hitoshura25/cvefixes huggingface dataset:
CVE-2022-31168 (Python, published 2022-07-22T13:15Z)
Description: value: Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/zulip/zulip
Files changed:
zerver/tests/test_bots.py
zerver/views/users.py
Commit message: CVE-2022-31168: Fix authorization check for changing bot roles.

Due to an incorrect authorization check in Zulip Server 5.4 and
earlier, a member of an organization could craft an API call that
grants organization administrator privileges to one of their bots.

Signed-off-by: Anders Kaseorg <anders@zulip.com>


Vulnerable code:
        result = self.client_patch(f"/json/bots/{self.get_bot_user(email).id}", req)
        # grant/remove the role in question.  access_user_by_id has
        # already verified we're an administrator; here we enforce
        # that only owners can toggle the is_realm_owner flag.

Fixed code:
from zerver.actions.bots import do_change_bot_owner
        result = self.client_patch(f"/json/users/{user_profile.id}", req)
        self.assert_json_error(result, "Must be an organization owner")

        result = self.client_patch(f"/json/bots/{user_profile.id}", req)
        # Test for not allowing a non-administrator user to assign a bot an administrator role
        shiva = self.example_user("shiva")
        self.assertEqual(shiva.role, UserProfile.ROLE_MODERATOR)
        self.login_user(shiva)
        do_change_bot_owner(user_profile, shiva, acting_user=None)

        req = dict(role=UserProfile.ROLE_REALM_ADMINISTRATOR)

        result = self.client_patch(f"/json/users/{user_profile.id}", req)
        self.assert_json_error(result, "Must be an organization administrator")

        result = self.client_patch(f"/json/bots/{user_profile.id}", req)
        self.assert_json_error(result, "Must be an organization administrator")

    OrganizationAdministratorRequired,
        # grant/remove the role in question.
        elif not user_profile.is_realm_admin:
            raise OrganizationAdministratorRequired()
        elif not user_profile.is_realm_admin:
            raise OrganizationAdministratorRequired()
CVE-2022-31168 (Python, published 2022-07-22T13:15Z)
Description: value: Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and lack permission to create them, can’t exploit the vulnerability. As a workaround for the vulnerability, an organization administrator can restrict the `Who can create bots` permission to administrators only, and change the ownership of existing bots.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/zulip/zulip
Files changed:
zerver/tests/test_bots.py
zerver/views/users.py
Commit message: CVE-2022-31168: Fix authorization check for changing bot roles.

Due to an incorrect authorization check in Zulip Server 5.4 and
earlier, a member of an organization could craft an API call that
grants organization administrator privileges to one of their bots.

Signed-off-by: Anders Kaseorg <anders@zulip.com>


Vulnerable code:
        result = self.client_patch(f"/json/bots/{self.get_bot_user(email).id}", req)
        # grant/remove the role in question.  access_user_by_id has
        # already verified we're an administrator; here we enforce
        # that only owners can toggle the is_realm_owner flag.

Fixed code:
from zerver.actions.bots import do_change_bot_owner
        result = self.client_patch(f"/json/users/{user_profile.id}", req)
        self.assert_json_error(result, "Must be an organization owner")

        result = self.client_patch(f"/json/bots/{user_profile.id}", req)
        # Test for not allowing a non-administrator user to assign a bot an administrator role
        shiva = self.example_user("shiva")
        self.assertEqual(shiva.role, UserProfile.ROLE_MODERATOR)
        self.login_user(shiva)
        do_change_bot_owner(user_profile, shiva, acting_user=None)

        req = dict(role=UserProfile.ROLE_REALM_ADMINISTRATOR)

        result = self.client_patch(f"/json/users/{user_profile.id}", req)
        self.assert_json_error(result, "Must be an organization administrator")

        result = self.client_patch(f"/json/bots/{user_profile.id}", req)
        self.assert_json_error(result, "Must be an organization administrator")

    OrganizationAdministratorRequired,
        # grant/remove the role in question.
        elif not user_profile.is_realm_admin:
            raise OrganizationAdministratorRequired()
        elif not user_profile.is_realm_admin:
            raise OrganizationAdministratorRequired()
CVE-2023-33186 (Other, published 2023-05-30T06:16Z)
Description: value: Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zulip/zulip
Files changed:
web/src/tippyjs.js
web/templates/narrow_tooltip.hbs
web/templates/tooltip_templates.hbs
Commit message: CVE-2023-33186: Fix topic tooltip cross-site scripting vulnerability.

Commit 903dbda79bd176702d3175a7c8a5450a64b6eccb (#25370) introduced a
cross-site scripting vulnerability in the tooltips for the stream and
topic in the recipient bar.  An attacker who can send messages could
maliciously craft a topic for the message, such that a victim who
hovers the tooltip for that topic in their message feed triggers
execution of JavaScript code controlled by the attacker.

Signed-off-by: Anders Kaseorg <anders@zulip.com>


Vulnerable code:
            const content = instance.props.content + $("#narrow-hotkey-tooltip-template").html();
            instance.setContent(parse_html(content));
<template id="narrow-hotkey-tooltip-template">
    {{tooltip_hotkey_hints "S"}}
</template>

Fixed code:
import render_narrow_tooltip from "../templates/narrow_tooltip.hbs";
            instance.setContent(
                parse_html(render_narrow_tooltip({content: instance.props.content})),
            );
{{content}}
{{tooltip_hotkey_hints "S"}}
CVE-2023-33186 (Other, published 2023-05-30T06:16Z)
Description: value: Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful. The main development branch of Zulip Server from May 2, 2023 and later, including beta versions 7.0-beta1 and 7.0-beta2, is vulnerable to a cross-site scripting vulnerability in tooltips on the message feed. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zulip/zulip
Files changed:
web/src/tippyjs.js
web/templates/recipient_row.hbs
web/templates/tooltip_templates.hbs
Commit message: tooltips: Add `S` hotkey hint to `narrow-to` tippy tooltips.

Added hotkey hint to Narrow to stream/topic/DM tooltips by creating
new tippy for `tippy-narrow-tooltip` with LONG_HOVER_DELAY which
appends `S` hotkey to the existing tippy content set by
data-tippy-content attribute on the element.

Using this approach instead of a <template> with
data-tooltip-template-id avoids issues with context, where
{display_recipient}/{topic}/{display_reply_to} inside <template>
would always show the same stream/topic name regardless of the
actual stream/topic being hovered over.


Vulnerable code:
        <a class="message_label_clickable narrows_by_recipient stream_label tippy-zulip-delayed-tooltip"
            <a class="message_label_clickable narrows_by_topic tippy-zulip-delayed-tooltip"
        <a class="message_label_clickable narrows_by_recipient stream_label tippy-zulip-delayed-tooltip"

Fixed code:
    delegate("body", {
        target: ".tippy-narrow-tooltip",
        delay: LONG_HOVER_DELAY,
        appendTo: () => document.body,
        onCreate(instance) {
            const content = instance.props.content + $("#narrow-hotkey-tooltip-template").html();
            instance.setContent(parse_html(content));
        },
    });

        <a class="message_label_clickable narrows_by_recipient stream_label tippy-narrow-tooltip"
            <a class="message_label_clickable narrows_by_topic tippy-narrow-tooltip"
        <a class="message_label_clickable narrows_by_recipient stream_label tippy-narrow-tooltip"
<template id="narrow-hotkey-tooltip-template">
    {{tooltip_hotkey_hints "S"}}
</template>
CVE-2013-10010 (Perl, published 2023-01-11T16:15Z)
Description: value: A vulnerability classified as problematic has been found in zerochplus. This affects the function PrintResList of the file test/mordor/thread.res.pl. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named 9ddf9ecca8565341d8d26a3b2f64540bde4fa273. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218007.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/zerochplus/zerochplus
Files changed:
test/mordor/thread.res.pl
Commit message: パスワード抜きのXSS脆弱性対策

git-svn-id: http://svn.sourceforge.jp/svnroot/zerochplus/zerochplus/trunk@435 567da1b6-7cfc-4bc0-8471-d03287871468


Vulnerable code:

Fixed code:
		foreach (0 .. $#logs) {
			$logs[$_] =~ s/[\x0d\x0a\0]//g;
			$logs[$_] =~ s/&/&amp;/g;
			$logs[$_] =~ s/"/&quot;/g;
			$logs[$_] =~ s/'/&#39;/g;
			$logs[$_] =~ s/</&lt;/g;
			$logs[$_] =~ s/>/&gt;/g;
		}
CVE-2021-29455 (Unknown, published 2021-04-19T19:15Z)
Description: value: Grassroot Platform is an application to make it faster, cheaper and easier to persistently organize and mobilize people in low-income communities. Grassroot Platform before master deployment as of 2021-04-16 did not properly verify the signature of JSON Web Tokens when refreshing an existing JWT. This allows to forge a valid JWT. The problem has been patched in version 1.3.1 by deprecating the JWT refresh function, which was an overdue deprecation regardless (the "refresh" flow is no longer used).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/grassrootza/grassroot-platform
Files changed:
Commit message: Merge pull request #412 from grassrootza/fix/refresh

Removing deprecated refresh function

Vulnerable code:

Fixed code:
CVE-2023-41047 (Unknown, published 2023-10-09T16:15Z)
Description: value: OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-1336 \u2014 Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Repository: https://github.com/OctoPrint/OctoPrint
Files changed:
Commit message: Merge branch 'bug/gcode_script_vuln' into staging/bugfix


Vulnerable code:

Fixed code:
CVE-2024-23637 (Unknown, published 2024-01-31T18:15Z)
Description: value: OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/OctoPrint/OctoPrint
Files changed:
Commit message: Merge branch 'fix/reauthenticate' into maintenance


Vulnerable code:

Fixed code:
CVE-2024-28237 (JavaScript, published 2024-03-18T22:15Z)
Description: value: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute JavaScript code in the victims browser when attempting to render the snapshot image. An attacker who successfully talked a victim with admin rights into performing a snapshot test with such a crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The vulnerability is patched in version 1.10.0rc3. OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation and what settings they modify based on instructions by strangers.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/OctoPrint/OctoPrint
Files changed:
src/octoprint/plugins/classicwebcam/static/js/classicwebcam_settings.js
Commit message: 🔒️ Fix a XSS in the webcam snapshot test

See GHSA-x7mf-wrh9-r76c


Vulnerable code:
                    var content = response.response.content;
                    var contentType = response.response.assumed_content_type;
                    var mimeType = "image/jpeg";
                    if (contentType) {
                        mimeType = contentType.split(";")[0];
                    }

                    var text = gettext(
                        message: $(
                            "<p>" +
                                text +
                                '</p><p><img src="data:' +
                                mimeType +
                                ";base64," +
                                content +
                                '" style="border: 1px solid black" /></p>'
                        ),

Fixed code:
                    const content = response.response.content;
                    const contentType = response.response.assumed_content_type;
                    const text = gettext(
                    const mimeType = contentType
                        ? contentType.split(";")[0]
                        : "image/jpeg";

                    const textElement = $("<p></p>").text(text);
                    const imgElement = $("<img>")
                        .attr("src", "data:" + mimeType + ";base64," + content)
                        .css("border", "1px solid black");
                    const message = $("<p></p>").append(textElement).append(imgElement);

                        message: message,
CVE-2022-24720 (Ruby, published 2022-03-01T23:15Z)
Description: value: image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/janko/image_processing
Files changed:
CHANGELOG.md
lib/image_processing/chainable.rb
test/pipeline_test.rb
Commit message: Prevent remote shell execution in `#apply`

If the operations are coming from user input, this could allow the user
to execute arbitrary shell commands via `Kernel#system` and
`Kernel#spawn`:

  ImageProcessing::Vips.apply({ system: "echo something" })

We prevent this by using `#public_send` instead of `#send`, which goes
to method missing instead of calling private methods, which include
`Kernel#system` and `Kernel#spawn`.


Vulnerable code:
          builder.send(name)
          builder.send(name, *argument)
          builder.send(name, **argument)
          builder.send(name, argument)

Fixed code:
## HEAD

* Prevent remote shell execution when using `#apply` with operations coming from user input (@janko)

          builder.public_send(name)
          builder.public_send(name, *argument)
          builder.public_send(name, **argument)
          builder.public_send(name, argument)

  it "doesn't allow making system calls" do
    ImageProcessing::Vips.source(@portrait).apply(system: "touch foo.txt")
    refute File.exist?("foo.txt")

    assert_raises Vips::Error do
      ImageProcessing::Vips.source(@portrait).spawn("touch foo.txt").call
    end
    refute File.exist?("foo.txt")

    assert_raises MiniMagick::Error do
      ImageProcessing::MiniMagick.source(@portrait).spawn("touch foo.txt").call
    end
    refute File.exist?("foo.txt")
  end
CVE-2014-7192 (JavaScript, published 2014-12-11T11:59Z)
Description: value: Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remote attackers to execute arbitrary code via a crafted file.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/substack/node-syntax-error
Files changed:
index.js
test/sources/run2.js
Commit message: use eval() with early throw instead of Function() to prevent script injection


Vulnerable code:
        Function(src);
}); process.exit(1); (function () {

Fixed code:
        eval('throw "STOP"; (function () { ' + src + '})()');
        if (err === 'STOP') return undefined;
})();
process.exit(1);
(function () {
CVE-2016-15030 (PHP, published 2023-03-25T18:15Z)
Description: value: A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of the argument from leads to open redirect. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 8549ad3cf197095f783643e41333586d6a4d0e54. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-223803.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/Arno0x/TwoFactorAuth
Files changed:
login/login.php
Commit message: cross-site ?from can be used for phishing

Using cross-site ?from, the user can be presented with a fake "auth failed" page, which will trick them into logging in again. Since they are now on a different site, the site can capture their user, password, and current token in order to steal their access to the real site.

Vulnerable code:
	        if (isset($_POST["from"])) {
	        	$from = urldecode($_POST["from"]);

Fixed code:
	        if (isset($_GET['from'])) {
	        	$from = $_GET['from'];
			if (preg_match('#^(?:https?:)?//#', $_GET['from'], $m)) {
				$url = parse_url($_GET['from']);
				$from = $url['path'] . (!empty($url['query']) ? '?' . $url['query'] : '') . (!empty($url['fragment']) ? '#' . $url['fragment'] : '');
			}