hitoshura25/cvefixes huggingface dataset:
CVE-2023-32310 (Java, published 2023-06-01T16:15Z)
Description: value: DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/dataease/dataease
Files changed:
backend/src/main/java/io/dataease/service/panel/ShareService.java
Commit message: feat(仪表板): 删除分享IDOR漏洞


Vulnerable code:
import io.dataease.commons.utils.DeLogUtils;
import io.dataease.ext.ExtPanelShareMapper;
        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup) || StringUtils.isBlank(panelGroup.getName())) {

Fixed code:
import io.dataease.commons.utils.DeLogUtils;
import io.dataease.ext.ExtPanelShareMapper;
        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup)) {
            return;
        }
        if (StringUtils.isBlank(panelGroup.getName())) {
CVE-2023-40183 (Other, published 2023-09-21T15:15Z)
Description: value: DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/dataease/dataease
Files changed:
core/backend/src/main/java/io/dataease/service/staticResource/StaticResourceService.java
core/frontend/src/views/background/BackgroundOverall.vue
core/frontend/src/views/panel/appTemplate/AppTemplateContent.vue
Commit message: fix: 加强图片校验，防止恶意代码通过合成到图片上传到服务器中引起的攻击行为


Vulnerable code:
        if (image == null || image.getWidth() <= 0 || image.getHeight() <= 0) {
              accept=".jpeg,.jpg,.png,.gif,.svg"
              accept=".jpeg,.jpg,.png,.gif,.svg"

Fixed code:
import java.util.regex.Matcher;
import java.util.regex.Pattern;
        Pattern pattern = Pattern.compile("\\.(png|jpg|jpeg|gif)$");
        Matcher matcher = pattern.matcher(file.getOriginalFilename().toLowerCase());
        if (image == null || image.getWidth() <= 0 || image.getHeight() <= 0 || !matcher.find()) {

              accept=".jpeg,.jpg,.png,.gif"
              accept=".jpeg,.jpg,.png,.gif"
CVE-2024-23328 (Java, published 2024-02-29T01:44Z)
Description: value: Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/dataease/dataease
Files changed:
core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java
Commit message: fix: 限制 mysql 非法参数


Vulnerable code:
                if (getExtraParams().toLowerCase().contains(illegalParameter.toLowerCase())) {

Fixed code:
import java.net.URLDecoder;
                if (getExtraParams().toLowerCase().contains(illegalParameter.toLowerCase()) || URLDecoder.decode(getExtraParams()).contains(illegalParameter.toLowerCase())) {
CVE-2024-37304 (C#, published 2024-06-12T15:15Z)
Description: value: NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javascript:alert(1)>`, the link is rendered without proper sanitization. This means that the JavaScript code within the autolink can be executed by the browser, leading to an XSS attack. Version 2024.05.28 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/NuGet/NuGetGallery
Files changed:
src/NuGetGallery/Services/MarkdownService.cs
Commit message: don't support javascript (#9836)



Vulnerable code:

Fixed code:
        private static readonly Regex JavaScriptPattern = new Regex("<a href=([\"\'])javascript:.*?\\1 rel=([\"'])noopener noreferrer nofollow\\1>", RegexOptions.None, RegexTimeout);
                output.Content = JavaScriptPattern.Replace(htmlWriter.ToString(), "").Trim();
CVE-2022-48468 (Unknown, published 2023-04-13T21:15Z)
Description: value: protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/protobuf-c/protobuf-c
Files changed:
Commit message: Merge pull request #513 from protobuf-c/edmonds/issue499

Fix issue #499: unsigned integer overflow

Vulnerable code:

Fixed code:
CVE-2014-125088 (Other, published 2023-02-20T08:15Z)
Description: value: A vulnerability was found in qt-users-jp silk 0.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file contents/root/examples/header.qml. The manipulation of the argument model.key/model.value leads to cross site scripting. The attack can be initiated remotely. The name of the patch is bbc5d6eeea800025ef29edda3fd3c57836239eae. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221488.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/qt-users-jp/silk
Files changed:
contents/root/examples/header.qml
Commit message: fix XSS vector in document body issue in header.qml

Change-Id: Icb0981b2aed71f4b7e7d189eea27d5a69ef228e4
Reviewed-on: http://cr.qtquick.me/874
Tested-by: http://ci.qtquick.me/
Tested-by: R Kake <helicalgear@gmail.com>
Reviewed-by: R Kake <helicalgear@gmail.com>
Tested-by: Tasuku Suzuki <stasuku@gmail.com>
Reviewed-by: Tasuku Suzuki <stasuku@gmail.com>


Vulnerable code:
                    Dt { text: model.key }
                    Dd { text: model.value }

Fixed code:
                    Dt { text: Silk.escapeHTML(model.key) }
                    Dd { text: Silk.escapeHTML(model.value) }
CVE-2022-23612 (Java, published 2022-02-22T23:15Z)
Description: value: OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for `/images` & `/initfilter/scripts`. This can allow an attacker to access any file on a system running OpenMRS that is accessible to the user id OpenMRS is running under. Affected implementations should update to the latest patch version of OpenMRS Core for the minor version they use. These are: 2.1.5, 2.2.1, 2.3.5, 2.4.5 and 2.5.3. As a general rule, this vulnerability is already mitigated by Tomcat's URL normalization in Tomcat 7.0.28+. Users on older versions of Tomcat should consider upgrading their Tomcat instance as well as their OpenMRS instance.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/openmrs/openmrs-core
Files changed:
web/src/main/java/org/openmrs/web/filter/StartupFilter.java
Commit message: Fix bug


Vulnerable code:
				servletPath = servletPath.replaceFirst("/initfilter", "/WEB-INF/view"); // strip out the /initfilter part
				File file = new File(filterConfig.getServletContext().getRealPath(servletPath));
					file = new File(file, httpRequest.getPathInfo());
				InputStream imageFileInputStream = null;
				try {
					imageFileInputStream = new FileInputStream(file);
					log.error("Unable to find file: " + file.getAbsolutePath());
				finally {
					if (imageFileInputStream != null) {
						try {
							imageFileInputStream.close();
						}
						catch (IOException io) {
							log.warn("Couldn't close imageFileInputStream: " + io);
						}
					}
				log.error("velocity init failed, because: " + e);

Fixed code:
import java.nio.file.Path;
import java.nio.file.Paths;
				// strip out the /initfilter part
				servletPath = servletPath.replaceFirst("/initfilter", "/WEB-INF/view");
				Path filePath = Paths.get(filterConfig.getServletContext().getRealPath(servletPath)).normalize();
				Path fullFilePath = filePath;
					fullFilePath = fullFilePath.resolve(httpRequest.getPathInfo());
					if (!(fullFilePath.normalize().startsWith(filePath))) {
						log.warn("Detected attempted directory traversal in request for {}", httpRequest.getPathInfo());
						return;
					}
				try (InputStream imageFileInputStream = new FileInputStream(fullFilePath.normalize().toFile())) {
					log.error("Unable to find file: {}", filePath, e);
				catch (IOException e) {
					log.warn("An error occurred while handling file {}", filePath, e);
				log.error("velocity init failed, because: {}", e, e);
CVE-2017-0881 (Python, published 2017-03-28T02:59Z)
Description: value: An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/zulip/zulip
Files changed:
zerver/tests/test_subs.py
zerver/views/streams.py
Commit message: streams: Fix autosubscribe security bug (CVE-2017-0881).

A bug in Zulip's implementation of the "stream exists" endpoint meant
that any user of a Zulip server could subscribe to an invite-only
stream without needing to be invited by using the "autosubscribe"
argument.

Thanks to Rafid Aslam for discovering this issue.


Vulnerable code:
        if autosubscribe:

Fixed code:
    def test_existing_subscriptions_autosubscription_private_stream(self):
        # type: () -> None
        """Call /json/subscriptions/exist on an existing private stream with
        autosubscribe should fail.
        """
        stream_name = "Saxony"
        result = self.common_subscribe_to_streams("cordelia@zulip.com", [stream_name],
                                                  invite_only=True)
        stream = get_stream(stream_name, self.realm)

        result = self.client_post("/json/subscriptions/exists",
                                  {"stream": stream_name, "autosubscribe": True})
        self.assert_json_success(result)
        json = ujson.loads(result.content)
        self.assertIn("exists", json)
        self.assertTrue(json["exists"])
        self.assertIn("subscribed", json)
        # Importantly, we are not now subscribed
        self.assertFalse(json["subscribed"])
        self.assertEqual(Subscription.objects.filter(
            recipient__type=Recipient.STREAM,
            recipient__type_id=stream.id).count(), 1)

        if not stream.invite_only and autosubscribe:
CVE-2017-0896 (Python, published 2017-06-02T17:29Z)
Description: value: Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/zulip/zulip
Files changed:
zerver/tests/test_signup.py
zerver/views/invite.py
Commit message: invite: Fix invite_by_admins_only to be enforced in backend.

This is CVE-2017-0896.

Apparently, this setting never actually was wired up to anything other
than hiding the UI widget.

Huge thanks to Ibram Marzouk from the HackerOne community for finding
this security bug.


Vulnerable code:

Fixed code:
    def test_require_realm_admin(self):
        # type: () -> None
        """
        The invite_by_admins_only realm setting works properly.
        """
        realm = get_realm('zulip')
        realm.invite_by_admins_only = True
        realm.save()

        self.login("hamlet@zulip.com")
        email = "alice-test@zulip.com"
        email2 = "bob-test@zulip.com"
        invitee = "Alice Test <{}>, {}".format(email, email2)
        self.assert_json_error(self.invite(invitee, ["Denmark"]),
                               "Must be a realm administrator")

        # Now verify an administrator can do it
        self.login("iago@zulip.com")
        self.assert_json_success(self.invite(invitee, ["Denmark"]))
        self.assertTrue(find_key_by_email(email))
        self.assertTrue(find_key_by_email(email2))
        self.check_sent_emails([email, email2])

    if user_profile.realm.invite_by_admins_only and not user_profile.is_realm_admin:
        return json_error(_("Must be a realm administrator"))
CVE-2021-3866 (Other, published 2022-01-20T11:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zulip/zulip
Files changed:
static/templates/recipient_row.hbs
Commit message: CVE-2021-3853: Fix HTML escaping in recipient_row.

Commit 44f935695d452cc3fb16845a0c6af710438b153d (#20462) incorrectly
added these extra braces while intending to add whitespace control.
This triple-brace syntax was asking Handlebars to skip escaping the
string.

Signed-off-by: Anders Kaseorg <anders@zulip.com>


Vulnerable code:
                {{~{display_recipient}~}}

Fixed code:
                {{~display_recipient~}}
CVE-2021-3967 (Python, published 2022-02-26T23:15Z)
Description: value: Improper Access Control in GitHub repository zulip/zulip prior to 4.10.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/zulip/zulip
Files changed:
static/js/settings_account.js
zerver/tests/test_settings.py
zproject/urls.py
Commit message: CVE-2021-3967: Only regenerate the API key by authing with the old key.


Vulnerable code:
                url: "/json/users/me/api_key/regenerate",
    rest_path("users/me/api_key/regenerate", POST=regenerate_api_key),

Fixed code:
            const email = page_params.delivery_email;
            const api_key = $("#api_key_value").text();
            const authorization_header = "Basic " + btoa(`${email}:${api_key}`);

                // This endpoint is only accessible with the previous API key,
                // via our usual HTTP Basic auth mechanism.
                url: "/api/v1/users/me/api_key/regenerate",
                headers: {Authorization: authorization_header},
        # First verify this endpoint is not registered in the /json/... path
        # to prevent access with only a session.
        self.assertEqual(result.status_code, 404)

        # A logged-in session doesn't allow access to an /api/v1/ endpoint
        # of course.
        result = self.client_post("/api/v1/users/me/api_key/regenerate")
        self.assertEqual(result.status_code, 401)

        result = self.api_post(user, "/api/v1/users/me/api_key/regenerate")
    # The endpoint for regenerating and obtaining a new API key
    # should only be available by authenticating with the current
    # API key - as we consider access to the API key sensitive
    # and just having a logged-in session should be insufficient.
    rest_path("users/me/api_key/regenerate", POST=regenerate_api_key),
CVE-2022-24751 (Python, published 2022-03-16T14:15Z)
Description: value: Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in version 4.11 on the 4.x branch and version 5.0-rc1 on the 5.x branch. Upgrading to a fixed version will, as a side effect, deactivate any cached sessions that may have been leaked through this bug. There are currently no known workarounds.
Severity: MEDIUM (CVSS v3 base score: 7.4)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/zulip/zulip
Files changed:
zerver/lib/actions.py
zerver/tests/test_users.py
Commit message: CVE-2022-24751: Clear sessions outside of the transaction.

Clearing the sessions inside the transaction makes Zulip vulnerable to
a narrow window where the deleted session has not yet been committed,
but has been removed from the memcached cache.  During this window, a
request with the session-id which has just been deleted can
successfully re-fill the memcached cache, as the in-database delete is
not yet committed, and thus not yet visible.  After the delete
transaction commits, the cache will be left with a cached session,
which allows further site access until it expires (after
SESSION_COOKIE_AGE seconds), is ejected from the cache due to memory
pressure, or the server is upgraded.

Move the session deletion outside of the transaction.

Because the testsuite runs inside of a transaction, it is impossible
to test this is CI; the testsuite uses the non-caching
`django.contrib.sessions.backends.db` backend, regardless.  The test
added in this commit thus does not fail before this commit; it is
merely a base expression that the session should be deleted somehow,
and does not exercise the assert added in the previous commit.


Vulnerable code:
        delete_user_sessions(user_profile)

Fixed code:
    delete_user_sessions(user_profile)
from django.contrib.sessions.models import Session
    def test_clear_sessions(self) -> None:
        user = self.example_user("hamlet")
        self.login_user(user)
        session_key = self.client.session.session_key
        self.assertTrue(session_key)

        result = self.client_get("/json/users")
        self.assert_json_success(result)
        self.assertEqual(Session.objects.filter(pk=session_key).count(), 1)

        do_deactivate_user(user, acting_user=None)
        self.assertEqual(Session.objects.filter(pk=session_key).count(), 0)

        result = self.client_get("/json/users")
        self.assert_json_error(
            result, "Not logged in: API authentication or user session required", 401
        )