hitoshura25/cvefixes huggingface dataset:
CVE-2016-5730 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
examples/openid.php
Commit message: Improve error handling in OpenID example

- properly check parameter types
- catch all exceptions (eg. network error)

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
if (isset($_POST['identifier'])) {
} else if (isset($_SESSION['identifier'])) {
} catch (OpenID_Exception $e) {

Fixed code:
if (isset($_POST['identifier']) && is_string($_POST['identifier'])) {
} else if (isset($_SESSION['identifier']) && is_string($_SESSION['identifier'])) {
} catch (Exception $e) {
CVE-2016-5730 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
setup/validate.php
Commit message: Fix error reporting on invalid request data

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
    $result = 'Wrong data or no validation for ' . $vids;

Fixed code:
    $result = sprintf(
        __('Wrong data or no validation for %s'),
        implode(',', $vids)
    );
CVE-2016-5731 (PHP, published 2016-07-03T01:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
examples/openid.php
Commit message: Add error handling to constructing openid message

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
    $contents = "<div class='relyingparty_results'>\n";
    $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
    $contents .= "</div class='relyingparty_results'>";
    Show_page($contents);
    exit;
        $contents = "<div class='relyingparty_results'>\n";
        $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
        $contents .= "</div class='relyingparty_results'>";
        Show_page($contents);
        exit;
    $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);

Fixed code:
function Die_error($e)
{
    $contents = "<div class='relyingparty_results'>\n";
    $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
    $contents .= "</div class='relyingparty_results'>";
    Show_page($contents);
    exit;
}


    Die_error($e);
        Die_error($e);
    try {
        $message = new OpenID_Message($queryString, OpenID_Message::FORMAT_HTTP);
    } catch (Exception $e) {
        Die_error($e);
    }
CVE-2016-5731 (PHP, published 2016-07-03T01:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
examples/openid.php
Commit message: Escape error messages from OpenID

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
    $contents .= "<pre>" . $e->getMessage() . "</pre>\n";
    } catch (OpenID_Exception $e) {
        $contents .= "<pre>" . $e->getMessage() . "</pre>\n";

Fixed code:
    $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
    } catch (Exception $e) {
        $contents .= "<pre>" . htmlspecialchars($e->getMessage()) . "</pre>\n";
CVE-2016-5732 (Other, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
templates/table/structure/display_partitions.phtml
Commit message: Add missing escaping to partition listing

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                <code><?= $partitionMethod , '(' , $partitionExpression , ' )'; ?></code>
                    <code><?= $subPartitionMethod , '(' , $subPartitionExpression , ' )'; ?></code>
</div>

Fixed code:
                <code><?= htmlspecialchars($partitionMethod) , '(' , htmlspecialchars($partitionExpression) , ' )'; ?></code>
                    <code><?= htmlspecialchars($subPartitionMethod) , '(' , htmlspecialchars($subPartitionExpression) , ' )'; ?></code>
</div>
CVE-2016-5732 (Other, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
templates/table/structure/display_partitions.phtml
Commit message: Escape partition comment when displaying

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                        <td><?= $partition->getComment(); ?></td>

Fixed code:
                        <td><?= htmlspecialchars($partition->getComment()); ?></td>
CVE-2016-5733 (Other, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
templates/server/binlog/log_selector.phtml
Commit message: Escape binary log name

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                <option value="<?= $each_log['Log_name']; ?>"<?= ($each_log['Log_name'] == $_REQUEST['log'] ? ' selected="selected"' : ''); ?>>
                    <?= $each_log['Log_name']; ?>
</form>

Fixed code:
                <option value="<?= htmlspecialchars($each_log['Log_name']); ?>"<?= ($each_log['Log_name'] == $_REQUEST['log'] ? ' selected="selected"' : ''); ?>>
                    <?= htmlspecialchars($each_log['Log_name']); ?>
</form>
CVE-2016-5733 (JavaScript, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/tbl_chart.js
Commit message: Fixed rendering of chart of columns with HTML inside

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
        columnNames.push($(this).text());

Fixed code:
        columnNames.push(escapeHtml($(this).text()));
CVE-2016-5733 (Other, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
templates/table/search/rows_zoom.phtml
Commit message: Properly escape zoom search column type

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                    value="<?= $_POST['criteriaColumnTypes'][$i]; ?>"

Fixed code:
                    value="<?= htmlspecialchars($_POST['criteriaColumnTypes'][$i]); ?>"
CVE-2016-5733 (Other, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
templates/server/databases/table_row.phtml
Commit message: Properly escape translated string

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
           title="<?= sprintf(__('Check privileges for database "%s".'), htmlspecialchars($current['SCHEMA_NAME'])); ?>">
</tr>

Fixed code:
           title="<?= htmlspecialchars(sprintf(__('Check privileges for database "%s".'), $current['SCHEMA_NAME'])); ?>">
</tr>
CVE-2016-5733 (JavaScript, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/ajax.js
Commit message: Escape HTML when rendering AJAX error

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
            '<div>' + errorCode + '</div>' +
            '<div>' + errorText + '</div>' +

Fixed code:
            '<div>' + escapeHtml(errorCode) + '</div>' +
            '<div>' + escapeHtml(errorText) + '</div>' +
CVE-2016-5733 (PHP, published 2016-07-03T01:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
js/get_image.js.php
Commit message: Escape attributes when showing images in javascript

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
        retval.attr('alt', attributes.alt);
        retval.attr('alt', alternate);
        retval.attr('title', attributes.title);
        retval.attr('title', alternate);

Fixed code:
        retval.attr('alt', escapeHtml(attributes.alt));
        retval.attr('alt', escapeHtml(alternate));
        retval.attr('title', escapeHtml(attributes.title));
        retval.attr('title', escapeHtml(alternate));
CVE-2016-5734 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
import.php
libraries/Tracker.php
libraries/plugins/export/ExportSql.php
templates/columns_definitions/transformation.phtml
test/libraries/core/PMA_warnMissingExtension_test.php
Commit message: Quote delimiter before using preg_replace

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
            $quoted = preg_quote($parameter);
                    '/`' . preg_quote($dbname) . '`\s?\./',
                    '/' . preg_quote(Util::backquote($db)) . '\./',
                         && preg_match('@' . preg_quote($available_mime[$type . '_file'][$mimekey]) . '3?@i',
</select>
        $this->expectOutputRegex('@' . preg_quote($warn) . '@');

Fixed code:
            $quoted = preg_quote($parameter, '/');
                    '/`' . preg_quote($dbname, '/') . '`\s?\./',
                    '/' . preg_quote(Util::backquote($db), '/') . '\./',
                         && preg_match('@' . preg_quote($available_mime[$type . '_file'][$mimekey], '@') . '3?@i',
</select>
        $this->expectOutputRegex('@' . preg_quote($warn, '@') . '@');
CVE-2016-5734 (PHP, published 2016-07-03T01:59Z)
Description: value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/controllers/table/TableSearchController.php
Commit message: Always use delimiter not present in search expression

This avoids need to figure out correct escaping in case delimiter is
present in the expression.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
                    "/" . $find . "/",

Fixed code:
            /* Iterate over possible delimiters to get one */
            $delimiters = array('/', '@', '#', '~', '!', '$', '%', '^', '&', '_');
            $found = false;
            for ($i = 0; $i < count($delimiters); $i++) {
                if (strpos($find, $delimiters[$i]) === false) {
                    $found = true;
                    break;
                }
            }
            if (! $found) {
                return false;
            }
            $find = $delimiters[$i] . $find . $delimiters[$i];
                    $find,
CVE-2016-5739 (PHP, published 2016-07-03T01:59Z)
Description: value: The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/Header.php
Commit message: Update referrer <meta> to match current standards

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:
        $retval .= '<meta name="referrer" content="none" />';

Fixed code:
        $retval .= '<meta name="referrer" content="no-referrer" />';
CVE-2016-5739 (PHP, published 2016-07-03T01:59Z)
Description: value: The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/phpmyadmin/phpmyadmin
Files changed:
libraries/Header.php
Commit message: Add referrer CSP and <meta> tag

This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>


Vulnerable code:

Fixed code:
            . "referrer no-referrer;"
            . "referrer no-referrer;"
            . "referrer no-referrer;"
        $retval .= '<meta name="referrer" content="none" />';