hitoshura25/cvefixes huggingface dataset:
CVE-2015-10079 (JavaScript, published 2023-02-13T22:15Z)
Description: value: A vulnerability was found in juju2143 WalrusIRC 0.0.2. It has been rated as problematic. This issue affects the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.0.3 is able to address this issue. The patch is named 45fd885895ae13e8d9b3a71e89d59768914f60af. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220751.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/juju2143/walrusirc
Files changed:
public/parser.js
Commit message: Fix JS injection exploit


Vulnerable code:
  text = text.replace(RegExp("(^|.)(((f|ht)(tp|tps):\/\/)[^\\s\x02\x03\x0f\x16\x1d\x1f]*)","g"),'$1<a target="_blank" href="$2"'+(nav?' class="navbar-link"':'')+'>$2</a>');
  text = text.replace(RegExp("(^|\\s)(www\\.[^\\s\x02\x03\x0f\x16\x1d\x1f]*)","g"),'$1<a target="_blank" href="http://$2"'+(nav?' class="navbar-link"':'')+'>$2</a>');
  text = text.replace(RegExp("(^|.)\x01(img.codewalr.us\/[^\\s\x02\x03\x0f\x16\x1d\x1f]*)","g"),'$1<a target="_top" href="http://$2"'+(nav?' class="navbar-link"':'')+'><img src="http://$2" class="picture" /></a>');
  text = text.replace(RegExp("(^|.)\x01([^\\s\x02\x03\x0f\x16\x1d\x1f]*)","g"),'$1<a target="_top" href="http://$2"'+(nav?' class="navbar-link"':'')+'>http://$2</a>');

Fixed code:
  text = text.replace(RegExp("(^|.)(((f|ht)(tp|tps):\/\/)[^\\s\x02\x03\x0f\x16\x1d\x1f\"]*)","g"),'$1<a target="_blank" href="$2"'+(nav?' class="navbar-link"':'')+'>$2</a>');
  text = text.replace(RegExp("(^|\\s)(www\\.[^\\s\x02\x03\x0f\x16\x1d\x1f\"]*)","g"),'$1<a target="_blank" href="http://$2"'+(nav?' class="navbar-link"':'')+'>$2</a>');
  text = text.replace(RegExp("(^|.)\x01(img.codewalr.us\/[^\\s\x02\x03\x0f\x16\x1d\x1f\"]*)","g"),'$1<a target="_top" href="http://$2"'+(nav?' class="navbar-link"':'')+'><img src="http://$2" class="picture" /></a>');
  text = text.replace(RegExp("(^|.)\x01([^\\s\x02\x03\x0f\x16\x1d\x1f\"]*)","g"),'$1<a target="_top" href="http://$2"'+(nav?' class="navbar-link"':'')+'>http://$2</a>');
CVE-2019-12272 (Lua, published 2019-05-23T15:30Z)
Description: value: In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/openwrt/luci
Files changed:
modules/luci-mod-admin-full/luasrc/controller/admin/status.lua
Commit message: luci-mod-admin-full: fix possible shell injection in bandwith status

Signed-off-by: Jo-Philipp Wich <jo@mein.io>


Vulnerable code:
	local bwc = io.popen("luci-bwc -i %q 2>/dev/null" % iface)
	local bwc = io.popen("luci-bwc -r %q 2>/dev/null" % iface)

Fixed code:
	local bwc = io.popen("luci-bwc -i '%s' 2>/dev/null" % iface:gsub("'", ""))
	local bwc = io.popen("luci-bwc -r '%s' 2>/dev/null" % iface:gsub("'", ""))
CVE-2019-17367 (Lua, published 2019-10-18T17:15Z)
Description: value: OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/openwrt/luci
Files changed:
modules/luci-base/luasrc/dispatcher.lua
Commit message: luci-base: fix CSRF prevention for arcombine targets

The dispatcher failed to propagate the child target post security
requirements to the arcombine() dispatch target so far - fix this
by recursively testing the post security requirements.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>


Vulnerable code:
local function require_post_security(target)
	if c and require_post_security(c.target) then

Fixed code:
local function require_post_security(target, args)
	if type(target) == "table" and target.type == "arcombine" and type(target.targets) == "table" then
		return require_post_security((type(args) == "table" and #args > 0) and target.targets[2] or target.targets[1], args)
	end

	if c and require_post_security(c.target, args) then
CVE-2022-41435 (JavaScript, published 2022-11-03T12:15Z)
Description: value: OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openwrt/luci
Files changed:
modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
Commit message: luci-mod-system: sshkeys.js: prevent XSS through pubkey comments

Ensure to not display public key comments verbatim in order to prevent
injection of markup.

Reported-by: Eric McDonald <ericmcdonald@protonmail.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>


Vulnerable code:
		E('strong', pubkey.comment || _('Unnamed key')), E('br'),

Fixed code:
		E('strong', [ pubkey.comment || _('Unnamed key') ]), E('br'),
CVE-2023-24181 (Other, published 2023-04-10T14:15Z)
Description: value: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openwrt/luci
Files changed:
applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm
Commit message: luci-app-openvpn: fix potential XSS in pageswitch template

Ensure to escape URL instance parameter displayed in the heading.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>


Vulnerable code:
		<%=luci.i18n.translatef("Instance \"%s\"", self.instance)%>

Fixed code:
		<%=luci.i18n.translatef("Instance \"%s\"", pcdata(self.instance))%>
CVE-2023-24182 (JavaScript, published 2023-04-11T01:15Z)
Description: value: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openwrt/luci
Files changed:
modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
Commit message: luci-mod-system: fix potential stored XSS

Make sure to escape the key contents in the delete confirmation dialog.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>


Vulnerable code:
		E('pre', delkey),

Fixed code:
		E('pre', [ delkey ]),
CVE-2015-10105 (Other, published 2023-05-01T02:15Z)
Description: value: A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/wp-plugins/ip-blacklist-cloud
Files changed:
ip_blacklist_cloud.php
readme.txt
Commit message: fixed CSV file import vulnerability - version 3.43

git-svn-id: https://plugins.svn.wordpress.org/ip-blacklist-cloud/trunk@1107588 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 3.42
			if(current_user_can( 'manage_options' ) && $_REQUEST['filename'])
				$filename= $upload_dir."/ipblc_csv/".$_REQUEST['filename'];
				if (($handle = fopen("$filename", "r")) !== FALSE)
				{
					$AllData=array();
					while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
						$field=$data[0];
						$value=$data[1];
						$AllData[]=array("$field"=>$value);
					fclose($handle);
					echo json_encode($AllData);
Stable tag: 3.42

Fixed code:
Version: 3.43
			if(current_user_can( 'manage_options' ) && isset($_REQUEST['filename']))
				$file_req=$_REQUEST['filename'];

				//---remove ../ or ./ from direct access---

				$file_req=str_replace("../","",$file_req);
				$file_req=str_replace("./","",$file_req);

				$filename= $upload_dir."/ipblc_csv/".$file_req;



				$exp=explode(".",$filename);
				$ext=strtolower($exp[count($exp)-1]);
				$file_type=filetype($filename);
				
				if($ext=="csv" && $file_type=="file")
				{ 
					if (($handle = fopen("$filename", "r")) !== FALSE)
					{
						$AllData=array();
						while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
						{
							$field=$data[0];
							$value=$data[1];
							$AllData[]=array("$field"=>$value);
						}
						fclose($handle);
						echo json_encode($AllData);
					}
					else
						echo "-1";
Stable tag: 3.43
= 3.43 =
* Quick Fix - Fixed CSV import vulnerability found by g0blin
CVE-2024-32657 (Perl, published 2024-04-22T23:15Z)
Description: value: Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/NixOS/hydra
Files changed:
src/lib/Hydra/Controller/Build.pm
Commit message: web: serveFile: also serve a CSP putting served HTML in its own origin


Vulnerable code:

Fixed code:
        # Have the hosted data considered its own origin to avoid being a giant
        # XSS hole.
        $c->response->header('Content-Security-Policy' => 'sandbox allow-scripts');
CVE-2023-41102 (C, published 2023-11-17T06:15Z)
Description: value: An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. Affected OpenNDS before version 10.1.3 fixed in OpenWrt master and OpenWrt 23.05 on 23. November by updating OpenNDS to version 10.2.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/openNDS/openNDS
Files changed:
src/client_list.c
src/http_microhttpd.c
Commit message: Fix - memory leak when deleting client from client list

Signed-off-by: Rob White <rob@blue-wave.net>


Vulnerable code:
	// Reset custom and client_type

		client->cid = safe_calloc(SMALL_BUF);
	} else {
		client->cpi_query = "none";

Fixed code:
	// Reset custom, client_type and cpi_query
	if (!client->cpi_query) {
		client->cpi_query = safe_calloc(STATUS_BUF);
	}

	client->cid = safe_calloc(SMALL_BUF);

	free(client->token);
	free(client->hid);
	free(client->custom);
	free(client->client_type);
	free(client->cid);

	if (strcmp(client->cpi_query, "") == 0) {
		free(client->cpi_query);
	}
CVE-2021-4241 (PHP, published 2022-11-15T23:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is bb10a5f3c68527c58073258cb12446782d223bc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213744.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/phpservermon/phpservermon
Files changed:
src/psm/Service/User.php
Commit message: SECURITY: Replaced mt_rand with random_bytes

https://huntr.dev/bounties/1-phpservermon/phpservermon/
CWE-1241: Use of Predictable Algorithm in Random Number Generator


Vulnerable code:
            list ($user_id, $token, $hash) = explode(':', $_COOKIE['rememberme']);
            if ($hash == hash('sha256', $user_id . ':' . $token . PSM_LOGIN_COOKIE_SECRET_KEY) && !empty($token)) {
        $random_token_string = hash('sha256', mt_rand());
        $cookie_string_first_part = $this->getUserId() . ':' . $random_token_string;
        $cookie_string = $cookie_string_first_part . ':' . $cookie_string_hash;
            foreach (
                $this->db_connection->query('SELECT `key`,`value` FROM `' .
                PSM_DB_PREFIX . 'users_preferences` WHERE `user_id` = ' . $this->user_id) as $row
            ) {

Fixed code:
            list($user_id, $token, $hash) = explode('_', $_COOKIE['rememberme']);
            if ($hash == hash('sha256', $user_id . '_' . $token . PSM_LOGIN_COOKIE_SECRET_KEY) && !empty($token)) {
        $random_token_string = hash('sha256', random_bytes(64));
        $cookie_string_first_part = $this->getUserId() . '_' . $random_token_string;
        $cookie_string = $cookie_string_first_part . '_' . $cookie_string_hash;
            foreach ($this->db_connection->query('SELECT `key`,`value` FROM `' .
                PSM_DB_PREFIX . 'users_preferences` WHERE `user_id` = ' . $this->user_id) as $row) {
CVE-2022-23652 (Other, published 2022-02-22T20:15Z)
Description: value: capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/clastix/capsule-proxy
Files changed:
go.mod
internal/webserver/webserver.go
Commit message: bug: cve exploiting malicious connection header


Vulnerable code:

Fixed code:
	golang.org/x/net v0.0.0-20210520170846-37e1c6afe023
	"net/textproto"
	"golang.org/x/net/http/httpguts"
	// Dropping malicious header connection
	// https://github.com/clastix/capsule-proxy/issues/188
	n.removingHopByHopHeaders(request)

func (n *kubeFilter) removingHopByHopHeaders(request *http.Request) {
	connectionHeaderName, upgradeHeaderName, requestUpgradeType := "connection", "upgrade", ""

	if httpguts.HeaderValuesContainsToken(request.Header[connectionHeaderName], upgradeHeaderName) {
		requestUpgradeType = request.Header.Get(upgradeHeaderName)
	}
	// Removing connection headers
	for _, f := range request.Header.Values(connectionHeaderName) {
		for _, sf := range strings.Split(f, ",") {
			if sf = textproto.TrimString(sf); sf != "" {
				request.Header.Del(sf)
			}
		}
	}

	if requestUpgradeType != "" {
		request.Header.Set(connectionHeaderName, upgradeHeaderName)
		request.Header.Set(upgradeHeaderName, requestUpgradeType)

		return
	}

	request.Header.Del(connectionHeaderName)
}
CVE-2022-4421 (PHP, published 2022-12-12T14:15Z)
Description: value: A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rathena/FluxCP
Files changed:
themes/default/servicedesk/view.php
Commit message: [Security]

* Fixed an issue where XSS was possible in the service desk image url inclusion.


Vulnerable code:
			<td colspan="3"><a href="<?php echo $trow->sslink ?>" target="_blank"><img src="<?php echo $trow->sslink ?>" width="100px" height="100"></a></td></tr>

Fixed code:
			<td colspan="3"><a href="<?php echo htmlspecialchars($trow->sslink) ?>" target="_blank"><img src="<?php echo htmlspecialchars($trow->sslink) ?>" width="100px" height="100"></a></td></tr>
CVE-2015-10041 (PHP, published 2023-01-13T20:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dovgalyuk/AIBattle-disabled-
Files changed:
site/procedures.php
Commit message: Fix SQL injection in comments


Vulnerable code:

Fixed code:
			$text = mysqli_real_escape_string($link, $text);
CVE-2015-10042 (PHP, published 2023-01-13T21:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dovgalyuk/AIBattle-disabled-
Files changed:
site/procedures.php
Commit message: Fix login SQL injection


Vulnerable code:
            $login = mysqli_real_escape_string($link, $login);

Fixed code:
            $postLogin = mysqli_real_escape_string($link, $postLogin);