hitoshura25/cvefixes huggingface dataset:
CVE-2020-7752 (HTML, published 2020-10-26T17:15Z)
Description: value: This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
CHANGELOG.md
docs/history.html
docs/index.html
lib/internet.js
Commit message: inetChecksite() fixed vulnerability: command injection


Vulnerable code:
      <div class="version">Current Version: <span id="version">4.27.10</span></div>
      const urlSanitized = util.sanitizeShellString(url).toLowerCase();

Fixed code:
| 4.27.11        | 2020-10-26     | `inetChecksite()` fixed vulnerability: command injection |
                  <tr>
                    <th scope="row">4.27.11</th>
                    <td>2020-10-26</td>
                    <td><span class="code">inetChecksite()</span> fixed vulnerability: command injection</td>
                  </tr>
      <div class="version">Current Version: <span id="version">4.27.11</span></div>
      let urlSanitized = util.sanitizeShellString(url).toLowerCase();
      urlSanitized = urlSanitized.replace(/ /g, '');
      urlSanitized = urlSanitized.replace(/\$/g, '');
      urlSanitized = urlSanitized.replace(/\(/g, '');
      urlSanitized = urlSanitized.replace(/\)/g, '');
      urlSanitized = urlSanitized.replace(/{/g, '');
      urlSanitized = urlSanitized.replace(/}/g, '');
CVE-2020-7778 (JavaScript, published 2020-11-26T11:15Z)
Description: value: This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
lib/internet.js
lib/network.js
lib/util.js
Commit message: security update (prototype pollution prevention)


Vulnerable code:
      for (i = 0; i <= 2000; i++) {
            urlSanitized = urlSanitized + sl[i];
                  rx_bytes = parseInt(stats[6]);
                  rx_dropped = parseInt(stats[11]);
                  rx_errors = parseInt(stats[5]);
                  tx_bytes = parseInt(stats[9]);
                  tx_dropped = parseInt(stats[11]);
                  tx_errors = parseInt(stats[8]);

  for (i = 0; i <= 2000; i++) {
  s = '1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
    for (i = 0; i < l; i++) {
    for (i = 0; i < l; i++) {

Fixed code:
      for (let i = 0; i <= 2000; i++) {
            urlSanitized = urlSanitized + sl[0];
                  const offset = stats.length > 11 ? 1 : 0;
                  rx_bytes = parseInt(stats[offset + 5]);
                  rx_dropped = parseInt(stats[offset + 10]);
                  rx_errors = parseInt(stats[offset + 4]);
                  tx_bytes = parseInt(stats[offset + 8]);
                  tx_dropped = parseInt(stats[offset + 10]);
                  tx_errors = parseInt(stats[offset + 7]);
  for (let i = 0; i <= 2000; i++) {
  const s = '1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
    for (let i = 0; i < l; i++) {
    for (let i = 0; i < l; i++) {
CVE-2021-21388 (JavaScript, published 2021-04-29T18:15Z)
Description: value: systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
lib/docker.js
lib/internet.js
lib/network.js
lib/processes.js
Commit message: sanitizeShellString() and other security improvements


Vulnerable code:
          for (let i = 0; i <= 2000; i++) {
      const mathMin = util.mathMin;
      for (let i = 0; i <= mathMin(s.length, 2000); i++) {
      const mathMin = util.mathMin;
      for (let i = 0; i <= mathMin(s.length, 2000); i++) {
      const mathMin = util.mathMin;
      for (let i = 0; i <= mathMin(s.length, 2000); i++) {
        const mathMin = util.mathMin;
        for (let i = 0; i <= mathMin(s.length, 2000); i++) {
      const mathMin = util.mathMin;
      for (let i = 0; i <= mathMin(s.length, 2000); i++) {

Fixed code:
          for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
        for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
CVE-2021-21388 (JavaScript, published 2021-04-29T18:15Z)
Description: value: systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
lib/internet.js
Commit message: sanitizeShellString() and other security improvements


Vulnerable code:
const execFile = require('child_process').execFile;
          execFile('ping', params.split(' '), util.execOptsWin, function (error, stdout) {
            if (!error) {
              let lines = stdout.toString().split('\r\n');

Fixed code:
          util.execSave('ping', params.split(' '), util.execOptsWin).then((stdout) => {
            if (stdout) {
              let lines = stdout.split('\r\n');
CVE-2023-42810 (HTML, published 2023-09-21T18:15Z)
Description: value: systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/sebhildebrandt/systeminformation
Files changed:
docs/history.html
docs/index.html
docs/security.html
lib/wifi.js
Commit message: wifi sanitizing ssid names


Vulnerable code:
      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.6.13</a>
      <div class="version">New Version: <span id="version">5.21.6</span></div>
</html>
          const nmiConnection = nmiConnectionLinux(ssid);

Fixed code:
                    <tr>
                      <th scope="row">5.21.7</th>
                      <td>2023-09-19</td>
                      <td><span class="code">wifiConnections()</span> <span class="code">wifiNetworks()</span>fixed security issue (linux)</td>
                    </tr>
      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.21.7</a>
      <div class="version">New Version: <span id="version">5.21.7</span></div>
                <h2>SSID Command Injection Vulnerability</h2>
                <p><span class="bold">Affected versions:</span>
                  &lt; 5.21.07 and &lt; 4.34.22<br>
                  <span class="bold">Date:</span> 2023-09-19<br>
                  <span class="bold">CVE indentifier</span> -
                </p>

                <h4>Impact</h4>
                <p>We had an issue that there was a possibility to perform a potential command injection possibility by crafting detected SSIDs in <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span>.</p>

                <h4>Patch</h4>
                <p>Problem was fixed with parameter checking. Please upgrade to version >= 5.7.21 (or >= 4.34.22 if you are using version 4).</p>

                <h4>Workaround</h4>
                <p>If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span> (string only)</p>
                <hr>
                <br>

</html>
          let ssidSanitized = '';
          const t = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(ssid, true);
          for (let i = 0; i <= util.mathMin(t.length, 2000); i++) {
            if (t[i] !== undefined) {
              ssidSanitized = ssidSanitized + t[i];
            }
          }

          const nmiConnection = nmiConnectionLinux(ssidSanitized);
CVE-2024-24819 (Unknown, published 2024-02-09T01:15Z)
Description: value: icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class `gipfl\Web\Form` is the base for various concrete form implementations [1] and provides protection against cross site request forgery (CSRF) by default. This is done by automatically adding an element with a CSRF token to any form, unless explicitly disabled, but even if enabled, the CSRF token (sent during a client's submission of a form relying on it) is not validated. This enables attackers to perform changes on behalf of a user which, unknowingly, interacts with a prepared link or website. The version 0.22.0 is available to remedy this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Icinga/icingaweb2-module-incubator
Files changed:
Commit message: Merge pull request from GHSA-p8vv-9pqq-rm8p

`gipfl/web/Form`: Fix form validation

Vulnerable code:

Fixed code:
CVE-2019-10800 (Python, published 2022-07-13T12:15Z)
Description: value: This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-88 \u2014 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
Repository: https://github.com/codecov/codecov-python
Files changed:
codecov/__init__.py
tests/test.py
Commit message: CE-1380_sanitize_args


Vulnerable code:
                  (codecov.gcov_root or root),
                  (codecov.gcov_exec or ''),
                  (codecov.gcov_args or ''))

Fixed code:
def sanitize_arg(replacement, arg):
    return re.sub(r'[\&]+', replacement, arg, 0, re.MULTILINE)


                  (sanitize_arg('', codecov.gcov_root or root)),
                  (sanitize_arg('', codecov.gcov_exec or '')),
                  (sanitize_arg('', codecov.gcov_args or '')))
    def test_sanitize_arg(self):
        self.assertEqual(codecov.sanitize_arg('', '& echo test > vuln1.txt'), ' echo test > vuln1.txt')
CVE-2021-23365 (Unknown, published 2021-04-26T10:15Z)
Description: value: The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/TykTechnologies/tyk-identity-broker
Files changed:
Commit message: Merge pull request #147 from TykTechnologies/fix/saml-vuln-and-broken-tests

TT-13322-Fix SAML vuln and broken tests

Vulnerable code:

Fixed code:
CVE-2018-5212 (PHP, published 2018-01-04T18:29Z)
Description: value: The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Arsenal21/simple-download-monitor
Files changed:
simple-download-monitor/main.php
simple-download-monitor/readme.txt
Commit message: v3.5.4 released

Vulnerable code:
 * Version: 3.5.3
define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.3');
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . $old_value . '" placeholder="http://..." />';
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo $old_value; ?>" placeholder="http://..." />
	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . $value . '" />';
	echo ' <input type="text" name="sdm_item_file_size" value="' . $file_size . '" size="20" />';
	echo ' <input type="text" name="sdm_item_version" value="' . $version . '" size="20" />';
	    update_post_meta($post_id, 'sdm_upload', $_POST['sdm_upload']);
	    update_post_meta($post_id, 'sdm_upload_thumbnail', $_POST['sdm_upload_thumbnail']);
	    update_post_meta($post_id, 'sdm_item_file_size', $_POST['sdm_item_file_size']);
	    update_post_meta($post_id, 'sdm_item_version', $_POST['sdm_item_version']);
Stable tag: 3.5.3

Fixed code:
 * Version: 3.5.4
define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.4');
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . esc_url($old_value) . '" placeholder="http://..." />';
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo esc_url($old_value); ?>" placeholder="http://..." />
	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . esc_attr($value) . '" />';
	echo ' <input type="text" name="sdm_item_file_size" value="' . esc_attr($file_size) . '" size="20" />';
	echo ' <input type="text" name="sdm_item_version" value="' . esc_attr($version) . '" size="20" />';
	    update_post_meta($post_id, 'sdm_upload', sanitize_text_field($_POST['sdm_upload']));
	    update_post_meta($post_id, 'sdm_upload_thumbnail', sanitize_text_field($_POST['sdm_upload_thumbnail']));
	    update_post_meta($post_id, 'sdm_item_file_size', sanitize_text_field($_POST['sdm_item_file_size']));
	    update_post_meta($post_id, 'sdm_item_version', sanitize_text_field($_POST['sdm_item_version']));
Stable tag: 3.5.4
= 3.5.4 =
- Fixed stored-XSS bug. Thanks to d4wner.
CVE-2018-5213 (PHP, published 2018-01-04T18:29Z)
Description: value: The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Arsenal21/simple-download-monitor
Files changed:
simple-download-monitor/main.php
simple-download-monitor/readme.txt
Commit message: v3.5.4 released

Vulnerable code:
 * Version: 3.5.3
define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.3');
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . $old_value . '" placeholder="http://..." />';
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo $old_value; ?>" placeholder="http://..." />
	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . $value . '" />';
	echo ' <input type="text" name="sdm_item_file_size" value="' . $file_size . '" size="20" />';
	echo ' <input type="text" name="sdm_item_version" value="' . $version . '" size="20" />';
	    update_post_meta($post_id, 'sdm_upload', $_POST['sdm_upload']);
	    update_post_meta($post_id, 'sdm_upload_thumbnail', $_POST['sdm_upload_thumbnail']);
	    update_post_meta($post_id, 'sdm_item_file_size', $_POST['sdm_item_file_size']);
	    update_post_meta($post_id, 'sdm_item_version', $_POST['sdm_item_version']);
Stable tag: 3.5.3

Fixed code:
 * Version: 3.5.4
define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.4');
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . esc_url($old_value) . '" placeholder="http://..." />';
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo esc_url($old_value); ?>" placeholder="http://..." />
	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . esc_attr($value) . '" />';
	echo ' <input type="text" name="sdm_item_file_size" value="' . esc_attr($file_size) . '" size="20" />';
	echo ' <input type="text" name="sdm_item_version" value="' . esc_attr($version) . '" size="20" />';
	    update_post_meta($post_id, 'sdm_upload', sanitize_text_field($_POST['sdm_upload']));
	    update_post_meta($post_id, 'sdm_upload_thumbnail', sanitize_text_field($_POST['sdm_upload_thumbnail']));
	    update_post_meta($post_id, 'sdm_item_file_size', sanitize_text_field($_POST['sdm_item_file_size']));
	    update_post_meta($post_id, 'sdm_item_version', sanitize_text_field($_POST['sdm_item_version']));
Stable tag: 3.5.4
= 3.5.4 =
- Fixed stored-XSS bug. Thanks to d4wner.
CVE-2021-32820 (Markdown, published 2021-05-14T19:15Z)
Description: value: Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/express-handlebars/express-handlebars
Files changed:
README.md
Commit message: fix: add note about security

Vulnerable code:

Fixed code:
## Danger 🔥
 
Never put objects on the `req` object straight in as the data, this can allow hackers to run XSS attacks. Always make sure you are destructuring the values on objects like `req.query` and `req.params`. See https://blog.shoebpatel.com/2021/01/23/The-Secret-Parameter-LFR-and-Potential-RCE-in-NodeJS-Apps/ for more details.
CVE-2024-22418 (PHP, published 2024-01-18T21:15Z)
Description: value: Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Intermesh/groupoffice
Files changed:
www/modules/files/controller/FileController.php
www/modules/files/controller/FolderController.php
Commit message: Files: Fixed Stored XSS Vulnerability via Malicious File Names in Upload Feature


Vulnerable code:
		$response['data']['path'] = $model->path;
		$response['path'] = $folder->path;
		$record['path'] = $model->path;

Fixed code:
		$response['data']['path'] = htmlspecialchars($model->path);
		$response['path'] = htmlentities($folder->path);
		$record['path'] = htmlspecialchars($model->path);