hitoshura25/cvefixes huggingface dataset:
CVE-2020-36653 (Unknown, published 2023-01-18T08:15Z)
Description: value: A vulnerability was found in GENI Portal. It has been rated as problematic. Affected by this issue is some unknown functionality of the file portal/www/portal/error-text.php. The manipulation of the argument error leads to cross site scripting. The attack may be launched remotely. The patch is identified as c2356cc41260551073bfaa3a94d1ab074f554938. It is recommended to apply a patch to fix this issue. VDB-218474 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/GENI-NSF/geni-portal
Files changed:
Commit message: Merge pull request #1822 from GENI-NSF/hussamnasir-xssvul1_fix

Update error-text.php

Vulnerable code:

Fixed code:
CVE-2020-36654 (PHP, published 2023-01-18T08:15Z)
Description: value: A vulnerability classified as problematic has been found in GENI Portal. This affects the function no_invocation_id_error of the file portal/www/portal/sliceresource.php. The manipulation of the argument invocation_id/invocation_user leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 39a96fb4b822bd3497442a96135de498d4a81337. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218475.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/GENI-NSF/geni-portal
Files changed:
portal/www/portal/sliceresource.php
Commit message: Fix XSS Vul for $invocation_user

Since the invocation id and invocation user cannot be anything but an alphanumeric string , we will use that check as our fix . This will avoid the usage of any JS code as values since it would need special chars like "<>"

Vulnerable code:

Fixed code:
    if(!ctype_alnum($invocation_id) || !ctype_alnum($invocation_user))
    {
      relative_redirect('dashboard.php#slices');
    }
CVE-2023-3635 (Kotlin, published 2023-07-12T19:15Z)
Description: value: GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/square/okio
Files changed:
okio/src/jvmMain/kotlin/okio/GzipSource.kt
okio/src/jvmTest/kotlin/okio/GzipKotlinTest.kt
Commit message: Fix a bug where xlen larger than 0x7fff was rejected (#1280)

We treated this short value as unsigned and it should have been
treated as signed.

Vulnerable code:
      val xlen = source.buffer.readShortLe().toLong()
    val gzip = (data as Sink).gzip()
    gzip.buffer().writeUtf8("Hi!").close()
    val gzip = (buffer as Source).gzip()
    assertEquals("Hi!", gzip.buffer().readUtf8())

Fixed code:
      val xlen = (source.buffer.readShortLe().toInt() and 0xffff).toLong()
    (data as Sink).gzip().buffer().use { gzip ->
      gzip.writeUtf8("Hi!")
    }
    (buffer as Source).gzip().buffer().use { gzip ->
      assertEquals("Hi!", gzip.readUtf8())
    }
  }

  @Test fun extraLongXlen() {
    val xlen = 0xffff
    val buffer = Buffer()
      .write("1f8b0804000000000000".decodeHex())
      .writeShort(xlen)
      .write(ByteArray(xlen))
      .write("f3c8540400dac59e7903000000".decodeHex())
    (buffer as Source).gzip().buffer().use { gzip ->
      assertEquals("Hi!", gzip.readUtf8())
    }
CVE-2017-5594 (Unknown, published 2017-01-25T18:59Z)
Description: value: An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/pagekit/pagekit
Files changed:
Commit message: Merge branch 'release/1.0.11'


Vulnerable code:

Fixed code:
CVE-2010-4335 (PHP, published 2011-01-14T23:00Z)
Description: value: The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/cakephp/cakephp
Files changed:
cake/libs/controller/components/security.php
cake/tests/cases/libs/controller/components/security.test.php
Commit message: Fixing issue found by Felix Wilhelm(flxm) where users could send potentially dangerous or corrupted serialized objects to SecurityComponent, potentially allowing manipulation of file map caches.  Test case added.


Vulnerable code:
		$locked = unserialize(str_rot13($locked));

Fixed code:
		$locked = str_rot13($locked);
		if (preg_match('/(\A|;|{|})O\:[0-9]+/', $locked)) {
			return false;
		}

		$locked = unserialize($locked);

/**
 * Test that objects can't be passed into the serialized string. This was a vector for RFI and LFI 
 * attacks. Thanks to Felix Wilhelm
 *
 * @return void
 */
	function testValidatePostObjectDeserialize() {
		$this->Controller->Security->startup($this->Controller);
		$key = $this->Controller->params['_Token']['key'];
		$fields = 'a5475372b40f6e3ccbf9f8af191f20e1642fd877';

		// a corrupted serialized object, so we can see if it ever gets to deserialize
		$attack = 'O:3:"App":1:{s:5:"__map";a:1:{s:3:"foo";s:7:"Hacked!";s:1:"fail"}}';
		$fields .= urlencode(':' . str_rot13($attack));

		$this->Controller->data = array(
			'Model' => array('username' => 'mark', 'password' => 'foo', 'valid' => '0'),
			'_Token' => compact('key', 'fields')
		);
		$result = $this->Controller->Security->validatePost($this->Controller);
		$this->assertFalse($result, 'validatePost passed when key was missing. %s');
	}
CVE-2015-8379 (PHP, published 2016-01-26T19:59Z)
Description: value: CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/cakephp/cakephp
Files changed:
src/Controller/Component/CsrfComponent.php
tests/TestCase/Controller/Component/CsrfComponentTest.php
Commit message: Only allow GET, HEAD, OPTIONS to not have CSRF tokens.

This covers cases where bad guys make up fake HTTP methods to trick CSRF
validation.

Update test cases to not muck about in $_SERVER too.


Vulnerable code:
        if ($request->is(['patch', 'put', 'post', 'delete'])) {
        $_SERVER['REQUEST_METHOD'] = 'GET';

        $controller->request = new Request(['webroot' => '/dir/']);
            ['PATCH'], ['PUT'], ['POST'], ['DELETE']
        $_SERVER['REQUEST_METHOD'] = $method;
        $_SERVER['HTTP_X_CSRF_TOKEN'] = 'testing123';

        $controller->request = new Request(['cookies' => ['csrfToken' => 'testing123']]);
        $_SERVER['REQUEST_METHOD'] = $method;
        $_SERVER['HTTP_X_CSRF_TOKEN'] = 'nope';

        $_SERVER['REQUEST_METHOD'] = $method;

        $_SERVER['REQUEST_METHOD'] = $method;

        $_SERVER['REQUEST_METHOD'] = 'POST';

        $_SERVER['REQUEST_METHOD'] = $method;

        $_SERVER['REQUEST_METHOD'] = 'POST';

        $_SERVER['REQUEST_METHOD'] = 'GET';

        $controller->request = new Request(['webroot' => '/dir/']);
        $_SERVER['REQUEST_METHOD'] = 'POST';


Fixed code:
        if (!$request->is(['head', 'get', 'options'])) {
        $controller->request = new Request([
            'environment' => ['REQUEST_METHOD' => 'GET'],
            'webroot' => '/dir/',
        ]);
            ['PATCH'], ['PUT'], ['POST'], ['DELETE'], ['PURGE'], ['INVALIDMETHOD']
        $controller->request = new Request([
            'environment' => [
                'REQUEST_METHOD' => $method,
                'HTTP_X_CSRF_TOKEN' => 'testing123',
            ],
            'cookies' => ['csrfToken' => 'testing123']
        ]);
            'environment' => [
                'REQUEST_METHOD' => $method,
                'HTTP_X_CSRF_TOKEN' => 'nope',
            ],
            'environment' => [
                'REQUEST_METHOD' => $method,
            ],
            'environment' => [
                'REQUEST_METHOD' => $method,
            ],
            'environment' => [
                'REQUEST_METHOD' => 'POST',
            ],
            'environment' => [
                'REQUEST_METHOD' => $method
            ],
            'environment' => ['REQUEST_METHOD' => 'POST'],
        $controller->request = new Request([
            'environment' => ['REQUEST_METHOD' => 'GET'],
            'webroot' => '/dir/'
        ]);
            'environment' => ['REQUEST_METHOD' => 'POST'],
CVE-2019-11458 (PHP, published 2019-05-08T18:29Z)
Description: value: An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/cakephp/cakephp
Files changed:
src/Mailer/Transport/SmtpTransport.php
tests/TestCase/Mailer/Transport/SmtpTransportTest.php
Commit message: Fix side-effect in destructor

SmtpTransport had the potential to create a harmful side-effect
in its destructor should an untrusted value ever be deserialized. This
solves that by removing the socket on wakeup.


Vulnerable code:

Fixed code:
    /**
     * Unserialize handler.
     *
     * Ensure that the socket property isn't reinitialized in a broken state.
     *
     * @return void
     */
    public function __wakeup()
    {
        $this->_socket = null;
    }


    /**
     * Ensure that unserialized transports have no connection.
     *
     * @return void
     */
    public function testSerializeCleanupSocket()
    {
        $this->socket->expects($this->at(0))->method('connect')->will($this->returnValue(true));
        $this->socket->expects($this->at(1))->method('read')->will($this->returnValue("220 Welcome message\r\n"));
        $this->socket->expects($this->at(2))->method('write')->with("EHLO localhost\r\n");
        $this->socket->expects($this->at(3))->method('read')->will($this->returnValue("250 OK\r\n"));

        $smtpTransport = new SmtpTestTransport();
        $smtpTransport->setSocket($this->socket);
        $smtpTransport->connect();

        $result = unserialize(serialize($smtpTransport));
        $this->assertAttributeEquals(null, '_socket', $result);
        $this->assertFalse($result->connected());
    }
CVE-2023-22727 (PHP, published 2023-01-17T21:15Z)
Description: value: CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/cakephp/cakephp
Files changed:
src/Database/Query.php
tests/TestCase/Database/QueryTest.php
Commit message: Disallow strings in limit() and offset()

Back in 68a08a2 int casts were removed in limit() and offset(). This
opened up the possibility for applications to provide unsafe user input
into these methods and create an injection vector.

We've been trying to narrow the accepted types, so instead of adding
casting I've added an exception when strings that are not number shaped
are provided.


Vulnerable code:

Fixed code:
        if (is_string($limit) && !is_numeric($limit)) {
            throw new InvalidArgumentException('Invalid value for `limit()`');
        }
        if (is_string($offset) && !is_numeric($offset)) {
            throw new InvalidArgumentException('Invalid value for `offset()`');
        }
    /**
     * Tests selecting rows with string offset/limit
     */
    public function testSelectLimitInvalid(): void
    {
        $query = new Query($this->connection);
        $this->expectException(InvalidArgumentException::class);
        $query->select('id')->from('comments')
            ->limit('1 --more')
            ->order(['id' => 'ASC'])
            ->execute();
    }

    /**
     * Tests selecting rows with string offset/limit
     */
    public function testSelectOffsetInvalid(): void
    {
        $query = new Query($this->connection);
        $this->expectException(InvalidArgumentException::class);
        $query->select('id')->from('comments')
            ->offset('1 --more')
            ->order(['id' => 'ASC'])
            ->execute();
    }
CVE-2018-25086 (PHP, published 2023-06-01T07:15Z)
Description: value: A vulnerability was found in sea75300 FanPress CM up to 3.6.3. It has been classified as problematic. This affects the function getArticlesPreview of the file inc/controller/action/system/templatepreview.php of the component Template Preview. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.6.4 is able to address this issue. The patch is named c380d343c2107fcee55ab00eb8d189ce5e03369b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230235.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sea75300/fanpresscm3
Files changed:
inc/controller/action/system/help.php
inc/controller/action/system/templatepreview.php
Commit message: * Bugfix: Hilfe wird unter PHP 7 nicht angezeigt
* Bugfix: Mögliche XSS-Lücke in Template-Vorschau

Vulnerable code:
            if ($this->cache->isExpired() || !is_array($contents)) {
                }                
            $this->view->assign('content', implode(PHP_EOL, $parsed));

Fixed code:
            if (!is_array($contents)) {
                $contents = [];
            }

            if ($this->cache->isExpired()) {
                }
                
                $this->cache->write($contents, FPCM_LANGCACHE_TIMEOUT);

            $this->view->assign('content', str_replace(
                ['<script>', '</script>'],
                ['&lt;script_diabled_in_preview&gt;', '&lt;/script_diabled_in_preview&gt;'],
                implode(PHP_EOL, $parsed))
            );
CVE-2022-4495 (Python, published 2022-12-14T15:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.7 is able to address this issue. The name of the patch is 6c4d616fcc771822a14ebae5e23f3f6d96d134bd. It is recommended to upgrade the affected component. The identifier VDB-215813 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/collective/collective.dms.basecontent
Files changed:
CHANGES.rst
setup.py
src/collective/dms/basecontent/browser/column.py
Commit message: Updated columns to work with z3c.table 2.2. Escaped rendering special caracters to avoid xss


Vulnerable code:
- Nothing changed yet.

        'z3c.table',
import os.path
import Missing
from Acquisition import aq_base
from Products.CMFCore.utils import getToolByName
from zope.i18nmessageid import MessageFactory
import z3c.table.table
import z3c.table.column
from Products.CMFCore.WorkflowCore import WorkflowException
from collective.dms.basecontent import _
                principals.append(user.getProperty('fullname', None) or user.getId())
                    principals.append(group.getProperty('title', None) or group.getId())
        if isinstance(title, unicode):
            return title
        else:
            return unicode(title, 'utf-8', 'ignore')
        content = super(IconColumn, self).getLinkContent(item)

Fixed code:
- Updated columns to work with z3c.table 2.2. Escaped rendering special caracters to avoid xss.
  [sgeulette]
        'future',
        'z3c.table>=2.2',
from Acquisition import aq_base
from collective.dms.basecontent import _
from html import escape
from Products.CMFCore.utils import getToolByName
from Products.CMFCore.WorkflowCore import WorkflowException
from Products.CMFPlone.utils import safe_unicode
from zope.i18nmessageid import MessageFactory

import Missing
import os.path
import z3c.table.column
import z3c.table.table
                principals.append(escape(user.getProperty('fullname', None)) or user.getId())
                    principals.append(escape(group.getProperty('title', None)) or group.getId())
    def renderCell(self, item):
        # setup a tag
        return '<a href="%s"%s%s%s>%s</a>' % (
            self.getLinkURL(item),  # originally escaped
            self.getLinkTarget(item),
            self.getLinkCSS(item),
            self.getLinkTitle(item),
            self.getLinkContent(item),  # originally escaped
        )

        return escape(safe_unicode(title))
        content = super(IconColumn, self).getLinkContent(item)  # escaped
CVE-2022-22984 (TypeScript, published 2022-11-30T13:15Z)
Description: value: The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/snyk/snyk-cocoapods-plugin
Files changed:
.snyk
lib/sub-process.ts
package.json
test/lib/sub-process.test.ts
Commit message: fix: quote args


Vulnerable code:
version: v1.13.5
ignore: {}
      subProcess.execute('basename', ['$PWD'], { cwd: __dirname }),

Fixed code:
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
  'snyk:lic:npm:shescape:MPL-2.0':
    - '*':
        reason: None Given
        expires: 2022-12-29T09:11:54.820Z
        created: 2022-11-29T09:11:54.829Z
import { quoteAll } from 'shescape';
  args = quoteAll(args, spawnOptions);

    "shescape": "1.6.1",
      subProcess.execute('basename $PWD', [], { cwd: __dirname }),