hitoshura25/cvefixes huggingface dataset:
CVE-2022-4822 (PHP, published 2022-12-28T21:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. It is recommended to apply a patch to fix this issue. The identifier VDB-217001 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
setup/lib/main.lib.php
Commit message: fixes #176, possible XSS in setup


Vulnerable code:
	if (!ctype_alnum($_POST ['fpuser']))
		$err [] = "{$_POST['fpuser']} is not a valid username. 

	if (strlen(trim(($_POST ['fppwd']))) < 6)

	if (($_POST ['fppwd']) != ($_POST ['fppwd2']))

	if (!(preg_match('!@.*@|\.\.|\,|\;!', $_POST ['email']) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $_POST ['email'])))
		$err [] = "{$_POST['email']} is not a valid email address";

	$www = $_POST ['www'];
		$err [] = "$www is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/')
	$fp_config ['general'] ['author'] = $user ['userid'] = $_POST ['fpuser'];
	$user ['password'] = $_POST ['fppwd'];
	$fp_config ['general'] ['email'] = $user ['email'] = $_POST ['email'];

Fixed code:
	$fpuser = strip_tags($_POST ['fpuser']);
	$fppwd = $_POST ['fppwd'];
	$fppwd2 = $_POST ['fppwd2'];
	$email = strip_tags($_POST ['email']);
	$www = strip_tags($_POST ['www']);
	if (!ctype_alnum($fpuser)) {
		$err [] = $fpuser . " is not a valid username. 
	}
	if (strlen(trim(($fppwd))) < 6) {
	}
	if (($fppwd) != ($fppwd2)) {
	}
	if (!(preg_match('!@.*@|\.\.|\,|\;!', $email) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $email))) {
		$err [] = $email . " is not a valid email address";
	}
		$err [] = $www . " is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/') {
	}
	$fp_config ['general'] ['author'] = $user ['userid'] = $fpuser;
	$user ['password'] = $fppwd;
	$fp_config ['general'] ['email'] = $user ['email'] = $email;
CVE-2023-0947 (Other, published 2023-02-22T01:15Z)
Description: value: Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
.htaccess
Commit message: Added .htaccess to prevent directory browsing.


Vulnerable code:

Fixed code:
Options -Indexes
CVE-2023-1104 (PHP, published 2023-03-01T02:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
admin/panels/uploader/admin.uploader.php
Commit message: fixes #188


Vulnerable code:
			'md'

Fixed code:
			'md',
			'pages'
CVE-2023-1105 (PHP, published 2023-03-01T02:15Z)
Description: value: External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-73 \u2014 External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit message: fixes #179, preventing path traversal


Vulnerable code:

Fixed code:
			// prevent path traversal: remove ".." and "/" resp. "\"
			$name = preg_replace('(\.\.|\/|\\\\)', '', $name);
CVE-2023-1106 (PHP, published 2023-03-02T02:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
setup/lib/main.lib.php
Commit message: fixes #176, possible XSS in setup


Vulnerable code:
	if (!ctype_alnum($_POST ['fpuser']))
		$err [] = "{$_POST['fpuser']} is not a valid username. 

	if (strlen(trim(($_POST ['fppwd']))) < 6)

	if (($_POST ['fppwd']) != ($_POST ['fppwd2']))

	if (!(preg_match('!@.*@|\.\.|\,|\;!', $_POST ['email']) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $_POST ['email'])))
		$err [] = "{$_POST['email']} is not a valid email address";

	$www = $_POST ['www'];
		$err [] = "$www is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/')
	$fp_config ['general'] ['author'] = $user ['userid'] = $_POST ['fpuser'];
	$user ['password'] = $_POST ['fppwd'];
	$fp_config ['general'] ['email'] = $user ['email'] = $_POST ['email'];

Fixed code:
	$fpuser = strip_tags($_POST ['fpuser']);
	$fppwd = $_POST ['fppwd'];
	$fppwd2 = $_POST ['fppwd2'];
	$email = strip_tags($_POST ['email']);
	$www = strip_tags($_POST ['www']);
	if (!ctype_alnum($fpuser)) {
		$err [] = $fpuser . " is not a valid username. 
	}
	if (strlen(trim(($fppwd))) < 6) {
	}
	if (($fppwd) != ($fppwd2)) {
	}
	if (!(preg_match('!@.*@|\.\.|\,|\;!', $email) || preg_match('!^.+\@(\[?)[a-zA-Z0-9\.\-]+\.([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$!', $email))) {
		$err [] = $email . " is not a valid email address";
	}
		$err [] = $www . " is not a valid URL";
	if ($www && $www [strlen($www) - 1] != '/') {
	}
	$fp_config ['general'] ['author'] = $user ['userid'] = $fpuser;
	$user ['password'] = $fppwd;
	$fp_config ['general'] ['email'] = $user ['email'] = $email;
CVE-2023-1107 (PHP, published 2023-03-02T02:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
fp-plugins/mediamanager/panels/panel.mediamanager.file.php
Commit message: fixes #177, possible XSS in Media Manager plugin


Vulnerable code:
			$newgallery = $_POST ['mm-newgallery-name'];

Fixed code:
			$newgallery = strip_tags($_POST ['mm-newgallery-name']);
CVE-2023-1146 (PHP, published 2023-03-02T03:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
admin/panels/config/admin.config.php
Commit message: fixes #87, possible XSS in config panel


Vulnerable code:
			'author' => $_POST ['author'],
			'email' => $_POST ['email'],
				/* preserve the following */
				'theme' => $fp_config ['general'] ['theme'],

Fixed code:
			'author' => wp_specialchars($_POST ['author']),
			'email' => wp_specialchars($_POST ['email']),
			// preserve the following
			'theme' => $fp_config ['general'] ['theme'],
CVE-2023-1147 (PHP, published 2023-03-02T03:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/flatpressblog/flatpress
Files changed:
fp-includes/core/core.comment.php
Commit message: Fixes #186, possible XSS in comments


Vulnerable code:
	$arr ['name'] = apply_filters('pre_comment_author_name', stripslashes($arr ['name']));
	if (isset($arr ['email']))
		$arr ['email'] = apply_filters('pre_comment_author_email', $arr ['email']);
	if (isset($arr ['url']))
		$arr ['url'] = apply_filters('pre_comment_author_url', $arr ['url']);
	$arr ['content'] = apply_filters('pre_comment_content', $arr ['content']);

Fixed code:
	$arr ['name'] = strip_tags(apply_filters('pre_comment_author_name', stripslashes($arr ['name'])));
	if (isset($arr ['email'])) {
		$arr ['email'] = strip_tags(apply_filters('pre_comment_author_email', $arr ['email']));
	}
	if (isset($arr ['url'])) {
		$arr ['url'] = strip_tags(apply_filters('pre_comment_author_url', $arr ['url']));
	}
	$arr ['content'] = strip_tags(apply_filters('pre_comment_content', $arr ['content']));
CVE-2018-25073 (Unknown, published 2023-01-11T14:15Z)
Description: value: A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the file webinterface/bot.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.2.7 is able to address this issue. The patch is identified as b3a3cd8efe2cd3bd3c5b3b7abf2fe80dbee51b77. It is recommended to upgrade the affected component. VDB-218002 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Newcomer1989/TSN-Ranksystem
Files changed:
Commit message: Merge pull request #467 from JVMerkle/xss_pull

Fix reflected XSS in bot.php

Vulnerable code:

Fixed code:
CVE-2017-16618 (Python, published 2017-11-08T03:29Z)
Description: value: An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/tadashi-aikawa/owlmixin
Files changed:
owlmixin/util.py
tests/test_util.py
tests/yaml/vulnerability.yaml
Commit message: :scream: Fix vulnerability of `load_yaml` and `load_yamlf` (#12)


Vulnerable code:
from yaml import Loader, SafeLoader
Loader.add_constructor(u'tag:yaml.org,2002:str', construct_yaml_str)
    return yaml.load(yaml_str)
        return yaml.load(f)

Fixed code:
from yaml import SafeLoader
    return yaml.safe_load(yaml_str)
        return yaml.safe_load(f)
from yaml.constructor import ConstructorError
import pytest



class TestLoadYaml:
    def test(self):
        actual = util.load_yaml('''
id: 1
names:
  - tadashi
  - aikawa
        ''')
        assert actual == {
            "id": 1,
            "names": ['tadashi', 'aikawa']
        }

    def test_yaml_load_vulnerability(self):
        with pytest.raises(ConstructorError):
            util.load_yaml('!!python/object/apply:os.system ["calc.exe"]')


class TestLoadYamlf:
    def test(self):
        assert util.load_yamlf('tests/yaml/spots_utf8.yaml', 'utf-8') == [
            {
                "address": {"name": "address1"},
                "names": ["spot1"]
            },
            {
                "names": ["スポット21", "スポット22"]
            }
        ]

    def test_yaml_load_vulnerability(self):
        with pytest.raises(ConstructorError):
            util.load_yamlf('tests/yaml/vulnerability.yaml', 'utf-8')
!!python/object/apply:os.system ["calc.exe"]
CVE-2022-4603 (C, published 2022-12-18T11:15Z)
Description: value: A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ppp-project/ppp
Files changed:
pppdump/pppdump.c
Commit message: pppdump: Avoid out-of-range access to packet buffer

This fixes a potential vulnerability where data is written to spkt.buf
and rpkt.buf without a check on the array index.  To fix this, we
check the array index (pkt->cnt) before storing the byte or
incrementing the count.  This also means we no longer have a potential
signed integer overflow on the increment of pkt->cnt.

Fortunately, pppdump is not used in the normal process of setting up a
PPP connection, is not installed setuid-root, and is not invoked
automatically in any scenario that I am aware of.

Signed-off-by: Paul Mackerras <paulus@ozlabs.org>


Vulnerable code:
		    pkt->buf[pkt->cnt++] = c;

Fixed code:
			if (pkt->cnt >= sizeof(pkt->buf)) {
			    printf("%s over-long packet truncated:\n     ", dir);
			    q = "    ";
			}
		    if (pkt->cnt < sizeof(pkt->buf))
			pkt->buf[pkt->cnt++] = c;
CVE-2021-31245 (Python, published 2021-05-06T13:15Z)
Description: value: omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length dependent manner, which allows remote attackers to guess the password via a timing attack.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/Ysurac/openmptcprouter-vps-admin
Files changed:
omr-admin.py
Commit message: Fix timing attacks potential vulnerability


Vulnerable code:
    if plain_password == user_password:

Fixed code:
    if secrets.compare_digest(plain_password,user_password):
CVE-2013-4168 (Perl, published 2019-11-01T20:15Z)
Description: value: Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 in the start and end time fields.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/oetiker/SmokePing
Files changed:
lib/Smokeping.pm
Commit message: xss fix from Steven Chamberlain


Vulnerable code:
    for ($in){
	/^(\d+)$/ && do { my $value = $1; $value = time if $value > 2**32; return $value};

Fixed code:
    for ($in){ 
        $in =~ s/$xssBadRx/_/g;
        /^(\d+)$/ && do { my $value = $1; $value = time if $value > 2**32; return $value};
CVE-2013-10027 (PHP, published 2023-06-04T14:15Z)
Description: value: A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of the file blogger-importer.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. Upgrading to version 0.6 is able to address this issue. The patch is identified as b83fa4f862b0f19a54cfee76060ec9c2e7f7ca70. It is recommended to upgrade the affected component. VDB-230658 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wp-plugins/blogger-importer
Files changed:
blogger-importer.php
readme.txt
Commit message: Adding a nonce to prevent CSRF.



git-svn-id: https://plugins.svn.wordpress.org/blogger-importer/trunk@784566 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Version: 0.6
            delete_option('blogger_importer');
            $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'><p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
Tested up to: 3.4
Stable tag: 0.5

Fixed code:
Version: 0.5
            if ( check_admin_referer( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ) ) {
                delete_option('blogger_importer');
                $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_key = 'blogger_author'");
            }
            exit;
                echo "<div class='wrap'><h2>$restart</h2><p>$message</p><form method='post' action='?import=blogger&amp;noheader=true'>";
                wp_nonce_field( 'clear-blogger-importer', 'clear-blogger-importer-nonce' ); 
                echo "<p class='submit' style='text-align:left;'><input type='submit' class='button' value='$submit' name='restart' /></p></form></div>";
Tested up to: 3.6
Stable tag: 0.6
= 0.6 = 
* Security improvements.
CVE-2022-32323 (Unknown, published 2022-07-14T21:15Z)
Description: value: AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.
Severity: MEDIUM (CVSS v3 base score: 7.3)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/autotrace/autotrace
Files changed:
Commit message: Merge pull request #72 from lemenkov/misleading_indentation

Misleading indentation

Vulnerable code:

Fixed code:
CVE-2023-45669 (Unknown, published 2023-10-16T19:15Z)
Description: value: WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator returns an incremented signature counter value during authentication, webauthn4j-spring-security-core does not properly persist the value, which means cloned authenticator detection does not work. An attacker who cloned valid authenticator in some way can use the cloned authenticator without being detected. This issue has been addressed in version `0.9.1.RELEASE`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/webauthn4j/webauthn4j-spring-security
Files changed:
Commit message: Merge pull request from GHSA-v9hx-v6vf-g36j

Release 0.9.1

Vulnerable code:

Fixed code:
CVE-2020-36048 (JavaScript, published 2021-01-08T00:15Z)
Description: value: Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/socketio/engine.io
Files changed:
lib/server.js
Commit message: feat: decrease the default value of maxHttpBufferSize

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by
malicious clients sending huge amounts of data.


Vulnerable code:
        maxHttpBufferSize: 10e7,

Fixed code:
        maxHttpBufferSize: 1e6,
CVE-2022-41940 (TypeScript, published 2022-11-22T01:15Z)
Description: value: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-248 \u2014 Uncaught Exception
An exception is thrown from a function, but it is not caught.
Repository: https://github.com/socketio/engine.io
Files changed:
lib/server.ts
Commit message: fix: catch errors when destroying invalid upgrades (#658)

Before this change, receiving an HTTP2 upgrade would make the server
crash:

> Error: read ECONNRESET
>    at TCP.onStreamRead (node:internal/stream_base_commons:217:20) {
>  errno: -104,
>  code: 'ECONNRESET',
>  syscall: 'read'
> }

This can be reproduced with Node.js v14.15.3, v16.18.1 and v18.12.1.


Vulnerable code:

Fixed code:
              socket.on("error", e => {
                debug("error while destroying upgrade: %s", e.message);
              });