hitoshura25/cvefixes huggingface dataset:
CVE-2016-15031 (PHP, published 2023-05-06T01:15Z)
Description: value: A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/class.loginscript.php of the component POST Parameter Handler. The manipulation of the argument myusername leads to sql injection. The attack can be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is identified as 0083ec652786ddbb81335ea20da590df40035679. It is recommended to upgrade the affected component. VDB-228022 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ipoelnet/php-login
Files changed:
login/scripts/class.loginscript.php
Commit message: Added sqlInjection prevention.
The login form parameter username was vulnerable.
SQLMap output:
---------------------
POST parameter 'myusername' is vulnerable.
sqlmap identified the following injection point(s) with a total of 910 HTTP(s) requests:
---
Parameter: myusername (POST)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: myusername=uoev' RLIKE (SELECT (CASE WHEN (6566=6566) THEN 0x756f6576 ELSE 0x28 END)) AND 'cyMw'='cyMw&mypassword=&Submit=TzWk
---------------------

added prepared statement to prevent sql injection


Vulnerable code:
		$stmt = $stmt = $db->conn->query("SELECT * FROM $tbl_name WHERE username='$myusername'");

Fixed code:
            //http://www.w3schools.com/php/php_mysql_prepared_statements.asp
        
		$stmt = $stmt = $db->conn->prepare("SELECT * FROM $tbl_name WHERE username= :myusername");
        $stmt->bindParm(':myusername', $myusrname);
        $myusrname = $myusername;
        stmt->execute();
CVE-2023-25166 (JavaScript, published 2023-02-08T20:15Z)
Description: value: formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/hapijs/formula
Files changed:
lib/index.js
Commit message: chore: better number regex


Vulnerable code:
    numberRx: /^(?:[0-9]*\.?[0-9]*){1}$/,

Fixed code:
    numberRx: /^(?:[0-9]*(\.[0-9]*)?){1}$/,
CVE-2017-12795 (Java, published 2019-05-10T15:29Z)
Description: value: OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openmrs/openmrs-module-htmlformentry
Files changed:
omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
Commit message: Added privilege check when previewing an uploaded html form


Vulnerable code:

Fixed code:

        Context.requirePrivilege("Manage Forms");
CVE-2022-31109 (Unknown, published 2022-08-01T17:15Z)
Description: value: laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by default, and require users to opt-in to `X-Forwarded-*` header usage via a configured `Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject `X-Forwarded-*` headers at the web server level.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/laminas/laminas-diactoros
Files changed:
Commit message: Merge pull request from GHSA-8274-h5jp-97vr

Security/x forwarded header trust

Vulnerable code:

Fixed code:
CVE-2022-31109 (Unknown, published 2022-08-01T17:15Z)
Description: value: laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by default, and require users to opt-in to `X-Forwarded-*` header usage via a configured `Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject `X-Forwarded-*` headers at the web server level.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/laminas/laminas-diactoros
Files changed:
Commit message: Merge pull request from GHSA-8274-h5jp-97vr

Security/x forwarded header trust

Vulnerable code:

Fixed code:
CVE-2015-5612 (Other, published 2015-09-04T15:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octobercms/october
Files changed:
modules/backend/formwidgets/fileupload/partials/_file_multi.htm
modules/backend/formwidgets/fileupload/partials/_file_single.htm
modules/backend/formwidgets/fileupload/partials/_image_multi.htm
modules/backend/formwidgets/fileupload/partials/_image_single.htm
Commit message: Escape file title - Fixes #1302


Vulnerable code:
                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>

Fixed code:
                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
CVE-2015-5613 (Other, published 2017-09-28T01:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving a file title, a different vulnerability than CVE-2015-5612.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octobercms/october
Files changed:
modules/backend/formwidgets/fileupload/partials/_file_multi.htm
modules/backend/formwidgets/fileupload/partials/_file_single.htm
modules/backend/formwidgets/fileupload/partials/_image_multi.htm
modules/backend/formwidgets/fileupload/partials/_image_single.htm
Commit message: Escape file title - Fixes #1302


Vulnerable code:
                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>

Fixed code:
                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
CVE-2017-16244 (PHP, published 2017-11-01T01:29Z)
Description: value: Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/octobercms/october
Files changed:
config/cms.php
modules/cms/classes/Controller.php
Commit message: Implement CSRF token by default
Implement CSRF protection on CMS for postback handling


Vulnerable code:
    'enableCsrfProtection' => false,

Fixed code:
    'enableCsrfProtection' => true,
            ($this->verifyCsrfToken()) &&

    //
    // Security
    //

    /**
     * Checks the request data / headers for a valid CSRF token.
     * Returns false if a valid token is not found. Override this
     * method to disable the check.
     * @return bool
     */
    protected function verifyCsrfToken()
    {
        if (!Config::get('cms.enableCsrfProtection')) {
            return true;
        }

        if (in_array(Request::method(), ['HEAD', 'GET', 'OPTIONS'])) {
            return true;
        }

        $token = Request::input('_token') ?: Request::header('X-CSRF-TOKEN');

        return hash_equals(
            Session::token(),
            $token
        );
    }
CVE-2020-11083 (PHP, published 2020-07-14T21:15Z)
Description: value: In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/octobercms/october
Files changed:
modules/backend/ServiceProvider.php
modules/backend/formwidgets/MarkdownEditor.php
modules/backend/lang/en/lang.php
Commit message: Add new backend.allow_unsafe_markdown permission


Vulnerable code:
                ]
use BackendAuth;
     * @inheritDoc
     * @inheritDoc
     * @inheritDoc
     * @inheritDoc

Fixed code:
use Backend\Models\UserRole;
                ],
                'backend.allow_unsafe_markdown' => [
                    'label' => 'backend::lang.permissions.allow_unsafe_markdown',
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                ],
use Html;
use BackendAuth;
     * {@inheritDoc}
     * {@inheritDoc}
     * {@inheritDoc}
     * {@inheritDoc}
    /**
     * Check to see if the generated HTML should be cleaned to remove any potential XSS
     *
     * @return boolean
     */
    protected function shouldCleanHtml()
    {
        $user = BackendAuth::getUser();
        return !$user || !$user->hasAccess('backend.allow_unsafe_markdown');
    }

    /**
     * {@inheritDoc}
     */
    public function getSaveValue($value)
    {
        if ($this->shouldCleanHtml()) {
            $value = Html::clean($value);
        }

        return $value;
    }

    /**
     * AJAX handler to render the markdown as HTML
     *
     * @return array ['preview' => $generatedHTML]
     */
        if ($this->shouldCleanHtml()) {
            $previewHtml = Html::clean($previewHtml);
        }

        'allow_unsafe_markdown' => 'Use unsafe Markdown (can use HTML & JS)',
CVE-2020-15248 (PHP, published 2020-11-23T20:15Z)
Description: value: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Issue has been patched in Build 470 (v1.0.470) & v1.1.1.
Severity: MEDIUM (CVSS v3 base score: 4.2)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/octobercms/october
Files changed:
modules/backend/ServiceProvider.php
modules/system/ServiceProvider.php
Commit message: Tightened up the default permissions granted to the "Publisher" system role out of the box

(cherry picked from commit 8a785e439395aa901d2b9d7bcb6a343a071c7870)


Vulnerable code:
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'

Fixed code:
                    'tab'   => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab'   => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab'   => 'system::lang.permissions.name',
                    'tab'   => 'system::lang.permissions.name',
                    'tab'   => 'system::lang.permissions.name',
use Backend\Models\UserRole;
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
CVE-2020-26231 (PHP, published 2020-11-23T21:15Z)
Description: value: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 470 (v1.0.470) and v1.1.1.
Severity: MEDIUM (CVSS v3 base score: 6.7)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/octobercms/october
Files changed:
modules/system/twig/SecurityPolicy.php
Commit message: Improve Twig security policy

Follow up to https://github.com/octobercms/october/compare/106daa2930de4cebb18732732d47d4056f01dd5b...7cb148c1677373ac30ccfd3069d18098e403e1ca. Thanks to @ka1n4t for the additional review.


Vulnerable code:

Fixed code:
        'bindEvent',
        'bindEventOnce',
CVE-2020-5295 (PHP, published 2020-06-03T22:15Z)
Description: value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-829 \u2014 Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Repository: https://github.com/octobercms/october
Files changed:
modules/cms/classes/Asset.php
Commit message: Improve asset file path handling


Vulnerable code:
        return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;

Fixed code:
        // Limit paths to those under the assets directory
        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
        $path = realpath($directory . $fileName);
        if (!starts_with($path, $directory)) {
            return false;
        }

        return $path;
CVE-2020-5296 (PHP, published 2020-06-03T22:15Z)
Description: value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/octobercms/october
Files changed:
modules/cms/classes/Asset.php
Commit message: Improve asset file path handling


Vulnerable code:
        return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;

Fixed code:
        // Limit paths to those under the assets directory
        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
        $path = realpath($directory . $fileName);
        if (!starts_with($path, $directory)) {
            return false;
        }

        return $path;
CVE-2020-5297 (PHP, published 2020-06-03T22:15Z)
Description: value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
Severity: MEDIUM (CVSS v3 base score: 2.7)
Weakness: CWE-610 \u2014 Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Repository: https://github.com/octobercms/october
Files changed:
modules/cms/widgets/AssetList.php
Commit message: Improve asset file path handling when moving assets


Vulnerable code:
            $newFullPath = rtrim($destinationFullPath, '/').'/'.$basename;

Fixed code:
            $newFullPath = realpath(rtrim($destinationFullPath, '/')) . '/' . $basename;
            if (!starts_with($newFullPath, $safeDir)) {
                throw new ApplicationException(Lang::get(
                    'cms::lang.asset.error_moving_file',
                    ['file' => $basename]
                ));
            }