hitoshura25/cvefixes huggingface dataset:
CVE-2012-10016 (PHP, published 2023-10-17T00:15Z)
Description: value: A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wp-plugins/simple-download-button-shortcode
Files changed:
simple-download-button.php
simple-download-button_dl.php
Commit message: ver1.1 Reported vulnerability corrected

git-svn-id: https://plugins.svn.wordpress.org/simple-download-button-shortcode/trunk@600290 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * Version: 1.0
			'%name%',
			'%download_dir%'
			$label,
			$download_dir
		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%&download_dir=%download_dir%\'"><b>%label%</b></button></div>'
	if(!$filename){ die("ERROR: a file name to download is not set!"); }
	
	$download_filepath = $download_dir. $filename;
		die("ERROR: There is not shuch file. Please hit the back button to return.");

Fixed code:
 * Version: 1.1
			'%name%'
			$label
		'<div id="simple-download-button"><button %style% onclick="location.href=\'%plugin_url%?file=%file%\'"><b>%label%</b></button></div>'
		
	/* Verify file parameter */
	$fileinfo =	pathinfo($filename);	
	if(!$fileinfo['filename']){
		die("ERROR: Downloading filename is not set. Please set the name. the short code should be wriiten like [dlbt file=dummy.html] ");
	}elseif(!$fileinfo['extension']){
		die("ERROR: Unappropriate downloading filename: $filename: no extention.");		
	}
	if(!preg_match('/^[a-zA-Z0-9_-]/',$fileinfo['filename'])) {
		die("ERROR: Unappropriate downloading filename: $filename: filename can contains only 'a-z', 'A-Z' '0-9', '-' and '_'");		
	}
	// making file path		
	$download_filepath = $download_dir. $fileinfo['filename']. '.'. $fileinfo['extension'];
		die("ERROR: There is not shuch file at $download_filepath.");
CVE-2011-4312 (JavaScript, published 2011-11-24T04:01Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/reviewboard/reviewboard
Files changed:
reviewboard/htdocs/media/rb/js/diffviewer.js
reviewboard/htdocs/media/rb/js/screenshots.js
reviewboard/reviews/templatetags/reviewtags.py
Commit message: Fix a comment vulnerability allowing scripts to be loaded.

Due to the way that comments were loaded in, it was possible to
terminate a script and inject a new one while loading the diff viewer.
This isn't believed to have been a problem in the wild, but is certainly
an important one to fix.

We now ensure that the text is escaped at the point where it's being fed
into the JavaScript. It's no longer possible to inject scripts.

Thanks to Damian Johnson for the heads up and for the fix that this
change is based on.

This will be going into 1.5.7 and 1.6.3 releases.


Vulnerable code:
                'text': comment.text,
                'text': comment.text,

Fixed code:
            // We load in encoded text, so decode it.
            comment.text = $("<div/>").html(comment.text).text();

            // We load in encoded text, so decode it.
            comment.text = $("<div/>").html(comment.text).text();

from django.utils.html import escape
                'text': escape(comment.text),
                'text': escape(comment.text),
CVE-2013-2209 (JavaScript, published 2013-07-31T13:20Z)
Description: value: Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/reviewboard/reviewboard
Files changed:
reviewboard/htdocs/media/rb/js/reviews.js
Commit message: Fix an XSS vulnerability in the reviews dropdown.

The reviews dropdown had a bad vulnerability where it would assume the
user's full name is valid HTML. This allowed the user to craft a script
tag that would be executed every time the name appeared in the dropdown.

This vulnerability exists in 1.6.x, 1.7.x, and the in-development 1.8.
There are no known attacks in the wild.

This was reported by Craig Young at Tripwire.


Vulnerable code:
                    var s = data[options.nameKey];
                        s += " <span>(" + data[options.descKey] + ")</span>";

Fixed code:
                    var s = data[options.nameKey],
                        desc;
                        desc = $('<div/>').text(data[options.descKey]).html();
                        s += " <span>(" + desc + ")</span>";
CVE-2022-23645 (C, published 2022-02-18T21:15Z)
Description: value: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/stefanberger/swtpm
Files changed:
src/swtpm/swtpm_nvstore.c
Commit message: swtpm: Check header size indicator against expected size (CID 375869)

This fix addresses Coverity issue CID 375869.

Check the header size indicated in the header of the state against the
expected size and return an error code in case the header size indicator
is different. There was only one header size so far since blobheader was
introduced, so we don't need to deal with different sizes.

Without this fix a specially craft header could have cause out-of-bounds
accesses on the byte array containing the swtpm's state.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>


Vulnerable code:
    *dataoffset = ntohs(bh->hdrsize);

Fixed code:
    uint16_t hdrsize;
    hdrsize = ntohs(bh->hdrsize);
    if (hdrsize != sizeof(blobheader)) {
        logprintf(STDERR_FILENO,
                  "bad header size: %u != %zu\n",
                  hdrsize, sizeof(blobheader));
        return TPM_BAD_DATASIZE;
    }

    *dataoffset = hdrsize;
CVE-2020-27985 (Other, published 2020-11-23T14:15Z)
Description: value: Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home/<user>/SecurityOnion/setup/so-setup.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/Security-Onion-Solutions/securityonion
Files changed:
salt/common/tools/sbin/soup
setup/so-functions
Commit message: [feat] Remove so-setup permission from sudoers file after iso setup

Closes #1701


Vulnerable code:

Fixed code:
	[[ "$INSTALLEDVERSION" =~ 2.3.2 ]] && up_2.3.2_to_2.3.10
up_2.3.2_to_2.3.10() {
	if grep -q "so-setup" /etc/sudoers; then
		echo "[ INFO ] There is an entry for so-setup in the sudoers file, this can be safely deleted using \"visudo\"."
	fi
}

	if [[ $install_type == 'iso' ]]; then
		info "Removing so-setup permission entry from sudoers file"
		sed -i '/so-setup/d' /etc/sudoers
	fi
CVE-2011-3591 (JavaScript, published 2014-12-26T02:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
js/functions.js
js/tbl_structure.js
Commit message: Escape HTML in js-generated confirmation messages


Vulnerable code:
- [security] Fixed XSS in Inline Edit on save action
 * Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query.
        var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db;
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`';
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)';

Fixed code:
- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14
- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 
 * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query.
        var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db);
/**
 * HTML escaping
 */
function escapeHtml(unsafe) {
    return unsafe
        .replace(/&/g, "&amp;")
        .replace(/</g, "&lt;")
        .replace(/>/g, "&gt;")
        .replace(/"/g, "&quot;")
        .replace(/'/g, "&#039;");
}
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`';
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)';
CVE-2011-3592 (Other, published 2014-12-26T02:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
js/sql.js
Commit message: [security] Fixed XSS in Inline Edit on save action


Vulnerable code:
            $this_sibling.html(new_html);

Fixed code:
- [security] Fixed XSS in Inline Edit on save action
            $this_sibling.text(new_html);
CVE-2012-1190 (JavaScript, published 2012-05-03T04:08Z)
Description: value: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/replication.js
Commit message: Do not put database names as html


Vulnerable code:
var conf_prefix = "server-id=" + random_server_id + "<br />log-bin=mysql-bin<br />log-error=mysql-bin.err<br />";
        $('#rep').html(conf_prefix);
        $('#rep').html(conf_prefix + conf_ignore + database_list);
        $('#rep').html(conf_prefix + conf_do + database_list);
    $('#rep').html(conf_prefix);

Fixed code:
var conf_prefix = "server-id=" + random_server_id + "\nlog-bin=mysql-bin\nlog-error=mysql-bin.err\n";
        $('#rep').text(conf_prefix);
        $('#rep').text(conf_prefix + conf_ignore + database_list);
        $('#rep').text(conf_prefix + conf_do + database_list);
    $('#rep').text(conf_prefix);
CVE-2012-1902 (Other, published 2012-04-06T19:55Z)
Description: value: show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
ChangeLog
show_config_errors.php
Commit message: [security] Fixed local path disclosure vulnerability, see PMASA-2012-2


Vulnerable code:
require CONFIG_FILE;

Fixed code:
3.4.10.2 (2012-03-28)
- [security] Fixed local path disclosure vulnerability, see PMASA-2012-2

if (is_readable(CONFIG_FILE)) {
    require CONFIG_FILE;
}
CVE-2012-5339 (PHP, published 2012-10-25T10:51Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
Severity: LOW (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/rte/common.js
libraries/rte/rte_list.lib.php
Commit message: triggers, routines, events : escape drop sql


Vulnerable code:
        var question = $('<div/>').text($curr_row.children('td').children('.drop_sql').html());
    $retval .= "                <span class='drop_sql hide'>$sql_drop</span>\n";
    $retval .= "                <span class='drop_sql hide'>{$trigger['drop']}</span>\n";
    $retval .= "                <span class='drop_sql hide'>$sql_drop</span>\n";

Fixed code:
        var question = $('<div/>').text($curr_row.children('td').children('.drop_sql').text());
    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($sql_drop) . "</span>\n";
    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($trigger['drop']) . "</span>\n";
    $retval .= "                <span class='drop_sql hide'>" . htmlspecialchars($sql_drop) . "</span>\n";
CVE-2012-5368 (JavaScript, published 2012-10-25T10:51Z)
Description: value: phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/functions.js
Commit message: Escape json reply received from server


Vulnerable code:
    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + data['version'];
        var message = $.sprintf(PMA_messages['strNewerVersion'], data['version'], data['date']);

Fixed code:
    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + escapeHtml(data['version']);
        var message = $.sprintf(PMA_messages['strNewerVersion'], escapeHtml(data['version']), escapeHtml(data['date']));
CVE-2012-5368 (PHP, published 2012-10-25T10:51Z)
Description: value: phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/functions.js
libraries/header_http.inc.php
Commit message: Load JSON rather than javascript from phpmyadmin.net

Conflicts:
	js/functions.js
	libraries/Header.class.php


Vulnerable code:
function PMA_current_version()
    var latest = parseVersionString(PMA_latest_version);
    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + PMA_latest_version;
        var message = $.sprintf(PMA_messages['strNewerVersion'], PMA_latest_version, PMA_latest_date);
                    showDataLabels:  true 
        $.getScript('http://www.phpmyadmin.net/home_page/version.js', PMA_current_version);
    header("X-Content-Security-Policy: allow 'self'; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:; script-src 'self' http://www.phpmyadmin.net");

Fixed code:
function PMA_current_version(data)
    var latest = parseVersionString(data['version']);
    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + data['version'];
        var message = $.sprintf(PMA_messages['strNewerVersion'], data['version'], data['date']);
                    showDataLabels:  true
        $.getJSON('http://www.phpmyadmin.net/home_page/version.json', {}, PMA_current_version);
    header("X-Content-Security-Policy: allow 'self' http://www.phpmyadmin.net; options inline-script eval-script; frame-ancestors 'self'; img-src 'self' data:");
CVE-2013-1937 (PHP, published 2013-04-16T14:04Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
tbl_gis_visualization.php
Commit message: fix XSS reported by Janek Vind


Vulnerable code:
    <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
?>

Fixed code:
    <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">
?>
CVE-2013-3238 (PHP, published 2013-04-26T03:34Z)
Description: value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/mult_submits.inc.php
Commit message: Dropped unsafe usage of preg_replace

It could be tricked by apending /e\x00 to execute arbitrary php code.
The new code does simple string replace, we don't really need any of
regex stuff here.


Vulnerable code:
                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);
                $newtablename = preg_replace("/^" . $from_prefix . "/", $to_prefix, $current);

Fixed code:
                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
                } else {
                    $newtablename = $current;
                }
                if (substr($current, 0, strlen($from_prefix)) == $from_prefix) {
                    $newtablename = $to_prefix . substr($current, strlen($from_prefix));
                } else {
                    $newtablename = $current;
                }
                $newtablename = $to_prefix . substr($current, strlen($from_prefix));
CVE-2013-3238 (PHP, published 2013-04-26T03:34Z)
Description: value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/Tracker.class.php
Commit message: Prevent null-byte injection in preg_replace()


Vulnerable code:

Fixed code:
        // Remove null bytes (preg_replace() is vulnerable in some
        // PHP versions)
        $dbname = str_replace("\0", "", $dbname);