hitoshura25/cvefixes huggingface dataset:
CVE-2023-1212 (PHP, published 2023-03-07T00:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/dashboard/index.php
functions/classes/class.Common.php
misc/CHANGELOG
Commit message: Bugfix: XSS (stored) in user widget settings

Reported by Peng Zhou @zpbrent


Vulnerable code:
	//get fetails
	$wdet = (array) $widgets[$uv];

			$wdet = (array) $widgets[$c];
				print "	<div class='col-xs-12 col-sm-12 col-md-12 col-lg-$wdet[wsize] widget-dash' id='w-$wdet[wfile]'>";
				if($wdet['whref']=="yes")	{ print "<a href='".create_link("widgets",$wdet['wfile'])."'> <h4>"._($wdet['wtitle'])."<i class='fa fa-external-link fa-gray pull-right'></i></h4></a>"; }
				else						{ print "<h4>"._($wdet['wtitle'])."</h4>"; }
				print "	<div class='col-xs-12 col-sm-12 col-md-12 col-lg-6' id='w-$c'>";
				print "		<blockquote style='margin-top:20px;margin-left:20px;'><p>Invalid widget $c</p></blockquote>";
			$banned_elements = ['script', 'iframe', 'embed'];

Fixed code:
	//get details
	$wdet = isset($widgets[$uv]) ? (array) $widgets[$uv] : ['wsize' => 6];
				$wdet = (array) $widgets[$c];

				print "	<div class='col-xs-12 col-sm-12 col-md-12 col-lg-".escape_input($wdet['wsize'])." widget-dash' id='w-".escape_input($wdet['wfile'])."'>";
				if($wdet['whref']=="yes")	{ print "<a href='".create_link("widgets",$wdet['wfile'])."'> <h4>"._(escape_input($wdet['wtitle']))."<i class='fa fa-external-link fa-gray pull-right'></i></h4></a>"; }
				else						{ print "<h4>"._(escape_input($wdet['wtitle']))."</h4>"; }
				print "	<div class='col-xs-12 col-sm-12 col-md-12 col-lg-6' id='w-".escape_input($c)."'>";
				print "		<blockquote style='margin-top:20px;margin-left:20px;'><p>Invalid widget ".escape_input($c)."</p></blockquote>";
			$banned_elements = ['script', 'iframe', 'embed', 'object'];
    + XSS (stored) in user widget settings;
CVE-2021-23592 (PHP, published 2022-05-06T20:15Z)
Description: value: The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/top-think/framework
Files changed:
src/think/cache/Driver.php
Commit message: 改进缓存驱动unserialize方法参数类型限制


Vulnerable code:
    protected function unserialize(string $data)

Fixed code:
    protected function unserialize($data)
CVE-2015-10018 (PHP, published 2023-01-06T13:15Z)
Description: value: A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function actionUpload/actionDownloadFile of the file controllers/D2filesController.php. The manipulation leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The identifier of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/DBRisinajumi/d2files
Files changed:
controllers/D2filesController.php
Commit message: SQL injection problem


Vulnerable code:
        if (!$this->performReadValidation($model_name, $model_id)) {
                            'model_id' => $model_id,
                            'model_id' => $id,

Fixed code:
        if (!$this->performReadValidation($model_name, (int)$model_id)) {
                            'model_id' => (int)$model_id,
                            'model_id' => (int)$id,
CVE-2014-125067 (Other, published 2023-01-08T10:15Z)
Description: value: A vulnerability classified as critical was found in corincerami curiosity. Affected by this vulnerability is an unknown functionality of the file app/controllers/image_controller.rb. The manipulation of the argument sol leads to sql injection. The patch is named d64fddd74ca72714e73f4efe24259ca05c8190eb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217639.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/corincerami/curiosity
Files changed:
.gitignore
app/controllers/image_controller.rb
app/views/image/show.html.erb
Commit message: Sanitized form input to protect against SQL injection.


Vulnerable code:
    @images = Image.where(sol: params[:sol])
    # find the martial solar date of the most recent image taken
    # @most_recent = Image.all.sort_by { |hash| -hash[:sol].to_i }.first[:sol]
      These photos were captured by Curiosity on sol <%= params[:sol] %> of its mission on Mars. They come from its eight cameras: the front hazard avoidance camera (FHAZ), read hazard avoidance camera (RHAZ), left and right navigation cameras (NAVCAM), chemistry camera (CHEMCAM), Mars descent imager (MARDI), Mars hand lens imager (MAHLI), and mast camera (Mastcam).

Fixed code:
images.rb
    @images = Image.where(:sol => params[:sol])
    # find the martian solar date of the most recent image taken
      These photos were captured by Curiosity on sol <%=h params[:sol] %> of its mission on Mars. They come from its eight cameras: the front hazard avoidance camera (FHAZ), read hazard avoidance camera (RHAZ), left and right navigation cameras (NAVCAM), chemistry camera (CHEMCAM), Mars descent imager (MARDI), Mars hand lens imager (MAHLI), and mast camera (Mastcam).
CVE-2021-23326 (Markdown, published 2021-01-20T13:15Z)
Description: value: This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ardatan/graphql-tools
Files changed:
.changeset/green-cycles-drive.md
packages/loaders/git/src/load-git.ts
Commit message: Fix vulnerability in git-loader: use execFile instead of exec (#2470)



Vulnerable code:
import { exec, execSync } from 'child_process';
const createCommand = ({ ref, path }: Input) => {
  return `git show ${ref}:${path}`;
      exec(createCommand(input), { encoding: 'utf-8', maxBuffer: 1024 * 1024 * 1024 }, (error, stdout) => {
    return execSync(createCommand(input), { encoding: 'utf-8' });

Fixed code:
---
'@graphql-tools/git-loader': patch
---

Fix vulnerability: use execFile instead of exec
import { execFile, execFileSync } from 'child_process';
const createCommand = ({ ref, path }: Input): string[] => {
  return ['show', `${ref}:${path}`];
      execFile('git', createCommand(input), { encoding: 'utf-8', maxBuffer: 1024 * 1024 * 1024 }, (error, stdout) => {
    return execFileSync('git', createCommand(input), { encoding: 'utf-8' });
CVE-2021-23566 (JavaScript, published 2022-01-14T20:15Z)
Description: value: The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/ai/nanoid
Files changed:
index.js
test/index.test.js
Commit message: fix collision by proxy number (#328)



Vulnerable code:
  fillPool(bytes)
  fillPool(size)

Fixed code:
  // `-=` convert `bytes` to number to prevent `valueOf` abusing
  fillPool((bytes -= 0))
  // `-=` convert `size` to number to prevent `valueOf` abusing
  fillPool((size -= 0))

    if (type === 'node') {
      describe('proxy number', () => {
        it('prevent collision', () => {
          let makeProxyNumberToReproducePreviousID = () => {
            let step = 0
            return {
              valueOf() {
                // "if (!pool || pool.length < bytes) {"
                if (step === 0) {
                  step++
                  return 0
                }
                // "} else if (poolOffset + bytes > pool.length) {"
                if (step === 1) {
                  step++
                  return -Infinity
                }
                // "poolOffset += bytes"
                if (step === 2) {
                  step++
                  return 0
                }

                return 21
              }
            }
          }

          let ID1 = nanoid()
          let ID2 = nanoid(makeProxyNumberToReproducePreviousID())

          expect(ID1).not.toBe(ID2)
        })
      })
    }
CVE-2021-21236 (Unknown, published 2021-01-06T17:15Z)
Description: value: CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/Kozea/CairoSVG
Files changed:
Commit message: Merge pull request from GHSA-hq37-853p-g5cf

Don’t use overlapping groups for regular expressions

Vulnerable code:

Fixed code:
CVE-2023-27586 (Python, published 2023-03-20T16:15Z)
Description: value: CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/Kozea/CairoSVG
Files changed:
cairosvg/__main__.py
cairosvg/parser.py
cairosvg/surface.py
Commit message: Don’t allow fetching external files unless explicitly asked for


Vulnerable code:
        help='resolve XML entities and allow very large files '
             '(WARNING: vulnerable to XXE attacks and various DoS)')
        :param unsafe: A boolean allowing XML entities and very large files

Fixed code:
        help='fetch external files, resolve XML entities and allow very large '
             'files (WARNING: vulnerable to XXE attacks and various DoS)')

        # Don’t allow fetching external files unless explicitly asked for
        if 'url_fetcher' not in kwargs and not unsafe:
            self.url_fetcher = (
                lambda *args, **kwargs: b'<svg width="1" height="1"></svg>')

        :param unsafe: A boolean allowing external file access, XML entities
                       and very large files
CVE-2023-27586 (Other, published 2023-03-20T16:15Z)
Description: value: CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default.
Severity: nan (CVSS v3 base score: 7.1)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/Kozea/CairoSVG
Files changed:
NEWS.rst
cairosvg/VERSION
Commit message: Version 2.7.0


Vulnerable code:
2.6.0

Fixed code:
Version 2.7.0 released on 2023-03-20
====================================

**WARNING:** this is a security update.

When processing SVG files, CairoSVG could access other files online, possibly
leading to very long renderings or other security problems.

This feature is now disabled by default. External resources can still be
accessed using the "unsafe" or the "url_fetcher" parameter.


2.7.0
CVE-2017-18190 (C, published 2018-02-16T17:29Z)
Description: value: A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-290 \u2014 Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Repository: https://github.com/apple/cups
Files changed:
scheduler/client.c
Commit message: Don't treat "localhost.localdomain" as an allowed replacement for localhost, since it isn't.


Vulnerable code:
#ifdef __linux
	    !_cups_strcasecmp(con->clientname, "localhost.localdomain") ||
#endif /* __linux */

Fixed code:
CVE-2017-18248 (C, published 2018-03-26T17:29Z)
Description: value: The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/apple/cups
Files changed:
CHANGES.md
scheduler/ipp.c
Commit message: DBUS notifications could crash the scheduler (Issue #5143)

- scheduler/ipp.c: Make sure requesting-user-name string is valid UTF-8.


Vulnerable code:
CHANGES - 2.2.6 - 2017-10-19
- Fixed TLS cipher suite selection with GNU TLS (Issue #5145)
  attr = ippFindAttribute(job->attrs, "requesting-user-name", IPP_TAG_NAME);


Fixed code:
CHANGES - 2.2.6 - 2017-10-23
- DBUS notifications could crash the scheduler (Issue #5143)
- Fixed TLS cipher suite selection with GNU TLS (Issue #5145, Issue #5150)
  attr = ippFindAttribute(con->request, "requesting-user-name", IPP_TAG_NAME);

  if (attr && !ippValidateAttribute(attr))
  {
    send_ipp_status(con, IPP_ATTRIBUTES, _("Bad requesting-user-name value: %s"), cupsLastErrorString());
    if ((attr = ippCopyAttribute(con->response, attr, 0)) != NULL)
      attr->group_tag = IPP_TAG_UNSUPPORTED_GROUP;
    return (NULL);
  }
CVE-2022-4605 (PHP, published 2022-12-18T14:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
admin/panels/uploader/admin.uploader.php
Commit message: added SVG to forbidden file types in order to prevent possible XSS - see https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24588/CVE-2022-24588.pdf


Vulnerable code:
			'wml'

Fixed code:
			'wml',
			'svg'
CVE-2022-4606 (Unknown, published 2022-12-18T13:15Z)
Description: value: PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-98 \u2014 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
Commit message: Merge branch 'master' of https://github.com/flatpressblog/flatpress into issue94_smartyupdate

# resolved conflicts:
#	fp-includes/smarty/plugins/function.html_select_date.php


Vulnerable code:

Fixed code:
CVE-2022-4748 (PHP, published 2022-12-27T09:15Z)
Description: value: A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit message: fixes #179, preventing path traversal


Vulnerable code:

Fixed code:
			// prevent path traversal: remove ".." and "/" resp. "\"
			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
CVE-2022-4755 (PHP, published 2022-12-27T10:15Z)
Description: value: A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit message: fixes #177, possible XSS in Media Manager plugin


Vulnerable code:
			$newgallery = $_POST ['mm-newgallery-name'];

Fixed code:
			$newgallery = strip_tags($_POST ['mm-newgallery-name']);
CVE-2022-4820 (PHP, published 2022-12-28T21:15Z)
Description: value: A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 229752b51025e678370298284d42f8ebb231f67f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216999.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
admin/panels/entry/admin.entry.list.php
admin/panels/entry/admin.entry.list.tpl
Commit message: fixes #180, possible XSS in entry list


Vulnerable code:
		if (!empty($_REQUEST ['entry']))
<form method="get" action="{$smarty.server.PHP_SELF}?p=entry">

Fixed code:
		$this->smarty->assign('formtarget', strip_tags($_SERVER ['PHP_SELF']));
		if (!empty($_REQUEST ['entry'])) {
		}
<form method="get" action="{$formtarget}?p=entry">
CVE-2022-4821 (PHP, published 2022-12-28T21:15Z)
Description: value: A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
admin/panels/uploader/admin.uploader.php
Commit message: fixes #178, possible XSS via uploaded XML & MD files


Vulnerable code:
			'svg'

Fixed code:
			'svg',
			'xml',
			'md'