hitoshura25/cvefixes huggingface dataset:
CVE-2022-4905 (PHP, published 2023-02-13T21:15Z)
Description: value: A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/udx/wp-stateless
Files changed:
lib/classes/class-settings.php
Commit message: vulnerability fix


Vulnerable code:
          $settings = apply_filters('stateless::settings::save', sanitize_text_field($_POST['sm']));


Fixed code:
          $settings = apply_filters('stateless::settings::save', $_POST['sm']);
            /**
             * Sanitize POST data
             */
            $value = sanitize_text_field($value);
CVE-2022-32983 (Other, published 2022-06-20T16:15Z)
Description: value: Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/CZ-NIC/knot-resolver
Files changed:
modules/policy/README.rst
Commit message: policy docs: warn about filters and forwarding

We've been notified about possibility of "cache poisoning" this way,
so let's document this drawback to make the expectations clearer.


Vulnerable code:

Fixed code:
.. warning::
   Limiting forwarding actions by filters (e.g. :func:`policy.suffix`) may have unexpected consequences.
   Notably, forwarders can inject *any* records into your cache
   even if you "restrict" them to an insignificant DNS subtree --
   except in cases where DNSSEC validation applies, of course.

   The behavior is probably best understood through the fact
   that filters and actions are completely decoupled.
   The forwarding actions have no clue about why they were executed,
   e.g. that the user wanted to restrict the forwarder only to some subtree.
   The action just selects some set of forwarders to process this whole request from the client,
   and during that processing it might need some other "sub-queries" (e.g. for validation).
   Some of those might not've passed the intended filter,
   but policy rule-set only applies once per client's request.
CVE-2022-4957 (PHP, published 2023-12-03T19:15Z)
Description: value: A vulnerability was found in librespeed speedtest up to 5.2.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file results/stats.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. Upgrading to version 5.2.5 is able to address this issue. The patch is named a85f2c086f3449dffa8fe2edb5e2ef3ee72dc0e9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-246643.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librespeed/speedtest
Files changed:
results/stats.php
Commit message: Fixed minor vulnerability in stats.php


Vulnerable code:
                        echo '<div>There was an error trying to fetch the speedtest result for ID "'.$_GET['id'].'".</div>';
                        echo '<div>Could not find a speedtest result for ID "'.$_GET['id'].'".</div>';

Fixed code:
                        echo '<div>There was an error trying to fetch the speedtest result for ID "'.htmlspecialchars($_GET['id'], ENT_HTML5, 'UTF-8').'".</div>';
                        echo '<div>Could not find a speedtest result for ID "'.htmlspecialchars($_GET['id'], ENT_HTML5, 'UTF-8').'".</div>';
CVE-2024-32890 (PHP, published 2024-05-01T07:15Z)
Description: value: librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The `processedString` field in the `ispinfo` parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (`results/telemetry.php`) and returned in the JSON API (`results/json.php`). This vulnerability has been introduced in commit 3937b94. This vulnerability affects LibreSpeed speedtest instances running version 5.2.5 or higher which have telemetry enabled and has been addressed in version 5.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/librespeed/speedtest
Files changed:
results/json.php
Commit message: Results can now be fetched in json format instead of just an image (results/json.php


Vulnerable code:

Fixed code:
<?php

require_once 'telemetry_db.php';

/**
 * @param int|float $d
 *
 * @return string
 */
function format($d)
{
    if ($d < 10) {
        return number_format($d, 2, '.', '');
    }
    if ($d < 100) {
        return number_format($d, 1, '.', '');
    }

    return number_format($d, 0, '.', '');
}

/**
 * @param array $speedtest
 *
 * @return array
 */
function formatSpeedtestData($speedtest)
{
    // format values for the image
    $speedtest['dl'] = format($speedtest['dl']);
    $speedtest['ul'] = format($speedtest['ul']);
    $speedtest['ping'] = format($speedtest['ping']);
    $speedtest['jitter'] = format($speedtest['jitter']);
    $speedtest['timestamp'] = $speedtest['timestamp'];

    $ispinfo = json_decode($speedtest['ispinfo'], true)['processedString'];
    $dash = strpos($ispinfo, '-');
    if ($dash !== false) {
        $ispinfo = substr($ispinfo, $dash + 2);
        $par = strrpos($ispinfo, '(');
        if ($par !== false) {
            $ispinfo = substr($ispinfo, 0, $par);
        }
    } else {
        $ispinfo = '';
    }

    $speedtest['ispinfo'] = $ispinfo;

    return $speedtest;
}

$speedtest = getSpeedtestUserById($_GET['id']);
if (!is_array($speedtest)) {
    echo '{}';
}
$speedtest = formatSpeedtestData($speedtest);
 
echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
CVE-2024-32890 (PHP, published 2024-05-01T07:15Z)
Description: value: librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The `processedString` field in the `ispinfo` parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (`results/telemetry.php`) and returned in the JSON API (`results/json.php`). This vulnerability has been introduced in commit 3937b94. This vulnerability affects LibreSpeed speedtest instances running version 5.2.5 or higher which have telemetry enabled and has been addressed in version 5.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/librespeed/speedtest
Files changed:
results/json.php
speedtest.js
Commit message: Fixed vulnerability in json.php caused my missing Content-Type header


Vulnerable code:
$speedtest = formatSpeedtestData($speedtest);

echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
    "LibreSpeed by Federico Dossena v5.3.0 - https://github.com/librespeed/speedtest"

Fixed code:
error_reporting(0);
header('Content-Type: application/json; charset=utf-8');

} else {
    $speedtest = formatSpeedtestData($speedtest);
    echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
    "LibreSpeed by Federico Dossena v5.3.1 - https://github.com/librespeed/speedtest"
CVE-2013-7262 (C, published 2014-01-05T20:55Z)
Description: value: SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/mapserver/mapserver
Files changed:
mappostgis.c
Commit message: Fix potential SQL Injection with postgis TIME filters (#4834)


Vulnerable code:

Fixed code:
  if( strchr(timestring,'\'') || strchr(timestring, '\\') ) {
     msSetError(MS_MISCERR, "Invalid time filter.", "msPostGISLayerSetTimeFilter()");
     return MS_FALSE;
  }
CVE-2017-5522 (C, published 2017-03-15T16:59Z)
Description: value: Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/mapserver/mapserver
Files changed:
mapogcfilter.c
mapogcfiltercommon.c
Commit message: security fix (patch by EvenR)


Vulnerable code:

Fixed code:
  if( 1 + 2 * nLength + 1 + 1 >= sizeof(szTmp) )
      return NULL;
  if( 1 + 2 * nLength + 1 + 1 >= sizeof(szTmp) )
      return NULL;
CVE-2021-39132 (Unknown, published 2021-08-30T20:15Z)
Description: value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/rundeck/rundeck
Files changed:
Commit message: Merge pull request from GHSA-q4rf-3fhx-88pf

fix: plugin yaml loader should only deserialize the PluginMeta type

Vulnerable code:

Fixed code:
CVE-2021-39133 (Unknown, published 2021-08-30T20:15Z)
Description: value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/rundeck/rundeck
Files changed:
Commit message: Merge pull request from GHSA-3jmw-c69h-426c

Add CSRF protection to plugin upload/install endpoints

Vulnerable code:

Fixed code:
CVE-2021-41111 (Unknown, published 2022-02-28T20:15Z)
Description: value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/rundeck/rundeck
Files changed:
Commit message: Merge pull request from GHSA-mfqj-f22m-gv8j

Fix IDOR webhook get does not correctly authorize project

Vulnerable code:

Fixed code:
CVE-2022-29186 (Unknown, published 2022-05-20T21:15Z)
Description: value: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. A patch on Rundeck's `main` branch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured. To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Two workarounds are available: Do not use any pre-existing public key file from the rundeck docker images to allow SSH access by adding it to authorized_keys files and, if you have copied the public key file included in the docker image, remove it from any authorized_keys files.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/rundeck/rundeck
Files changed:
Commit message: Merge pull request from GHSA-qxjx-xr2m-hgqx

Remove ssh-keygen from dockerfile

Vulnerable code:

Fixed code:
CVE-2022-36058 (Unknown, published 2022-09-06T20:15Z)
Description: value: Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or actual) could encounter a `MultiESDTNFTTransfer` transaction like this: `MultiESDTNFTTransfer` with a missing function name. Basic functionality like p2p messaging, storage, API requests and such are unaffected. Version 1.3.34 contains a fix for this issue. There are no known workarounds.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ElrondNetwork/elrond-go
Files changed:
Commit message: Merge pull request from GHSA-qf7j-25g9-r63f

Extra check in vm-common

Vulnerable code:

Fixed code:
CVE-2022-46173 (Unknown, published 2022-12-28T07:15Z)
Description: value: Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been patched in version 1.3.50.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-669 \u2014 Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Repository: https://github.com/ElrondNetwork/elrond-go
Files changed:
Commit message: Merge pull request #4718 from ElrondNetwork/test-scr-processor-lookup

Improve SCR lookup in smartcontract preprocessor

Vulnerable code:

Fixed code:
CVE-2015-10012 (Other, published 2023-01-03T09:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 is able to address this issue. The name of the patch is abe4993390ba9bd7821ab12678270556645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-209 \u2014 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
Repository: https://github.com/sumocoders/FrameworkUserBundle
Files changed:
Resources/views/Security/login.html.twig
Commit message: Make sure we don't get a doctrine error message.

The old exception message gave us a lot of info about our application.
This could help a user find out we're running Symfony and find possible
exploits. This commit will hide the message behind a translated version
of the message of the exception.


Vulnerable code:
                {{ error|trans }}

Fixed code:
                {{ error.messageKey|trans(error.messageData, 'security') }}
CVE-2022-4607 (Unknown, published 2022-12-18T22:15Z)
Description: value: A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to xml external entity reference. Upgrading to version 5.2.1 is able to address this issue. The name of the patch is 246f4e2a97ad81491c00a7ed72ce5e7c7f75050a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216215.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/3dcitydb/web-feature-service
Files changed:
Commit message: Merge pull request #12 from 3dcitydb/hotfix-prevent-xxe-vulnerabilities

Prevent XXE vulnerabilities

Vulnerable code:

Fixed code:
CVE-2018-1000559 (HTML, published 2018-06-26T16:29Z)
Description: value: qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/qutebrowser/qutebrowser
Files changed:
qutebrowser/browser/qutescheme.py
tests/end2end/data/issue4011.html
tests/end2end/features/history.feature
Commit message: Fix XSS issue on qute://history

Fixes #4011


Vulnerable code:
    return [{"url": e.url, "title": e.title or e.url, "time": e.atime}
            for e in entries]

Fixed code:
import html
    return [{"url": html.escape(e.url),
             "title": html.escape(e.title) or html.escape(e.url),
             "time": e.atime} for e in entries]
<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8">
        <title>&lt;img src=&quot;x&quot; onerror=&quot;console.log('XSS')&quot;&gt;foo</title>
    </head>
    <body>
        foo
    </body>
</html>

    Scenario: XSS in :history
        When I open data/issue4011.html
        And I open qute://history
        Then the javascript message "XSS" should not be logged