hitoshura25/cvefixes huggingface dataset:
CVE-2017-2611 (Unknown, published 2018-05-08T18:29Z)
Description: value: Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #99 from jenkinsci-cert/SECURITY-389

[SECURITY-389] Check ADMINISTER on /fingerprintCleanup and /workspaceCleanup

Vulnerable code:

Fixed code:
CVE-2017-2613 (Unknown, published 2018-05-15T22:29Z)
Description: value: jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
Commit message: Merge pull request #107 from jenkinsci-cert/SECURITY-406

[SECURITY-406] Prevent user creation via GET /user/whatever

Vulnerable code:

Fixed code:
CVE-2020-11091 (Unknown, published 2020-06-03T23:15Z)
Description: value: In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates.
Severity: LOW (CVSS v3 base score: 5.8)
Weakness: CWE-350 \u2014 Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
Repository: https://github.com/weaveworks/weave
Files changed:
Commit message: Merge pull request #3801 from weaveworks/disable-accept-ra

Disable accept_ra on Weave Net interfaces

Vulnerable code:

Fixed code:
CVE-2020-26278 (YAML, published 2021-01-20T22:15Z)
Description: value: Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is supplied with a manifest that runs pods on every node in a Kubernetes cluster, which are responsible for managing network connections for all other pods in the cluster. This requires a lot of power over the host, and the manifest sets `privileged: true`, which gives it that power. It also set `hostPID: true`, which gave it the ability to access all other processes on the host, and write anywhere in the root filesystem of the host. This setting was not necessary, and is being removed. You are only vulnerable if you have an additional vulnerability (e.g. a bug in Kubernetes) or misconfiguration that allows an attacker to run code inside the Weave Net pod, No such bug is known at the time of release, and there are no known instances of this being exploited. Weave Net 2.8.0 removes the hostPID setting and moves CNI plugin install to an init container. Users who do not update to 2.8.0 can edit the hostPID line in their existing DaemonSet manifest to say false instead of true, arrange some other way to install CNI plugins (e.g. Ansible) and remove those mounts from the DaemonSet manifest.
Severity: HIGH (CVSS v3 base score: 8)
Weakness: CWE-250 \u2014 Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Repository: https://github.com/weaveworks/weave
Files changed:
prog/weave-kube/weave-daemonset-k8s-1.11.yaml
prog/weave-kube/weave-daemonset-k8s-1.6.yaml
prog/weave-kube/weave-daemonset-k8s-1.7.yaml
prog/weave-kube/weave-daemonset-k8s-1.8.yaml
prog/weave-kube/weave-daemonset-k8s-1.9.yaml
Commit message: Stop running in host PID namespace

We shouldn't need this


Vulnerable code:
          hostPID: true
          hostPID: true
          hostPID: true
          hostPID: true
          hostPID: true

Fixed code:
          hostPID: false
          hostPID: false
          hostPID: false
          hostPID: false
          hostPID: false
CVE-2022-1698 (PHP, published 2022-05-12T16:15Z)
Description: value: Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/causefx/organizr
Files changed:
api/classes/organizr.class.php
Commit message: fix more lengths of user inputs


Vulnerable code:

Fixed code:
			if (!$this->qualifyLength($array['name'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['name'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['category'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['category'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['username'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['email'], 50, true)) {
				return false;
			}
		if (!$this->qualifyLength($username, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($email, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($password, 200, true)) {
			return false;
		}
		if (!$this->qualifyLength($username, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($email, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($password, 200, true)) {
			return false;
		}
			if (!$this->qualifyLength($array['group'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['group'], 50, true)) {
				return false;
			}
CVE-2022-1699 (PHP, published 2022-05-12T16:15Z)
Description: value: Uncontrolled Resource Consumption in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/causefx/organizr
Files changed:
api/classes/organizr.class.php
Commit message: fix more lengths of user inputs


Vulnerable code:

Fixed code:
			if (!$this->qualifyLength($array['name'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['name'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['category'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['category'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['username'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['email'], 50, true)) {
				return false;
			}
		if (!$this->qualifyLength($username, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($email, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($password, 200, true)) {
			return false;
		}
		if (!$this->qualifyLength($username, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($email, 50, true)) {
			return false;
		}
		if (!$this->qualifyLength($password, 200, true)) {
			return false;
		}
			if (!$this->qualifyLength($array['group'], 50, true)) {
				return false;
			}
			if (!$this->qualifyLength($array['group'], 50, true)) {
				return false;
			}
CVE-2022-1909 (PHP, published 2022-05-27T09:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/causefx/organizr
Files changed:
api/classes/organizr.class.php
Commit message: sanitize tab image and group image


Vulnerable code:

Fixed code:
		} else {
			$array['image'] = $this->sanitizeUserString($array['image']);
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
			$array['image'] = $this->sanitizeUserString($array['image']);
			$array['image'] = $this->sanitizeUserString($array['image']);
CVE-2010-10002 (PHP, published 2023-01-01T17:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the argument AuthState leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is identified as d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/simplesamlphp/simplesamlphp-module-openid
Files changed:
templates/consumer.php
Commit message: openid: Fix cross-site scripting.

Can be exploited by a malicious openid provider to execute scripts
on the host using openid.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2444 44740490-163a-0410-bde0-09ae8108e29a


Vulnerable code:
			<input type="hidden" name="AuthState" value="<?php echo $this->data['AuthState']; ?>" />

Fixed code:
			<input type="hidden" name="AuthState" value="<?php echo htmlspecialchars($this->data['AuthState']); ?>" />
CVE-2024-23841 (TypeScript, published 2024-01-30T18:15Z)
Description: value: apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-80 \u2014 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Repository: https://github.com/apollographql/apollo-client-nextjs
Files changed:
package/package.json
package/src/ssr/dataTransport.ts
package/src/util/htmlescape.ts
Commit message: Merge pull request from GHSA-rv8p-rr2h-fgpg

* escape html characters in JSON string before injecting it into stream

* increment package version

Vulnerable code:
  "version": "0.6.0",
  return `(window[Symbol.for("${key}")] ??= []).push(${SuperJSON.stringify(
    data

Fixed code:
  "version": "0.7.0",
import { htmlEscapeJsonString } from "../util/htmlescape";
  return `(window[Symbol.for("${key}")] ??= []).push(${htmlEscapeJsonString(
    SuperJSON.stringify(data)
// --------------------------------------------------------------------------------
//
// copied from
// https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/src/server/htmlescape.ts
// License: https://github.com/vercel/next.js/blob/6bc07792a4462a4bf921a72ab30dc4ab2c4e1bda/packages/next/license.md
//
// --------------------------------------------------------------------------------

// This utility is based on https://github.com/zertosh/htmlescape
// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE

const ESCAPE_LOOKUP: { [match: string]: string } = {
  "&": "\\u0026",
  ">": "\\u003e",
  "<": "\\u003c",
  "\u2028": "\\u2028",
  "\u2029": "\\u2029",
};

export const ESCAPE_REGEX = /[&><\u2028\u2029]/g;

export function htmlEscapeJsonString(str: string): string {
  return str.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
}
CVE-2023-49802 (PHP, published 2023-12-11T22:15Z)
Description: value: The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mantisbt-plugins/LinkedCustomFields
Files changed:
LinkedCustomFields.API.php
Commit message: Fix XSS in linked Custom Field's values 

Github Security Advisory GHSA-2f37-9xpx-5hhw

Fixes #10, PR #11 


Vulnerable code:

		$t_field_values_js = '[ ';

		foreach( $p_array as $t_custom_field_value ) {
			$t_field_values_js .= '"'.string_attribute( $t_custom_field_value ).'" ,';
		}

		$t_field_values_js = rtrim( $t_field_values_js, ',' );
		$t_field_values_js .= ']';

		return $t_field_values_js;

Fixed code:
		return json_encode($p_array);
CVE-2020-13616 (Other, published 2020-05-26T23:15Z)
Description: value: The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-295 \u2014 Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Repository: https://github.com/pichi-router/pichi
Files changed:
CMakeLists.txt
Commit message: Fix the insecure bug not verifying remote host name for TLS egress

- Verify nothing if 'insecure' field is true
- Verify only with the CA file if it's specified
- Otherwise, verify according to RFC 2818


Vulnerable code:

Fixed code:
   if (WIN32 AND STATIC_LINK)
     link_libraries(crypt32)
+  endif ()
CVE-2020-25792 (Unknown, published 2020-09-19T21:15Z)
Description: value: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair().
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-129 \u2014 Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Repository: https://github.com/bodil/sized-chunks
Files changed:
Commit message: Merge pull request #14 from vorner/inline-array-align

Fix alignment issues of InlineArray

Vulnerable code:

Fixed code:
CVE-2024-29885 (PHP, published 2024-07-17T20:15Z)
Description: value: silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by their direct URL by any user who has access to view the reports admin section, even if the `canView()` method for that report returns `false`. This issue has been addressed in version 5.2.3. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/silverstripe/silverstripe-reports
Files changed:
code/ReportAdmin.php
tests/ReportAdminTest.php
tests/ReportAdminTest/CannotViewReport.php
tests/ReportAdminTest/FakeReport.php
Commit message: [CVE-2024-29885] Respect canView permissions for viewing reports


Vulnerable code:
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Dev\SapphireTest;
class ReportAdminTest extends SapphireTest

Fixed code:
            if (!$this->reportObject->canView()) {
                return Security::permissionFailure($this);
            }
use SilverStripe\Dev\FunctionalTest;
use SilverStripe\Reports\Tests\ReportAdminTest\CannotViewReport;
class ReportAdminTest extends FunctionalTest
    public function provideShowReport(): array
    {
        return [
            'cannot view' => [
                'reportClass' => CannotViewReport::class,
                'expected' => 403,
            ],
            'can view' => [
                'reportClass' => FakeReport::class,
                'expected' => 200,
            ],
        ];
    }

    /**
     * @dataProvider provideShowReport
     */
    public function testShowReport(string $reportClass, int $expected): void
    {
        $this->logInWithPermission('ADMIN');
        $report = new $reportClass();
        $controller = $this->mockController($report);
        $breadcrumbs = $controller->BreadCrumbs();
        $response = $this->get($breadcrumbs[1]->Link);

        $this->assertSame($expected, $response->getStatusCode());
    }

<?php

namespace SilverStripe\Reports\Tests\ReportAdminTest;

use SilverStripe\Dev\TestOnly;
use SilverStripe\Reports\Report;

class CannotViewReport extends Report implements TestOnly
{
    public function title()
    {
        return 'Cannot View report';
    }

    public function canView($member = null)
    {
        return false;
    }
}
use SilverStripe\ORM\ArrayList;
use SilverStripe\Security\Member;

    public function sourceRecords($params = [], $sort = null, $limit = null)
    {
        $list = new ArrayList();
        $list->setDataClass(Member::class);
        return $list;
    }
CVE-2023-48300 (PHP, published 2023-11-20T19:15Z)
Description: value: The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy_opt_out` shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 1.8.1 contains a patch for this issue.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/epiphyt/embed-privacy
Files changed:
CHANGELOG.md
SECURITY.md
embed-privacy.php
inc/class-embed-privacy.php
readme.txt
Commit message: 🔒️ Properly sanitize show_all attribute in shortcode
Closes #199


Vulnerable code:
| 1.7.x   | :white_check_mark: |
| < 1.7   | :x:                |
Version:		1.8.0
\define( 'EMBED_PRIVACY_VERSION', '1.8.0' );
		$output = '<div class="embed-privacy-opt-out" data-show-all="' . $attributes['show_all'] . '">' . \PHP_EOL . $headline . $subline;

Fixed code:
## 1.8.1
* Fixed the output of the opt-out shortcode

| 1.8.x   | :white_check_mark: |
| < 1.8   | :x:                |
Version:		1.8.1
\define( 'EMBED_PRIVACY_VERSION', '1.8.1' );
		$output = '<div class="embed-privacy-opt-out" data-show-all="' . ( $attributes['show_all'] ? 1 : 0 ) . '">' . \PHP_EOL . $headline . $subline;
= 1.8.1 =
* Fixed the output of the opt-out shortcode