hitoshura25/cvefixes huggingface dataset:
CVE-2023-3568 (PHP, published 2023-07-10T16:15Z)
Description: value: Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.


Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/controllers/Calendar.php
Commit message: Only allow authorized users to manage appointments from the calendar page (#1387)


Vulnerable code:
            // Save customer changes to the database.
            $appointment_data = request('appointment_data');

            $provider = $this->providers_model->find($unavailability['id_users_provider']);

Fixed code:
            $appointment_data = request('appointment_data');

            $this->check_event_permissions($appointment_data['id_users_provider']);
            // Save customer changes to the database.

            $this->check_event_permissions($appointment['id_users_provider']);

            $provider_id = $unavailability['id_users_provider'];

            $this->check_event_permissions($provider_id);

            $provider = $this->providers_model->find($provider_id);
            
            $this->check_event_permissions($unavailability['id_users_provider']);

    private function check_event_permissions($provider_id)
    {
        $user_id = (int)session('user_id');
        $role_slug = session('role_slug');

        if ($role_slug === DB_SLUG_SECRETARY && ! $this->secretaries_model->is_provider_supported($user_id, $provider_id))
        {
            abort(403);
        }

        if ($role_slug === DB_SLUG_PROVIDER && $user_id !== $provider_id)
        {
            abort(403);
        }
    }
CVE-2023-3700 (PHP, published 2023-07-17T07:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.


Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/alextselegidis/easyappointments
Files changed:
application/controllers/Calendar.php
Commit message: Only allow authorized users to manage appointments from the calendar page (#1387)


Vulnerable code:
            // Save customer changes to the database.
            $appointment_data = request('appointment_data');

            $provider = $this->providers_model->find($unavailability['id_users_provider']);

Fixed code:
            $appointment_data = request('appointment_data');

            $this->check_event_permissions($appointment_data['id_users_provider']);
            // Save customer changes to the database.

            $this->check_event_permissions($appointment['id_users_provider']);

            $provider_id = $unavailability['id_users_provider'];

            $this->check_event_permissions($provider_id);

            $provider = $this->providers_model->find($provider_id);
            
            $this->check_event_permissions($unavailability['id_users_provider']);

    private function check_event_permissions($provider_id)
    {
        $user_id = (int)session('user_id');
        $role_slug = session('role_slug');

        if ($role_slug === DB_SLUG_SECRETARY && ! $this->secretaries_model->is_provider_supported($user_id, $provider_id))
        {
            abort(403);
        }

        if ($role_slug === DB_SLUG_PROVIDER && $user_id !== $provider_id)
        {
            abort(403);
        }
    }
CVE-2019-11454 (Other, published 2019-04-22T16:29Z)
Description: value: Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://bitbucket.org/tildeslash/monit
Files changed:
CHANGES
src/http/cervlet.c
Commit message: Fixed: HTML escape the log file content when viewed via Monit GUI.


Vulnerable code:
                                StringBuffer_append(res->outputbuffer, "%s", buf);

Fixed code:
Fixed: HTML escape the log file content when viewed via Monit GUI.

                                escapeHTML(res->outputbuffer, buf);
CVE-2019-11454 (Other, published 2019-04-22T16:29Z)
Description: value: Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://bitbucket.org/tildeslash/monit
Files changed:
CHANGES
Commit message: text + add the reporter name for viewlog XSS vulnerability report


Vulnerable code:
Fixed: HTML escape the log file content when viewed via Monit GUI.

Fixed code:
Fixed: XSS vulnerabilitty: HTML escape the log file content when viewed via Monit GUI. Thanks for Zack Flack
for report.
CVE-2019-11455 (Other, published 2019-04-22T16:29Z)
Description: value: A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker to retrieve the contents of adjacent memory via manipulation of GET or POST parameters. The attacker can also cause a denial of service (application outage).
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://bitbucket.org/tildeslash/monit
Files changed:
CHANGES
src/util.c
Commit message: Fixed: Buffer overrun vulnerability in URL decoding. Thanks to Zack Flack for report.


Vulnerable code:
static char x2c(char *hex) {
                                                        *(buf + insertpos) = x2c(&buf[editpos + 3]);
                                                *(buf + insertpos) = x2c(&buf[editpos+3]);
                        if ((url[x] = url[y]) == '+')
                        else if (url[x] == '%') {
                                if (! (url[x + 1] && url[x + 2]))
                                url[x] = x2c(url + y + 1);

Fixed code:
Fixed: Buffer overrun vulnerability in URL decoding. Thanks to Zack Flack for report.

static char _x2c(char *hex) {
                                                        *(buf + insertpos) = _x2c(&buf[editpos + 3]);
                                                *(buf + insertpos) = _x2c(&buf[editpos+3]);
                        if (url[y] == '+') {
                        } else if (url[y] == '%') {
                                if (! url[y + 1] || ! url[y + 2])
                                url[x] = _x2c(url + y + 1);
                        } else {
                                url[x] = url[y];
CVE-2022-26563 (Other, published 2023-07-18T14:15Z)
Description: value: An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authorization.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://bitbucket.org/tildeslash/monit
Files changed:
CHANGES
src/util.c
Commit message: Fixed: PAM authentication: Users with a valid password for disabled account can login to Monit. Thanks to Youssef Rebahi-Gilbert.


Vulnerable code:
        rv = pam_authenticate(pamh, PAM_SILENT);
        if (pam_end(pamh, rv) != PAM_SUCCESS)
                pamh = NULL;

Fixed code:
Fixed: PAM authentication: Users with a valid password for disabled account can login to Monit.
Thanks to Youssef Rebahi-Gilbert.

        if ((rv = pam_authenticate(pamh, PAM_SILENT)) == PAM_SUCCESS)
                rv = pam_acct_mgmt(pamh, PAM_SILENT);
        pam_end(pamh, rv);
CVE-2021-21433 (Python, published 2021-04-09T18:15Z)
Description: value: Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/DEMON1A/Discord-Recon
Files changed:
app.py
Commit message: Fixing Command Injection Issues.

Vulnerable code:

Fixed code:
    if not CommandInjection.commandInjection(argument=argument , RCE=RCE):
        await ctx.send("**Your Command Contains Unallowed Chars. Don't Try To Use It Again.**")
        return
    
    if not CommandInjection.commandInjection(argument=argument , RCE=RCE):
        await ctx.send("**Your Command Contains Unallowed Chars. Don't Try To Use It Again.**")
        return
CVE-2024-21663 (Python, published 2024-01-09T00:15Z)
Description: value: Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability has been fixed in version 0.0.8.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/DEMON1A/Discord-Recon
Files changed:
app.py
Commit message: Use CommandInjection protection on prips command


Vulnerable code:
            await ctx.send("Prips Results: ", file=discord.File(f"messages/{RandomStr}"))
            await ctx.send(f"\n**- {ctx.message.author}**")
        await ctx.send("**Prips Results:**")
        await ctx.send(f"\n**- {ctx.message.author}**")

Fixed code:
    argument = CommandInjection.sanitizeInput(argument)
            await ctx.send(f"Prips output for **{argument}**: ", file=discord.File(f"messages/{RandomStr}"))
            await ctx.send(f"\nRequested by **{ctx.message.author}**")
        await ctx.send(f"Prips output for **{argument}:**")
        await ctx.send(f"\nRequested by **{ctx.message.author}**")
CVE-2024-38514 (Unknown, published 2024-06-28T19:15Z)
Description: value: NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web
Files changed:
Commit message: Merge pull request from GHSA-gph5-rx77-3pjg

fix: validate the url to avoid SSRF

Vulnerable code:

Fixed code:
CVE-2021-23368 (JavaScript, published 2021-04-12T14:15Z)
Description: value: The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/postcss/postcss
Files changed:
lib/previous-map.js
Commit message: Fix unsafe regexp


Vulnerable code:
    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\s*\*\//gm)

Fixed code:
    let annotations = css.match(/\/\*\s*# sourceMappingURL=.*\*\//gm)
CVE-2021-23368 (JavaScript, published 2021-04-12T14:15Z)
Description: value: The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/postcss/postcss
Files changed:
lib/previous-map.js
Commit message: Fix unsafe regexp in getAnnotationURL() too


Vulnerable code:
    return sourceMapString
      .match(/\/\*\s*# sourceMappingURL=(.*)\s*\*\//)[1]
      .trim()

Fixed code:
    return sourceMapString.match(/\/\*\s*# sourceMappingURL=(.*)\*\//)[1].trim()
CVE-2021-23382 (Unknown, published 2021-04-26T16:15Z)
Description: value: The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/postcss/postcss
Files changed:
Commit message: Merge pull request #1567 from yetingli/main

Fix ReDoS in previous-map

Vulnerable code:

Fixed code:
CVE-2023-44270 (JavaScript, published 2023-09-29T22:15Z)
Description: value: An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/postcss/postcss
Files changed:
lib/tokenize.js
test/parse.test.ts
Commit message: Fix carrier return parsing


Vulnerable code:
const RE_BAD_BRACKET = /.[\n"'(/\\]/

Fixed code:
const RE_BAD_BRACKET = /.[\r\n"'(/\\]/
test('parses carrier return', () => {
  throws(() => {
    parse('@font-face{ font:(\r/*);} body { a: "a*/)} a{}"}')
  }, /:1:46: Unclosed string/)
})
CVE-2023-28609 (Go, published 2023-03-18T21:15Z)
Description: value: api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/ansible-semaphore/semaphore
Files changed:
api/auth.go
api/router.go
Commit message: fix: authentization bug


Vulnerable code:
func authenticationHandler(w http.ResponseWriter, r *http.Request) {
			return
			return
			return
			return
			return
			return
			return
		return
			return
		authenticationHandler(w, r)
		next.ServeHTTP(w, r)
			authenticationHandler(w, r)
		next.ServeHTTP(w, r)
	//updateAvailable, err := util.CheckUpdate()

	//if err != nil {
	//	helpers.WriteError(w, err)
	//	return
	//}

		//"update":  updateAvailable,

Fixed code:
func authenticationHandler(w http.ResponseWriter, r *http.Request) bool {
			return false
			return false
			return false
			return false
			return false
			return false
			return false
		return false
			return false
	return true
		ok := authenticationHandler(w, r)
		if ok {
			next.ServeHTTP(w, r)
		}
		var ok bool
		
			ok = authenticationHandler(w, r)
		if ok {
			next.ServeHTTP(w, r)
		}
CVE-2022-25948 (TypeScript, published 2022-12-22T05:15Z)
Description: value: The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/harttle/liquidjs
Files changed:
package-lock.json
src/context/context.ts
src/liquid-options.ts
Commit message: refactor: change `ownPropertyOnly` default value to `true`

BREAKING CHANGE: `ownPropertyOnly` default value changed to `true`


Vulnerable code:
      "version": "1.0.30001335",
      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001335.tgz",
      "integrity": "sha512-ddP1Tgm7z2iIxu6QTtbZUv6HJxSaV/PZeSrWFZtbY4JZ69tOeNhBCl3HyRQgeNZKE5AOn1kpV7fhljigy0Ty3w==",
  if (isNil(obj)) return obj
  const jsProperty = readJSProperty(obj, key, ownPropertyOnly)
  if (jsProperty === undefined && obj instanceof Drop) return obj.liquidMethodMissing(key)
  if (isFunction(jsProperty)) return jsProperty.call(obj)
  return jsProperty
  if (ownPropertyOnly && !Object.hasOwnProperty.call(obj, key)) return undefined
  ownPropertyOnly: false,

Fixed code:
      "version": "1.0.30001431",
      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001431.tgz",
      "integrity": "sha512-zBUoFU0ZcxpvSt9IU66dXVT/3ctO1cy4y9cscs1szkPlcWb6pasYM144GqrUygUbT+k7cmUCW61cvskjcv0enQ==",
  if (isNil(obj)) return obj
  const value = readJSProperty(obj, key, ownPropertyOnly)
  if (value === undefined && obj instanceof Drop) return obj.liquidMethodMissing(key)
  if (isFunction(value)) return value.call(obj)
  return value
  if (ownPropertyOnly && !Object.hasOwnProperty.call(obj, key) && !(obj instanceof Drop)) return undefined
  ownPropertyOnly: true,
CVE-2013-7416 (Python, published 2014-12-03T21:59Z)
Description: value: canto_curses/guibase.py in Canto Curses before 0.9.0 allows remote feed servers to execute arbitrary commands via shell metacharacters in a URL in a feed.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/themoken/canto-curses
Files changed:
canto_curses/guibase.py
Commit message: Proper URL quoting to avoid shell injection


Vulnerable code:

Fixed code:
        # Make sure that we quote href such that malicious URLs like
        # "http://example.com & rm -rf ~/" won't be interpreted by the shell.

        href = shlex.quote(href)
CVE-2022-4594 (Java, published 2022-12-18T08:15Z)
Description: value: A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/rogatkin/web/WarRoller.java. The manipulation leads to path traversal. The attack can be launched remotely. The name of the patch is 1bac15c496ec54efe21ad7fab4e17633778582fc. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216187.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/drogatkin/TJWS2
Files changed:
1.x/src/rogatkin/web/WarRoller.java
Commit message: the a Path Traversal vulnerability reported by Google

Vulnerable code:

Fixed code:
		    if (en.contains("../") || en.contains("/..")) 
		    	throw new IOException("The file name " + en + " contains .. which can lead to a Path Traversal vulnerability");
CVE-2023-1362 (PHP, published 2023-03-13T05:15Z)
Description: value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-1021 \u2014 Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
Repository: https://github.com/unilogies/bumsys
Files changed:
core/loader.php
Commit message: Set X-Frame-Option


Vulnerable code:

Fixed code:
// Prevent Loading iframe to other website
header("X-Frame-Options: DENY");
CVE-2019-16235 (Other, published 2019-09-11T19:15Z)
Description: value: Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/dino/dino
Files changed:
xmpp-vala/src/module/xep/0280_message_carbons.vala
Commit message: Fix check of source of a carbons message


Vulnerable code:
                string? from_attribute = message_node.get_attribute("from", Xmpp.NS_URI);
                if (from_attribute != null && from_attribute == stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid.to_string()) {

Fixed code:
                if (!message.from.equals(stream.get_flag(Bind.Flag.IDENTITY).my_jid.bare_jid)) {
                    warning("Received alleged carbon message from %s, ignoring", message.from.to_string());