hitoshura25/cvefixes huggingface dataset:
CVE-2019-3817 (C, published 2019-03-27T13:29Z)
Description: value: A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/rpm-software-management/libcomps
Files changed:
libcomps/src/comps_mradix.c
libcomps/src/comps_objmradix.c
libcomps/src/comps_objradix.c
libcomps/src/comps_radix.c
Commit message: Fix UAF in comps_objmrtree_unite function

The added field is not used at all in many places and it is probably the
left-over of some copy-paste.


Vulnerable code:
        char added;
        pair->added = 0;
        char added;
        pair->added = 0;
        char added;
        //pair->added = 0;
        char added;

Fixed code:
CVE-2022-24377 (TypeScript, published 2022-12-14T05:15Z)
Description: value: The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/Soontao/cycle-import-check
Files changed:
src/file.ts
src/index.ts
Commit message: chore: dep update


Vulnerable code:
import { Extension, ScanResult, ReportVO, PackageJson, FileImportDescription } from "./type";
import { join as pathJoin, dirname, join, normalize, relative } from "path";
import { join as arrayJoin, map, isArray, isString, concat, filter, keys } from "@newdash/newdash";
import { includes } from "@newdash/newdash/includes"
import { readFileSync, writeFileSync, existsSync } from "fs";
import { tmpdir, platform } from "os";
import { exec } from "child_process";
const extensions = [
  "js", "jsx", "ts", "tsx", "mjs"
]

export const writeFileToTmpDirAndOpenIt = (filename: string, content: string) => {
  const path = join(tmpdir(), filename);
  writeFileSync(path, content);
  if (platform() === "win32") {
    exec(`start ${path}`)
  } else {
    exec(`open ${path}`)
  }
}
export { writeFileToTmpDirAndOpenIt } from "./file"


Fixed code:
import { concat, filter, isArray, isString, join as arrayJoin, keys, map } from "@newdash/newdash";
import { includes } from "@newdash/newdash/includes";
import { readFileSync } from "fs";
import { dirname, join, join as pathJoin, normalize, relative } from "path";
import { Extension, FileImportDescription, PackageJson, ReportVO, ScanResult } from "./type";
CVE-2020-36629 (Unknown, published 2022-12-25T11:15Z)
Description: value: A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/SimbCo/httpster
Files changed:
Commit message: Merge pull request #36 from 418sec/master

Security Fix for Path Traversal - huntr.dev

Vulnerable code:

Fixed code:
CVE-2020-15237 (Ruby, published 2020-10-05T19:15Z)
Description: value: In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/shrinerb/shrine
Files changed:
CHANGELOG.md
lib/shrine/plugins/derivation_endpoint.rb
Commit message: Securely compare signature in derivation_endpoint

Using regular string comparison when comparing signature has different
performance depending on how much of the string matched, which can make
derivation_endpoint susceptible to timing attacks. We avoid that by
using `Rack::Utils.secure_compare` instead.

Big thanks to @esparta for reporting this.


Vulnerable code:
      elsif signature != generate_signature(string)

Fixed code:
* `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)

      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
CVE-2020-15237 (Ruby, published 2020-10-05T19:15Z)
Description: value: In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-208 \u2014 Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/shrinerb/shrine
Files changed:
CHANGELOG.md
lib/shrine/plugins/derivation_endpoint.rb
Commit message: Securely compare signature in derivation_endpoint

Using regular string comparison when comparing signature has different
performance depending on how much of the string matched, which can make
derivation_endpoint susceptible to timing attacks. We avoid that by
using `Rack::Utils.secure_compare` instead.

Big thanks to @esparta for reporting this.


Vulnerable code:
      elsif signature != generate_signature(string)

Fixed code:
* `derivation_endpoint` – Avoid possibility of timing attacks when comparing signatures (@esparta)

      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
CVE-2023-23625 (Unknown, published 2023-02-09T21:15Z)
Description: value: go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/ipfs/go-unixfs
Files changed:
Commit message: Merge pull request from GHSA-q264-w97q-q778

fix: correctly handle degenerate hamts while reading data

Vulnerable code:

Fixed code:
CVE-2018-1000869 (PHP, published 2018-12-20T17:29Z)
Description: value: phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to have been fixed in 1.4.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/admin/nat/item-add-submit.php
misc/CHANGELOG
Commit message: Bugfix: Possible SQL injection in nat/item-add-submit.php. Fixes #2344


Vulnerable code:

Fixed code:
    // validate object type
    if (!in_array($obj_type, ['subnets', 'ipaddresses'])) { $Result->show("danger", _("Invalid object type"), true); }

    // validate object id
    if (!is_numeric($obj_id)) { $Result->show("danger", _("Invalid object id"), true); }

    + Possible SQL injection in nat/item-add-submit.php (#2344);
CVE-2018-1000870 (PHP, published 2018-12-20T17:29Z)
Description: value: PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. Admin(Victim) views user in admin-panel and gets exploited.. This vulnerability appears to have been fixed in 1.4.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/admin/users/print-user.php
app/tools/user-menu/2fa.php
app/tools/user-menu/2fa_save.php
app/tools/user-menu/account.php
app/tools/user-menu/index.php
app/tools/user-menu/user-edit.php
app/tools/user-menu/user-widgets-set.php
misc/CHANGELOG
Commit message: Bugfix: XSS in print-user.php, CSRF in user-edit.php. Fixes #2326


Vulnerable code:
	<td><?php print $user->theme=="" ? _("Default") : $user->theme ?></td>

Fixed code:
	<td><?php print $user->theme=="" ? _("Default") : escape_input($user->theme) ?></td>
<input type="hidden" name="csrf_cookie" value="<?php print $csrf; ?>">
# validate csrf cookie
$User->Crypto->csrf_cookie ("validate", "user-menu", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";

<input type="hidden" name="csrf_cookie" value="<?php print $csrf; ?>">
# create csrf token
$csrf = $User->Crypto->csrf_cookie ("create", "user-menu");

# validate csrf cookie
$User->Crypto->csrf_cookie ("validate", "user-menu", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";

# Verify Theme
if (!empty($_POST['theme'])) {
	if (!in_array($_POST['theme'], ['default', 'white', 'dark'])) 				{ $Result->show("danger alert-absolute", _('Invalid theme'), true); }
}

# verify that user is logged in
$User->check_user_session();

    + XSS in print-user.php, CSRF in user-edit.php (#2326);
CVE-2021-46426 (PHP, published 2022-03-25T16:15Z)
Description: value: phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/admin/subnets/find_free_section_subnets.php
app/subnets/subnets-menu.php
functions/classes/class.Sections.php
misc/CHANGELOG
Commit message: Bugfix: Security fix

    - XSS (reflected) in 'find subnets';

Reported by Celso Bezerra <celso.bezerra@tempest.com.br>


Vulnerable code:
                <input type="hidden" name="sectionid" value='<?php print $_POST['sectionid']; ?>'>
	print "	 <button class='btn btn-xs btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php'  data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')." $section[name]'  data-sectionId='$section[id]'><i class='fa fa-sm fa-search'></i></button>";
				$html[] = "<button class='btn btn-sm btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php'  data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')."'  data-sectionId='$sectionId'><i class='fa fa-sm fa-search'></i> "._("Find subnet")."</button>";

Fixed code:
# validate csrf cookie
$User->Crypto->csrf_cookie ("validate", "find_free_section_subnets", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";

                <input type="hidden" name="sectionid" value='<?php print escape_input($_POST['sectionid']); ?>'>
# create csrf token
$csrf_ffss = $User->Crypto->csrf_cookie ("create-if-not-exists", "find_free_section_subnets");

	print "	 <button class='btn btn-xs btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php' data-csrf_cookie='$csrf_ffss' data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')." $section[name]'  data-sectionId='$section[id]'><i class='fa fa-sm fa-search'></i></button>";
		# create csrf token
		$csrf_ffss = $User->Crypto->csrf_cookie ("create-if-not-exists", "find_free_section_subnets");

				$html[] = "<button class='btn btn-sm btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php' data-csrf_cookie='$csrf_ffss' data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')."'  data-sectionId='$sectionId'><i class='fa fa-sm fa-search'></i> "._("Find subnet")."</button>";
    + XSS (reflected) in 'find subnets';
CVE-2021-46426 (PHP, published 2022-03-25T16:15Z)
Description: value: phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/admin/subnets/find_free_section_subnets.php
app/subnets/subnets-menu.php
functions/classes/class.Sections.php
misc/CHANGELOG
Commit message: Bugfix: Security fix

    - XSS (reflected) in 'find subnets';

Reported by Celso Bezerra <celso.bezerra@tempest.com.br>


Vulnerable code:
                <input type="hidden" name="sectionid" value='<?php print $_POST['sectionid']; ?>'>
	print "	 <button class='btn btn-xs btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php'  data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')." $section[name]'  data-sectionId='$section[id]'><i class='fa fa-sm fa-search'></i></button>";
				$html[] = "<button class='btn btn-sm btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php'  data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')."'  data-sectionId='$sectionId'><i class='fa fa-sm fa-search'></i> "._("Find subnet")."</button>";

Fixed code:
# validate csrf cookie
$User->Crypto->csrf_cookie ("validate", "find_free_section_subnets", $_POST['csrf_cookie']) === false ? $Result->show("danger", _("Invalid CSRF cookie"), true) : "";

                <input type="hidden" name="sectionid" value='<?php print escape_input($_POST['sectionid']); ?>'>
# create csrf token
$csrf_ffss = $User->Crypto->csrf_cookie ("create-if-not-exists", "find_free_section_subnets");

	print "	 <button class='btn btn-xs btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php' data-csrf_cookie='$csrf_ffss' data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')." $section[name]'  data-sectionId='$section[id]'><i class='fa fa-sm fa-search'></i></button>";
		# create csrf token
		$csrf_ffss = $User->Crypto->csrf_cookie ("create-if-not-exists", "find_free_section_subnets");

				$html[] = "<button class='btn btn-sm btn-default btn-success open_popup' data-script='app/admin/subnets/find_free_section_subnets.php' data-csrf_cookie='$csrf_ffss' data-class='700' rel='tooltip' data-container='body'  data-placement='top' title='"._('Search for free subnets in section ')."'  data-sectionId='$sectionId'><i class='fa fa-sm fa-search'></i> "._("Find subnet")."</button>";
    + XSS (reflected) in 'find subnets';
CVE-2022-3845 (PHP, published 2022-11-02T20:15Z)
Description: value: A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/admin/import-export/import-load-data.php
misc/CHANGELOG
Commit message: Bugfix: XSS (reflected) in import previews

Reported by Faisal Fs <faisalfs10x@gmail.com>


Vulnerable code:
		$fieldmap[$col] = $impfields[$val];
				$record[$fieldmap[$col]] = trim($val);
		$fieldmap[$col] = $impfields[$Tools->convert_encoding_to_UTF8($xls->val($row,$col,$sheet))];
			$record++;
				$record[$fieldmap[$col]] = trim($Tools->convert_encoding_to_UTF8($xls->val($row,$col,$sheet)));

?>

Fixed code:
		$fieldmap[$col] = escape_input(trim($impfields[$val]));
				$record[$fieldmap[$col]] = escape_input(trim($val));
		$fieldmap[$col] = $impfields[escape_input($Tools->convert_encoding_to_UTF8($xls->val($row,$col,$sheet)))];
				$record[$fieldmap[$col]] = escape_input(trim($Tools->convert_encoding_to_UTF8($xls->val($row,$col,$sheet))));
    + XSS (reflected) in import previews;
CVE-2023-0676 (PHP, published 2023-02-04T13:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/tools/ip-calculator/bw-calculator-result.php
misc/CHANGELOG
Commit message: Bugfix: XSS (reflected) in 'bw-calulator-result.php';

Reported by ZenalArifin


Vulnerable code:
$tcp   = $_POST['wsize'];
$delay = $_POST['delay'];
$fsize = $_POST['fsize'];
$mbps = round($tcp/($delay/1000)/(1024*1024),2);

Fixed code:
$tcp   = filter_var($_POST['wsize'], FILTER_VALIDATE_INT,   ["options" => ["min_range"=>1024, "max_range"=>65536]]) ?: die(_("Invalid input"));
$delay = filter_var($_POST['delay'], FILTER_VALIDATE_FLOAT, ["options" => ["min_range"=>0.1,  "max_range"=>1000]])  ?: die(_("Invalid input"));
$fsize = filter_var($_POST['fsize'], FILTER_VALIDATE_FLOAT, ["options" => ["min_range"=>100,  "max_range"=>4096]])  ?: die(_("Invalid input"));
$mbps = round($tcp/($delay/1000)/(1024*1024), 4);
    Security Fixes:
    ----------------------------
    + XSS (reflected) in 'bw-calulator-result.php';
CVE-2023-0678 (PHP, published 2023-02-04T13:15Z)
Description: value: Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/phpipam/phpipam
Files changed:
functions/scripts/find_full_subnets.php
misc/CHANGELOG
Commit message: Bugfix: Restrict find_full_subnets.php to CLI

find_full_subnets.php does not verify if the user is authorized to access the data, and if the script was started from a command line.

Reported by ovprophet


Vulnerable code:
?>

Fixed code:
# script can only be run from cli
if(php_sapi_name()!="cli") 						{ die("This script can only be run from cli!"); }

    + Restrict find_full_subnets.php to CLI;
CVE-2023-1211 (PHP, published 2023-03-07T00:15Z)
Description: value: SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/phpipam/phpipam
Files changed:
functions/classes/class.Admin.php
misc/CHANGELOG
Commit message: Bugfix: SQL injection in custom field enum/set types

Reported by Peng Zhou @zpbrent


Vulnerable code:
	    else																																{ $field['ftype'] = $field['fieldType']."(".$field['fieldSize'].")"; }

Fixed code:
	    else																																{ $field['ftype'] = $field['fieldType']."( :enumset )"; }
	    if (strpos($query, ":enumset")>0)	$params['enumset'] = $field['fieldSize'];
    + SQL injection in custom field enum/set types;