hitoshura25/cvefixes huggingface dataset:
CVE-2023-3445 (Ruby, published 2023-06-28T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository spinacms/spina prior to 2.15.1.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/spinacms/spina
Files changed:
app/components/spina/pages/actions_component.html.erb
Commit message: Sanitiez title (#1258)



Vulnerable code:
          <%= button_to t('spina.pages.delete'), helpers.spina.admin_page_path(@page), method: :delete, class: "block w-full text-left px-4 py-2 text-sm leading-5 font-medium text-red-500 cursor-pointer bg-white hover:bg-red-100 hover:bg-opacity-50 hover:text-red-500 focus:outline-none focus:bg-gray-100 focus:text-gray-900", form: {data: {controller: "confirm", confirm_message: t('spina.pages.delete_confirmation', subject: @page.title)}} %>

Fixed code:
          <%= button_to t('spina.pages.delete'), helpers.spina.admin_page_path(@page), method: :delete, class: "block w-full text-left px-4 py-2 text-sm leading-5 font-medium text-red-500 cursor-pointer bg-white hover:bg-red-100 hover:bg-opacity-50 hover:text-red-500 focus:outline-none focus:bg-gray-100 focus:text-gray-900", form: {data: {controller: "confirm", confirm_message: t('spina.pages.delete_confirmation', subject: sanitize(@page.title))}} %>
CVE-2024-35237 (JavaScript, published 2024-05-27T17:15Z)
Description: value: MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants them roles in a Discord server, and stores information about them in a database backend. A vulnerability that exists prior to commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e impacts all users who have performed verification with an instance of MIT IdentiBot that meets the following conditions: The instance of IdentiBot is tied to a "public" Discord application—i.e., users other than the API access registrant can add it to servers; *and* the instance has not yet been patched. In affected versions, IdentiBot does not check that a server is authorized before allowing members to execute slash and user commands in that server. As a result, any user can join IdentiBot to their server and then use commands (e.g., `/kerbid`) to reveal the full name and other information about a Discord user who has verified their affiliation with MIT using IdentiBot. The latest version of MIT IdentiBot contains a patch for this vulnerability (implemented in commit 48e3e5e7ead6777fa75d57c7711c8e55b501c24e). There is no way to prevent exploitation of the vulnerability without the patch. To prevent exploitation of the vulnerability, all vulnerable instances of IdentiBot should be taken offline until they have been updated.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ZelnickB/mit-identibot
Files changed:
discordBot/commands/ChatInput/logic/kerbid.js
discordBot/commands/ChatInput/logic/resetnick.js
discordBot/commands/User/logic/Get Profile from Linked Kerberos.js	
discordBot/commands/serverAuthorization.js
Commit message: Patched GHSA-h8r9-7r8x-78v6

This commit patches GHSA-h8r9-7r8x-78v6 by performing an authorization check (i.e., checking whether the server is registered) before the use of `/kerbid` and `/resetnick` (as well as the corresponding user commands).


Vulnerable code:

Fixed code:
import { authorizeAndReply } from '../../serverAuthorization.js'
  if (!await authorizeAndReply(interaction)) return
import { authorizeAndReply } from '../../serverAuthorization.js'
  if (!await authorizeAndReply(interaction)) return
import { authorizeAndReply } from '../../serverAuthorization.js'
  if (!await authorizeAndReply(interaction)) return
import { configDb } from '../../lib/preferencesReader.js'

export async function authorize (interaction) {
  return Object.keys(await configDb.getDocumentByName('servers')).includes(interaction.guildId)
}

export async function authorizeAndReply (interaction, ephemeralResponse = true) {
  if (await authorize(interaction)) {
    return true
  } else {
    await interaction.reply({
      content: '**Error!** This server is not authorized to perform the attempted action.',
      ephemeral: ephemeralResponse
    })
    return false
  }
}
CVE-2022-4817 (Unknown, published 2022-12-28T19:15Z)
Description: value: A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216988.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/centic9/jgit-cookbook
Files changed:
Commit message: Merge pull request #86 from BulkSecurityGeneratorProjectV2/fix/JLL/temporary_directory_hijacking_or_temporary_directory_information_disclosure

[SECURITY] Fix Temporary Directory Hijacking or Information Disclosure Vulnerability

Vulnerable code:

Fixed code:
CVE-2018-7466 (PHP, published 2018-02-25T07:29Z)
Description: value: install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
install/installNewDB.php
Commit message: Limit DB LOGIN NAMES length to avoid some kind of injection


Vulnerable code:
$db_admin_name = trim($_SESSION['databaseloginname']);
$db_admin_name = preg_replace($san,'',$db_admin_name);

$tl_db_login = trim($_SESSION['tl_loginname']);
$tl_db_login = preg_replace($san,'',$tl_db_login);


Fixed code:
// will limit length to avoi some kind of injection
// Choice: 32 
$tl_db_login = trim($_SESSION['tl_loginname']);
$tl_db_login = substr(preg_replace($san,'',$tl_db_login),0,32);

$db_admin_name = trim($_SESSION['databaseloginname']);
$db_admin_name = substr(preg_replace($san,'',$db_admin_name),0,32);
CVE-2019-20107 (PHP, published 2020-03-05T13:15Z)
Description: value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
lib/testcases/tcAssign2Tplan.php
Commit message: fix: security #8829


Vulnerable code:

Fixed code:
  
  $args->tproject_id = intval($args->tproject_id);
  $args->tplan_id = intval($args->tplan_id);


  $args->tcase_id = intval($args->tcase_id);

  $args->tcversion_id = intval($args->tcversion_id);
CVE-2019-20107 (PHP, published 2020-03-05T13:15Z)
Description: value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
lib/requirements/reqCompareVersions.php
Commit message: fix: security #8829


Vulnerable code:
  $args->req_id = isset($_REQUEST['requirement_id']) ? $_REQUEST['requirement_id'] : 0;
    $args->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;

Fixed code:
  $args->req_id = isset($_REQUEST['requirement_id']) ? intval($_REQUEST['requirement_id']) : 0;

    $args->tproject_id = isset($_SESSION['testprojectID']) ? intval($_SESSION['testprojectID']) : 0;
CVE-2019-20107 (PHP, published 2020-03-05T13:15Z)
Description: value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
lib/testcases/tcCompareVersions.php
Commit message: fix: security #8829


Vulnerable code:

Fixed code:
  $args->tcase_id = intval($args->tcase_id);
CVE-2019-20107 (PHP, published 2020-03-05T13:15Z)
Description: value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
lib/requirements/reqSpecCompareRevisions.php
Commit message: fix: security #8829


Vulnerable code:
	$args->req_spec_id = isset($_REQUEST['req_spec_id']) ? $_REQUEST['req_spec_id'] : 0;
	$args->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;

Fixed code:
	$args->req_spec_id = isset($_REQUEST['req_spec_id']) ? intval($_REQUEST['req_spec_id']) : 0;
	$args->tproject_id = isset($_SESSION['testprojectID']) ? intval($_SESSION['testprojectID']) : 0;
CVE-2019-20107 (PHP, published 2020-03-05T13:15Z)
Description: value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
lib/plan/newest_tcversions.php
lib/plan/planUpdateTC.php
Commit message: fix: security #8829


Vulnerable code:
    $args->tproject_id = $_SESSION['testprojectID'];
    
    $args->id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;

Fixed code:
    $args->tproject_id = intval($_SESSION['testprojectID']);
    $args->tplan_id = intval($args->tplan_id);

    $args->id = isset($_REQUEST['id']) ? intval($_REQUEST['id']) : null;
CVE-2019-20381 (PHP, published 2020-01-20T06:15Z)
Description: value: TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
index.php
Commit message: fix: 0008808: TestLink v1.9.19.1 - Bypass security fix for XSS at index.php


Vulnerable code:
    if (strpos($args->reqURI,'javascript') !== false) {

Fixed code:
    if (stripos($args->reqURI,'javascript') !== false) {
CVE-2022-23598 (Unknown, published 2022-01-28T22:15Z)
Description: value: laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value was not being escaped for HTML contexts, which could potentially lead to a reflected cross-site scripting attack. Versions 3.1.1 and above contain a patch to mitigate the vulnerability. A workaround is available. One may manually place code at the top of a view script where one calls the `formElementErrors()` view helper. More information about this workaround is available on the GitHub Security Advisory.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laminas/laminas-form
Files changed:
Commit message: Merge pull request from GHSA-jq4p-mq33-w375

Html escape validation error messages

Vulnerable code:

Fixed code:
CVE-2019-19905 (C, published 2019-12-19T18:15Z)
Description: value: NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have NetHack installed suid/sgid, and shared systems that allow users to upload their own configuration files.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/NetHack/NetHack
Files changed:
src/files.c
Commit message: parse_conf_file fix fix


Vulnerable code:
/* NetHack 3.6	files.c	$NHDT-Date: 1574116097 2019/11/18 22:28:17 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.272 $ */
                    buf[sizeof inbuf - 1] = '\0';

Fixed code:
/* NetHack 3.6	files.c	$NHDT-Date: 1576626110 2019/12/17 23:41:50 $  $NHDT-Branch: NetHack-3.6 $:$NHDT-Revision: 1.276 $ */
                    if (strlen(buf) >= sizeof inbuf)
                        buf[sizeof inbuf - 1] = '\0';
CVE-2019-19905 (Other, published 2019-12-19T18:15Z)
Description: value: NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have NetHack installed suid/sgid, and shared systems that allow users to upload their own configuration files.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/NetHack/NetHack
Files changed:
doc/fixes36.4
src/files.c
Commit message: fix potential buffer overflow loading config file


Vulnerable code:
This fixes36.4 file is here to capture information about updates in the 3.6.x
lineage following the release of 3.6.3 in December 2019.  Hypothetical version
3.6.4 may not be released, in which case these fixes will appear in 3.7.0.
flying hero could not use a hole deliberately with '>'


Fixes to Post-3.6.3 Problems that Were Exposed Via git Repository


NetHack Community Patches (or Variation) Included


Code Cleanup and Reorganization
    mungspaces(strcpy(buf, origbuf));
    struct obj *otmp = readobjnam(buf, (struct obj *) 0);
                    len = (int) strlen(inbuf) + 1;
                        len += (int) strlen(buf);
                        Sprintf(tmpbuf, "%s %s", buf, inbuf);
                    } else
                        Strcpy(tmpbuf, inbuf);
                    buf = tmpbuf;
                if (handle_config_section(ep)) {
                        free(config_section_chosen);
                    if (section)
                    else {

Fixed code:
fixes36.4 contains a terse summary of changes made to 3.6.3 in order to
produce 3.6.4.
 
fix potential buffer overflow when parsing run-time configuration file
none
    while (*origbuf == ' ' || *origbuf == '\t') /* skip leading whitespace */
        ++origbuf;                   /* (caller probably already did this) */
    (void) strncpy(buf, origbuf, sizeof buf - 1);
    buf[sizeof buf - 1] = '\0'; /* strncpy not guaranteed to NUL terminate */
    mungspaces(buf);
    struct obj *otmp;

    if (strlen(buf) >= BUFSZ)
        buf[BUFSZ - 1] = '\0';
    otmp = readobjnam(buf, (struct obj *) 0);
                    len = (int) strlen(ep) + 1; /* +1: final '\0' */
                        len += (int) strlen(buf) + 1; /* +1: space */
                    *tmpbuf = '\0';
                        Strcat(strcpy(tmpbuf, buf), " ");
                    }
                    buf = strcat(tmpbuf, ep);
                    buf[sizeof inbuf - 1] = '\0';
                if (handle_config_section(buf)) {
                        free(config_section_chosen), config_section_chosen = 0;
                    if (section) {
                    } else {
    if (strlen(buf) >= BUFSZ)
        buf[BUFSZ - 1] = '\0';