hitoshura25/cvefixes huggingface dataset:
CVE-2023-48715 (PHP, published 2023-12-11T19:15Z)
Description: value: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and prior to versions 15.2-4 and 15.1-8 of Tuleap Enterprise Edition, the name of the releases are not properly escaped on the edition page of a release. A malicious user with the ability to create a FRS release could force a victim having write permissions in the FRS to execute uncontrolled code. Tuleap Community Edition 15.2.99.103, Tuleap Enterprise Edition 15.2-4, and Tuleap Enterprise Edition 15.1-8 contain a fix for this issue.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Enalean/tuleap
Files changed:
src/www/file/file_utils.php
Commit message: Fixes request #35143: XSS on the edition page of a release

Change-Id: I351c201117301e8a28ba56d8330c468d026d3050


Vulnerable code:

function frs_show_release_popup($group_id, $name = 'release_id', $checked_val = "xzxz")
{
    /*
        return a pop-up select box of releases for the project
    */
    global $FRS_RELEASE_ID_RES,$FRS_RELEASE_NAME_RES,$Language;
    $release_factory = new FRSReleaseFactory();
    if (! $group_id) {
        return $Language->getText('file_file_utils', 'g_id_err');
    } else {
        if (! isset($FRS_RELEASE_ID_RES)) {
            $res                  = $release_factory->getFRSReleasesInfoListFromDb($group_id);
            $FRS_RELEASE_ID_RES   = [];
            $FRS_RELEASE_NAME_RES = [];
            foreach ($res as $release) {
                $FRS_RELEASE_ID_RES[]   = $release['release_id'];
                $FRS_RELEASE_NAME_RES[] = $release['package_name'] . ':' . $release['release_name'];
            }
        }
        return html_build_select_box_from_arrays($FRS_RELEASE_ID_RES, $FRS_RELEASE_NAME_RES, $name, $checked_val, false);
    }
}
        $select = '<select name="' . $name . '">';
            $select .= '<optgroup label="' . $package_name . '">';
                $select .= '<option value="' . $id . '" ' . ($id == $checked_val ? 'selected="selected"' : '') . '>' . $hp->purify($name) . '</option>';

Fixed code:
        $select = '<select name="' . $hp->purify($name) . '">';
            $select .= '<optgroup label="' . $hp->purify($package_name) . '">';
                $select .= '<option value="' . $hp->purify($id) . '" ' . ($id == $checked_val ? 'selected="selected"' : '') . '>' . $hp->purify($name) . '</option>';
CVE-2022-23065 (TypeScript, published 2022-05-02T13:15Z)
Description: value: In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/vendure-ecommerce/vendure
Files changed:
packages/asset-server-plugin/src/plugin.ts
Commit message: fix(asset-server-plugin): Fix svg XSS vulnerability

It was discovered that a malicious SVG file containing javascript could be executed when opening the
source file in a new tab. This is now mitigated by adding a Content Security Policy header
to responses from the AssetServerPlugin.


Vulnerable code:

Fixed code:
                res.setHeader('content-security-policy', `default-src 'self'`);
                        res.setHeader('content-security-policy', `default-src 'self'`);
CVE-2010-10010 (PHP, published 2023-06-01T05:15Z)
Description: value: A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.2.2b is able to address this issue. The identifier of the patch is 5d3b7311fd5085ec6ea1b1bfa9a05285964e07e4. It is recommended to upgrade the affected component. The identifier VDB-230265 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/StarsAlliance/PsychoStats
Files changed:
upload/admin/login.php
Commit message: User JS2007 detected a "poisoned-URL" XSS-Defacement
Link: http://www.psychostats.com/forums/index.php?showtopic=20796&hl=


Vulnerable code:

Fixed code:
$_GET['ref'] = htmlspecialchars($_GET['ref']); //XSS Fix. Thanks to JS2007
CVE-2012-2671 (Unknown, published 2012-06-17T03:41Z)
Description: value: The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/rtomayko/rack-cache
Files changed:
Commit message: Merge pull request #52 from rmm5t/strip_set_cookie

Rack::Cache caches Set-Cookie response headers yielding potential security holes in apps

Vulnerable code:

Fixed code: