hitoshura25/cvefixes huggingface dataset:
CVE-2013-2506 (Ruby, published 2013-03-08T18:55Z)
Description: value: app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/spree/spree_auth_devise
Files changed:
app/controllers/spree/admin/users_controller.rb
app/models/spree/user.rb
spec/controllers/spree/users_controller_spec.rb
Commit message: Remove Mass Assignment of Role IDs


Vulnerable code:
    attr_accessible :email, :password, :password_confirmation, :remember_me, :persistence_token, :login, :spree_role_ids

Fixed code:
      def create
        if params[:user]
          roles = params[:user].delete("spree_role_ids")
        end

        @user = Spree::User.new(params[:user])
        if @user.save

          if roles
            @user.spree_roles = roles.reject(&:blank?).collect{|r| Spree::Role.find(r)}
          end

          flash.now[:notice] = t(:created_successfully)
          render :edit
        else
          render :new
        end
      end

      def update
        if params[:user]
          roles = params[:user].delete("spree_role_ids")
        end

        if @user.update_attributes(params[:user])
          if roles
            @user.spree_roles = roles.reject(&:blank?).collect{|r| Spree::Role.find(r)}
          end

          if params[:user][:password].present?
            # this logic needed b/c devise wants to log us out after password changes
            user = Spree::User.reset_password_by_token(params[:user])
            sign_in(@user, :event => :authentication, :bypass => !Spree::Auth::Config[:signout_after_password_change])
          end
          flash.now[:notice] = t(:account_updated)
          render :edit
        else
          render :edit
        end
      end

    attr_accessible :email, :password, :password_confirmation, :remember_me, :persistence_token, :login
  let(:role) { create(:role) }

    it 'should not update roles' do
      expect { spree_put :update, { :user => { :spree_role_ids => [role.id] } }}.to raise_exception(ActiveModel::MassAssignmentSecurity::Error)
    end
CVE-2019-11565 (PHP, published 2019-04-27T14:29Z)
Description: value: Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/mnelson4/printmyblog
Files changed:
includes/vendor/mnelson4/RestApiDetector/RestApiDetector.php
Commit message: do a little more sanitizing of the site param when REST PRoxy enabled


Vulnerable code:
        // If the REST API Proxy Plugin isn't active, always use the current site.
        if(! PMB_REST_PROXY_EXISTS){
            $site = '';
        }
        $this->setSite($site);
        // If they forgot to add http(s), add it for them.
        if(strpos($this->getSite(), 'http://') === false && strpos($this->getSite(), 'https://') === false) {
            $this->setSite( 'http://' . $this->getSite());
        }
        // if there is one, check if it exists in wordpress.com, eg "retirementreflections.com"
        $site = trailingslashit(sanitize_text_field($this->getSite()));



Fixed code:
        $this->setSite($this->sanitizeSite($site));
        $site = $this->getSite();
    /**
     * Avoid SSRF by sanitizing the site received.
     * @since $VID:$
     * @param $site
     * @return mixed|string
     */
    protected function sanitizeSite($site)
    {
        // If the REST API Proxy Plugin isn't active, always use the current site.
        if(! PMB_REST_PROXY_EXISTS){
            return '';
        }
        // If they forgot to add http(s), add it for them.
        if(strpos($site, 'http://') === false && strpos($site, 'https://') === false) {
            $site = 'http://' . $site;
        }
        // if there is one, check if it exists in wordpress.com, eg "retirementreflections.com"

        $file_info = pathinfo($site);
        if( isset($file_info['extension'])){
            $site = str_replace($file_info['filename'] . "." . $file_info['extension'], "", $site);
        }
        $site = trailingslashit(sanitize_text_field($site));
        return $site;
    }
CVE-2022-4396 (Python, published 2022-12-10T12:15Z)
Description: value: A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e. It is recommended to apply a patch to fix this issue. The identifier VDB-215249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/RDFLib/pyrdfa3
Files changed:
pyRdfa/__init__.py
Commit message: xss changes


Vulnerable code:

		graph = processor.rdf_from_source(input, outputFormat, rdfOutput = ("forceRDFOutput" in list(form.keys())) or not htmlOutput)
			retval +="<dt>Media Type:</dt><dd>%s</dd>\n" % media_type
			retval +="<dt>Requested graphs:</dt><dd>%s</dd>\n" % form.getfirst("graph").lower()
		if "space_preserve" in form : retval +="<dt>Space preserve:</dt><dd> %s</dd>\n" % form["space_preserve"].value

Fixed code:
	@staticmethod
	def _validate_output_format(outputFormat):
		"""
		Malicious actors may create XSS style issues by using an illegal output format... better be careful
		"""
		# protection against possible malicious URL call
		if outputFormat not in ["turtle", "n3", "xml", "pretty-xml", "nt", "json-ld"] :
			outputFormat = "turtle"
		return outputFormat
		
		# protection against possible malicious URL call
		outputFormat = pyRdfa._validate_output_format(outputFormat);

		outputFormat = pyRdfa._validate_output_format(outputFormat);
		graph = processor.rdf_from_source(input, outputFormat, rdfOutput = ("forceRDFOutput" in list(form.keys())) or not htmlOutput)
			retval +="<dt>Media Type:</dt><dd>%s</dd>\n" % cgi.escape(media_type)
			retval +="<dt>Requested graphs:</dt><dd>%s</dd>\n" % cgi.escape(form.getfirst("graph").lower())
		if "space_preserve" in form : retval +="<dt>Space preserve:</dt><dd> %s</dd>\n" % cgi.escape(form["space_preserve"].value)
CVE-2017-6503 (C++, published 2017-03-06T02:59Z)
Description: value: WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/qbittorrent/qBittorrent
Files changed:
src/base/logger.cpp
src/base/utils/string.cpp
src/base/utils/string.h
src/gui/deletionconfirmationdlg.h
src/gui/properties/peerlistwidget.cpp
src/gui/properties/propertieswidget.cpp
Commit message: Add Utils::String::toHtmlEscaped


Vulnerable code:
    Log::Msg temp = { msgCounter++, QDateTime::currentMSecsSinceEpoch(), type, message };
    Log::Peer temp = { peerCounter++, QDateTime::currentMSecsSinceEpoch(), ip, blocked, reason };
#include "guiiconprovider.h"
      label->setText(tr("Are you sure you want to delete '%1' from the transfer list?", "Are you sure you want to delete 'ubuntu-linux-iso' from the transfer list?").arg(name));
    m_listModel->setData(m_listModel->index(row, PeerListDelegate::CLIENT), peer.client());
    m_listModel->setData(m_listModel->index(row, PeerListDelegate::CLIENT), peer.client());
        comment_text->setText(Utils::Misc::parseHtmlLinks(m_torrent->comment()));
        label_created_by_val->setText(m_torrent->creator());

Fixed code:
#include "base/utils/string.h"
    Log::Msg temp = { msgCounter++, QDateTime::currentMSecsSinceEpoch(), type, Utils::String::toHtmlEscaped(message) };
    Log::Peer temp = { peerCounter++, QDateTime::currentMSecsSinceEpoch(), Utils::String::toHtmlEscaped(ip), blocked, Utils::String::toHtmlEscaped(reason) };

QString Utils::String::toHtmlEscaped(const QString &str)
{
#ifdef QBT_USES_QT5
    return str.toHtmlEscaped();
#else
    return Qt::escape(str);
#endif
}
        QString toHtmlEscaped(const QString &str);

#include "base/utils/string.h"
#include "guiiconprovider.h"
      label->setText(tr("Are you sure you want to delete '%1' from the transfer list?", "Are you sure you want to delete 'ubuntu-linux-iso' from the transfer list?").arg(Utils::String::toHtmlEscaped(name)));
    m_listModel->setData(m_listModel->index(row, PeerListDelegate::CLIENT), Utils::String::toHtmlEscaped(peer.client()));
    m_listModel->setData(m_listModel->index(row, PeerListDelegate::CLIENT), Utils::String::toHtmlEscaped(peer.client()));
        comment_text->setText(Utils::Misc::parseHtmlLinks(Utils::String::toHtmlEscaped(m_torrent->comment())));
        label_created_by_val->setText(Utils::String::toHtmlEscaped(m_torrent->creator()));
CVE-2017-6504 (C, published 2017-03-06T02:59Z)
Description: value: WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/qbittorrent/qBittorrent
Files changed:
src/base/http/types.h
src/webui/abstractwebapplication.cpp
Commit message: [WebUI] Avoid clickjacking attacks


Vulnerable code:
    clear(); // clear response

Fixed code:
    const QString HEADER_X_FRAME_OPTIONS = "X-Frame-Options";
    // clear response
    clear();

    // avoid clickjacking attacks
    header(Http::HEADER_X_FRAME_OPTIONS, "SAMEORIGIN");
CVE-2012-0807 (Other, published 2012-01-27T00:55Z)
Description: value: Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/stefanesser/suhosin
Files changed:
Changelog
header.c
Commit message: Fixed stack based buffer overflow in transparent cookie encryption (see separate advisory)


Vulnerable code:
	char buffer[4096];
    char buffer2[4096];
	char *buf = buffer, *buf2 = buffer2, *d, *d_url;
    int l;

	if (name_len > sizeof(buffer)-2) {
		buf = estrndup(name, name_len);
	} else {
		memcpy(buf, name, name_len);
		buf[name_len] = 0;
	}
    normalize_varname(buf);
    name_len = strlen(buf);
			if (buf != buffer) {
				efree(buf);
			}
	if (strlen(value) <= sizeof(buffer2)-2) {
		memcpy(buf2, value, value_len);
		buf2[value_len] = 0;
	} else {
		buf2 = estrndup(value, value_len);
	}
    if (buf != buffer) {
		efree(buf);
	}
    if (buf2 != buffer2) {
		efree(buf2);
	}
	char buffer[4096];
    char buffer2[4096];
	char *buf = buffer, *buf2 = buffer2, *d, *d_url;
	if (name_len > sizeof(buffer)-2) {
		buf = estrndup(name, name_len);
	} else {
		memcpy(buf, name, name_len);
		buf[name_len] = 0;
	}
	
    normalize_varname(buf);
    name_len = strlen(buf);
			if (buf != buffer) {
				efree(buf);
			}
	if (strlen(value) <= sizeof(buffer2)-2) {
		memcpy(buf2, value, value_len);
		buf2[value_len] = 0;
	} else {
		buf2 = estrndup(value, value_len);
	}
	if (buf != buffer) {
		efree(buf);
	}
	if (buf2 != buffer2) {
		efree(buf2);
	}

Fixed code:
    - Fixed stack based buffer overflow in transparent cookie encryption (see separate advisory)
	char *buf, *buf2, *d, *d_url;
	int l;

	buf = estrndup(name, name_len);
	
	normalize_varname(buf);
	name_len = strlen(buf);
			efree(buf);
	buf2 = estrndup(value, value_len);
	efree(buf);
	efree(buf2);
	char *buf, *buf2, *d, *d_url;
	buf = estrndup(name, name_len);
		
	normalize_varname(buf);
	name_len = strlen(buf);
			efree(buf);
	buf2 = estrndup(value, value_len);
	efree(buf);
	efree(buf2);
CVE-2021-41157 (XML, published 2021-10-26T14:15Z)
Description: value: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse of this security issue allows attackers to subscribe to user agent event notifications without the need to authenticate. This abuse poses privacy concerns and might lead to social engineering or similar attacks. For example, attackers may be able to monitor the status of target SIP extensions. Although this issue was fixed in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. Software upgrades do not update the configuration by default. SIP SUBSCRIBE messages should be authenticated by default so that FreeSWITCH administrators do not need to explicitly set the `auth-subscriptions` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/signalwire/freeswitch
Files changed:
conf/insideout/sip_profiles/internal.xml
conf/minimal/sip_profiles/internal.xml
conf/testing/sip_profiles/internal.xml
conf/vanilla/sip_profiles/internal.xml
Commit message: [Default-Configuration] Force sip subscription requests to require authentication.



Vulnerable code:

Fixed code:
    <!-- Force subscription requests to require authentication -->
    <param name="auth-subscriptions" value="true"/>
    <!-- Force subscription requests to require authentication -->
    <param name="auth-subscriptions" value="true"/>
    <!-- Force subscription requests to require authentication -->
    <param name="auth-subscriptions" value="true"/>
    <!-- Force subscription requests to require authentication -->
    <param name="auth-subscriptions" value="true"/>
CVE-2023-51443 (Unknown, published 2023-12-27T17:15Z)
Description: value: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.
Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-703 \u2014 Improper Check or Handling of Exceptional Conditions
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Repository: https://github.com/signalwire/freeswitch
Files changed:
Commit message: Merge pull request from GHSA-39gv-hq72-j6m6

[Core] Reject DTLS packets coming from a source different than the current ICE negotiated path.

Vulnerable code:

Fixed code:
CVE-2021-43822 (Unknown, published 2021-12-13T20:15Z)
Description: value: Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/jackalope/jackalope-doctrine-dbal
Files changed:
Commit message: Merge pull request from GHSA-ph98-v78f-jqrm

Fix SQL injection: Avoid property name closing a string

Vulnerable code:

Fixed code:
CVE-2013-7342 (Unknown, published 2014-03-24T14:20Z)
Description: value: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML via the callback parameter, a related issue to CVE-2013-7341.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flowplayer/flowplayer
Files changed:
Commit message: Merge pull request #382 from flowplayer/bug/381

don't accept callback to be passed in the query string (#381)

Vulnerable code:

Fixed code:
CVE-2013-7343 (Unknown, published 2014-03-24T14:20Z)
Description: value: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flowplayer/flowplayer
Files changed:
Commit message: Merge pull request #578 from flowplayer/bug/381

Decode the URL before checking the callback param.

Vulnerable code:

Fixed code:
CVE-2022-23467 (C, published 2022-12-05T20:15Z)
Description: value: OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attacker can leak stack addresses of the `razer_attr_read_dpi_stages`, potentially bypassing KASLR. To exploit this vulnerability an attacker would need to access to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3.5.1. Users are advised to upgrade and should be reminded not to plug in unknown USB devices.
Severity: nan (CVSS v3 base score: 4.6)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/openrazer/openrazer
Files changed:
driver/razercommon.c
Commit message: driver: Sanitize data_size value returned from devices

We're using this value for some bounds checks and we should ensure that
we don't potentially get a data_size that's bigger than the arguments
array to avoid out of bounds reads.


Vulnerable code:

Fixed code:
    if (WARN_ONCE(response_report->data_size > ARRAY_SIZE(response_report->arguments),
                  "Field data_size %d in response is bigger than arguments\n",
                  response_report->data_size)) {
        /* Sanitize the value since at the moment callers don't respect the return code */
        response_report->data_size = ARRAY_SIZE(response_report->arguments);
        return -EINVAL;
    }
CVE-2020-22808 (PHP, published 2021-04-29T19:15Z)
Description: value: An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fecshop/yii2_fecshop
Files changed:
app/appfront/theme/base/front/checkout/cart/index.php
app/apphtml5/theme/base/html5/checkout/cart/index.php
Commit message: check cart page xss bug fix


Vulnerable code:
    selectall = "<?= Yii::$app->request->get('selectall') ?>";
    selectall = "<?= Yii::$app->request->get('selectall') ?>";

Fixed code:
    selectall = "<?=  \Yii::$service->helper->htmlEncode(Yii::$app->request->get('selectall')) ?>";
    // selectall = "<?= Yii::$app->request->get('selectall') ?>";
    selectall = "<?=  \Yii::$service->helper->htmlEncode(Yii::$app->request->get('selectall')) ?>";