hitoshura25/cvefixes huggingface dataset:
CVE-2014-8961 (Other, published 2014-11-30T11:59Z)
Description: value: Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file's line count via a crafted parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
libraries/error_report.lib.php
Commit message: bug #4595 [security] Path traversal can lead to leakage of line count

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>


Vulnerable code:

Fixed code:
- bug #4595 [security] Path traversal can lead to leakage of line count
    // ensure that the file is inside the phpMyAdmin folder
    $depath = 1;
    foreach (explode('/', $filename) as $part) {
        if ($part == '..') {
            $depath--;
        } elseif ($part != '.') {
            $depath++;
        }
        if ($depath < 0) {
            return 0;
        }
    }
CVE-2014-9218 (PHP, published 2014-12-08T11:59Z)
Description: value: libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
libraries/common.inc.php
libraries/plugins/AuthenticationPlugin.class.php
libraries/plugins/auth/AuthenticationCookie.class.php
Commit message: bug #4611 [security] DOS attack with long passwords

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>


Vulnerable code:

Fixed code:
- bug #4611 [security] DOS attack with long passwords
        if (isset($_REQUEST['pma_password'])) {
            $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256);
        }
        $auth_plugin->storeUserCredentials();

    /**
     * Stores user credentials after successful login.
     *
     * @return void
     */
    public function storeUserCredentials()
    {
    }

    }

    /**
     * Stores user credentials after successful login.
     *
     * @return void
     */
    public function storeUserCredentials()
    {
        global $cfg;
CVE-2014-9219 (Other, published 2014-12-08T11:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
url.php
Commit message: bug #4612 [security] XSS vulnerability in redirection mechanism

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>


Vulnerable code:
                window.location='" . htmlspecialchars($_GET['url']) . "';

Fixed code:
4.2.13.1 (not yet released)
- bug #4612 [security] XSS vulnerability in redirection mechanism

/**
 * JavaScript escaping.
 */
require_once './libraries/js_escape.lib.php';
                window.location='" . PMA_escapeJsString($_GET['url']) . "';
CVE-2015-2206 (PHP, published 2015-03-09T17:59Z)
Description: value: libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/select_lang.lib.php
Commit message: [security] Risk of BREACH attack

Thanks to Michal Čihař for the message suggestion.

Signed-off-by: Marc Delisle <marc@infomarc.info>


Vulnerable code:
if ($GLOBALS['lang_failed_cfg']) {
        sprintf(
            __('Unknown language: %1$s.'),
            htmlspecialchars($GLOBALS['lang_failed_cfg'])
        ),
if ($GLOBALS['lang_failed_cookie']) {
    trigger_error(
        sprintf(
            __('Unknown language: %1$s.'),
            htmlspecialchars($GLOBALS['lang_failed_cookie'])
        ),
        E_USER_ERROR
    );
}
if ($GLOBALS['lang_failed_request']) {
    trigger_error(
        sprintf(
            __('Unknown language: %1$s.'),
            htmlspecialchars($GLOBALS['lang_failed_request'])
        ),
        E_USER_ERROR
    );
}


Fixed code:
if ($GLOBALS['lang_failed_cfg']
    || $GLOBALS['lang_failed_cookie']
    || $GLOBALS['lang_failed_request']) {
        __('Ignoring unsupported language code.'),
CVE-2015-3903 (Other, published 2015-05-26T15:59Z)
Description: value: libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
libraries/Config.class.php
Commit message: bug #4900 [security] Vulnerability allowing man-in-the-middle attack

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>


Vulnerable code:
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

Fixed code:
- bug #4900 [security] Vulnerability allowing man-in-the-middle attack
CVE-2015-6830 (PHP, published 2015-09-14T01:59Z)
Description: value: libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
libraries/plugins/auth/AuthenticationCookie.class.php
test/classes/plugin/auth/PMA_AuthenticationCookie_test.php
Commit message: Fix reCaptcha bypass

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>


Vulnerable code:
        // We already have one correct captcha.
        $skip = false;
        if (  isset($_SESSION['last_valid_captcha'])
            && $_SESSION['last_valid_captcha']
        ) {
            $skip = true;
        }

            && !$skip
                // $_SESSION array is not immediately emptied
                $_SESSION['last_valid_captcha'] = false;
            // We already have one correct captcha.
            $skip = false;
            if (isset($_SESSION['last_valid_captcha'])
                && $_SESSION['last_valid_captcha']
            ) {
                $skip = true;
            }

                && ! $skip
                        $_SESSION['last_valid_captcha'] = false;
                    } else {
                        $_SESSION['last_valid_captcha'] = true;
                    if (! isset($_SESSION['last_valid_captcha'])
                        || ! $_SESSION['last_valid_captcha']
                    ) {
                        $conn_error = __('Please enter correct captcha!');
                        return false;
                    }
        $_SESSION['last_valid_captcha'] = true;
        $_SESSION['last_valid_captcha'] = false;
        $_SESSION['last_valid_captcha'] = false;
        $_SESSION['last_valid_captcha'] = true;
        $_SESSION['last_valid_captcha'] = true;
        $_SESSION['last_valid_captcha'] = true;
        $_SESSION['last_valid_captcha'] = true;

Fixed code:
4.4.14.1 (Not yet released)
- issue        [security] reCaptcha bypass

                    $conn_error = __('Please enter correct captcha!');
                    return false;
        $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPrivateKey'] = '';
        $GLOBALS['cfg']['CaptchaLoginPublicKey'] = '';
CVE-2015-7873 (Other, published 2015-10-28T10:59Z)
Description: value: The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
url.php
Commit message: Port content spoofing fix

Signed-off-by: Marc Delisle <marc@infomarc.info>


Vulnerable code:
    printf(__('Taking you to %s.'), htmlspecialchars($_REQUEST['url']));

Fixed code:
4.4.15.1 (2015-10-23)
- issue #11464 phpMyAdmin suggests upgrading to newer version not usable on that system
- issue        [security] Content spoofing on url.php

    // Do not display the value of $_REQUEST['url'] to avoid showing injected content
    echo __('Taking you to the target site.');
CVE-2016-2038 (PHP, published 2016-02-20T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/DatabaseInterface.class.php
Commit message: Fallback to default collation connection

If user supplied wrong string we should gracefully fallback.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                $this->query(

Fixed code:
                $result = $this->tryQuery(
                if ($result === false) {
                    trigger_error(
                        __('Failed to set configured collation connection!'),
                        E_USER_WARNING
                    );
                    $this->query(
                        "SET collation_connection = '"
                        . PMA_Util::sqlAddSlashes($default_collation)
                        . "';",
                        $link,
                        self::QUERY_STORE
                    );
                }
CVE-2016-2038 (PHP, published 2016-02-20T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
setup/lib/common.inc.php
Commit message: Can not use PMA_fatalError when including fails

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
    PMA_fatalError('Bad invocation!');

Fixed code:
    die('Bad invocation!');
CVE-2016-2038 (PHP, published 2016-02-20T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
setup/frames/form.inc.php
setup/index.php
setup/validate.php
Commit message: Fix path disclosure, items 1.4.x, 1.5 and 1.6

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>


Vulnerable code:
$formset_id = isset($_GET['formset']) ? $_GET['formset'] : null;
if (! isset($forms[$formset_id])) {
$page = isset($_GET['page']) ? $_GET['page'] : null;
$action_done = isset($_GET['action_done']) ? $_GET['action_done'] : null;
$ids = isset($_POST['id']) ? $_POST['id'] : null;
$vals = isset($_POST['values']) ? $_POST['values'] : null;

Fixed code:
$formset_id = PMA_isValid($_GET['formset'], 'scalar') ? $_GET['formset'] : null;
if (! isset($forms[$formset_id]) || substr($formset_id, 0, 1) === '_') {
$page = PMA_isValid($_GET['page'], 'scalar') ? $_GET['page'] : null;
$action_done = PMA_isValid($_GET['action_done'], 'scalar') ? $_GET['action_done'] : null;
$ids = PMA_isValid($_POST['id'], 'scalar') ? $_POST['id'] : null;
$vals = PMA_isValid($_POST['values'], 'scalar') ? $_POST['values'] : null;
CVE-2016-5705 (PHP, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/server_privileges.lib.php
Commit message: Escape user group when displaying

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                        ? $group_assignment[$host['User']]

Fixed code:
                        ? htmlspecialchars($group_assignment[$host['User']])
CVE-2016-5705 (JavaScript, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/console.js
Commit message: Escape error message from server

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                        PMA_ajaxShowMessage($('<div />',{'class':'error','html':PMA_messages.strRequestFailed+' ( '+AJAX.xhr.statusText+' )'}));

Fixed code:
                        PMA_ajaxShowMessage($('<div />',{'class':'error','html':PMA_messages.strRequestFailed+' ( '+escapeHtml(AJAX.xhr.statusText)+' )'}));
CVE-2016-5705 (JavaScript, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/functions.js
Commit message: Escape database name when showing dialog

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
            fields = PMA_sprintf(PMA_messages.strEmptyCentralList, "'" + db + "'");

Fixed code:
            fields = PMA_sprintf(PMA_messages.strEmptyCentralList, "'" + escapeHtml(db) + "'");
CVE-2016-5706 (PHP, published 2016-07-03T01:59Z)
Description: value: js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/get_scripts.js.php
Commit message: Limit number of included scripts in get_scripts.js.php

This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
    foreach ($_GET['scripts'] as $script) {

Fixed code:
    // Only up to 10 scripts as this is what we generate
    foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
CVE-2016-5730 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
setup/config.php
setup/frames/index.inc.php
Commit message: Improve error handling in setup in case config dir is not present

We do not show these options in UI, but the scripts should handle it
gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
    file_put_contents(
    header('Location: index.php' . PMA_URL_getCommon() . '&action_done=config_saved');
    $cfg = array();
    include $config_file_path;
    $GLOBALS['ConfigFile']->setConfigData($cfg);

Fixed code:
/**
 * Loads configuration file path
 *
 * Do this in a function to avoid messing up with global $cfg
 *
 * @param string $config_file_path
 *
 * @return array
 */
function loadConfig($config_file_path)
{
    $cfg = array();
    if (file_exists($config_file_path)) {
        include $config_file_path;
    }
    return $cfg;
}

    $result = @file_put_contents(
    if ($result === false) {
        $state = 'config_not_saved';
    } else {
        $state = 'config_saved';
    }
    header('Location: index.php' . PMA_URL_getCommon() . '&action_done=' . $state);
    $GLOBALS['ConfigFile']->setConfigData(
        loadConfig($config_file_path)
    );
case 'config_not_saved':
    /* Use uniqid to display this message every time configuration is saved */
    PMA_messagesSet(
        'notice', uniqid('config_not_saved'), __('Configuration not saved!'),
        PMA_sanitize(
            __(
                'Please create web server writable folder [em]config[/em] in '
                . 'phpMyAdmin top level directory as described in '
                . '[doc@setup_script]documentation[/doc]. Otherwise you will be '
                . 'only able to download or display it.'
            )
        )
    );
    break;
CVE-2016-5730 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/config/FormDisplay.php
Commit message: Properly convert POST parameters

We can get array instead of single parameter, so handle this gracefully.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                    settype($_POST[$key], 'float');
                        settype($_POST[$key], $type);
                    $_POST[$key] = trim($_POST[$key]);
            $v = trim($v);

Fixed code:
                    settype($this->_trimString($_POST[$key]), 'float');
                        settype($this->_trimString($_POST[$key]), $type);
                    $_POST[$key] = $this->_trimString($_POST[$key]);
            $v = $this->_trimString($v);

    /*
     * Converts given (request) paramter to string
     *
     * @param mixed $value Value to convert
     *
     * @return string
     */
    private function _trimString($value)
    {
        while (is_array($value)) {
            $value = reset($value);
        }
        return trim((string)$value);
    }