hitoshura25/cvefixes huggingface dataset:
CVE-2023-0810 (C#, published 2023-02-13T17:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.11.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/btcpayserver/btcpayserver
Files changed:
BTCPayServer/Storage/StorageExtensions.cs
Commit message: Fix XSS: Stenghten CSP rules on static file uploads (#4629)



Vulnerable code:
                context.Context.Response.Headers["Content-Security-Policy"] = "script-src 'self'";

Fixed code:
                context.Context.Response.Headers["Content-Security-Policy"] = "script-src ;";
CVE-2020-7762 (JavaScript, published 2020-11-05T13:15Z)
Description: value: This affects the package jsreport-chrome-pdf before 1.10.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/jsreport/jsreport-chrome-pdf
Files changed:
lib/conversion.js
Commit message: block file requests


Vulnerable code:

Fixed code:
    await page.setRequestInterception(true)

    if (executionInfo.error) {
      return
    }


      const isRelativeToHtmlUrl = r.url().lastIndexOf(htmlUrl, 0) === 0

      if (
        !isRelativeToHtmlUrl &&
        // potentially dangerous request to local file
        r.url().lastIndexOf('file:///', 0) === 0
      ) {
        r.abort('accessdenied')
        return
      }

      r.continue()
CVE-2020-7764 (JavaScript, published 2020-11-08T16:15Z)
Description: value: This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/delvedor/find-my-way
Files changed:
README.md
index.js
lib/accept-version.js
test/version.default-versioning.test.js
Commit message: Enable versioning on demand (#172)



Vulnerable code:
If needed you can provide a `version` option, which will allow you to declare multiple versions of the same route.
  this.versioning = opts.versioning || acceptVersionStrategy
module.exports = {
  storage: SemVerStore,
  deriveVersion: function (req, ctx) {
    return req.headers['accept-version']

Fixed code:
If needed you can provide a `version` option, which will allow you to declare multiple versions of the same route. If you never configure a versioned route, the `'Accept-Version'` header will be ignored.

Remember to set a [Vary](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary) header in your responses with the value you are using for deifning the versioning (e.g.: 'Accept-Version'), to prevent cache poisoning attacks. You can also configure this as part your Proxy/CDN.
  this.versioning = opts.versioning || acceptVersionStrategy(false)
  if (version != null && this.versioning.disabled) {
    this.versioning = acceptVersionStrategy(true)
  }
function build (enabled) {
  if (enabled) {
    return {
      storage: SemVerStore,
      deriveVersion: function (req, ctx) {
        return req.headers['accept-version']
      }
    }
  }
  return {
    storage: SemVerStore,
    deriveVersion: function (req, ctx) {},
    disabled: true

module.exports = build

test('Versioning won\'t work if there are no versioned routes', t => {
  t.plan(2)

  const findMyWay = FindMyWay({
    defaultRoute: (req, res) => {
      t.fail('We should not be here')
    }
  })

  findMyWay.on('GET', '/', (req, res) => {
    t.pass('Yeah!')
  })

  findMyWay.lookup({
    method: 'GET',
    url: '/',
    headers: { 'accept-version': '2.x' }
  }, null)

  findMyWay.lookup({
    method: 'GET',
    url: '/'
  }, null)
})
CVE-2021-23484 (JavaScript, published 2022-01-28T22:15Z)
Description: value: The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Mostafa-Samir/zip-local
Files changed:
tests/unzip.sync.test.js
Commit message: add test for sync unzipping a zip-slip attack file


Vulnerable code:

Fixed code:
    it("should raise an error when an entry is outside extraction path", function () {
        fs.mkdirSync("./tests/assets/zip-slip-sync");
        expect(
            zipper.sync.unzip("./tests/assets/zip-slip.zip").save("./tests/assets/zip-slip-sync")
        ).to.throw("Entry is outside the extraction path")
    });
CVE-2021-33318 (C#, published 2022-05-16T16:15Z)
Description: value: An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-704 \u2014 Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
Repository: https://github.com/jchristn/IpMatcher
Files changed:
IpMatcher/IpMatcher.csproj
IpMatcher/IpMatcher.xml
IpMatcher/Matcher.cs
Commit message: NuGet v1.0.4.2, fix for SICK-2021-060


Vulnerable code:
    <Version>1.0.4.1</Version>
    <PackageReleaseNotes>XML documentation</PackageReleaseNotes>
    <DocumentationFile>C:\Code\Misc\IpMatcher\IpMatcher\IpMatcher.xml</DocumentationFile>

Fixed code:
    <Version>1.0.4.2</Version>
    <PackageReleaseNotes>Fix for SICK-2021-060</PackageReleaseNotes>
    <DocumentationFile>IpMatcher.xml</DocumentationFile>
  </PropertyGroup>

  <PropertyGroup Condition="'$(Configuration)|$(TargetFramework)|$(Platform)'=='Debug|netstandard2.0|AnyCPU'">
    <DocumentationFile>IpMatcher.xml</DocumentationFile>
        <member name="F:IpMatcher.Matcher.Logger">
            <summary>
            Method to invoke to send log messages.
            </summary>
        </member>
        <member name="M:IpMatcher.Matcher.All">
            <summary>
            Retrieve all stored addresses.
            </summary>
            <returns></returns>
        </member>
            ip = IPAddress.Parse(ip).ToString();
            netmask = IPAddress.Parse(netmask).ToString();

            ip = IPAddress.Parse(ip).ToString();
            netmask = IPAddress.Parse(netmask).ToString();

            ip = IPAddress.Parse(ip).ToString();

            ip = IPAddress.Parse(ip).ToString();
CVE-2014-4501 (C, published 2014-07-23T14:55Z)
Description: value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/luke-jr/bfgminer
Files changed:
util.c
Commit message: Stratum: extract_sockaddr: Truncate overlong addresses rather than stack overflow

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!


Vulnerable code:

Fixed code:
	
	if (url_len >= sizeof(url_address))
	{
		applog(LOG_WARNING, "%s: Truncating overflowed address '%.*s'",
		       __func__, url_len, url_begin);
		url_len = sizeof(url_address) - 1;
	}
CVE-2014-4502 (C, published 2014-07-23T14:55Z)
Description: value: Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/luke-jr/bfgminer
Files changed:
util.c
Commit message: Bugfix: initiate_stratum: Ensure extranonce2 size is not negative (which could lead to exploits later as too little memory gets allocated)

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!


Vulnerable code:
	if (!n2size) {

Fixed code:
	if (n2size < 1)
	{
CVE-2023-0289 (PHP, published 2023-01-13T16:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository craigk5n/webcalendar prior to master.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/craigk5n/webcalendar
Files changed:
includes/functions.php
view_entry.php
Commit message: Security fix: Location event field XSS
- CWE-79: Cross-site Scripting (XSS) - Stored
- The location field was not being properly escaped when presented in
  a number of views, allowing malicious script to run on the user's
  browser.


Vulnerable code:
    ? '<dt>' . translate ( 'Location' ) . ":</dt>\n<dd> $location</dd>\n" : '' )
echo '<div class="row"><div class="col-3">' . translate('Description') . "</div>\n";
echo '<div class="col-9">'  . $location . "</div>\n";

Fixed code:
    ? '<dt>' . translate ( 'Location' ) . ":</dt>\n<dd>" . htmlspecialchars($location) . "</dd>\n" : '' )
echo '<div class="row"><div class="col-3">' . translate('Location') . "</div>\n";
echo '<div class="col-9">'  . htmlentities($location) . "</div>\n";
CVE-2022-31196 (Java, published 2022-09-02T20:15Z)
Description: value: Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerability. The SSRF is triggered by a sending a **single** HTTP POST request to create a databaseType. By supplying a `jdbcDriverFileUrl` that returns a non `200` response code, the url is executed, the response is logged (both in terminal and in database) and is included in the response. This would allow an attackers to obtain the real IP address and scan Intranet information. This issue was fixed in version 1.0.7.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/vran-dev/databasir
Files changed:
core/src/main/java/com/databasir/core/infrastructure/driver/DriverResources.java
Commit message: fix: security vulnerability SSRF (#256)



Vulnerable code:
            log.error("下载驱动时创建目录失败", e);
            log.error(parentDir + " download driver error", e);
            throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(e.getMessage());

Fixed code:
            log.error("create directory for driver failed", e);
            String msg = String.format("download driver from %s to %s failed", driverFileUrl, parentDir);
            log.error(msg, e);
            throw DomainErrors.DOWNLOAD_DRIVER_ERROR.exception(msg);
CVE-2024-1394 (Unknown, published 2024-03-21T13:00Z)
Description: value: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs?. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey? and ctx?. That function uses named return parameters to free pkey? and ctx? if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey? and ctx? will be nil inside the deferred function that should free them.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/golang-fips/openssl
Files changed:
Commit message: Merge pull request from GHSA-78hx-gp6g-7mj6

Fix memory leak in setupEVP and newCipherCtx

Vulnerable code:

Fixed code:
CVE-2022-1163 (Other, published 2022-03-30T07:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/mineweb/minewebcms
Files changed:
app/View/Navbar/admin_add.ctp
app/View/Navbar/admin_edit.ctp
Commit message: improv. fix xss with navbar


Vulnerable code:
                l = l[1];
                p = p[1];
                                                   value="<?= urldecode($name) ?>" name="name_of_nav">
                                                   value="<?= urldecode($url) ?>"
                l = l[1];
                p = p[1];

Fixed code:
                l = decodeURIComponent(l[1]);
                p = decodeURIComponent(p[1]);
                                                   value="<?= $name ?>" name="name_of_nav">
                                                   value="<?= $url ?>"
                l = decodeURIComponent(l[1]);
                p = decodeURIComponent(p[1]);
CVE-2022-4413 (TypeScript, published 2022-12-12T00:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nuxt/framework
Files changed:
packages/nuxt/src/core/runtime/nitro/renderer.ts
Commit message: fix(nuxt): disallow directly rendering error page (#8673)



Vulnerable code:
import { appendHeader, getQuery, writeEarlyHints } from 'h3'

Fixed code:
import { appendHeader, createError, getQuery, writeEarlyHints } from 'h3'
  if (ssrError && event.req.socket.readyState !== 'readOnly' /* direct request */) {
    throw createError('Cannot directly render error page!')
  }
CVE-2022-4414 (TypeScript, published 2022-12-12T00:15Z)
Description: value: Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nuxt/framework
Files changed:
packages/nuxt/src/app/composables/payload.ts
Commit message: fix(nuxt): ensure payload url has no protocol (#8675)



Vulnerable code:
import { parseURL, joinURL } from 'ufo'
  const parsed = parseURL(url)
  if (parsed.search) {
  return joinURL(useRuntimeConfig().app.baseURL, parsed.pathname, hash ? `_payload.${hash}.js` : '_payload.js')

Fixed code:
import { joinURL } from 'ufo'
  const u = new URL(url, 'http://localhost')
  if (u.search) {
  if (u.host !== 'localhost') {
    throw new Error('Payload URL cannot contain host: ' + url)
  }
  return joinURL(useRuntimeConfig().app.baseURL, u.pathname, hash ? `_payload.${hash}.js` : '_payload.js')
CVE-2023-39518 (PHP, published 2023-08-08T19:15Z)
Description: value: social-media-skeleton is an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Versions 1.0.0 until 1.0.3 have a stored cross-site scripting vulnerability. The problem is patched in v1.0.3.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/fobybus/social-media-skeleton
Files changed:
admin/atask/add.php
admin/atask/setting.php
signup.php
Commit message: Fix XSS issue (#4)

* Fix XSS issue

* Fix Stored XSS

Vulnerable code:
$uemail=$_POST["email"];
$upass=$_POST["password"];
	$newemail=$_POST['email'];
	$newpass=$_POST['password'];
		$oldpass=$_POST['oldpass'];
$uemail=$_POST["email"];
$upass=$_POST["password"];
$ufname=$_POST["fname"];
$ulname=$_POST["lname"];
$ugender=$_POST['gender'];
$ubdate=$_POST['bdate'];
$uelevel=$_POST['elevel'];
$ucity=$_POST['city'];

Fixed code:
$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
	$newemail=htmlspecialchars($_POST['email'], ENT_QUOTES, 'UTF-8');
	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
$ufname=htmlspecialchars($_POST["fname"], ENT_QUOTES, 'UTF-8');
$ulname=htmlspecialchars($_POST["lname"], ENT_QUOTES, 'UTF-8');
$ugender=htmlspecialchars($_POST['gender'], ENT_QUOTES, 'UTF-8');
$ubdate=htmlspecialchars($_POST['bdate'], ENT_QUOTES, 'UTF-8');
$uelevel=htmlspecialchars($_POST['elevel'], ENT_QUOTES, 'UTF-8');
$ucity=htmlspecialchars($_POST['city'], ENT_QUOTES, 'UTF-8');
CVE-2023-40174 (PHP, published 2023-08-18T22:15Z)
Description: value: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/fobybus/social-media-skeleton
Files changed:
admin/atask/add.php
admin/atask/setting.php
admin/home.php
admin/login.php
admin/mg.php
login.php
tasks/passw.php
user/home.php
user/profile.php
user/setting.php
Commit message: added session expiration


Vulnerable code:
<?php
      //session start

Fixed code:
 //is expired 
 if(sexpired())
 {
    header("location:logout.php");
    exit();
 }


 //is expired 
 if(sexpired())
 {
    header("location:logout.php");
    exit();
 }
 
include("../tasks/passw.php");

 //is expired 
if(sexpired())
{
   header("location:atask/logout.php");
   exit();
}

    $_SESSION["exp_time"]=time()+(10);
include("../tasks/passw.php");

 //is expired 
 if(sexpired())
 {
    header("location:atask/logout.php");
    exit();
 }

<?php   
      //session start 
  $_SESSION["exp_time"]=time()+(10);
//check se exp 
function sexpired()
{
  if(isset($_SESSION["exp_time"]) && $_SESSION["exp_time"]<time())
   return true; 
   else 
   return false;
}

require("../tasks/passw.php");

//is expired 
if(sexpired())
{
   header("location:logout.php");
   exit();
}

require("../tasks/passw.php");

//is expired 
if(sexpired())
{
   header("location:logout.php");
   exit();
}

//is expired 
if(sexpired())
{
   header("location:logout.php");
   exit();
}