hitoshura25/cvefixes huggingface dataset:
CVE-2022-0602 (PHP, published 2022-04-05T16:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tastyigniter/tastyigniter
Files changed:
app/admin/formwidgets/ScheduleEditor.php
app/admin/formwidgets/scheduleeditor/schedules.blade.php
app/main/formwidgets/components/component.blade.php
app/system/models/config/mail_templates_model.php
Commit message: Minor fixes

Signed-off-by: Sam Poyigi <6567634+sampoyigi@users.noreply.github.com>


Vulnerable code:
        $formTitle = sprintf(lang($this->formTitle), lang('admin::lang.text_'.$scheduleCode));
        $schedules = [];
        foreach ($this->model->availableWorkingTypes() as $scheduleCode) {
            $schedules[$scheduleCode] = $this->model->createScheduleItem($scheduleCode);
        }
<div class="row">
    @foreach ($schedules as $schedule)
        <div class="col-lg-4 py-3">
                data-schedule-code="{{ $schedule->name }}"
                        <h5 class="card-title">{{ lang('admin::lang.text_'.$schedule->name).' '.lang('admin::lang.locations.text_schedule') }}</h5>
    <div class="btn btn-light text-left p-3 component{{ $component->fatalError ? ' border-danger' : '' }}">

Fixed code:
use Admin\Models\Locations_model;
use Igniter\Flame\Location\OrderTypes;
        $formTitle = sprintf(lang($this->formTitle), lang($scheduleItem->name));
        $schedules = collect(OrderTypes::instance()->listOrderTypes())
            ->prepend(['name' => 'admin::lang.text_opening'], Locations_model::OPENING)
            ->mapWithKeys(function ($definition, $code) {
                $scheduleItem = $this->model->createScheduleItem($code);
                $scheduleItem->name = array_get($definition, 'name');

                return [$code => $scheduleItem];
            })
            ->all();
<div class="d-flex flex-nowrap overflow-auto">
    @foreach ($schedules as $scheduleCode => $schedule)
        <div class="col-lg-3 {{ $loop->first ? 'py-2 pr-2 pl-0' : 'p-2' }}">
                data-schedule-code="{{ $scheduleCode }}"
                        <h5 class="card-title">{{ lang($schedule->name).' '.lang('admin::lang.locations.text_schedule') }}</h5>
    <div class="btn btn-light text-left p-3 w-100 component{{ $component->fatalError ? ' border-danger' : '' }}">
        'invisible' => TRUE,
CVE-2015-8011 (C, published 2020-01-28T19:15Z)
Description: value: Buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.
Severity: MEDIUM (CVSS v3 base score: 9.8)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/vincentbernat/lldpd
Files changed:
src/daemon/protocols/lldp.c
Commit message: lldp: fix a buffer overflow when handling management address TLV

When a remote device was advertising a too large management address
while still respecting TLV boundaries, lldpd would crash due to a buffer
overflow. However, the buffer being a static one, this buffer overflow
is not exploitable if hardening was not disabled. This bug exists since
version 0.5.6.


Vulnerable code:
			
			CHECK_TLV_SIZE(4, "Organisational");

Fixed code:
			if (addr_str_length > sizeof(addr_str_buffer)) {
				log_warnx("lldp", "too large management address on %s",
				    hardware->h_ifname);
				goto malformed;
			}

			CHECK_TLV_SIZE(1 + (int)sizeof(orgid), "Organisational");
CVE-2015-8012 (C, published 2020-01-28T19:15Z)
Description: value: lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/vincentbernat/lldpd
Files changed:
src/daemon/lldpd.c
src/daemon/protocols/cdp.c
src/daemon/protocols/edp.c
src/daemon/protocols/lldp.c
src/daemon/protocols/sonmp.c
Commit message: protocols: don't use assert on paths that can be reached

Malformed packets should not make lldpd crash. Ensure we can handle them
by not using assert() in this part.


Vulnerable code:
	assert(addrsize <= LLDPD_MGMT_MAXADDRSIZE);
#include <assert.h>
							assert(errno == ENOMEM);
							log_warn("cdp", "unable to allocate memory for management address");
#include <assert.h>
#include <assert.h>
		assert(proto != LLDP_MGMT_ADDR_NONE);
				assert(errno == ENOMEM);
				log_warn("lldp", "unable to allocate memory "
				    "for management address");
#include <assert.h>
		assert(errno == ENOMEM);
		log_warn("sonmp", "unable to allocate memory for management address");

Fixed code:
							if (errno == ENOMEM)
								log_warn("cdp",
								    "unable to allocate memory for management address");
							else
								log_warn("cdp",
								    "too large management address received on %s",
								    hardware->h_ifname);
		if (proto == LLDP_MGMT_ADDR_NONE) continue;
				if (errno == ENOMEM)
					log_warn("lldp", "unable to allocate memory "
					    "for management address");
				else
					log_warn("lldp", "too large management address "
					    "received on %s", hardware->h_ifname);
		if (errno == ENOMEM)
			log_warn("sonmp", "unable to allocate memory for management address");
		else
			log_warn("sonmp", "too large management address received on %s",
			    hardware->h_ifname);
CVE-2018-25052 (Perl, published 2022-12-28T12:15Z)
Description: value: A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function _load_sessionid of the file lib/Catalyst/Plugin/Session.pm of the component Session ID Handler. The manipulation of the argument sid leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.41 is able to address this issue. The name of the patch is 88d1b599e1163761c9bd53bec53ba078f13e09d4. It is recommended to upgrade the affected component. VDB-216958 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/perl-catalyst/Catalyst-Plugin-Session
Files changed:
lib/Catalyst/Plugin/Session.pm
Commit message: Session: encode HTML entities in error

Without this, it's possible to self-XSS by trying to set a session id to
something like `</script><svg/onload='alert("xss")'>`.


Vulnerable code:

Fixed code:
use HTML::Entities      ();
            $sid = HTML::Entities::encode_entities($sid);
CVE-2011-3371 (PHP, published 2011-10-02T20:55Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7) form_sent, (8) csrf_token, (9) req_message, or (10) submit parameter to edit.php, the (11) action, (12) form_sent, (13) csrf_token, (14) req_email, or (15) request_pass parameter to login.php, the (16) email, (17) form_sent, (18) redirect_url, (19) csrf_token, (20) req_subject, (21) req_message, or (22) submit parameter to misc.php, the (23) action, (24) id, (25) form_sent, (26) csrf_token, (27) req_old_password, (28) req_new_password1, (29) req_new_password2, or (30) update parameter to profile.php, or the (31) action, (32) form_sent, (33) csrf_token, (34) req_username, (35) req_password1, (36) req_password2, (37) req_email1, (38) timezone, or (39) register parameter to register.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/punbb/punbb
Files changed:
include/functions.php
Commit message: Fix XSS vulnerabilities described on http://seclists.org/fulldisclosure/2011/Sep/158


Vulnerable code:
 * @copyright (C) 2008-2009 PunBB, partially based on code (C) 2008-2009 FluxBB.org
		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo $forum_page['form_action'] ?>">

Fixed code:
 * @copyright (C) 2008-2011 PunBB, partially based on code (C) 2008-2009 FluxBB.org
		<form class="frm-form" method="post" accept-charset="utf-8" action="<?php echo forum_htmlencode($forum_page['form_action']) ?>">
CVE-2019-15532 (Other, published 2019-08-26T12:15Z)
Description: value: CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gchq/CyberChef
Files changed:
src/core/operations/TextEncodingBruteForce.mjs
Commit message: Fixed XSS in 'Text Encoding Brute Force. Closes #539


Vulnerable code:
            const value = Utils.printable(encodings[enc], true);

Fixed code:
            const value = Utils.escapeHtml(Utils.printable(encodings[enc], true));
CVE-2024-28110 (Unknown, published 2024-03-06T22:15Z)
Description: value: Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/cloudevents/sdk-go
Files changed:
Commit message: Merge pull request from GHSA-5pf6-2qwx-pxm2

Avoid modifying the DefaultClient's Transport

Vulnerable code:

Fixed code:
CVE-2010-10003 (PHP, published 2023-01-04T10:15Z)
Description: value: A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugin_content_title.php. The manipulation of the argument phrase leads to sql injection. The patch is named b4604e523853965fa981a4e79aef4b554a535db0. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217351.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/gesellix/titlelink
Files changed:
j_1_5_x/plugin/changelog.php
j_1_5_x/plugin/titlelink.php
j_1_5_x/plugin/titlelink.xml
j_1_5_x/plugin/titlelink_plugins/plugin_content_title.php
Commit message: [#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php


git-svn-id: http://joomlacode.org/svn/titlelink@27 de31ee7e-3f2c-0410-b67e-83f64df8b4ac


Vulnerable code:
      $result = call_user_func($plugins[$i], $database, $phrase, $partial_match);
	<copyright>(C) 2005-2009 Tobias Gesellchen. All rights reserved.</copyright>
	<version>3.2.0 2009-06-06 stable</version>
  $where_variant = " AND a.alias " . (($partial_match) ? " LIKE '%$phrase%'" : "= '$phrase'");
    $where_variant = " AND a.title " . (($partial_match) ? " LIKE '%$phrase%'" : "= '$phrase'");

Fixed code:
2010-08-08:

- [#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php


    $phrase_escaped = $database->getEscaped($phrase, true);

      $result = call_user_func($plugins[$i], $database, $phrase_escaped, $partial_match);
	<copyright>(C) 2005-2010 Tobias Gesellchen. All rights reserved.</copyright>
	<version>3.2.1 2010-08-08 stable</version>
  $where_variant = " AND a.alias " .
  				(($partial_match)
  					? " LIKE ".$database->quote('%'.$phrase.'%', false)
    				: "= ".$database->quote($phrase, false));
    $where_variant = " AND a.title " .
  				(($partial_match)
  					? " LIKE ".$database->quote('%'.$phrase.'%', false)
  					: "= ".$database->quote($phrase, false));
CVE-2021-29136 (Go, published 2021-04-06T16:15Z)
Description: value: Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/opencontainers/umoci
Files changed:
oci/layer/tar_extract.go
Commit message: layer: don't permit / type to be changed on extraction

If users can change the type of / to a symlink, they can cause umoci to
overwrite host files. This is obviously bad, and is not caught by the
rest of our directory escape detection code because the root itself has
been changed to a different directory.

Fixes: CVE-2021-29136
Reported-by: Robin Peraglie <robin@cure53.de>
Tested-by: Daniel Dao <dqminh89@gmail.com>
Reviewed-by: Tycho Andersen <tycho@tycho.pizza>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>


Vulnerable code:

Fixed code:
		// If we're being asked to change the root type, bail because they may
		// change it to a symlink which we could inadvertently follow.
		if hdr.Typeflag != tar.TypeDir {
			return errors.New("malicious tar entry -- refusing to change type of root directory")
		}
CVE-2021-41256 (Java, published 2021-11-30T21:15Z)
Description: value: nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.
Severity: MEDIUM (CVSS v3 base score: 7.1)
Weakness: CWE-829 \u2014 Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Repository: https://github.com/nextcloud/news-android
Files changed:
News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java
News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java
Commit message: fix GHSL-2021-1033

Signed-off-by: David Luhmer <david-dev@live.de>


Vulnerable code:
        String oldListLayout = data.getStringExtra(SettingsActivity.SP_FEED_LIST_LAYOUT);
        String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT,"0");
import static de.luhmer.owncloudnewsreader.LoginDialogActivity.RESULT_LOGIN;

    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout";
        Intent intent = getIntent();
        intent.putExtra(
                SettingsActivity.SP_FEED_LIST_LAYOUT,
                mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0")
        );
        setResult(RESULT_OK,intent);

Fixed code:
        String oldListLayout = data.getStringExtra(SettingsActivity.AI_FEED_LIST_LAYOUT);
		String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout"; // used for shared prefs
    public static final String AI_FEED_LIST_LAYOUT = "ai_feed_list_layout"; // used for intents

        // Fix GHSL-2021-1033
        Intent intent = new Intent();
        String feedListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
        intent.putExtra(SettingsActivity.AI_FEED_LIST_LAYOUT, feedListLayout);
        setResult(RESULT_OK, intent);
CVE-2011-4966 (C, published 2013-03-12T23:55Z)
Description: value: modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-255 \u2014 Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Repository: https://github.com/alandekok/freeradius-server
Files changed:
src/modules/rlm_unix/rlm_unix.c
Commit message: heck for account and password expiration


Vulnerable code:
		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);

Fixed code:
	if (spwd && spwd->sp_lstchg > 0 && spwd->sp_max >= 0 &&
	    (request->timestamp / 86400) > (spwd->sp_lstchg + spwd->sp_max)) {
		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
		return RLM_MODULE_REJECT;
	}
	/*
	 *      Check if account has expired.
	 */
		radlog_request(L_AUTH, 0, request, "[%s]: account has expired", name);
CVE-2020-7693 (Unknown, published 2020-07-09T14:15Z)
Description: value: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/sockjs/sockjs-node
Files changed:
Commit message: Merge pull request #266 from cakoose/backport-writeHead-fix

writeHead: Don't end() response

Vulnerable code:

Fixed code:
CVE-2016-20014 (C, published 2022-04-21T04:15Z)
Description: value: In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/kravietz/pam_tacplus
Files changed:
pam_tacplus.c
Commit message: zero the arep structure (Coverity #115822)


Vulnerable code:

Fixed code:
    memset(&arep, 0, sizeof(arep));
CVE-2020-13881 (C, published 2020-06-06T19:15Z)
Description: value: In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
Repository: https://github.com/kravietz/pam_tacplus
Files changed:
support.c
Commit message: pam: don't leak TACACS+ secret to journald

If journald for syslog is used, the journal is going to store everything,
even DEBUG loglevel messages. Pre-journald logging of system-wide DEBUG
loglevel could be avoided and is not affected in all cases.

With journald presence it's probably safe to no longer log sensitive
details at DEBUG level.

Fix #149

Signed-off-by: Daniel Gollub <dgollub@att.com>


Vulnerable code:
            _pam_log(LOG_DEBUG, "server[%lu] { addr=%s, key='%s' }", n, tac_ntop(tac_srv[n].addr->ai_addr),
                     tac_srv[n].key);

Fixed code:
            _pam_log(LOG_DEBUG, "server[%lu] { addr=%s, key='********' }", n,
			    tac_ntop(tac_srv[n].addr->ai_addr));
CVE-2019-10792 (JavaScript, published 2020-02-18T16:15Z)
Description: value: bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Severity: MEDIUM (CVSS v3 base score: 6.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/diegohaz/bodymen
Files changed:
.travis.yml
src/index.js
test/index.js
Commit message: Fix prototype pollution vulnerability (#23)

* Fix prototype pollution vulnerability

* Update .travis.yml


Vulnerable code:
  - v5
  - v4

Fixed code:
  if (
    type === 'constructor' ||
    type === '__proto__' ||
    name === 'constructor' ||
    name === '__proto__'
  ) {
    return
  }

test('Prototype pollution', (t) => {
  const { toString } = {}

  bodymen.handler('__proto__', 'toString', 'JHU')
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  bodymen.handler('formatters', '__proto__', { toString: 'JHU' })
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  bodymen.handler('validators', '__proto__', { toString: 'JHU' })
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  t.end()
})
CVE-2022-0501 (PHP, published 2022-02-05T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ptrofimov/beanstalk_console
Files changed:
lib/include.php
Commit message: Sanitize input

Vulnerable code:
$GLOBALS['server'] = !empty($_GET['server']) ? $_GET['server'] : '';

Fixed code:
$GLOBALS['server'] = !empty($_GET['server']) ? htmlspecialchars($_GET['server']) : '';