hitoshura25/cvefixes huggingface dataset:
CVE-2023-2881 (PHP, published 2023-05-25T09:15Z)
Description: value: Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/CustomerView/DefaultCustomerView.php
Commit message: Remove password field from detals view (#469)

* Remove password field from customer details

* Apply php-cs-fixer changes

* Update src/CustomerView/DefaultCustomerView.php

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>

---------

Co-authored-by: aryaantony92 <aryaantony92@users.noreply.github.com>
Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>

Vulnerable code:
            if ($fd->getInvisible()) {

Fixed code:
            if ($fd->getInvisible() || $fd->getFieldtype() === 'password') {
CVE-2023-32075 (JavaScript, published 2023-05-11T17:15Z)
Description: value: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/Resources/public/js/config/conditions.js
Commit message: Restrict negative value (#466)



Vulnerable code:
                        value: this.options.count
            value: this.options.count
                        value: this.options.count

Fixed code:
                        value: this.options.count,
                        minValue: 0
            value: this.options.count,
            minValue: 0
                        value: this.options.count,
                        minValue: 0
CVE-2023-3574 (PHP, published 2023-07-10T16:15Z)
Description: value: Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/Controller/Admin/RulesController.php
src/Targeting/SegmentTracker.php
Commit message: [Bug]: Add missing permission check on Rules controller (#483)

* chore: fix rules permission check

* Apply php-cs-fixer changes

* chore: fix wrong class

* Update RulesController.php

* fix stan

---------

Co-authored-by: kingjia90 <kingjia90@users.noreply.github.com>

Vulnerable code:
class RulesController extends \Pimcore\Bundle\AdminBundle\Controller\AdminController
            if (!empty($groupCollection)) {
                usort($groupCollection, function ($left, $right) {
                    if ($left['count'] === $right['count']) {
                        return 0;
                    }
                    return ($left['count'] < $right['count']) ? 1 : -1;
                });
                $segmentCollection[$group] = array_slice($groupCollection, 0, $limitSegmentCountPerGroup);
            }

Fixed code:
use Pimcore\Bundle\AdminBundle\Controller\AdminController;
use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class RulesController extends AdminController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event)
    {
        $this->checkPermission('plugin_cmf_perm_customer_automation_rules');
    }

            usort($groupCollection, function ($left, $right) {
                if ($left['count'] === $right['count']) {
                    return 0;
                }
                return ($left['count'] < $right['count']) ? 1 : -1;
            });
            $segmentCollection[$group] = array_slice($groupCollection, 0, $limitSegmentCountPerGroup);
CVE-2023-4145 (PHP, published 2023-08-03T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
composer.json
src/View/Formatter/DefaultViewFormatter.php
Commit message: Fix Xss in the segment name (#490)

* Fix Xss in the segment name

* Apply php-cs-fixer changes

* Fix PHP stan

---------

Co-authored-by: aryaantony92 <aryaantony92@users.noreply.github.com>

Vulnerable code:
    "pimcore/pimcore": "^10.5",
        return sprintf('<span class="label label-default">%s</span>', $segment->getName());

Fixed code:
    "pimcore/pimcore": "^10.5.21",
use Pimcore\Security\SecurityHelper;
        return sprintf('<span class="label label-default">%s</span>', SecurityHelper::convertHtmlSpecialChars($segment->getName()));
CVE-2024-21666 (PHP, published 2024-01-11T01:15Z)
Description: value: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when reaching the `/admin/customermanagementframework/duplicates/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. Unauthorized user(s) can access PII data from customers. This vulnerability has been patched in version 4.0.6.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/Controller/Admin/DuplicatesController.php
Commit message: Fix: improper access (#523)



Vulnerable code:

Fixed code:
use Symfony\Component\HttpKernel\Event\ControllerEvent;
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        parent::onKernelControllerEvent($event);
        $this->checkPermission('plugin_cmf_perm_customerview');
    }
CVE-2024-21667 (PHP, published 2024-01-11T01:15Z)
Description: value: pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the `/admin/customermanagementframework/gdpr-data/search-data-objects` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers. This vulnerability has been patched in version 4.0.6.

Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/pimcore/customer-data-framework
Files changed:
src/Controller/Admin/GDPRDataController.php
Commit message: [Bug]: Fix GDPR search-data-objects permission (#525)

* Update GDPRDataController.php

* fix typo

* Apply php-cs-fixer changes

---------

Co-authored-by: kingjia90 <kingjia90@users.noreply.github.com>


Vulnerable code:
class GDPRDataController extends UserAwareController

Fixed code:
use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class GDPRDataController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('gdpr_data_extractor');
    }
CVE-2022-4933 (PHP, published 2023-03-20T05:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is the function upatePrice of the file script/interface.php. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is recommended to upgrade the affected component. VDB-223382 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ATM-Consulting/dolibarr_module_quicksupplierprice
Files changed:
ChangeLog.md
core/modules/modquicksupplierprice.class.php
script/interface.php
Commit message: FIX : `Interface.php` has fatal errors (invisible to user) due to SQL injection of empty input values - *29/06/2022* - 1.1.7


Vulnerable code:
		$this->version = '1.1.6';
        $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."product_fournisseur_price WHERE fk_product=" . $id_prod;
        $sql .= " AND fk_soc=" . $fk_soc;
        $sql .= " AND unitprice=" . $unitprice;
        $sql .= " AND quantity=" . $qte;
        	$sql .= " AND default_vat_code='" . $vat_src_code."'";

Fixed code:
- FIX : `Interface.php` has fatal errors (invisible to user) due to SQL
  injection of empty input values - *29/06/2022* - 1.1.7
		$this->version = '1.1.7';
		if ($price === '' || $unitprice === '') {
			print json_encode(array('retour' => 0, 'error' => 'prix non renseigné'));
			return;
		}

		$sql = 'SELECT rowid FROM ' . MAIN_DB_PREFIX . 'product_fournisseur_price'
			. ' WHERE fk_product=' . intval($id_prod)
			. ' AND fk_soc=' . intval($fk_soc)
			. ' AND unitprice=' . floatval($unitprice)
			. ' AND quantity=' . intval($qte);
        	$sql .= ' AND default_vat_code="' . $db->escape($vat_src_code).'"';
		if (!$resq) {
			print json_encode(array('retour' => 0, 'error' => $db->lasterror()));
			return;
		}
CVE-2023-50264 (Python, published 2023-12-15T21:15Z)
Description: value: Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/morpheus65535/bazarr
Files changed:
bazarr/app/ui.py
Commit message: Fixed some code to prevent arbitrary file read and blind SSRF.


Vulnerable code:
    return send_file(os.path.join(settings.backup.folder, filename), max_age=0, as_attachment=True)
    return send_file(os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'libs', 'flask_restx',
                     'static', filename))

Fixed code:
    fullpath = os.path.normpath(os.path.join(settings.backup.folder, filename))
    if not fullpath.startswith(settings.backup.folder):
        return '', 404
    else:
        return send_file(fullpath, max_age=0, as_attachment=True)
    basepath = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'libs', 'flask_restx',
                            'static')
    fullpath = os.path.join(basepath, filename)
    if not fullpath.startswith(basepath):
        return '', 404
    else:
        return send_file(fullpath)
    if protocol.lower not in ['http', 'https']:
        return dict(status=False, error='Unsupported protocol')
CVE-2023-50265 (Python, published 2023-12-15T21:15Z)
Description: value: Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/morpheus65535/bazarr
Files changed:
bazarr/app/ui.py
Commit message: Fixed some code to prevent arbitrary file read and blind SSRF.


Vulnerable code:
    return send_file(os.path.join(settings.backup.folder, filename), max_age=0, as_attachment=True)
    return send_file(os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'libs', 'flask_restx',
                     'static', filename))

Fixed code:
    fullpath = os.path.normpath(os.path.join(settings.backup.folder, filename))
    if not fullpath.startswith(settings.backup.folder):
        return '', 404
    else:
        return send_file(fullpath, max_age=0, as_attachment=True)
    basepath = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'libs', 'flask_restx',
                            'static')
    fullpath = os.path.join(basepath, filename)
    if not fullpath.startswith(basepath):
        return '', 404
    else:
        return send_file(fullpath)
    if protocol.lower not in ['http', 'https']:
        return dict(status=False, error='Unsupported protocol')
CVE-2023-50266 (Python, published 2023-12-15T21:15Z)
Description: value: Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/morpheus65535/bazarr
Files changed:
bazarr/app/ui.py
Commit message: Fixed some code to prevent arbitrary file read and blind SSRF.


Vulnerable code:
    return send_file(os.path.join(settings.backup.folder, filename), max_age=0, as_attachment=True)
    return send_file(os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'libs', 'flask_restx',
                     'static', filename))

Fixed code:
    fullpath = os.path.normpath(os.path.join(settings.backup.folder, filename))
    if not fullpath.startswith(settings.backup.folder):
        return '', 404
    else:
        return send_file(fullpath, max_age=0, as_attachment=True)
    basepath = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'libs', 'flask_restx',
                            'static')
    fullpath = os.path.join(basepath, filename)
    if not fullpath.startswith(basepath):
        return '', 404
    else:
        return send_file(fullpath)
    if protocol.lower not in ['http', 'https']:
        return dict(status=False, error='Unsupported protocol')
CVE-2018-10366 (Other, published 2018-04-25T09:29Z)
Description: value: An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rainlab/user-plugin
Files changed:
components/account/update.htm
Commit message: KISS and form_value() doesn't use escaping


Vulnerable code:
{{ form_ajax('onUpdate', { model: user }) }}
        <input name="name" type="text" class="form-control" id="accountName" value="{{ form_value('name') }}">
        <input name="email" type="email" class="form-control" id="accountEmail" value="{{ form_value('email') }}">
{{ form_close() }}

Fixed code:
{{ form_ajax('onUpdate') }}
        <input name="name" type="text" class="form-control" id="accountName" value="{{ user.name }}">
        <input name="email" type="email" class="form-control" id="accountEmail" value="{{ user.email }}">
{{ form_close() }}
CVE-2015-10035 (JavaScript, published 2023-01-09T21:15Z)
Description: value: A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/gperson/angular-test-reporter
Files changed:
app/app.js
rest-server/data-server.js
Commit message: Escaping to prevent sql injections & others issues


Vulnerable code:
		$location.path('/app/index.html#/view1');
	var query = connection.query("INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+note.testId+",'" + note.who + "','"+note.note+"')", function(err, rows, fields) {
	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ('"+test.name+"','" + test.param + "','"+test.error+ "','"+start+ "','"+end+ "','"+test.status+ "','"+test.extra+ "','"+test.runInfo+"')";

Fixed code:
		$location.path('/app/index.html#/tests');
	var queryStr = "INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+connection.escape(note.testId)+"," + connection.escape(note.who) + ","+connection.escape(note.note)+")";
	var query = connection.query(queryStr,function(err, rows, fields) {
	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ("+connection.escape(test.name)+"','" + connection.escape(test.param) + ","+connection.escape(test.error)+ "','"+start+ "','"+end+ "',"+connection.escape(test.status)+ ","+connection.escape(test.extra)+ ","+connection.escape(test.runInfo)+")";
CVE-2021-41272 (Java, published 2021-12-13T21:15Z)
Description: value: Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. In networks where only vulnerable versions are mining the relevant transaction will not be included in any blocks. When the network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this issue. Besu 21.7.4 is not vulnerable and clients can roll back to that version. There is a workaround available: Once a transaction with the relevant shift operations is included in the canonical chain, the only remediation is to make sure all nodes are on non-vulnerable versions.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/hyperledger/besu
Files changed:
evm/src/main/java/org/hyperledger/besu/evm/operation/SarOperation.java
evm/src/main/java/org/hyperledger/besu/evm/operation/ShlOperation.java
evm/src/main/java/org/hyperledger/besu/evm/operation/ShrOperation.java
Commit message: Shift Optimization (#3039)

Reduce shift calculations to shifts that may have an actual result.

Signed-off-by: Danno Ferrin <danno.ferrin@gmail.com>

Vulnerable code:
      if (shiftAmountInt >= 256) {
      if (shiftAmountInt >= 256) {
      if (shiftAmountInt >= 256) {

Fixed code:
      if (shiftAmountInt >= 256 || shiftAmountInt < 0) {
      if (shiftAmountInt >= 256 || shiftAmountInt < 0) {
      if (shiftAmountInt >= 256 || shiftAmountInt < 0) {