilter.c
Commit message: [ipfilter] Check transport layer length in frame before filtering ports

Reported-by: "P. Amsuo, Purdue University"


Vulnerable code:
    if ((ipv4_hdr->proto == PICO_PROTO_TCP) || (ipv4_hdr->proto == PICO_PROTO_UDP)) {
        trans = (struct pico_trans *) f->transport_hdr;
        temp.out_port = short_be(trans->dport);
        temp.in_port = short_be(trans->sport);
    }
    else if(ipv4_hdr->proto == PICO_PROTO_ICMP4) {
        icmp_hdr = (struct pico_icmp4_hdr *) f->transport_hdr;
        if(icmp_hdr->type == PICO_ICMP_UNREACH && icmp_hdr->code == PICO_ICMP_UNREACH_FILTER_PROHIB)
            return 0;

    temp.proto = ipv4_hdr->proto;

Fixed code:
    if ((f->transport_hdr + sizeof(struct pico_trans)) <= (f->buffer + f->buffer_len)) {
        if ((ipv4_hdr->proto == PICO_PROTO_TCP) || (ipv4_hdr->proto == PICO_PROTO_UDP)) {
                trans = (struct pico_trans *) f->transport_hdr;
                temp.out_port = short_be(trans->dport);
                temp.in_port = short_be(trans->sport);
        } else if(ipv4_hdr->proto == PICO_PROTO_ICMP4) {
            icmp_hdr = (struct pico_icmp4_hdr *) f->transport_hdr;
            if(icmp_hdr->type == PICO_ICMP_UNREACH && icmp_hdr->code == PICO_ICMP_UNREACH_FILTER_PROHIB)
                return 0;
        }
        temp.proto = ipv4_hdr->proto;
CVE-2023-35847 (C, published 2023-06-19T03:15Z)
Description: value: VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/virtualsquare/picotcp
Files changed:
modules/pico_tcp.c
modules/pico_tcp.h
Commit message: TCP: Fixed MSS size calculation. Set MSS lower bound.

Reported-by: "P. Amsuo, Purdue University"


Vulnerable code:
    t->mss = (uint16_t)(pico_socket_get_mss(&t->sock) - PICO_SIZE_TCPHDR);
    ts->mss = (uint16_t)(mtu - PICO_SIZE_TCPHDR);
    new->mss = (uint16_t)(mtu - PICO_SIZE_TCPHDR);

Fixed code:
    t->mss = (uint16_t)(pico_socket_get_mss(&t->sock));
    if (t->mss > PICO_SIZE_TCPHDR + PICO_TCP_MIN_MSS)
        t->mss -= (uint16_t)PICO_SIZE_TCPHDR;
    else
        t->mss = PICO_TCP_MIN_MSS;
    if (mtu > PICO_SIZE_TCPHDR + PICO_TCP_MIN_MSS)
        ts->mss = (uint16_t)(mtu - PICO_SIZE_TCPHDR);
    else
        ts->mss = PICO_TCP_MIN_MSS;
    if (mtu > PICO_SIZE_TCPHDR + PICO_TCP_MIN_MSS)
        new->mss = (uint16_t)(mtu - PICO_SIZE_TCPHDR);
    else
        new->mss = PICO_TCP_MIN_MSS;
#define PICO_TCP_MIN_MSS (64 - PICO_SIZE_TCPHDR)
CVE-2023-35849 (C, published 2023-06-19T03:15Z)
Description: value: VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/virtualsquare/picotcp
Files changed:
modules/pico_ipv4.c
modules/pico_tcp.c
Commit message: More checks for correct header sizes

Reported-by: "P. Amsuo, Purdue University"


Vulnerable code:

Fixed code:

    if ((f->net_hdr + f->net_len) > (f->buffer + f->buffer_len)) {
        pico_frame_discard(f);
        return 0;
    }
    if ((*idx + PICO_TCPOPTLEN_MSS) > len)
        return;


    if (f->buffer + f->buffer_len > f->transport_hdr + f->transport_len)
        return -1;
CVE-2022-31889 (PHP, published 2023-04-05T22:15Z)
Description: value: Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket-plugins
Files changed:
audit/templates/auditlogs.tmpl.php
Commit message: xss: Audit Log

This mitigates a vulnerability discovered by the AppSec Research Team at
Checkmarx where it's possible to perform XSS via the Audit Log plugin. This
is due to not properly escaping the `state` and `type` URL params. This adds
`Format::htmlchars()` to both params to ensure they are properly escaped.


Vulnerable code:
    $qs += array('type' => $_REQUEST['type']);
  $type=$_REQUEST['type'];
    $qs += array('state' => $_REQUEST['state']);
  $state=$_REQUEST['state'];
$order = AuditEntry::getOrder($_REQUEST['order']);

Fixed code:
    $qs += array('type' => Format::htmlchars($_REQUEST['type']));
  $type=Format::htmlchars($_REQUEST['type']);
    $qs += array('state' => Format::htmlchars($_REQUEST['state']));
  $state=Format::htmlchars($_REQUEST['state']);
$order = AuditEntry::getOrder(Format::htmlchars($_REQUEST['order']));
CVE-2022-31890 (PHP, published 2023-04-05T22:15Z)
Description: value: SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/osTicket/osTicket-plugins
Files changed:
audit/class.audit.php
Commit message: security: Audit Log Injection

This mitigates a vulnerability discovered by the AppSec Research Team at
Checkmarx where it's possible to perform injection via Audit Log plugin.
This is due to passing the `order` URL param directly to the select query.
This refactors the `getOrder()` method to only return predefined sort orders
to prevent using user-input.


Vulnerable code:
        if($_REQUEST['order'] && $orderWays[strtoupper($_REQUEST['order'])]) {
            $order=$orderWays[strtoupper($_REQUEST['order'])];
        }
        $order=$order?$order:'DESC';
        return $order;
      $orderWays=array('DESC'=>'DESC','ASC'=>'ASC');

Fixed code:
        $or = null;
        $orderWays=array('DESC'=>'DESC','ASC'=>'ASC');

        if ($order && $orderWays[strtoupper($order)])
            $or = $orderWays[strtoupper($order)];
        elseif($_REQUEST['order'] && $orderWays[strtoupper($_REQUEST['order'])])
            $or = $orderWays[strtoupper($_REQUEST['order'])];

        $or = $or ? $or : 'DESC';
        return $or;
CVE-2022-32074 (Unknown, published 2022-07-13T16:15Z)
Description: value: A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osTicket/osTicket-plugins
Files changed:
Commit message: Merge pull request #229 from JediKev/security/latest-security-patches-05-2022

Reviewed-By: JediKev <kevin@enhancesoft.com>, aydreeihn <adriane@enhancesoft.com>

Vulnerable code:

Fixed code:
CVE-2023-0642 (Other, published 2023-02-02T12:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/squidex/squidex
Files changed:
backend/src/Squidex/Areas/IdentityServer/Controllers/Account/AccountController.cs
backend/src/Squidex/Areas/IdentityServer/Controllers/Profile/ProfileController.cs
backend/src/Squidex/Areas/IdentityServer/Controllers/Setup/SetupController.cs
backend/src/Squidex/Areas/IdentityServer/Views/Account/Consent.cshtml
backend/src/Squidex/Areas/IdentityServer/Views/Account/Login.cshtml
backend/src/Squidex/Areas/IdentityServer/Views/Profile/Profile.cshtml
backend/src/Squidex/Areas/IdentityServer/Views/Setup/Setup.cshtml
frontend/src/app/shared/components/contents/content-list-cell.directive.ts
frontend/src/app/shared/components/contents/content-list-field.component.html
Commit message: Antiforgery for profile pages.


Vulnerable code:
       @if (Model!.HasPassword)
            return 50;
            <span class="text-nowrap">

Fixed code:
[AutoValidateAntiforgeryToken]
[AutoValidateAntiforgeryToken]
[AutoValidateAntiforgeryToken]
    @Html.AntiForgeryToken()

        @Html.AntiForgeryToken()

                @Html.AntiForgeryToken()

            @Html.AntiForgeryToken()

    @Html.AntiForgeryToken()

                                @Html.AntiForgeryToken()

            @Html.AntiForgeryToken()

        @if (Model!.HasPassword)
                @Html.AntiForgeryToken()

                @Html.AntiForgeryToken()

                @Html.AntiForgeryToken()

        @Html.AntiForgeryToken()

            @Html.AntiForgeryToken()

            return 80;
            <span class="text-nowrap truncate">
CVE-2023-3580 (YAML, published 2023-07-10T16:15Z)
Description: value: Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/squidex/squidex
Files changed:
.github/workflows/release.yml
Commit message: Fix build.


Vulnerable code:
          if [[ ${{ env.GITHUB_REF_SLUG }} =~ ^[0-9]+\.[0-9]+$ ]]; then
          docker tag squidex-local squidex/squidex:${{ env.GITHUB_REF_SLUG }}
          docker tag squidex-local squidex/squidex:${{ steps.version.outputs._0 }}
      - name: Publish - Push Latest
          docker tag squidex-local squidex/squidex:latest

Fixed code:
          if [[ ${{ env.GITHUB_REF_SLUG }} =~ ^[0-9]+\.[0-9]+(\.[0-9]+){0,2}$ ]]; then
          docker push squidex/squidex:${{ env.GITHUB_REF_SLUG }}
          docker push squidex/squidex:${{ steps.version.outputs._0 }}
      - name: Publish - Push Tags Latest
          docker push squidex/squidex:latest
CVE-2020-26263 (Unknown, published 2020-12-21T17:15Z)
Description: value: tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-326 \u2014 Inadequate Encryption Strength
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Repository: https://github.com/tlsfuzzer/tlslite-ng
Files changed:
Commit message: Merge pull request #439 from tlsfuzzer/bleichenbacher-fixes-0.7

Bleichenbacher fixes [0.7]

Vulnerable code:

Fixed code:
CVE-2022-25860 (TypeScript, published 2023-01-26T21:15Z)
Description: value: Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization.This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/steveukx/git-js
Files changed:
.changeset/fair-cobras-arrive.md
docs/PLUGIN-UNSAFE-ACTIONS.md
simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts
simple-git/test/unit/plugin.unsafe.spec.ts
Commit message: Block unsafe pack (push --exec) (#882)

Add `git push --exec` to the set of blocked operations without the use of an `allowUnsafePack` override.


Vulnerable code:
      ['clone', '-u touch /tmp/pwn'],

Fixed code:
---
'simple-git': patch
---

Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.
### Enabling custom upload and receive packs

Instead of using the default `git-receive-pack` and `git-upload-pack` binaries to parse incoming and outgoing
data, `git` can be configured to use _any_ arbitrary binary or evaluable script.

To avoid accidentally triggering the evaluation of a malicious script when merging user provided parameters
into command executed by `simple-git`, custom pack options (usually with the `--receive-pack` and `--upload-pack`)
are blocked without explicitly opting into their use  

```typescript
import { simpleGit } from 'simple-git';

// throws
await simpleGit()
   .raw('push', '--receive-pack=git-receive-pack-custom');

// allows calling clone with a helper transport
await simpleGit({ unsafe: { allowUnsafePack: true } })
   .raw('push', '--receive-pack=git-receive-pack-custom');
```


   if (method === 'push' && /^\s*--exec\b/.test(arg)) {
      throw new GitPluginError(
         undefined,
         'unsafe',
         `Use of push with option --exec is not permitted without enabling allowUnsafePack`
      );
   }
      ['clone', '-u touch /tmp/pwn'],
      ['push', '--exec=touch /tmp/pwn2'],
CVE-2020-5291 (Unknown, published 2020-03-31T18:15Z)
Description: value: Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/containers/bubblewrap
Files changed:
Commit message: Merge pull request from GHSA-j2qp-rvxj-43vj

Fix setuid vulnerability

Vulnerable code:

Fixed code:
CVE-2013-6372 (Java, published 2014-05-08T14:29Z)
Description: value: The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/jenkinsci/subversion-plugin
Files changed:
src/main/java/hudson/scm/SubversionSCM.java
Commit message: [FIXED SECURITY-58]

encryption of passphrases wasn't sufficiently secure.


Vulnerable code:
            private final String password; // scrambled by base64
                this.password = Scrambler.scramble(password);
                    return new SVNSSHAuthentication(userName,Scrambler.descramble(password),-1,false);
                    return new SVNPasswordAuthentication(userName,Scrambler.descramble(password),false);
            private final String passphrase; // scrambled by base64
                this.passphrase = Scrambler.scramble(passphrase);
                        return new SVNSSHAuthentication(userName, privateKey.toCharArray(), Scrambler.descramble(passphrase),-1,false);
            private final String password; // scrambled by base64
                this.password = Scrambler.scramble(password);
                                Scrambler.descramble(password), false);

Fixed code:
            private final Secret password; // for historical reasons, scrambled by base64 in addition to using 'Secret'
                this.password = Secret.fromString(Scrambler.scramble(password));
                    return new SVNSSHAuthentication(userName, getPassword(),-1,false);
                    return new SVNPasswordAuthentication(userName, getPassword(),false);
            }

            private String getPassword() {
                return Scrambler.descramble(Secret.toString(password));
            private final Secret passphrase; // for historical reasons, scrambled by base64 in addition to using 'Secret'
                this.passphrase = Secret.fromString(Scrambler.scramble(passphrase));
                        return new SVNSSHAuthentication(userName, privateKey.toCharArray(), Scrambler.descramble(Secret.toString(passphrase)),-1,false);
            private final Secret password; // for historical reasons, scrambled by base64 in addition to using 'Secret'
                this.password = Secret.fromString(Scrambler.scramble(password));
                                Scrambler.descramble(Secret.toString(password)), false);
CVE-2021-3690 (Java, published 2022-08-23T16:15Z)
Description: value: A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/undertow-io/undertow
Files changed:
websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
Commit message: [UNDERTOW-1935] - buffer leak on incoming websocket PONG message


Vulnerable code:

Fixed code:
        } else {
            bufferedBinaryMessage.getData().free();
CVE-2022-1319 (Unknown, published 2022-08-31T16:15Z)
Description: value: A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/undertow-io/undertow
Files changed:
Commit message: Merge pull request #1331 from fl4via/UNDERTOW-2060

[UNDERTOW-2060] fix double AJP response

Vulnerable code:

Fixed code: