hitoshura25/cvefixes huggingface dataset:
CVE-2023-5323 (PHP, published 2023-10-01T01:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
htdocs/main.inc.php
Commit message: Fix #hunter7a048bb7-bfdd-4299-931e-9bc283e92bc8

Vulnerable code:
	$inj += preg_match('/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i', $val); // onmousexxx can be set on img or any html tag like <img title='...' onmouseover=alert(1)>

Fixed code:
	// More not into the previous list
	$inj += preg_match('/on(repeat|begin|finish|beforeinput)\s*=/i', $val);
	$inj += preg_match('/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i', $tmpval); // onmousexxx can be set on img or any html tag like <img title='...' onmouseover=alert(1)>
	// More not into the previous list
	$inj += preg_match('/on(repeat|begin|finish|beforeinput)\s*=/i', $tmpval);
CVE-2023-5842 (PHP, published 2023-10-30T01:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dolibarr/dolibarr
Files changed:
htdocs/main.inc.php
Commit message: Fix #hunter7a048bb7-bfdd-4299-931e-9bc283e92bc8

Vulnerable code:
	$inj += preg_match('/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i', $val); // onmousexxx can be set on img or any html tag like <img title='...' onmouseover=alert(1)>

Fixed code:
	// More not into the previous list
	$inj += preg_match('/on(repeat|begin|finish|beforeinput)\s*=/i', $val);
	$inj += preg_match('/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i', $tmpval); // onmousexxx can be set on img or any html tag like <img title='...' onmouseover=alert(1)>
	// More not into the previous list
	$inj += preg_match('/on(repeat|begin|finish|beforeinput)\s*=/i', $tmpval);
CVE-2023-32787 (Unknown, published 2023-05-15T15:15Z)
Description: value: The OPC UA Legacy Java Stack before 6f176f2 enables an attacker to block OPC UA server applications via uncontrolled resource consumption so that they can no longer serve client applications.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/OPCFoundation/UA-Java-Legacy
Files changed:
Commit message: Merge pull request #229 from OPCFoundation/224-maxconnectioncount-should-be-limited

Fixed #224

Vulnerable code:

Fixed code:
CVE-2011-10002 (PHP, published 2023-02-07T17:15Z)
Description: value: A vulnerability classified as critical has been found in weblabyrinth 0.3.1. This affects the function Labyrinth of the file labyrinth.inc.php. The manipulation leads to sql injection. Upgrading to version 0.3.2 is able to address this issue. The identifier of the patch is 60793fd8c8c4759596d3510641e96ea40e7f60e9. It is recommended to upgrade the affected component. The identifier VDB-220221 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/rotelok/weblabyrinth
Files changed:
labyrinth.inc.php
Commit message: Fixed SQLi bug described in https://code.google.com/p/weblabyrinth/issues/detail?id=1 -- Whoops...


Vulnerable code:
		$this->crawler_ip = $ip;
		$this->crawler_useragent = $useragent;

		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$ip' AND crawler_useragent='$useragent'");

Fixed code:

		$this->crawler_ip = sqlite_escape_string($ip);
		$this->crawler_useragent = sqlite_escape_string($useragent);

		$this->crawler_info = $this->dbhandle->query("SELECT crawler_ip FROM crawlers WHERE crawler_ip='$this->ip' AND crawler_useragent='$this->useragent'");
CVE-2021-21284 (Unknown, published 2021-02-02T18:15Z)
Description: value: In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
Severity: LOW (CVSS v3 base score: 6.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/moby/moby
Files changed:
Commit message: Merge pull request #41964 from thaJeztah/CVE-2021-21284_master

[master] Fix Access to remapped root allows privilege escalation to real root (CVE-2021-21284)

Vulnerable code:

Fixed code:
CVE-2021-21285 (Unknown, published 2021-02-02T18:15Z)
Description: value: In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/moby/moby
Files changed:
Commit message: Merge pull request #41966 from thaJeztah/CVE-2021-21285_master

[master] prevent an invalid image from crashing docker daemon (CVE-2021-21285)

Vulnerable code:

Fixed code:
CVE-2022-24769 (Unknown, published 2022-03-24T20:15Z)
Description: value: Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/moby/moby
Files changed:
Commit message: Merge pull request from GHSA-2mm7-x5h6-5pvq

oci: inheritable capability set should be empty

Vulnerable code:

Fixed code:
CVE-2022-36109 (Unknown, published 2022-09-09T18:15Z)
Description: value: Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly.
Severity: nan (CVSS v3 base score: 6.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/moby/moby
Files changed:
Commit message: Merge pull request from GHSA-rc4r-wh2q-q6c4

AdditionalGids must include effective group ID

Vulnerable code:

Fixed code:
CVE-2024-24557 (Unknown, published 2024-02-01T17:15Z)
Description: value: Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-346 \u2014 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
Repository: https://github.com/moby/moby
Files changed:
Commit message: Merge pull request from GHSA-xw73-rw38-6vjc

image/cache: Restrict cache candidates to locally built images 

Vulnerable code:

Fixed code:
CVE-2021-41191 (Unknown, published 2021-10-27T21:15Z)
Description: value: Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/Redon-Tech/Roblox-Purchasing-Hub
Files changed:
Commit message: Merge pull request #8 from Redon-Tech/development

V1.0.2

Vulnerable code:

Fixed code:
CVE-2021-44664 (PHP, published 2022-02-24T21:15Z)
Description: value: An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/thexerteproject/xerteonlinetoolkits
Files changed:
editor/elfinder/php/connector.php
editor/uploadImage.php
modules/decision/engine/upload.php
modules/site/engine/upload.php
website_code/php/import/fileupload.php
Commit message: Prohibit path traversal on upload

 - Thank you Rik Lutz


Vulnerable code:
if (strpos($rootpath, 'USER-FILES') === false || strpos($rooturl, 'USER-FILES') === false)
if (strpos($_REQUEST['uploadURL'], 'USER-FILES') === false)
if (strpos($_GET['path'], 'USER-FILES') === false)
if (strpos($_GET['path'], 'USER-FILES') === false)
if (strpos($_POST['mediapath'], 'USER-FILES') === false)

Fixed code:
if (strpos($rootpath, 'USER-FILES') === false  || strpos($rootpath, '../') !== false || strpos($rooturl, 'USER-FILES') === false)
if (strpos($_REQUEST['uploadPath'], 'USER-FILES') === false || strpos($_REQUEST['uploadPath'], '../') !== false || strpos($_REQUEST['uploadURL'], 'USER-FILES') === false)
if (strpos($_GET['path'], 'USER-FILES') === false || strpos($_GET['path'], '../') !== false)
if (strpos($_GET['path'], 'USER-FILES') === false || strpos($_GET['path'], '../') !== false)
if (strpos($_POST['mediapath'], 'USER-FILES') === false || strpos($_POST['mediapath'], '../') !== false)
CVE-2021-44664 (PHP, published 2022-02-24T21:15Z)
Description: value: An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/thexerteproject/xerteonlinetoolkits
Files changed:
editor/elfinder/php/connector.php
editor/uploadImage.php
modules/decision/engine/upload.php
modules/site/engine/upload.php
website_code/php/import/fileupload.php
Commit message: Prohibit path traversal on upload

 - Thank you Rik Lutz


Vulnerable code:
if (strpos($rootpath, 'USER-FILES') === false || strpos($rooturl, 'USER-FILES') === false)
if (strpos($_REQUEST['uploadURL'], 'USER-FILES') === false)
if (strpos($_GET['path'], 'USER-FILES') === false)
if (strpos($_GET['path'], 'USER-FILES') === false)
if (strpos($_POST['mediapath'], 'USER-FILES') === false)

Fixed code:
if (strpos($rootpath, 'USER-FILES') === false  || strpos($rootpath, '../') !== false || strpos($rooturl, 'USER-FILES') === false)
if (strpos($_REQUEST['uploadPath'], 'USER-FILES') === false || strpos($_REQUEST['uploadPath'], '../') !== false || strpos($_REQUEST['uploadURL'], 'USER-FILES') === false)
if (strpos($_GET['path'], 'USER-FILES') === false || strpos($_GET['path'], '../') !== false)
if (strpos($_GET['path'], 'USER-FILES') === false || strpos($_GET['path'], '../') !== false)
if (strpos($_POST['mediapath'], 'USER-FILES') === false || strpos($_POST['mediapath'], '../') !== false)
CVE-2021-44664 (PHP, published 2022-02-24T21:15Z)
Description: value: An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/thexerteproject/xerteonlinetoolkits
Files changed:
editor/uploadImage.php
modules/decision/engine/upload.php
modules/site/engine/upload.php
website_code/php/import/fileupload.php
Commit message: Security! Check and verify paths used by move_uploaded_file

 - Make sure uploaded files can only be saved in the USER-FILES
   subfolder


Vulnerable code:

Fixed code:
// Check upload path, should contain USER-FILES
if (strpos($_REQUEST['uploadURL'], 'USER-FILES') === false)
{
    // Invalid folder, reject!
    $response->uploaded = 0;
    $response->error = IMAGEUPOLOAD_NOT_UPLOADED;

    echo json_encode($response);
    exit(-1);
}

if (strpos($_GET['path'], 'USER-FILES') === false)
    $pass = false;
if (strpos($_GET['path'], 'USER-FILES') === false)
    $pass = false;
if (strpos($_POST['mediapath'], 'USER-FILES') === false)
{
    // Invalid upload path
    _debug("Invalid or illegal mediapath");
    die("Invalid or illegal mediapath");
}
CVE-2021-44664 (PHP, published 2022-02-24T21:15Z)
Description: value: An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/thexerteproject/xerteonlinetoolkits
Files changed:
editor/uploadImage.php
modules/decision/engine/upload.php
modules/site/engine/upload.php
website_code/php/import/fileupload.php
Commit message: Security! Check and verify paths used by move_uploaded_file

 - Make sure uploaded files can only be saved in the USER-FILES
   subfolder


Vulnerable code:

Fixed code:
// Check upload path, should contain USER-FILES
if (strpos($_REQUEST['uploadURL'], 'USER-FILES') === false)
{
    // Invalid folder, reject!
    $response->uploaded = 0;
    $response->error = IMAGEUPOLOAD_NOT_UPLOADED;

    echo json_encode($response);
    exit(-1);
}

if (strpos($_GET['path'], 'USER-FILES') === false)
    $pass = false;
if (strpos($_GET['path'], 'USER-FILES') === false)
    $pass = false;
if (strpos($_POST['mediapath'], 'USER-FILES') === false)
{
    // Invalid upload path
    _debug("Invalid or illegal mediapath");
    die("Invalid or illegal mediapath");
}
CVE-2017-16642 (Other, published 2017-11-07T21:29Z)
Description: value: In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/derickr/timelib
Files changed:
parse_date.re
tests/files/frontof.parse
Commit message: Fix parser rule for 'backof' and 'frontof'


Vulnerable code:
backof           = 'back of ' hour24 space? meridian?;
frontof          = 'front of ' hour24 space? meridian?;

Fixed code:
backof           = 'back of ' hour24 (space? meridian)?;
frontof          = 'front of ' hour24 (space? meridian)?;
TS: 0 | -99999--99999--99999 -1:45:00 | frONt of 0 0
TS: 0 | -99999--99999--99999 15:45:00 | frONt of 4pm
TS: 0 | -99999--99999--99999 15:45:00 | frONt of 4 pm