hitoshura25/cvefixes huggingface dataset:
CVE-2014-7138 (PHP, published 2014-10-16T19:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in the Google Calendar Events plugin before 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gce_feed_ids parameter in a gce_ajax action to wp-admin/admin-ajax.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pderksen/WP-Google-Calendar-Events
Files changed:
google-calendar-events/includes/misc-functions.php
Commit message: Added esc_html to ajax post values


Vulnerable code:
	   $ids    = $_POST['gce_feed_ids'];
	   $title  = $_POST['gce_title_text'];
	   $month  = $_POST['gce_month'];
	   $year   = $_POST['gce_year'];
	   $paging = $_POST['gce_paging'];
	   $type   = $_POST['gce_type'];
	$grouped          = $_POST['gce_grouped'];
	$start            = $_POST['gce_start'];
	$ids              = $_POST['gce_feed_ids'];
	$title_text       = $_POST['gce_title_text'];
	$sort             = $_POST['gce_sort'];
	$paging           = $_POST['gce_paging'];
	$paging_interval  = $_POST['gce_paging_interval'];
	$paging_direction = $_POST['gce_paging_direction'];
	$start_offset     = $_POST['gce_start_offset'];
	$paging_type      = $_POST['gce_paging_type'];

Fixed code:
	   $ids    = esc_html( $_POST['gce_feed_ids'] );
	   $title  = esc_html( $_POST['gce_title_text'] );
	   $month  = esc_html( $_POST['gce_month'] );
	   $year   = esc_html( $_POST['gce_year'] );
	   $paging = esc_html( $_POST['gce_paging'] );
	   $type   = esc_html( $_POST['gce_type'] );
	$grouped          = esc_html( $_POST['gce_grouped'] );
	$start            = esc_html( $_POST['gce_start'] );
	$ids              = esc_html( $_POST['gce_feed_ids'] );
	$title_text       = esc_html( $_POST['gce_title_text'] );
	$sort             = esc_html( $_POST['gce_sort'] );
	$paging           = esc_html( $_POST['gce_paging'] );
	$paging_interval  = esc_html( $_POST['gce_paging_interval'] );
	$paging_direction = esc_html( $_POST['gce_paging_direction'] );
	$start_offset     = esc_html( $_POST['gce_start_offset'] );
	$paging_type      = esc_html( $_POST['gce_paging_type'] );
CVE-2022-3708 (PHP, published 2022-10-28T19:15Z)
Description: value: The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/GoogleForCreators/web-stories-wp
Files changed:
includes/REST_API/Hotlinking_Controller.php
tests/phpunit/integration/tests/REST_API/Hotlinking_Controller.php
Commit message: Improve URL checks in hotlinking controller


Vulnerable code:
			if ( 127 === $parts[0] || 10 === $parts[0] || 0 === $parts[0]
				|| ( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] )
				|| ( 192 === $parts[0] && 168 === $parts[1] )

Fixed code:
			if (
				0 === $parts[0] // 0.0.0.0/8.
				||
				127 === $parts[0] // 127.0.0.0/8.
				||
				10 === $parts[0] // 10.0.0.0/8.
				||
				( 172 === $parts[0] && 16 <= $parts[1] && 31 >= $parts[1] ) // 172.16.0.0/12.
				||
				( 192 === $parts[0] && 168 === $parts[1] ) // 192.168.0.0/16.
				||
				( 169 === $parts[0] && 254 === $parts[1] ) // 169.254.0.0/16.
				||
				// phpcs:ignore Squiz.PHP.CommentedOutCode.Found
				( 100 === $parts[0] && 64 <= $parts[1] && 127 >= $parts[1] ) // Private: 100.64.0.0/10.
			'a request with disallowed link-local ip'      => [
				'url' => 'http://169.254.0.0/caniload.php',
			],
CVE-2022-23492 (Unknown, published 2022-12-08T01:15Z)
Description: value: go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of go-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack. Users are advised to upgrade their version of go-libp2p to version `0.18.1` or newer. Users unable to upgrade may consult the denial of service (dos) mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/libp2p/go-libp2p
Files changed:
Commit message: Merge pull request #1275 from libp2p/rcmgr

use the resource manager

Vulnerable code:

Fixed code:
CVE-2014-2080 (PHP, published 2014-03-01T00:01Z)
Description: value: Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modxcms/revolution
Files changed:
core/docs/changelog.txt
core/model/modx/modmanagerrequest.class.php
manager/templates/default/header.tpl
Commit message: Prevent XSS on actionVar in header.tpl

The smarty template was reflecting the $_GET['a'] parameter without converting htmlspecialchars (was only using strip_tags)


Vulnerable code:
        $this->action = isset($_REQUEST[$this->actionVar]) ? $_REQUEST[$this->actionVar] : $this->defaultAction;
<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|strip_tags}" type="text/javascript"></script>
<script src="{$_config.connectors_url}layout/modx.config.js.php?action={$smarty.get.a|strip_tags}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>

Fixed code:
- Prevent XSS on actionVar in header.tpl
        $this->sanitizeRequest();
        
        $this->action = isset($_REQUEST[$this->actionVar]) ? (integer)$_REQUEST[$this->actionVar] : $this->defaultAction;
<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|htmlspecialchars}" type="text/javascript"></script>
<script src="{$_config.connectors_url}layout/modx.config.js.php?action={$smarty.get.a|htmlspecialchars}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>
CVE-2014-5451 (Other, published 2014-11-06T18:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/.  NOTE: this issue exists because of a CVE-2014-2080 regression.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/modxcms/revolution
Files changed:
core/docs/changelog.txt
manager/templates/default/header.tpl
Commit message: Prevent XSS via $_GET param for controller action

Originally fixed in 2.2.x via https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea - was reverted somehow

Should address #11966


Vulnerable code:
<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|strip_tags}" type="text/javascript"></script>
<script src="{$_config.connectors_url}modx.config.js.php?action={$smarty.get.a|strip_tags}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>

Fixed code:
- Prevent XSS via GET param for manager controller action [#11966]
<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|htmlspecialchars}" type="text/javascript"></script>
<script src="{$_config.connectors_url}modx.config.js.php?action={$smarty.get.a|htmlspecialchars}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>
CVE-2018-1000207 (Other, published 2018-07-13T18:29Z)
Description: value: MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/modxcms/revolution
Files changed:
core/docs/changelog.txt
Commit message: Filtering user parameters before passing them into phpthumb class #13979

* upstream/pr/13979:
  Added strict mode for in_array
  Returns the missed in the past the considering to phpthumb_imagemagick_path system setting
  Limit parameters incoming from users to only allowed from phpthumb
  Some code cleanup before fix


Vulnerable code:

Fixed code:
+- Filtering user parameters before passing them into phpthumb class #13979
CVE-2015-4619 (Ruby, published 2017-09-07T20:29Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/denkGroot/Spina
Files changed:
app/controllers/spina/application_controller.rb
Commit message: protect from forgery


Vulnerable code:

Fixed code:
    protect_from_forgery
CVE-2020-15120 (Python, published 2020-07-27T18:15Z)
Description: value: In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/spiral-project/ihatemoney
Files changed:
ihatemoney/models.py
Commit message: Fix unauthorized access and modification of project data (CVE-2020-15120)

An authenticated member of one project can modify and delete members of
another project, without knowledge of this other project's private
code. This can be further exploited to access all bills of another project
without knowledge of this other project's private code.

With the default configuration, anybody is allowed to create a new
project. An attacker can create a new project and then use it to become
authenticated and exploit this flaw. As such, the exposure is similar to
an unauthenticated attack, because it is trivial to become authenticated.

This issue was caused by a wrong database queries in PersonQuery.

For more details, see https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9


Vulnerable code:
                .filter(Project.id == project.id)
                .filter(Project.id == project.id)

Fixed code:
                .filter(Person.project_id == project.id)
                .filter(Person.project_id == project.id)
CVE-2021-29662 (Other, published 2021-03-31T18:15Z)
Description: value: The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/houseabsolute/Data-Validate-IP
Files changed:
Changes
lib/Data/Validate/IP.pm
Commit message: Update security note in docs to include mention of is_ip() and friends


Vulnerable code:
It's important to understand that if C<is_ipv4($ip)> or C<is_ipv6($ip)> return
false, then all other validation functions for that IP address family will
I<also> return false. So for example, if C<is_ipv4($ip)> is false, so are both
C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)>.
C<is_ipv4($ip)> as well.
However, this module's C<is_ipv4($ip)> function will return false for
addresses like "010.0.0.1" which have octal components. And of course that
means that it also returns false for C<is_private_ipv4($ip)> I<and>
C<is_public_ipv4($ip)>.

Fixed code:
- Added some more details to the security docs to include mentions of the
  is_*_ip() functions too.


It's important to understand that if C<is_ipv4($ip)>, C<is_ipv6($ip)>, or
C<is_ip($ip)> return false, then all other validation functions for that IP
address family will I<also> return false. So for example, if C<is_ipv4($ip)>
returns false, then C<is_private_ipv4($ip)> I<and> C<is_public_ipv4($ip)> will
both also return false.
C<is_ipv4($ip)> as well. This applies as well when using IPv6 functions or
generic functions like C<is_private_ip($ip)>.
However, this module's C<is_ipv4($ip)> and C<is_ip($ip)> functions will return
false for addresses like "010.0.0.1" which have octal components. And of
course that means that it also returns false for C<is_private_ipv4($ip)>
I<and> C<is_public_ipv4($ip)>.
CVE-2022-4525 (Other, published 2022-12-15T21:15Z)
Description: value: A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 59.0.0.rc is able to address this issue. The name of the patch is da44a3893b407087829b006d09339780919714cd. It is recommended to upgrade the affected component. The identifier VDB-215905 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nsrr/sleepdata.org
Files changed:
CHANGELOG.md
app/views/layouts/application.html.haml
app/views/layouts/full_page.html.haml
app/views/layouts/full_page_custom_header.html.haml
app/views/layouts/full_page_no_header.html.haml
app/views/layouts/full_page_sidebar.html.haml
Commit message: Fixed a Cross Site Scripting (XSS) issue


Vulnerable code:
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe
    %title= [@title, ENV["website_name"]].compact.join(" - ").html_safe

Fixed code:
### Enhancements
- **Security Changes**
  - Fixed a Cross Site Scripting (XSS) issue

    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
    %title= [@title, ENV["website_name"]].compact.join(" - ")
CVE-2024-38355 (TypeScript, published 2024-06-19T20:15Z)
Description: value: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/socketio/socket.io
Files changed:
lib/socket.ts
Commit message: refactor: add a noop handler for the error event

We should reduce the scope of the "event" error in the next major
version, as it is overloaded today:

- it can be sent by the client (`socket.emit("error")`, which is a perfectly valid event name)
- it can be emitted when the connection encounters an error (an invalid packet for example)
- it can be emitted when a packet is rejected in a middleware (`socket.use()`)

Related: https://github.com/socketio/socket.io/issues/2047


Vulnerable code:
    if (this.listeners("error").length) {
      this.emitReserved("error", err);
    } else {
      console.error("Missing error handler on `socket`.");
      console.error(err.stack);
    }

Fixed code:

    // prevents crash when the socket receives an "error" event without listener
    this.on("error", noop);
    // FIXME the meaning of the "error" event is overloaded:
    //  - it can be sent by the client (`socket.emit("error")`)
    //  - it can be emitted when the connection encounters an error (an invalid packet for example)
    //  - it can be emitted when a packet is rejected in a middleware (`socket.use()`)
    this.emitReserved("error", err);
CVE-2014-0791 (C, published 2014-01-03T18:54Z)
Description: value: Integer overflow in the license_read_scope_list function in libfreerdp/core/license.c in FreeRDP through 1.0.2 allows remote RDP servers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ScopeCount value in a Scope List in a Server License Request packet.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/sidhpurwala-huzaifa/FreeRDP
Files changed:
libfreerdp/core/license.c
Commit message: Fix possible integer overflow in license_read_scope_list()


Vulnerable code:

Fixed code:
        if (Stream_GetRemainingLength(s) / sizeof(LICENSE_BLOB) < scopeCount)
                return FALSE;  /* Avoid overflow in malloc */
CVE-2018-25064 (JavaScript, published 2023-01-05T09:15Z)
Description: value: A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. The patch is named 4bed3b34dcc01fe6661f39c0e5d2285b340f7cac. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217439.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/osmlab/show-me-the-way
Files changed:
index.html
js/site.js
Commit message: Fix some XSS issues

Since OSM data, changeset comments and potentially even OSM usernames may
contain HTML code, it's better to use the textContent property to insert
such values, since innerHTML would result in interpretation of this HTML
code which might even result in the execution of JavaScript code [1].
The Underscore.js template is also affected by such issues, which can be
mitigated by using <%- instead of <%= for interpolations [2].

[1] https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML#Security_considerations
[2] http://underscorejs.org/#template


Vulnerable code:
<p><a target='_blank' href='//openstreetmap.org/browse/changeset/<%=change.meta.changeset%>'><%=change.timetext%></a> <a target='_blank' href='//openstreetmap.org/user/<%= change.meta.user %>'><%= change.meta.user %></a>
     <%= past_tense[change.type] %> <a target='_blank' href='//openstreetmap.org/browse/<%= change.meta.type %>/<%= change.meta.id %>'><%= change.tagtext %></a>
        document.getElementById('reverse-location').innerHTML =
        document.getElementById('comment').innerHTML = changeset_data.comment + ' in ' + changeset_data.created_by;
    document.getElementById('queuesize').innerHTML = queue.length;

Fixed code:
<p><a target='_blank' href='//openstreetmap.org/browse/changeset/<%-change.meta.changeset%>'><%-change.timetext%></a> <a target='_blank' href='//openstreetmap.org/user/<%- change.meta.user %>'><%- change.meta.user %></a>
     <%- past_tense[change.type] %> <a target='_blank' href='//openstreetmap.org/browse/<%- change.meta.type %>/<%- change.meta.id %>'><%- change.tagtext %></a>
        document.getElementById('reverse-location').textContent =
        document.getElementById('comment').textContent = changeset_data.comment + ' in ' + changeset_data.created_by;
    document.getElementById('queuesize').textContent = queue.length;