hitoshura25/cvefixes huggingface dataset:
CVE-2020-7788 (JavaScript, published 2020-12-11T11:15Z)
Description: value: This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/npm/ini
Files changed:
ini.js
test/proto.js
Commit message: do not allow invalid hazardous string as section name


Vulnerable code:

Fixed code:
      if (section === '__proto__') {
        // not allowed
        // keep parsing the section, but don't attach it.
        p = {}
        return
      }
      if (key === '__proto__') return
      if (part === '__proto__') return
var ini = require('../')
var t = require('tap')

var data = `
__proto__ = quux
foo = baz
[__proto__]
foo = bar
[other]
foo = asdf
[kid.__proto__.foo]
foo = kid
[arrproto]
hello = snyk
__proto__[] = you did a good job
__proto__[] = so you deserve arrays
thanks = true
`
var res = ini.parse(data)
t.deepEqual(res, {
  foo: 'baz',
  other: {
    foo: 'asdf',
  },
  kid: {
    foo: {
      foo: 'kid',
    },
  },
  arrproto: {
    hello: 'snyk',
    thanks: true,
  },
})
t.equal(res.__proto__, Object.prototype)
t.equal(res.kid.__proto__, Object.prototype)
t.equal(res.kid.foo.__proto__, Object.prototype)
t.equal(res.arrproto.__proto__, Object.prototype)
t.equal(Object.prototype.foo, undefined)
t.equal(Object.prototype[0], undefined)
t.equal(Object.prototype['0'], undefined)
t.equal(Object.prototype[1], undefined)
t.equal(Object.prototype['1'], undefined)
t.equal(Array.prototype[0], undefined)
t.equal(Array.prototype[1], undefined)
CVE-2020-36650 (JavaScript, published 2023-01-11T18:15Z)
Description: value: A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The patch is named 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
Severity: nan (CVSS v3 base score: 8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/IonicaBizau/node-gry
Files changed:
example/index.js
lib/index.js
Commit message: fix command injection vulnerability


Vulnerable code:
        myRepo.exec("add .", cb);

        // Handle spawn
        if (Array.isArray(args)) {
            eargs.push("git", [command].concat(args));
        } else {
            eargs.push("git " + command.trim());
        }

        el.add.apply(el, eargs);
        return this.exec("init", callback);
        return this.exec("commit -m \"" + message + "\" " + options, callback)
        return this.exec("pull " + options, callback);
        return this.exec("add " + options, callback);
        return this.exec("branch " + options, callback);
        return this.exec("checkout " + options, callback);
        return this.exec("clone " + gitUrl + " " + options, callback);

Fixed code:
        myRepo.exec(['add', '.'], cb);
        console.log({command, eargs, callback})
        el.add('git', command, eargs[0], eargs[1]);
        return this.exec(['init'], callback);
        return this.exec(['commit', '-m', message, ...options.split(' ').filter(a => a)], callback)
        return this.exec(['pull', ...options.split(' ')], callback);
        return this.exec(['add', ...options.split(' ')], callback);
        return this.exec(['branch', ...options.split(' ')], callback);
        return this.exec(['checkout', ...options.split(' ')], callback);
        return this.exec(['clone', gitUrl, ...options.split(' ')], callback);
CVE-2017-12850 (PHP, published 2017-08-14T20:29Z)
Description: value: An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/UserCredentialController.php
app/Validator/UserValidator.php
Commit message: Make sure only admins can change password of other users


Vulnerable code:

Fixed code:
        if (! $this->userSession->isAdmin()) {
            $values['id'] = $this->userSession->getId();
        }

            if (! $this->userSession->isAdmin() && $values['id'] != $this->userSession->getId()) {
                return array(false, array('current_password' => array('Invalid User ID')));
            }
CVE-2017-12851 (PHP, published 2017-08-14T20:29Z)
Description: value: An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/UserCredentialController.php
app/Controller/UserModificationController.php
Commit message: Filter variables when updating user profile


Vulnerable code:
            $values['id'] = $this->userSession->getId();
            if (isset($values['role'])) {
                unset($values['role']);
            }

Fixed code:
            $values = array(
                'id' => $this->userSession->getId(),
                'password' => isset($values['password']) ? $values['password'] : '',
                'confirmation' => isset($values['confirmation']) ? $values['confirmation'] : '',
            );
            $values = array(
                'id' => $this->userSession->getId(),
                'username' => isset($values['username']) ? $values['username'] : '',
                'name' => isset($values['name']) ? $values['name'] : '',
                'email' => isset($values['email']) ? $values['email'] : '',
                'timezone' => isset($values['timezone']) ? $values['timezone'] : '',
                'language' => isset($values['language']) ? $values['language'] : '',
            );
CVE-2017-15205 (PHP, published 2017-10-11T01:32Z)
Description: value: In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project of another user.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/BaseController.php
Commit message: Make sure people do not access to files of other projects


Vulnerable code:
            $project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id !== $this->request->getIntegerParam('project_id')) {

Fixed code:
        $project_id = $this->request->getIntegerParam('project_id');
            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id != $task_project_id) {
        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
            throw new AccessForbiddenException();
        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new AccessForbiddenException();
        }
CVE-2017-15209 (PHP, published 2017-10-11T01:32Z)
Description: value: In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/BaseController.php
Commit message: Make sure people do not access to files of other projects


Vulnerable code:
            $project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id !== $this->request->getIntegerParam('project_id')) {

Fixed code:
        $project_id = $this->request->getIntegerParam('project_id');
            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id != $task_project_id) {
        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
            throw new AccessForbiddenException();
        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new AccessForbiddenException();
        }
CVE-2017-15210 (PHP, published 2017-10-11T01:32Z)
Description: value: In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another user.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/BaseController.php
Commit message: Make sure people do not access to files of other projects


Vulnerable code:
            $project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id !== $this->request->getIntegerParam('project_id')) {

Fixed code:
        $project_id = $this->request->getIntegerParam('project_id');
            $task_project_id = $this->taskFinderModel->getProjectId($task_id);
            if ($project_id != $task_project_id) {
        if (isset($file['task_id']) && $file['task_id'] != $task_id) {
            throw new AccessForbiddenException();
        } else if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new AccessForbiddenException();
        }
CVE-2019-7324 (PHP, published 2019-02-04T19:29Z)
Description: value: app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Core/Paginator.php
Commit message: Avoid XSS in pagination ordering


Vulnerable code:
                ->limit($this->limit)
                ->orderBy($this->order, $this->direction);

Fixed code:

                ->limit($this->limit);

            if (preg_match('/^[a-zA-Z0-9._]+$/', $this->order)) {
                $this->query->orderBy($this->order, $this->direction);
            } else {
                $this->order = '';
            }
CVE-2023-32685 (JavaScript, published 2023-05-30T05:15Z)
Description: value: Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kanboard/kanboard
Files changed:
assets/js/app.min.js
assets/js/components/screenshot.js
Commit message: Avoid potential clipboard based cross-site scripting


Vulnerable code:
function initialize(){destroy();if(!window.Clipboard){pasteCatcher=document.createElement('div');pasteCatcher.id='screenshot-pastezone';pasteCatcher.contentEditable=!0;pasteCatcher.style.opacity=0;pasteCatcher.style.position='fixed';pasteCatcher.style.top=0;pasteCatcher.style.right=0;pasteCatcher.style.width=0;document.body.insertBefore(pasteCatcher,document.body.firstChild);pasteCatcher.focus();document.addEventListener('click',setFocus);document.getElementById('screenshot-zone').addEventListener('click',setFocus)}
            pasteCatcher = document.createElement('div');

Fixed code:
function initialize(){destroy();if(!window.Clipboard){pasteCatcher=document.createElement('template');pasteCatcher.id='screenshot-pastezone';pasteCatcher.contentEditable=!0;pasteCatcher.style.opacity=0;pasteCatcher.style.position='fixed';pasteCatcher.style.top=0;pasteCatcher.style.right=0;pasteCatcher.style.width=0;document.body.insertBefore(pasteCatcher,document.body.firstChild);pasteCatcher.focus();document.addEventListener('click',setFocus);document.getElementById('screenshot-zone').addEventListener('click',setFocus)}
            pasteCatcher = document.createElement('template');
CVE-2023-33956 (PHP, published 2023-06-05T20:15Z)
Description: value: Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/BaseController.php
Commit message: Fix Parameter based Indirect Object Referencing leading to private file exposure


Vulnerable code:
     * @throws AccessForbiddenException
            throw new AccessForbiddenException();

Fixed code:
        $project_id = $this->request->getIntegerParam('project_id');
            throw new PageNotFoundException();
        }

        if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new PageNotFoundException();
CVE-2023-33968 (PHP, published 2023-06-05T20:15Z)
Description: value: Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Controller/TaskDuplicationController.php
Commit message: Add missing project permission check for Move/Duplicate task to another project


Vulnerable code:
            if ($valid && $this->taskProjectMoveModel->moveToProject($task['id'],
                $this->flash->success(t('Task updated successfully.'));
                return $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('task_id' => $task['id'])));
                    $task['id'], $values['project_id'], $values['swimlane_id'],
                    $values['column_id'], $values['category_id'], $values['owner_id']

Fixed code:
use Kanboard\Core\Controller\AccessForbiddenException;

            if ($valid) {
                if (! $this->projectPermissionModel->isUserAllowed($values['project_id'], $this->userSession->getId())) {
                    throw new AccessForbiddenException();
                }

                if ($this->taskProjectMoveModel->moveToProject($task['id'],
                    $this->flash->success(t('Task updated successfully.'));
                    return $this->response->redirect($this->helper->url->to('TaskViewController', 'show', array('task_id' => $task['id'])));
                }
                if (! $this->projectPermissionModel->isUserAllowed($values['project_id'], $this->userSession->getId())) {
                    throw new AccessForbiddenException();
                }

                    $task['id'],
                    $values['project_id'],
                    $values['swimlane_id'],
                    $values['column_id'],
                    $values['category_id'],
                    $values['owner_id']
CVE-2023-33969 (PHP, published 2023-06-05T20:15Z)
Description: value: Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an attacker to execute arbitrary Javascript and any user who views the task containing the malicious code will be exposed to the XSS attack. Note: The default CSP header configuration blocks this javascript attack. This issue has been addressed in version 1.2.30. Users are advised to upgrade. Users unable to upgrade should ensure that they have a restrictive CSP header config.


Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Template/board/tooltip_external_links.php
app/Template/task_external_link/table.php
Commit message: Avoid stored XSS in task external link


Vulnerable code:
                    <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
                <a href="<?= $link['url'] ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>

Fixed code:
                    <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?></a>
                <a href="<?= $this->text->e($link['url']) ?>" title="<?= $this->text->e($link['url']) ?>" target="_blank"><?= $this->text->e($link['title']) ?><span class="ui-helper-hidden-accessible"> (<?= $this->text->e($link['url']) ?>)</span></a>
CVE-2023-33970 (PHP, published 2023-06-05T20:15Z)
Description: value: Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/kanboard/kanboard
Files changed:
app/Api/Procedure/TaskLinkProcedure.php
app/Controller/TaskInternalLinkController.php
Commit message: Add missing permission check when creating/updating internal links


Vulnerable code:

Fixed code:

        if ($this->userSession->isLogged()) {
            $opposite_task = $this->taskFinderModel->getById($opposite_task_id);

            if (! $this->projectPermissionModel->isUserAllowed($opposite_task['project_id'], $this->userSession->getId())) {
                return false;
            }
        }


        if ($this->userSession->isLogged()) {
            $opposite_task = $this->taskFinderModel->getById($opposite_task_id);

            if (! $this->projectPermissionModel->isUserAllowed($opposite_task['project_id'], $this->userSession->getId())) {
                return false;
            }
        }

use Kanboard\Core\Controller\AccessForbiddenException;
            $opposite_task = $this->taskFinderModel->getById($values['opposite_task_id']);

            if (! $this->projectPermissionModel->isUserAllowed($opposite_task['project_id'], $this->userSession->getId())) {
                throw new AccessForbiddenException();
            }

            $opposite_task = $this->taskFinderModel->getById($values['opposite_task_id']);

            if (! $this->projectPermissionModel->isUserAllowed($opposite_task['project_id'], $this->userSession->getId())) {
                throw new AccessForbiddenException();
            }