Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-24816: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the `preview` feature. All integrators that use these samples in the production code can be affected. The vulnerability allows an attacker to execute JavaScript code by abusing the misconfigured preview feature. It affects all users using the CKEditor 4 at version < 4.24.0-lts with affected samples used in a production environment. A fix is available in version 4.24.0-lts.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-02-07T17:15Z
Repository: https://github.com/ckeditor/ckeditor4
Language: Unknown
Commit date: 2024-01-16 13:47:10 +0100
Commit message: Merge commit
CVE-2010-10008: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file templates/trust.tpl.php. The manipulation of the argument StateID leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The identifier of the patch is 8365d48c863cf06ccf1465cc0a161cefae29d69d. It is recommended to upgrade the affected component. The identifier VDB-218473 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-17T08:15Z
Repository: https://github.com/simplesamlphp/simplesamlphp-module-openidprovider
Language: PHP
Files changed: templates/trust.tpl.php
Commit date: 2010-07-29 10:42:27 +0000
Commit message: openidProvider: Fix cross-site scripting.

If someone is able to perform a session fixation attack on the
openidProvider host, he can then make users execute scripts in that
domain.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2445 44740490-163a-0410-bde0-09ae8108e29a

Diff: diff --git a/templates/trust.tpl.php b/templates/trust.tpl.php
index f924171..5cbb595 100644
--- a/templates/trust.tpl.php
+++ b/templates/trust.tpl.php
@@ -8,11 +8,11 @@ $params = array(
 	'%SITEURL%' => '<code>' . htmlspecialchars($this->data['trustRoot']) . '</code>',
 	);
 echo('<p>' . $this->t('{openidProvider:openidProvider:confirm_question}', $params) . '</p>');
 ?>
 <form method="post" action="?">
-<input type="hidden" name="StateID" value="<?php echo $this->data['StateID']; ?>" />
+<input type="hidden" name="StateID" value="<?php echo htmlspecialchars($this->data['StateID']); ?>" />
 
 <input type="checkbox" name="TrustRemember" value="on" id="remember" />
 <label for="TrustRemember"><?php echo($this->t('{openidProvider:openidProvider:remember}')); ?></label>
 <br />
 

Vulnerable code: <input type="hidden" name="StateID" value="<?php echo $this->data['StateID']; ?>" />
Fixed code: <input type="hidden" name="StateID" value="<?php echo htmlspecialchars($this->data['StateID']); ?>" />
CVE-2017-18187: Integer Overflow or Wraparound (CWE-190)
value: In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-02-14T17:29Z
Repository: https://github.com/ARMmbed/mbedtls
Language: C
Files changed: library/ssl_srv.c
Commit date: 2017-06-26 14:09:55 +0100
Commit message: Prevent bounds check bypass through overflow in PSK identity parsing

The check `if( *p + n > end )` in `ssl_parse_client_psk_identity` is
unsafe because `*p + n` might overflow, thus bypassing the check. As
`n` is a user-specified value up to 65K, this is relevant if the
library happens to be located in the last 65K of virtual memory.

This commit replaces the check by a safe version.

Diff: diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index f137c3dce..97d7a9e80 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -3434,20 +3434,20 @@ static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned cha
     }
 
     /*
      * Receive client pre-shared key identity name
      */
-    if( *p + 2 > end )
+    if( end - *p < 2 )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
         return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 
     n = ( (*p)[0] << 8 ) | (*p)[1];
     *p += 2;
 
-    if( n < 1 || n > 65535 || *p + n > end )
+    if( n < 1 || n > 65535 || n > (size_t) ( end - *p ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
         return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
     }
 

Vulnerable code:     if( *p + 2 > end )
    if( n < 1 || n > 65535 || *p + n > end )
Fixed code:     if( end - *p < 2 )
    if( n < 1 || n > 65535 || n > (size_t) ( end - *p ) )
CVE-2018-9988: Out-of-bounds Read (CWE-125)
value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2018-04-10T19:29Z
Repository: https://github.com/ARMmbed/mbedtls
Language: C
Files changed: library/ssl_cli.c
Commit date: 2018-03-13 11:28:49 +0100
Commit message: Add bounds check before signature length read

Diff: diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 2534346a4..279a127ba 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2476,10 +2476,18 @@ static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
         }
 
         /*
          * Read signature
          */
+
+        if( p > end - 2 )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
+            mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                            MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
+            return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
+        }
         sig_len = ( p[0] << 8 ) | p[1];
         p += 2;
 
         if( end != p + sig_len )
         {

Fixed code: 
        if( p > end - 2 )
        {
            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
            mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                            MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
            return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
        }
CVE-2018-9988: Out-of-bounds Read (CWE-125)
value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2018-04-10T19:29Z
Repository: https://github.com/ARMmbed/mbedtls
Language: C
Files changed: library/ssl_cli.c
Commit date: 2018-03-13 11:29:24 +0100
Commit message: Prevent arithmetic overflow on bounds check

Diff: diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 279a127ba..df6abc389 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2487,11 +2487,11 @@ static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
         }
         sig_len = ( p[0] << 8 ) | p[1];
         p += 2;
 
-        if( end != p + sig_len )
+        if( p != end - sig_len )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );

Vulnerable code:         if( end != p + sig_len )
Fixed code:         if( p != end - sig_len )
CVE-2018-9989: Out-of-bounds Read (CWE-125)
value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2018-04-10T19:29Z
Repository: https://github.com/ARMmbed/mbedtls
Language: C
Files changed: library/ssl_cli.c
Commit date: 2018-03-13 11:31:14 +0100
Commit message: Add bounds check before length read

Diff: diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 2534346a4..585750ef2 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2055,10 +2055,16 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
     /*
      * PSK parameters:
      *
      * opaque psk_identity_hint<0..2^16-1>;
      */
+    if( (*p) > end - 2 )
+    {
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
+                                    "(psk_identity_hint length)" ) );
+        return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
+    }
     len = (*p)[0] << 8 | (*p)[1];
     *p += 2;
 
     if( (*p) + len > end )
     {

Fixed code:     if( (*p) > end - 2 )
    {
        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
                                    "(psk_identity_hint length)" ) );
        return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
    }
CVE-2018-9989: Out-of-bounds Read (CWE-125)
value: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2018-04-10T19:29Z
Repository: https://github.com/ARMmbed/mbedtls
Language: C
Files changed: library/ssl_cli.c
Commit date: 2018-03-13 11:31:38 +0100
Commit message: Prevent arithmetic overflow on bounds check

Diff: diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 585750ef2e..759a4562a1 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -2064,11 +2064,11 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
     }
     len = (*p)[0] << 8 | (*p)[1];
     *p += 2;
 
-    if( (*p) + len > end )
+    if( (*p) > end - len )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
                                     "(psk_identity_hint length)" ) );
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
     }

Vulnerable code:     if( (*p) + len > end )
Fixed code:     if( (*p) > end - len )
CVE-2024-23685: Use of Hard-coded Credentials (CWE-798)
value: Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.



CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 5.3
Published: 2024-01-19T21:15Z
Repository: https://github.com/folio-org/mod-remote-storage
Language: Unknown
Commit date: 2023-07-20 14:11:26 +0200
Commit message: Merge pull request from GHSA-m8v7-469p-5x89

MODRS-174: Hard-coded system user credentials
CVE-2022-0472: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 5.4
Published: 2022-02-04T23:15Z
Repository: https://github.com/jsdecena/laracom
Language: PHP
Files changed: project/app/Shop/Products/Requests/UpdateProductRequest.php
Commit date: 2022-02-02 11:16:55 +1300
Commit message: Fix vulnerability report from hunter.dev

Diff: diff --git a/project/app/Shop/Products/Requests/UpdateProductRequest.php b/project/app/Shop/Products/Requests/UpdateProductRequest.php
index 2ef53f0..1527834 100644
--- a/project/app/Shop/Products/Requests/UpdateProductRequest.php
+++ b/project/app/Shop/Products/Requests/UpdateProductRequest.php
@@ -18,9 +18,11 @@ class UpdateProductRequest extends BaseFormRequest
             'sku' => ['required'],
             'name' => ['required', Rule::unique('products')->ignore($this->segment(3))],
             'quantity' => ['required', 'integer', 'min:0'],
             'price' => ['required', 'numeric', 'min:0'],
             'sale_price' => ['nullable', 'numeric'],
-            'weight' => ['nullable', 'numeric', 'min:0']
+            'weight' => ['nullable', 'numeric', 'min:0'],
+            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
+            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
         ];
     }
 }

Vulnerable code:             'weight' => ['nullable', 'numeric', 'min:0']
Fixed code:             'weight' => ['nullable', 'numeric', 'min:0'],
            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
CVE-2022-0472: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-04T23:15Z
Repository: https://github.com/jsdecena/laracom
Language: PHP
Files changed: project/app/Shop/Products/Requests/UpdateProductRequest.php
Commit date: 2022-02-02 11:16:55 +1300
Commit message: Fix vulnerability report from hunter.dev

Diff: diff --git a/project/app/Shop/Products/Requests/UpdateProductRequest.php b/project/app/Shop/Products/Requests/UpdateProductRequest.php
index 2ef53f0..1527834 100644
--- a/project/app/Shop/Products/Requests/UpdateProductRequest.php
+++ b/project/app/Shop/Products/Requests/UpdateProductRequest.php
@@ -18,9 +18,11 @@ class UpdateProductRequest extends BaseFormRequest
             'sku' => ['required'],
             'name' => ['required', Rule::unique('products')->ignore($this->segment(3))],
             'quantity' => ['required', 'integer', 'min:0'],
             'price' => ['required', 'numeric', 'min:0'],
             'sale_price' => ['nullable', 'numeric'],
-            'weight' => ['nullable', 'numeric', 'min:0']
+            'weight' => ['nullable', 'numeric', 'min:0'],
+            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
+            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
         ];
     }
 }

Vulnerable code:             'weight' => ['nullable', 'numeric', 'min:0']
Fixed code:             'weight' => ['nullable', 'numeric', 'min:0'],
            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
            'cover' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
CVE-2014-9721: Improper Input Validation (CWE-20)
value: libzmq before 4.0.6 and 4.1.x before 4.1.1 allows remote attackers to conduct downgrade attacks and bypass ZMTP v3 protocol security mechanisms via a ZMTP v2 or earlier header.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2015-06-03T20:59Z
Repository: https://github.com/zeromq/zeromq4-x
Language: Unknown
Commit date: 2014-12-05 09:08:38 +0100
Commit message: Merge pull request #101 from hintjens/master

Problem: issue #1273, protocol downgrade attack
CVE-2023-50246: Out-of-bounds Write (CWE-787)
value: jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-12-13T21:15Z
Repository: https://github.com/jqlang/jq
Language: Other
Files changed: NEWS.md, src/jv.c, tests/shtest
Commit date: 2023-12-13 20:20:22 +0100
Commit message: Merge pull request from GHSA-686w-5m7m-54vc

decNumberToString calls for a buffer that can hold a string of digits+14
characters, not a buffer of size digits+14.
We need to allocate an extra byte for the NUL byte.

-10E-1000010001, for example, will be stringified as -1.0E-1000010000
and decNumberToString will currently write an extra NUL byte after the
allocated buffer in the heap.

Originally reported by @SEU-SSL on GitHub.

Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574

Fixes GHSA-686w-5m7m-54vc
Diff: diff --git a/NEWS.md b/NEWS.md
index 913be89..14a594b 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,10 +1,10 @@
 # 1.7.1
 
 ## Security
 
-- CVE-2023-50246: ....
+- CVE-2023-50246: Fix heap buffer overflow in jvp\_literal\_number\_literal
 - CVE-2023-50268: fix stack-buffer-overflow if comparing nan with payload
 
 ## CLI changes
 
 - Make the default background color more suitable for bright backgrounds. @mjarosie @taoky @nicowilliams @itchyny #2904
diff --git a/src/jv.c b/src/jv.c
index 6ca1e1d..e23d8ec 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -633,11 +633,11 @@ static const char* jvp_literal_number_literal(jv n) {
     // (or minimum) double here.
     return NULL;
   }
 
   if (plit->literal_data == NULL) {
-    int len = jvp_dec_number_ptr(n)->digits + 14;
+    int len = jvp_dec_number_ptr(n)->digits + 15 /* 14 + NUL */;
     plit->literal_data = jv_mem_alloc(len);
 
     // Preserve the actual precision as we have parsed it
     // don't do decNumberTrim(pdec);
 
diff --git a/tests/shtest b/tests/shtest
index a426c79..14aafbf 100755
--- a/tests/shtest
+++ b/tests/shtest
@@ -607,6 +607,11 @@ fi
 if ! r=$($JQ --args -rn 1 -- '$ARGS.positional[0]' bar) || [ "$r" != 1 ]; then
     echo "passing the inline script before -- didn't work"
     exit 1
 fi
 
+# CVE-2023-50246: No heap overflow for '-10E-1000000001'
+$VALGRIND $Q $JQ . <<\NUM
+-10E-1000000001
+NUM
+
 exit 0

Vulnerable code: - CVE-2023-50246: ....
    int len = jvp_dec_number_ptr(n)->digits + 14;
Fixed code: - CVE-2023-50246: Fix heap buffer overflow in jvp\_literal\_number\_literal
    int len = jvp_dec_number_ptr(n)->digits + 15 /* 14 + NUL */;
# CVE-2023-50246: No heap overflow for '-10E-1000000001'
$VALGRIND $Q $JQ . <<\NUM
-10E-1000000001
NUM
CVE-2019-10762: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-10-30T22:15Z
Repository: https://github.com/catfan/Medoo
Language: PHP
Files changed: src/Medoo.php
Commit date: 2019-10-11 23:50:40 +0800
Commit message: [fix] Fix columnQuote for security issue reported by Snyk

Diff: diff --git a/src/Medoo.php b/src/Medoo.php
index 6d68f4c..478e0a8 100644
--- a/src/Medoo.php
+++ b/src/Medoo.php
@@ -498,10 +498,15 @@ class Medoo
 		return [$value, $map[ $type ]];
 	}
 
 	protected function columnQuote($string)
 	{
+		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
+		{
+			throw new InvalidArgumentException("Incorrect column name \"$string\"");
+		}
+
 		if (strpos($string, '.') !== false)
 		{
 			return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';
 		}
 

Fixed code: 		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
		{
			throw new InvalidArgumentException("Incorrect column name \"$string\"");
		}
CVE-2021-30070: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-08-18T05:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: Unknown
Commit date: 2021-03-30 11:44:14 -0300
Commit message: Merge remote-tracking branch 'jaapmarcus/fix/prevent-install-non-controlled-package' into main
CVE-2021-30070: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-08-18T05:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: Other
Files changed: bin/v-update-sys-hestia, func/main.sh
Commit date: 2021-03-30 09:28:48 +0000
Commit message: Prevent install via CLI / API / WebGUI via command v-update-sys-hestia package 
Current script accepts all valid packages now limiited to hestia, hestia-nginx, hestia-php
@numanturle
Diff: diff --git a/bin/v-update-sys-hestia b/bin/v-update-sys-hestia
index 38fe45151..0a0315110 100755
--- a/bin/v-update-sys-hestia
+++ b/bin/v-update-sys-hestia
@@ -30,10 +30,11 @@ source $HESTIA/conf/hestia.conf
 #                    Verifications                         #
 #----------------------------------------------------------#
 
 # Checking arg number
 check_args '1' "$#" 'PACKAGE'
+is_hestia_package "hestia,hestia-nginx,hestia-php" "$package"
 
 # Perform verification if read-only mode is enabled
 check_hestia_demo_mode
 
 #----------------------------------------------------------#
diff --git a/func/main.sh b/func/main.sh
index cba1d4782..0640c08ed 100644
--- a/func/main.sh
+++ b/func/main.sh
@@ -1152,10 +1152,16 @@ multiphp_default_version() {
     fi
 
     echo "$sys_phpversion"
 }
 
+is_hestia_package(){
+    if [ -z "$(echo $1 | grep -w $2)" ]; then
+        check_result $E_INVALID "$2 package is not controlled by hestiacp"
+    fi
+}
+
 # Run arbitrary cli commands with dropped privileges
 # Note: setpriv --init-groups is not available on debian9 (util-linux 2.29.2)
 # Input:
 #     - $user : Vaild hestia user
 user_exec() {

Fixed code: is_hestia_package "hestia,hestia-nginx,hestia-php" "$package"
is_hestia_package(){
    if [ -z "$(echo $1 | grep -w $2)" ]; then
        check_result $E_INVALID "$2 package is not controlled by hestiacp"
    fi
}
CVE-2021-30071: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in /admin/list_key.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-08-18T05:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: HTML
Files changed: web/templates/admin/list_key.html
Commit date: 2021-03-28 19:59:10 -0300
Commit message: Fix XSS issue in list_key.html


Diff: diff --git a/web/templates/admin/list_key.html b/web/templates/admin/list_key.html
index 56198fd36..ec78523cd 100644
--- a/web/templates/admin/list_key.html
+++ b/web/templates/admin/list_key.html
@@ -27,11 +27,11 @@
     foreach ($data as $key => $value) {
     ++$i;
   ?>
   <div class="l-unit header animated fadeIn">
     <div class="l-unit__col l-unit__col--right">
-      <div class="clearfix l-unit__stat-col--left wide-3"><b><?=$data[$key]['ID'];?></b></div>
+      <div class="clearfix l-unit__stat-col--left wide-3"><b><?=htmlspecialchars($data[$key]['ID']);?></b></div>
           <div class="clearfix l-unit__stat-col--left text-left compact-2">
             <div class="l-unit-toolbar__col l-unit-toolbar__col--right noselect">
               <div class="actions-panel clearfix">
                 <div class="actions-panel__col actions-panel__delete shortcut-delete" key-action="js">
                   <a id="delete_link_<?=$i?>" class="data-controls do_delete" title="<?=_('delete')?>">

Vulnerable code:       <div class="clearfix l-unit__stat-col--left wide-3"><b><?=$data[$key]['ID'];?></b></div>
Fixed code:       <div class="clearfix l-unit__stat-col--left wide-3"><b><?=htmlspecialchars($data[$key]['ID']);?></b></div>
CVE-2021-3797: Other (NVD-CWE-Other)
value: hestiacp is vulnerable to Use of Wrong Operator in String Comparison
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2021-09-15T13:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: Unknown
Commit date: 2021-09-10 16:47:36 +0200
Commit message: Merge pull request #2120 from jaapmarcus/fix/csrf-juggling

Rewrite session token check to prevent juggling
CVE-2017-6059: Improper Input Validation (CWE-20)
value: Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-04-12T20:59Z
Repository: https://github.com/pingidentity/mod_auth_openidc
Language: Other
Files changed: ChangeLog, src/mod_auth_openidc.c
Commit date: 2017-01-19 00:03:37 +0100
Commit message: don't echo query params on invalid requests to redirect URI; closes #212

thanks @LukasReschke; I'm sure there's some OWASP guideline that warns
against this
Diff: diff --git a/ChangeLog b/ChangeLog
index 4010fb3..b046b8d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
+01/18/2017
+- don't echo the query parameters on the error page when an invalid request is made to the Redirect URI; closes #212; thanks @LukasReschke
+
 01/14/2017
 - use dynamic memory buffer for writing HTTP call responses; solves curl/mpm-event interference; see #207
 - bump to 2.1.4rc1
 
 01/10/2017
diff --git a/src/mod_auth_openidc.c b/src/mod_auth_openidc.c
index fea5775..1a2fc55 100644
--- a/src/mod_auth_openidc.c
+++ b/src/mod_auth_openidc.c
@@ -2843,12 +2843,12 @@ int oidc_handle_redirect_uri_request(request_rec *r, oidc_cfg *c,
 	}
 
 	/* something went wrong */
 	return oidc_util_html_send_error(r, c->error_template, "Invalid Request",
 			apr_psprintf(r->pool,
-					"The OpenID Connect callback URL received an invalid request: %s",
-					r->args), HTTP_INTERNAL_SERVER_ERROR);
+					"The OpenID Connect callback URL received an invalid request"),
+					HTTP_INTERNAL_SERVER_ERROR);
 }
 
 /*
  * main routine: handle OpenID Connect authentication
  */

Vulnerable code: 					"The OpenID Connect callback URL received an invalid request: %s",
					r->args), HTTP_INTERNAL_SERVER_ERROR);
Fixed code: 01/18/2017
- don't echo the query parameters on the error page when an invalid request is made to the Redirect URI; closes #212; thanks @LukasReschke

					"The OpenID Connect callback URL received an invalid request"),
					HTTP_INTERNAL_SERVER_ERROR);
CVE-2024-25639: Insufficient Information (NVD-CWE-noinfo)
value: Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-08T15:15Z
Repository: https://github.com/khoj-ai/khoj
Language: Unknown
Commit date: 2024-06-04 11:29:21 +0530
Commit message: Merge pull request from GHSA-h2q2-vch3-72qm

Add CSP and sanitize chat messages in Obsidian, Desktop, Web apps
CVE-2020-5258: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.7
Published: 2020-03-10T18:15Z
Repository: https://github.com/dojo/dojo
Language: JavaScript
Files changed: request/util.js, tests/unit/request/util.js
Commit date: 2020-03-10 07:12:16 -0700
Commit message: Merge pull request from GHSA-jxfh-8wgv-vfr2


Diff: diff --git a/request/util.js b/request/util.js
index eef6b35b..91de9dd9 100644
--- a/request/util.js
+++ b/request/util.js
@@ -42,11 +42,11 @@ define([
 
 	exports.deepCopy = function(target, source) {
 		for (var name in source) {
 			var tval = target[name],
   			    sval = source[name];
-			if (tval !== sval) {
+			if (name !== '__proto__' && tval !== sval) {
 				if (shouldDeepCopy(sval)) {
 					if (Object.prototype.toString.call(sval) === '[object Date]') { // use this date test to handle crossing frame boundaries
 						target[name] = new Date(sval);
 					} else if (lang.isArray(sval)) {
  						  target[name] = exports.deepCopyArray(sval);
diff --git a/tests/unit/request/util.js b/tests/unit/request/util.js
index 8cd71de6..25ec592a 100644
--- a/tests/unit/request/util.js
+++ b/tests/unit/request/util.js
@@ -32,10 +32,16 @@ define([
 			assert.strictEqual(object1.banana.price, 200);
 			assert.strictEqual(object1.banana.code, "B98765");
 			assert.equal(object1.banana.purchased.getTime(), new Date(2017, 0, 1).getTime());
 		},
 
+		'.deepCopy should ignore the __proto__ property': function() {
+			var payload = JSON.parse('{ "__proto__": { "protoPollution": true }}');
+			util.deepCopy({}, payload);
+			assert.isUndefined(({}).protoPollution);
+		},
+
 		'deepCopy with FormData': function(){
 			if (has('native-formdata')) {
 				var formData = new FormData();
 				var object1 = {
 					apple: 0,

Vulnerable code: 			if (tval !== sval) {
Fixed code: 			if (name !== '__proto__' && tval !== sval) {
		'.deepCopy should ignore the __proto__ property': function() {
			var payload = JSON.parse('{ "__proto__": { "protoPollution": true }}');
			util.deepCopy({}, payload);
			assert.isUndefined(({}).protoPollution);
		},
CVE-2022-21227: Insufficient Information (NVD-CWE-noinfo)
value: The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-05-01T16:15Z
Repository: https://github.com/TryGhost/node-sqlite3
Language: JavaScript
Files changed: src/statement.cc, test/other_objects.test.js
Commit date: 2021-03-09 22:54:46 +0000
Commit message: bug: fix segfault of invalid toString() object (#1450)

* bug: verify toString() returns valid data
* test: faulty toString test
Diff: diff --git a/src/statement.cc b/src/statement.cc
index 23842e1..9f6a9cd 100644
--- a/src/statement.cc
+++ b/src/statement.cc
@@ -203,11 +203,17 @@ template <class T> Values::Field*
     }
     else if (OtherInstanceOf(source.As<Object>(), "Date")) {
         return new Values::Float(pos, source.ToNumber().DoubleValue());
     }
     else if (source.IsObject()) {
-        std::string val = source.ToString().Utf8Value();
+        Napi::String napiVal = source.ToString();
+        // Check whether toString returned a value that is not undefined.
+        if(napiVal.Type() == 0) {
+            return NULL;
+        }
+
+        std::string val = napiVal.Utf8Value();
         return new Values::Text(pos, val.length(), val.c_str());
     }
     else {
         return NULL;
     }
diff --git a/test/other_objects.test.js b/test/other_objects.test.js
index 1559517..7185987 100644
--- a/test/other_objects.test.js
+++ b/test/other_objects.test.js
@@ -84,6 +84,15 @@ describe('data types', function() {
                     done();
                 });
             });
         });
     });
+
+    it('should ignore faulty toString', function(done) {
+        const faulty = { toString: 23 };
+        db.run("INSERT INTO txt_table VALUES(?)", faulty, function (err) {
+            assert.notEqual(err, undefined);
+            done();
+        });
+    });
+
 });

Vulnerable code:         std::string val = source.ToString().Utf8Value();
Fixed code:         Napi::String napiVal = source.ToString();
        // Check whether toString returned a value that is not undefined.
        if(napiVal.Type() == 0) {
            return NULL;
        }

        std::string val = napiVal.Utf8Value();

    it('should ignore faulty toString', function(done) {
        const faulty = { toString: 23 };
        db.run("INSERT INTO txt_table VALUES(?)", faulty, function (err) {
            assert.notEqual(err, undefined);
            done();
        });
    });
CVE-2011-1007: Credentials Management Errors (CWE-255)
value: Best Practical Solutions RT before 3.8.9 does not perform certain redirect actions upon a login, which allows physically proximate attackers to obtain credentials by resubmitting the login form via the back button of a web browser on an unattended workstation after an RT logout.
CWE description: Weaknesses in this category are related to the management of credentials.
Published: 2011-02-28T16:00Z
Repository: https://github.com/bestpractical/rt
Language: Unknown
Commit date: 2010-10-27 10:50:52 -0400
Commit message: Merge branch 'redirect-after-login' into 3.8-trunk
CVE-2011-1008: Permissions, Privileges, and Access Controls (CWE-264)
value: Scrips_Overlay.pm in Best Practical Solutions RT before 3.8.9 does not properly restrict access to a TicketObj in a Scrip after a CurrentUser change, which allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by custom-field value information, related to SQL logging.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2011-02-28T16:00Z
Repository: https://github.com/bestpractical/rt
Language: Perl
Files changed: lib/RT/Scrips_Overlay.pm
Commit date: 2010-05-13 20:28:35 +0800
Commit message: security fix: clone the ticket to set CurrentUser

Diff: diff --git a/lib/RT/Scrips_Overlay.pm b/lib/RT/Scrips_Overlay.pm
index df24b3cff..1d3070257 100644
--- a/lib/RT/Scrips_Overlay.pm
+++ b/lib/RT/Scrips_Overlay.pm
@@ -281,11 +281,14 @@ sub _SetupSourceObjects {
             Ticket => undef,
             Transaction => undef,
             TransactionObj => undef,
             @_ );
 
-    if ( ( $self->{'TicketObj'} = $args{'TicketObj'} ) ) {
+
+    if ( $args{'TicketObj'} ) {
+        # clone the ticket here as we need to change CurrentUser
+        $self->{'TicketObj'} = bless { %{$args{'TicketObj'} } }, 'RT::Ticket';
         $self->{'TicketObj'}->CurrentUser( $self->CurrentUser );
     }
     else {
         $self->{'TicketObj'} = RT::Ticket->new( $self->CurrentUser );
         $self->{'TicketObj'}->Load( $args{'Ticket'} )

Vulnerable code:     if ( ( $self->{'TicketObj'} = $args{'TicketObj'} ) ) {
Fixed code: 
    if ( $args{'TicketObj'} ) {
        # clone the ticket here as we need to change CurrentUser
        $self->{'TicketObj'} = bless { %{$args{'TicketObj'} } }, 'RT::Ticket';
CVE-2021-38562: Observable Discrepancy (CWE-203)
value: Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 7.5
Published: 2021-10-18T09:15Z
Repository: https://github.com/bestpractical/rt
Language: Perl
Files changed: lib/RT/REST2/Middleware/Auth.pm
Commit date: 2021-08-12 06:02:17 +0800
Commit message: Always check password to avoid timing side channel attacks in REST2 basic auth

This addresses CVE-2021-38562.

Diff: diff --git a/lib/RT/REST2/Middleware/Auth.pm b/lib/RT/REST2/Middleware/Auth.pm
index cb04790385..4fdc7469c8 100644
--- a/lib/RT/REST2/Middleware/Auth.pm
+++ b/lib/RT/REST2/Middleware/Auth.pm
@@ -130,14 +130,23 @@ sub login_from_basicauth {
     require MIME::Base64;
     if (($env->{HTTP_AUTHORIZATION}||'') =~ /^basic (.*)$/i) {
         my($user, $pass) = split /:/, (MIME::Base64::decode($1) || ":"), 2;
         my $cu = RT::CurrentUser->new;
         $cu->Load($user);
+
+        # Load the RT system user as well to avoid timing side channel
+        my $system_user = RT::CurrentUser->new();
+        $system_user->Load(1);    # User with ID 1 should always exist!
+
         if ($cu->id and $cu->IsPassword($pass)) {
             return $cu;
         }
         else {
+            if (!$cu->id) {
+                # Avoid timing side channel... always run IsPassword
+                $system_user->IsPassword($pass);
+            }
             RT->Logger->info("Failed login for $user");
             return;
         }
     }
 

Fixed code: 
        # Load the RT system user as well to avoid timing side channel
        my $system_user = RT::CurrentUser->new();
        $system_user->Load(1);    # User with ID 1 should always exist!

            if (!$cu->id) {
                # Avoid timing side channel... always run IsPassword
                $system_user->IsPassword($pass);
            }
CVE-2015-2311: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 9.8
Published: 2017-08-09T18:29Z
Repository: https://github.com/capnproto/capnproto
Language: Other
Files changed: c++/src/capnp/layout.c++
Commit date: 2015-03-02 10:35:12 -0800
Commit message: SECURITY: Integer underflow in pointer validation.

Details: https://github.com/sandstorm-io/capnproto/tree/master/security-advisories/2014-03-02-1-c++-integer-underflow.md

Diff: diff --git a/c++/src/capnp/layout.c++ b/c++/src/capnp/layout.c++
index a43dbcd6..5956bb99 100644
--- a/c++/src/capnp/layout.c++
+++ b/c++/src/capnp/layout.c++
@@ -1428,27 +1428,33 @@ struct WireHelpers {
 
   static KJ_ALWAYS_INLINE(Text::Builder getWritableTextPointer(
       WirePointer* ref, word* refTarget, SegmentBuilder* segment,
       const void* defaultValue, ByteCount defaultSize)) {
     if (ref->isNull()) {
+    useDefault:
       if (defaultSize == 0 * BYTES) {
         return nullptr;
       } else {
         Text::Builder builder = initTextPointer(ref, segment, defaultSize).value;
         memcpy(builder.begin(), defaultValue, defaultSize / BYTES);
         return builder;
       }
     } else {
       word* ptr = followFars(ref, refTarget, segment);
+      char* cptr = reinterpret_cast<char*>(ptr);
 
       KJ_REQUIRE(ref->kind() == WirePointer::LIST,
           "Called getText{Field,Element}() but existing pointer is not a list.");
       KJ_REQUIRE(ref->listRef.elementSize() == ElementSize::BYTE,
           "Called getText{Field,Element}() but existing list pointer is not byte-sized.");
 
-      // Subtract 1 from the size for the NUL terminator.
-      return Text::Builder(reinterpret_cast<char*>(ptr), ref->listRef.elementCount() / ELEMENTS - 1);
+      size_t size = ref->listRef.elementCount() / ELEMENTS;
+      KJ_REQUIRE(size > 0 && cptr[size-1] == '\0', "Text blob missing NUL terminator.") {
+        goto useDefault;
+      }
+
+      return Text::Builder(cptr, size - 1);
     }
   }
 
   static KJ_ALWAYS_INLINE(SegmentAnd<Data::Builder> initDataPointer(
       WirePointer* ref, SegmentBuilder* segment, ByteCount size,

Vulnerable code:       // Subtract 1 from the size for the NUL terminator.
      return Text::Builder(reinterpret_cast<char*>(ptr), ref->listRef.elementCount() / ELEMENTS - 1);
Fixed code:     useDefault:
      char* cptr = reinterpret_cast<char*>(ptr);
      size_t size = ref->listRef.elementCount() / ELEMENTS;
      KJ_REQUIRE(size > 0 && cptr[size-1] == '\0', "Text blob missing NUL terminator.") {
        goto useDefault;
      }

      return Text::Builder(cptr, size - 1);
CVE-2021-32724: Insertion of Sensitive Information into Log File (CWE-532)
value: check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`), an attacker can send a crafted Pull Request that causes a `GITHUB_TOKEN` to be exposed. With the `GITHUB_TOKEN`, it's possible to push commits to the repository bypassing standard approval processes. Commits to the repository could then steal any/all secrets available to the repository. As a workaround users may can either: [Disable the workflow](https://docs.github.com/en/actions/managing-workflow-runs/disabling-and-enabling-a-workflow) until you've fixed all branches or Set repository to [Allow specific actions](https://docs.github.com/en/github/administering-a-repository/managing-repository-settings/disabling-or-limiting-github-actions-for-a-repository#allowing-specific-actions-to-run). check-spelling isn't a verified creator and it certainly won't be anytime soon. You could then explicitly add other actions that your repository uses. Set repository [Workflow permissions](https://docs.github.com/en/github/administering-a-repository/managing-repository-settings/disabling-or-limiting-github-actions-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository) to `Read repository contents permission`. Workflows using `check-spelling/check-spelling@main` will get the fix automatically. Workflows using a pinned sha or tagged version will need to change the affected workflows for all repository branches to the latest version. Users can verify who and which Pull Requests have been running the action by looking up the spelling.yml action in the Actions tab of their repositories, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml - you can filter PRs by adding ?query=event%3Apull_request_target, e.g., https://github.com/check-spelling/check-spelling/actions/workflows/spelling.yml?query=event%3Apull_request_target.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 9.9
Published: 2021-09-09T21:15Z
Repository: https://github.com/check-spelling/check-spelling
Language: Unknown
Commit date: 2021-07-12 15:37:53 -0400
Commit message: Merge pull request from GHSA-g86g-chm8-7r2p

File handling
CVE-2018-12588: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-06-19T21:29Z
Repository: https://github.com/pkp/omp
Language: Other
Files changed: templates/frontend/pages/searchResults.tpl
Commit date: 2018-06-18 09:09:01 -0700
Commit message: pkp/pkp-lib#3805 Add missing escaping to catalog.noTitlesSearch

Diff: diff --git a/templates/frontend/pages/searchResults.tpl b/templates/frontend/pages/searchResults.tpl
index d2bb7a43f..036d6d652 100644
--- a/templates/frontend/pages/searchResults.tpl
+++ b/templates/frontend/pages/searchResults.tpl
@@ -25,11 +25,11 @@
 	{if $searchQuery == '' }
 
 	{* No published titles *}
 	{elseif !$publishedMonographs|@count}
 		<div class="search_results">
-			{translate key="catalog.noTitlesSearch" searchQuery=$searchQuery}
+			{translate key="catalog.noTitlesSearch" searchQuery=$searchQuery|escape}
 			<a href="#search-form">
 				{translate key="search.searchAgain"}
 			</a>
 		</div>
 

Vulnerable code: 			{translate key="catalog.noTitlesSearch" searchQuery=$searchQuery}
Fixed code: 			{translate key="catalog.noTitlesSearch" searchQuery=$searchQuery|escape}