hitoshura25/cvefixes huggingface dataset:
CVE-2022-0539 (PHP, published 2022-02-09T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ptrofimov/beanstalk_console
Files changed:
lib/tpl/main.php
lib/tpl/serversList.php
Commit message: applying htmlspecialchars for sanitization output
Fix issue XSS
Disclosure : https://huntr.dev/bounties/5f41b182-dda2-4c6f-9668-2a9afaed53af/


Vulnerable code:
                                            <li><a href="./?server=<?php echo $serverItem ?>"><?php echo empty($key) || is_numeric($key) ? $serverItem : $key ?></a></li>
                                            <li><a href="./?server=<?php echo $serverItem ?>"><?php echo empty($key) || is_numeric($key) ? $serverItem : $key ?></a></li>
                                <td style="white-space: nowrap;"><?php echo $label ?></td>
                                <td  style="white-space: nowrap;"><a href="./?server=<?php echo $server ?>"><?php echo $label; ?></a></td>
                                    <a class="btn btn-xs btn-danger" title="Remove from list" href="./?action=serversRemove&removeServer=<?php echo $server ?>"><span

Fixed code:
                                            <li><a href="./?server=<?php echo htmlspecialchars($serverItem) ?>"><?php echo empty($key) || is_numeric($key) ? htmlspecialchars($serverItem) : $key ?></a></li>
                                            <li><a href="./?server=<?php echo htmlspecialchars($serverItem) ?>"><?php echo empty($key) || is_numeric($key) ? htmlspecialchars($serverItem) : $key ?></a></li>
                                <td style="white-space: nowrap;"><?php echo htmlspecialchars($label) ?></td>
                                <td  style="white-space: nowrap;"><a href="./?server=<?php echo htmlspecialchars($server) ?>"><?php echo htmlspecialchars($label); ?></a></td>
                                    <a class="btn btn-xs btn-danger" title="Remove from list" href="./?action=serversRemove&removeServer=<?php echo htmlspecialchars($server) ?>"><span
CVE-2023-26494 (JavaScript, published 2023-04-24T17:15Z)
Description: value: lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.


Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/TheThingsNetwork/lorawan-stack
Files changed:
CHANGELOG.md
pkg/webui/account/views/login/index.js
Commit message: account: Prevent open redirects after login


Vulnerable code:

Fixed code:
- Fix open redirect vulnerability for Console/Account App logins.

  // Only allow relative redirects to prevent open redirects.
  if (!next.startsWith('/') || next.startsWith('//')) {
    return appRoot
  }
CVE-2020-15900 (C, published 2020-07-28T16:15Z)
Description: value: A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-191 \u2014 Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Repository: https://github.com/ArtifexSoftware/ghostpdl
Files changed:
psi/zstring.c
Commit message: Bug 702582, CVE 2020-15900 Memory Corruption in Ghostscript 9.52

Fix the 'rsearch' calculation for the 'post' size to give the correct
size.  Previous calculation would result in a size that was too large,
and could underflow to max uint32_t. Also fix 'rsearch' to return the
correct 'pre' string with empty string match.

A future change may 'undefine' this undocumented, non-standard operator
during initialization as we do with the many other non-standard internal
PostScript operators and procedures.


Vulnerable code:
    op->value.bytes = ptr;
    r_set_size(op, size);
    op[-1] = *op1;
    r_set_size(op - 1, ptr - op[-1].value.bytes);
    op1->value.bytes = ptr + size;
    r_set_size(op1, count + (!forward ? (size - 1) : 0));

Fixed code:
    op->value.bytes = ptr;				/* match */
    op->tas.rsize = size;				/* match */
    op[-1] = *op1;					/* pre */
    op[-3].value.bytes = ptr + size;			/* post */
    if (forward) {
        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
        op[-3].tas.rsize = count;			/* post */
    } else {
        op[-1].tas.rsize = count;			/* pre */
        op[-3].tas.rsize -= count + size;		/* post */
    }
CVE-2020-15900 (C, published 2020-07-28T16:15Z)
Description: value: A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ArtifexSoftware/ghostpdl
Files changed:
psi/zstring.c
Commit message: Bug 702582, CVE 2020-15900 Memory Corruption in Ghostscript 9.52

Fix the 'rsearch' calculation for the 'post' size to give the correct
size.  Previous calculation would result in a size that was too large,
and could underflow to max uint32_t. Also fix 'rsearch' to return the
correct 'pre' string with empty string match.

A future change may 'undefine' this undocumented, non-standard operator
during initialization as we do with the many other non-standard internal
PostScript operators and procedures.


Vulnerable code:
    op->value.bytes = ptr;
    r_set_size(op, size);
    op[-1] = *op1;
    r_set_size(op - 1, ptr - op[-1].value.bytes);
    op1->value.bytes = ptr + size;
    r_set_size(op1, count + (!forward ? (size - 1) : 0));

Fixed code:
    op->value.bytes = ptr;				/* match */
    op->tas.rsize = size;				/* match */
    op[-1] = *op1;					/* pre */
    op[-3].value.bytes = ptr + size;			/* post */
    if (forward) {
        op[-1].tas.rsize = ptr - op[-1].value.bytes;	/* pre */
        op[-3].tas.rsize = count;			/* post */
    } else {
        op[-1].tas.rsize = count;			/* pre */
        op[-3].tas.rsize -= count + size;		/* post */
    }
CVE-2015-8813 (C#, published 2017-03-03T16:59Z)
Description: value: The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs
Commit message: Fixes U4-7457 Server side request forgery (xsrf) in feedproxy.aspx


Vulnerable code:
                            if (feedProxyXml != null && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null)

Fixed code:
                            if (feedProxyXml != null 
                                && feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null
                                && requestUri.Port == 80)
CVE-2017-15279 (C#, published 2017-10-12T08:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs
src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs
Commit message: Html encode nodenames to prevent XSS attacks. Fixes U4-10497 XSS Vulnerability in page name.


Vulnerable code:
            PageName = doc.Name;
            pane_form.Text = ui.Text("notifications", "editNotifications", node.Text, base.getUser());

Fixed code:
            PageName = Server.HtmlEncode(doc.Name);
            pane_form.Text = ui.Text("notifications", "editNotifications", Server.HtmlEncode(node.Text), base.getUser());
CVE-2017-15280 (C#, published 2017-10-12T08:29Z)
Description: value: XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs
Commit message: U4-10506 Importing a specially crafted document type file can cause XXE attack


Vulnerable code:

			xd.Load(fileName);

Fixed code:
		    xd.XmlResolver = null;
            
		    xd.XmlResolver = null;
            xd.Load(fileName);
CVE-2023-37267 (C#, published 2023-07-13T14:15Z)
Description: value: Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Infrastructure/Runtime/RuntimeState.cs
src/Umbraco.Web.BackOffice/Install/InstallApiController.cs
Commit message: Merge pull request from GHSA-h8wc-r4jh-mg7m

* Don't login after install

* Fail the install if database is not created

---------

Co-authored-by: Zeegaan <nge@umbraco.dk>
Co-authored-by: Nikolaj <nikolajlauridsen@protonmail.ch>

Vulnerable code:
                        Level = RuntimeLevel.Install;
    private readonly IBackOfficeSignInManager _backOfficeSignInManager;
    private readonly IBackOfficeUserManager _backOfficeUserManager;
        _backOfficeUserManager = backOfficeUserManager;
        _backOfficeSignInManager = backOfficeSignInManager;
        RuntimeLevel levelBeforeRestart = _runtime.State.Level;

        if (levelBeforeRestart == RuntimeLevel.Install)
        {
            BackOfficeIdentityUser identityUser = await _backOfficeUserManager.FindByIdAsync(Core.Constants.Security.SuperUserIdAsString);
            _backOfficeSignInManager.SignInAsync(identityUser, false);
        }


Fixed code:
                        Level = RuntimeLevel.BootFailed;
using Microsoft.Extensions.DependencyInjection;
    [Obsolete("Use the constructor without IBackOfficeUserManager & IBackOfficeSignInManager instead, scheduled for removal in v14")]
        : this(databaseBuilder, proflog, logger, installHelper, installSteps, installStatusTracker, runtime)
    {
    }

    [ActivatorUtilitiesConstructor]
    public InstallApiController(
        DatabaseBuilder databaseBuilder,
        IProfilingLogger proflog,
        ILogger<InstallApiController> logger,
        InstallHelper installHelper,
        InstallStepCollection installSteps,
        InstallStatusTracker installStatusTracker,
        IRuntime runtime)
CVE-2023-37267 (C#, published 2023-07-13T14:15Z)
Description: value: Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Infrastructure/Runtime/RuntimeState.cs
src/Umbraco.Web.BackOffice/Install/InstallApiController.cs
Commit message: Merge pull request from GHSA-h8wc-r4jh-mg7m

* Don't login after install

* Fail the install if database is not created

---------

Co-authored-by: Zeegaan <nge@umbraco.dk>
Co-authored-by: Nikolaj <nikolajlauridsen@protonmail.ch>


Vulnerable code:
                        Level = RuntimeLevel.Install;
    private readonly IBackOfficeSignInManager _backOfficeSignInManager;
    private readonly IBackOfficeUserManager _backOfficeUserManager;
        _backOfficeUserManager = backOfficeUserManager;
        _backOfficeSignInManager = backOfficeSignInManager;
        RuntimeLevel levelBeforeRestart = _runtime.State.Level;

        if (levelBeforeRestart == RuntimeLevel.Install)
        {
            BackOfficeIdentityUser? identityUser =
                await _backOfficeUserManager.FindByIdAsync(Core.Constants.Security.SuperUserIdAsString);
            if (identityUser is not null)
            {
                _backOfficeSignInManager.SignInAsync(identityUser, false);
            }
        }


Fixed code:
                        Level = RuntimeLevel.BootFailed;
using Microsoft.Extensions.DependencyInjection;
    [Obsolete("Use the constructor without IBackOfficeUserManager & IBackOfficeSignInManager instead, scheduled for removal in v14")]
        : this(databaseBuilder, proflog, logger, installHelper, installSteps, installStatusTracker, runtime)
    {
    }

    [ActivatorUtilitiesConstructor]
    public InstallApiController(
        DatabaseBuilder databaseBuilder,
        IProfilingLogger proflog,
        ILogger<InstallApiController> logger,
        InstallHelper installHelper,
        InstallStepCollection installSteps,
        InstallStatusTracker installStatusTracker,
        IRuntime runtime)
CVE-2024-28868 (C#, published 2024-03-20T20:15Z)
Description: value: Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs
Commit message: Merge pull request from GHSA-552f-97wf-pmpq

Co-authored-by: jey <jey@umbraco.dk>
(cherry picked from commit b743f6a2df7c4e8bc72d6aaffd2ae1544ed2ad1a)


Vulnerable code:
        // we cannot proceed if the user passed in does not have an identity
        if (user.HasIdentity == false)
        
        

Fixed code:
        // we cannot proceed if the user passed in does not have an identity, or if no password is provided.
        if (user.HasIdentity == false || password is null)
CVE-2024-29035 (XML, published 2024-04-17T15:15Z)
Description: value: Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/umbraco/Umbraco-CMS
Files changed:
src/Umbraco.Core/EmbeddedResources/Lang/da.xml
src/Umbraco.Core/EmbeddedResources/Lang/en_us.xml
src/Umbraco.Web.BackOffice/Mapping/WebhookMapDefinition.cs
Commit message: Merge pull request from GHSA-74p6-39f2-23v3

* Don't display exception if not in debug mode

* Only display not OK status code in production

Vulnerable code:
﻿using Umbraco.Cms.Core.Mapping;
        target.ResponseBody = source.ResponseBody;
        target.StatusCode = source.StatusCode;
        target.ResponseHeaders = source.ResponseHeaders;
        target.ExceptionOccured = source.ExceptionOccured;

Fixed code:
    <key alias="toggleDebug">Skift til debug mode for mere information.</key>
    <key alias="statusNotOk">Ikke OK status kode.</key>
    <key alias="toggleDebug">Toggle debug mode for more information.</key>
    <key alias="statusNotOk">Not OK status code</key>
﻿using Umbraco.Cms.Core.Hosting;
using Umbraco.Cms.Core.Mapping;
using Umbraco.Cms.Core.Services;
    private readonly IHostingEnvironment _hostingEnvironment;
    private readonly ILocalizedTextService _localizedTextService;

    public WebhookMapDefinition(IHostingEnvironment hostingEnvironment, ILocalizedTextService localizedTextService)
    {
        _hostingEnvironment = hostingEnvironment;
        _localizedTextService = localizedTextService;
    }


        if (_hostingEnvironment.IsDebugMode)
        {
            target.ExceptionOccured = source.ExceptionOccured;
            target.ResponseBody = source.ResponseBody;
            target.ResponseHeaders = source.ResponseHeaders;
            target.StatusCode = source.StatusCode;
        }
        else
        {
            target.ResponseBody = _localizedTextService.Localize("webhooks", "toggleDebug", Thread.CurrentThread.CurrentUICulture);
            target.StatusCode = source.StatusCode is "OK (200)" ? source.StatusCode : _localizedTextService.Localize("webhooks", "statusNotOk", Thread.CurrentThread.CurrentUICulture);
        }
CVE-2019-3826 (Other, published 2019-03-26T18:29Z)
Description: value: A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/prometheus/prometheus
Files changed:
CHANGELOG.md
VERSION
Commit message: *: cut 2.7.1 (#5164)

Signed-off-by: Goutham Veeramachaneni <gouthamve@gmail.com>

Vulnerable code:
2.7.0

Fixed code:
## 2.7.1 / 2019-01-31

This release has a fix for a Stored DOM XSS vulnerability that can be triggered when using the query history functionality. Thanks to Dor Tumarkin from Checkmarx for reporting it.

* [BUGFIX/SECURITY] Fix a Stored DOM XSS vulnerability with query history. #5163
* [BUGFIX] `prometheus_rule_group_last_duration_seconds` now reports seconds instead of nanoseconds. #5153
* [BUGFIX] Make sure the targets are consistently sorted in the targets page. #5161

2.7.1
CVE-2017-5473 (C++, published 2017-01-14T07:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ntop/ntopng
Files changed:
src/Lua.cpp
Commit message: Check for presence of crsf in admin scripts


Vulnerable code:

Fixed code:
  bool csrf_found = false;
  
    
      

		csrf_found = true;

  if(strstr(request_info->uri, "/admin/") && (!csrf_found)) {
    const char *msg = "Missing CSRF parameter";
    
    return(send_error(conn, 500 /* Internal server error */, msg, PAGE_ERROR, request_info->uri, msg));
  }
CVE-2017-5473 (Lua, published 2017-01-14T07:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ntop/ntopng
Files changed:
scripts/lua/admin/add_user.lua
scripts/lua/admin/change_user_prefs.lua
scripts/lua/admin/delete_user.lua
scripts/lua/admin/password_reset.lua
Commit message: Added fixes to avoid users to be manipulated with invalid CSRF token


Vulnerable code:

Fixed code:
if(_GET["csrf"] ~= nil) then
end
if(_GET["csrf"] ~= nil) then
end
if(_GET["csrf"] ~= nil) then
end
if(_GET["csrf"] ~= nil) then
end
CVE-2017-7458 (C++, published 2017-06-26T23:29Z)
Description: value: The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should have contained a hostname or IP address.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/ntop/ntopng
Files changed:
src/Lua.cpp
src/NetworkInterface.cpp
Commit message: Security fix: prevents empty host from being used


Vulnerable code:
	 && (_equal = strchr(tok, '='))) {

Fixed code:
	 && (_equal = strchr(tok, '='))
	 && (strlen(_equal) > 1)) {
  if(!host_ip) return(NULL);