Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID
Language: Python
Files changed: cdo_local_uuid/__init__.py
Commit date: 2023-12-14 00:04:07 -0500
Commit message: Merge pull request #3 from Cyber-Domain-Ontology/fix_command_in_top_srcdir_case


Diff: diff --cc cdo_local_uuid/__init__.py
index b951440,9ef7abd..6f42b31
--- a/cdo_local_uuid/__init__.py
+++ b/cdo_local_uuid/__init__.py
@@@ -43,25 -57,20 +57,27 @@@ def configure() -> None
      """
      This function is part of setting up _demo_uuid() to generate non-random UUIDs.  See _demo_uuid() documentation for further setup notes.
      """
      global DEMO_UUID_BASE
  
+     # _logger.debug("sys.argv = %r.", sys.argv)
+ 
      if os.getenv("DEMO_UUID_REQUESTING_NONRANDOM") == "NONRANDOM_REQUESTED":
          warnings.warn(
 -            "Environment variable DEMO_UUID_REQUESTING_NONRANDOM is deprecated.  See case_utils.local_uuid._demo_uuid for usage notes on its replacement, CASE_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
 +            "Environment variable DEMO_UUID_REQUESTING_NONRANDOM is deprecated.  See cdo_local_uuid._demo_uuid for usage notes on its replacement, CDO_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
              FutureWarning,
          )
          return
  
 -    env_base_dir_name = os.getenv("CASE_DEMO_NONRANDOM_UUID_BASE")
 +    if os.getenv("CASE_DEMO_NONRANDOM_UUID_BASE") is not None:
 +        warnings.warn(
 +            "Environment variable CASE_DEMO_NONRANDOM_UUID_BASE is deprecated.  Its replacement variable is CDO_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
 +            FutureWarning,
 +        )
 +        return
 +
 +    env_base_dir_name = os.getenv("CDO_DEMO_NONRANDOM_UUID_BASE")
      if env_base_dir_name is None:
          return
  
      base_dir_original_path = pathlib.Path(env_base_dir_name)
      if not base_dir_original_path.exists():

Fixed code:      # _logger.debug("sys.argv = %r.", sys.argv)
CVE-2014-0477: Other (NVD-CWE-Other)
value: The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-07-03T17:55Z
Repository: https://github.com/rjbs/Email-Address
Language: Perl
Files changed: lib/Email/Address.pm
Commit date: 2014-06-17 22:48:03 -0400
Commit message: quoted part can be empty

Diff: diff --git a/lib/Email/Address.pm b/lib/Email/Address.pm
index acece12..1e0feb8 100644
--- a/lib/Email/Address.pm
+++ b/lib/Email/Address.pm
@@ -49,11 +49,11 @@ my $atom           = qr/$cfws*$atext+$cfws*/;
 my $dot_atom_text  = qr/$atext+(?:\.$atext+)*/;
 my $dot_atom       = qr/$cfws*$dot_atom_text$cfws*/;
 
 my $qtext          = qr/[^\\"]/;
 my $qcontent       = qr/$qtext|$quoted_pair/;
-my $quoted_string  = qr/$cfws*"$qcontent+"$cfws*/;
+my $quoted_string  = qr/$cfws*"$qcontent*"$cfws*/;
 
 my $word           = qr/$atom|$quoted_string/;
 
 # XXX: This ($phrase) used to just be: my $phrase = qr/$word+/; It was changed
 # to resolve bug 22991, creating a significant slowdown.  Given current speed

Vulnerable code: my $quoted_string  = qr/$cfws*"$qcontent+"$cfws*/;
Fixed code: my $quoted_string  = qr/$cfws*"$qcontent*"$cfws*/;
CVE-2024-30265: Insufficient Information (NVD-CWE-noinfo)
value: Collabora Online is a collaborative online office suite based on LibreOffice technology. Any deployment of voilà dashboard allow local file inclusion. Any file on a filesystem that is readable by the user that runs the voilà dashboard server can be downloaded by someone with network access to the server. Whether this still requires authentication depends on how voilà is deployed. This issue has been patched in 0.2.17, 0.3.8, 0.4.4 and 0.5.6.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-03T23:15Z
Repository: https://github.com/voila-dashboards/voila
Language: Python
Files changed: voila/app.py
Commit date: 2024-04-02 15:01:41 +0200
Commit message: Merge pull request from GHSA-2q59-h24c-w6fg


Diff: diff --git a/voila/app.py b/voila/app.py
index 3ca9b22..bf6af89 100644
--- a/voila/app.py
+++ b/voila/app.py
@@ -659,11 +659,10 @@ class Voila(Application):
             kernel_spec_manager=self.kernel_spec_manager,
             allow_remote_access=True,
             autoreload=self.autoreload,
             voila_jinja2_env=env,
             jinja2_env=server_env,
-            static_path="/",
             server_root_dir="/",
             contents_manager=self.contents_manager,
             config_manager=self.config_manager,
             cookie_secret=self.cookie_secret,
             authorizer=self.authorizer,

Vulnerable code:             static_path="/",
CVE-2022-31502: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.3
Published: 2022-07-11T01:15Z
Repository: https://github.com/operatorequals/wormnest
Language: Unknown
Commit date: 2022-04-29 11:37:58 +0300
Commit message: Merge pull request #8 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
CVE-2018-14371: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-07-18T12:29Z
Repository: https://github.com/eclipse-ee4j/mojarra
Language: Java
Files changed: impl/src/main/java/com/sun/faces/application/applicationimpl/InstanceFactory.java, impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java
Commit date: 2018-05-11 16:02:52 +0800
Commit message: fixing CTS failure issue in master branch

Diff: diff --git a/impl/src/main/java/com/sun/faces/application/applicationimpl/InstanceFactory.java b/impl/src/main/java/com/sun/faces/application/applicationimpl/InstanceFactory.java
index a983b19..bbcb561 100644
--- a/impl/src/main/java/com/sun/faces/application/applicationimpl/InstanceFactory.java
+++ b/impl/src/main/java/com/sun/faces/application/applicationimpl/InstanceFactory.java
@@ -286,10 +286,14 @@ public class InstanceFactory {
 
         return result;
     }
     
     public UIComponent createComponent(FacesContext context, String componentType, String rendererType) {
+        
+        notNull(CONTEXT, context);
+        notNull(COMPONENT_TYPE, componentType);
+        
         return createComponentApplyAnnotations(context, componentType, rendererType, true);
     }
     
     public UIComponent createComponent(ValueExpression componentExpression, FacesContext context, String componentType, String rendererType) {
 
diff --git a/impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java b/impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java
index 24f8f7d..53e0d64 100644
--- a/impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java
+++ b/impl/src/main/java/com/sun/faces/application/resource/ResourceManager.java
@@ -563,11 +563,11 @@ public class ResourceManager {
 
         String localePrefix = null;
         
         localePrefix = context.getExternalContext().getRequestParameterMap().get("loc");
         
-        if(localePrefix != null){
+        if(localePrefix != null && !nameContainsForbiddenSequence(localePrefix)){
             return localePrefix;
         }
         
         String appBundleName = context.getApplication().getMessageBundle();
         if (null != appBundleName) {

Vulnerable code:         if(localePrefix != null){
Fixed code:         
        notNull(CONTEXT, context);
        notNull(COMPONENT_TYPE, componentType);
        
        if(localePrefix != null && !nameContainsForbiddenSequence(localePrefix)){
CVE-2019-17091: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-10-02T14:15Z
Repository: https://github.com/eclipse-ee4j/mojarra
Language: Unknown
Commit date: 2019-05-17 07:15:25 +0800
Commit message: Merge pull request #4567 from ruolli/Issue_4556

Fixes #4556 : HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2
CVE-2019-17091: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-10-02T14:15Z
Repository: https://github.com/eclipse-ee4j/mojarra
Language: Java
Files changed: impl/src/main/java/com/sun/faces/context/PartialViewContextImpl.java
Commit date: 2019-05-06 15:38:42 +0800
Commit message: Fixes #4556 : HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2

Diff: diff --git a/impl/src/main/java/com/sun/faces/context/PartialViewContextImpl.java b/impl/src/main/java/com/sun/faces/context/PartialViewContextImpl.java
index 42f78a3d..ad9c06a7 100644
--- a/impl/src/main/java/com/sun/faces/context/PartialViewContextImpl.java
+++ b/impl/src/main/java/com/sun/faces/context/PartialViewContextImpl.java
@@ -509,11 +509,11 @@ import com.sun.faces.util.Util;
 
         ClientWindow window = context.getExternalContext().getClientWindow();
         if (null != window) {
             String clientWindowId = Util.getClientWindowId(context);
             writer.startUpdate(clientWindowId);
-            writer.write(window.getId());
+            writer.writeText(window.getId(), null);
             writer.endUpdate();
         }
     }
 
 	private void renderEvalScripts(FacesContext context) throws IOException {

Vulnerable code:             writer.write(window.getId());
Fixed code:             writer.writeText(window.getId(), null);
CVE-2014-0083: Use of Password Hash With Insufficient Computational Effort (CWE-916)
value: The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.
CWE description: The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
CVSS v3 base score: 5.5
Published: 2019-11-21T14:15Z
Repository: https://github.com/ruby-ldap/ruby-net-ldap
Language: Ruby
Files changed: lib/net/ldap/password.rb
Commit date: 2015-01-07 08:43:48 +0900
Commit message: Use SecureRandam to generate salt

Diff: diff --git a/lib/net/ldap/password.rb b/lib/net/ldap/password.rb
index 3669dfc..729e17e 100644
--- a/lib/net/ldap/password.rb
+++ b/lib/net/ldap/password.rb
@@ -25,11 +25,11 @@ class Net::LDAP::Password
       when :md5
          attribute_value = '{MD5}' + Base64.encode64(Digest::MD5.digest(str)).chomp! 
       when :sha
          attribute_value = '{SHA}' + Base64.encode64(Digest::SHA1.digest(str)).chomp! 
       when :ssha
-         srand; salt = (rand * 1000).to_i.to_s 
+         srand; salt = SecureRandom.random_bytes(16)
          attribute_value = '{SSHA}' + Base64.encode64(Digest::SHA1.digest(str + salt) + salt).chomp!
       else
          raise Net::LDAP::HashTypeUnsupportedError, "Unsupported password-hash type (#{type})"
       end
       return attribute_value

Vulnerable code:          srand; salt = (rand * 1000).to_i.to_s 
Fixed code:          srand; salt = SecureRandom.random_bytes(16)
CVE-2024-21638: Improper Authentication (CWE-287)
value: Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as the Service Principal used is only assigned the Reader role at the root Management Group level. Until recently, the solution lacked the validation of the passed in authentication token which may result in attacker impersonating any privileged user to access data stored within the IPAM instance and subsequently from Azure, causing an elevation of privilege. This vulnerability has been patched in version 3.0.0.

CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2024-01-10T22:15Z
Repository: https://github.com/Azure/ipam
Language: Unknown
Commit date: 2023-12-22 12:36:16 -0800
Commit message: Merge pull request #218 from Azure/vnet-missing-fix

Token Validation + Fixes
CVE-2023-40022: Integer Overflow or Wraparound (CWE-190)
value: Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2023-08-24T23:15Z
Repository: https://github.com/rizinorg/rz-libdemangle
Language: C
Files changed: src/gnu_v2/cplus-dem.c, test/test_cxx_gnu_v2.c
Commit date: 2023-08-13 16:04:28 +0800
Commit message: [gnuv2] Fix multiplication overflow check due compiler optimizations (#54)

Vulnerability found by @ifyGecko
Diff: diff --git a/src/gnu_v2/cplus-dem.c b/src/gnu_v2/cplus-dem.c
index 10f427c..7ef3f64 100644
--- a/src/gnu_v2/cplus-dem.c
+++ b/src/gnu_v2/cplus-dem.c
@@ -418,11 +418,14 @@ static const char *
 
 static int
 	consume_count(type)
 		const char **type;
 {
-	int count = 0;
+	// Note by RizinOrg:
+	// to prevent the overflow check to be optimized out
+	// by the compiler, this variable needs to be volatile.
+	volatile int count = 0;
 
 	if (!isdigit((unsigned char)**type))
 		return -1;
 
 	while (isdigit((unsigned char)**type)) {
diff --git a/test/test_cxx_gnu_v2.c b/test/test_cxx_gnu_v2.c
index a6c74f7..b05df10 100644
--- a/test/test_cxx_gnu_v2.c
+++ b/test/test_cxx_gnu_v2.c
@@ -2,10 +2,13 @@
 // SPDX-License-Identifier: LGPL-3.0-only
 
 #include "minunit.h"
 
 mu_demangle_tests(gnu_v2,
+	// fuzzed strings
+	mu_demangle_test("_ITM_deregisterTMCCCCCCCCCCCCCCCCCCCtart__5555555555555555CloneTable", NULL),
+	// normal
 	mu_demangle_test("_vt.foo", "foo virtual table"),
 	mu_demangle_test("_vt$foo", "foo virtual table"),
 	mu_demangle_test("_vt$foo$bar", "foo::bar virtual table"),
 	mu_demangle_test("__vt_foo", "foo virtual table"),
 	mu_demangle_test("_3foo$varname", "foo::varname"),

Vulnerable code: 	int count = 0;
Fixed code: 	// Note by RizinOrg:
	// to prevent the overflow check to be optimized out
	// by the compiler, this variable needs to be volatile.
	volatile int count = 0;
	// fuzzed strings
	mu_demangle_test("_ITM_deregisterTMCCCCCCCCCCCCCCCCCCCtart__5555555555555555CloneTable", NULL),
	// normal
CVE-2023-41036: Improper Privilege Management (CWE-269)
value: Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2023-11-07T04:20Z
Repository: https://github.com/macvim-dev/macvim
Language: Unknown
Commit date: 2023-09-11 21:58:18 -0700
Commit message: Merge pull request from GHSA-9jgj-jfwg-99fv

Harden NSConnection security in handling third-party connections
CVE-2024-27086: Insufficient Information (NVD-CWE-noinfo)
value: The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability.   
A malicious application running on a customer Android device    can cause local denial of service against applications that were built using MSAL.NET for authentication on the same device (i.e., prevent the user of the legitimate application from logging in) due to incorrect activity export configuration. MSAL.NET version 4.60.1 includes the fix.  As a workaround, a developer may explicitly mark the MSAL.NET activity non-exported.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-16T22:15Z
Repository: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet
Language: C#
Files changed: src/client/Microsoft.Identity.Client/Platforms/Android/EmbeddedWebview/AuthenticationAgentActivity.cs
Commit date: 2024-04-15 14:22:06 -0700
Commit message: Ashok's fix (#4714)

Update AuthenticationAgentActivity.cs

Co-authored-by: Ashok Kumar Ramakrishnan <83938949+ashok672@users.noreply.github.com>
Diff: diff --git a/src/client/Microsoft.Identity.Client/Platforms/Android/EmbeddedWebview/AuthenticationAgentActivity.cs b/src/client/Microsoft.Identity.Client/Platforms/Android/EmbeddedWebview/AuthenticationAgentActivity.cs
index c70913d8..49b0b29b 100644
--- a/src/client/Microsoft.Identity.Client/Platforms/Android/EmbeddedWebview/AuthenticationAgentActivity.cs
+++ b/src/client/Microsoft.Identity.Client/Platforms/Android/EmbeddedWebview/AuthenticationAgentActivity.cs
@@ -14,11 +14,11 @@
 using Microsoft.Identity.Client.PlatformsCommon.Shared;
 using Microsoft.Identity.Client.Utils;
 
 namespace Microsoft.Identity.Client.Platforms.Android.EmbeddedWebview
 {
-    [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=true)]
+    [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=false)]
     internal class AuthenticationAgentActivity : Activity
     {
         private const string AboutBlankUri = "about:blank";
         private CoreWebViewClient _client;
 

Vulnerable code:     [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=true)]
Fixed code:     [Activity(ConfigurationChanges = ConfigChanges.Orientation | ConfigChanges.ScreenSize, Exported=false)]
CVE-2015-6938: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-09-21T19:59Z
Repository: https://github.com/jupyter/notebook
Language: Python
Files changed: notebook/notebookapp.py
Commit date: 2015-09-01 16:39:01 +0200
Commit message: Fix XSS reported on Security list

No CVE-ID yet

August 18, 2015
-----
Reported to Quantopian by Juan Broullón <thebrowfc@gmail.com>...

If you create a new folder in the iPython file browser and set
Javascript code as its name the code injected will be executed. So, if I
create a folder called "><img src=x onerror=alert(document.cookie)> and
then I access to it, the cookies will be prompted.

The XSS code is also executed if you access a link pointing directly at
the folder.

  jik
------

Diff: diff --git a/notebook/notebookapp.py b/notebook/notebookapp.py
index 35d9312e..02aab5f4 100644
--- a/notebook/notebookapp.py
+++ b/notebook/notebookapp.py
@@ -157,11 +157,13 @@ class NotebookWebApplication(web.Application):
         )
         if isinstance(_template_path, py3compat.string_types):
             _template_path = (_template_path,)
         template_path = [os.path.expanduser(path) for path in _template_path]
 
-        jenv_opt = jinja_env_options if jinja_env_options else {}
+        jenv_opt = {"autoescape": True}
+        jenv_opt.update(jinja_env_options if jinja_env_options else {})
+
         env = Environment(loader=FileSystemLoader(template_path), **jenv_opt)
         
         sys_info = get_sys_info()
         if sys_info['commit_source'] == 'repository':
             # don't cache (rely on 304) when working from master

Vulnerable code:         jenv_opt = jinja_env_options if jinja_env_options else {}
Fixed code:         jenv_opt = {"autoescape": True}
        jenv_opt.update(jinja_env_options if jinja_env_options else {})
CVE-2018-19351: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-11-18T17:29Z
Repository: https://github.com/jupyter/notebook
Language: Python
Files changed: notebook/nbconvert/handlers.py
Commit date: 2018-10-22 14:52:36 +0100
Commit message: Apply CSP sandboxing for nbconvert responses

These may contain untrusted content, so they should be treated as being
from a different domain to the notebook server.

Diff: diff --git a/notebook/nbconvert/handlers.py b/notebook/nbconvert/handlers.py
index bb26664aa..bf0a4bfba 100644
--- a/notebook/nbconvert/handlers.py
+++ b/notebook/nbconvert/handlers.py
@@ -76,10 +76,17 @@ def get_exporter(format, **kwargs):
 
 class NbconvertFileHandler(IPythonHandler):
 
     SUPPORTED_METHODS = ('GET',)
 
+    @property
+    def content_security_policy(self):
+        # In case we're serving HTML/SVG, confine any Javascript to a unique
+        # origin so it can't interact with the notebook server.
+        return super(NbconvertFileHandler, self).content_security_policy + \
+               "; sandbox allow-scripts"
+
     @web.authenticated
     def get(self, format, path):
 
         exporter = get_exporter(format, config=self.config, log=self.log)
 
@@ -143,10 +150,17 @@ class NbconvertFileHandler(IPythonHandler):
         self.finish(output)
 
 class NbconvertPostHandler(IPythonHandler):
     SUPPORTED_METHODS = ('POST',)
 
+    @property
+    def content_security_policy(self):
+        # In case we're serving HTML/SVG, confine any Javascript to a unique
+        # origin so it can't interact with the notebook server.
+        return super(NbconvertPostHandler, self).content_security_policy + \
+               "; sandbox allow-scripts"
+
     @web.authenticated
     def post(self, format):
         exporter = get_exporter(format, config=self.config)
 
         model = self.get_json_body()

Fixed code:     @property
    def content_security_policy(self):
        # In case we're serving HTML/SVG, confine any Javascript to a unique
        # origin so it can't interact with the notebook server.
        return super(NbconvertFileHandler, self).content_security_policy + \
               "; sandbox allow-scripts"

    @property
    def content_security_policy(self):
        # In case we're serving HTML/SVG, confine any Javascript to a unique
        # origin so it can't interact with the notebook server.
        return super(NbconvertPostHandler, self).content_security_policy + \
               "; sandbox allow-scripts"
CVE-2018-19352: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-11-18T17:29Z
Repository: https://github.com/jupyter/notebook
Language: Unknown
Commit date: 2018-11-18 14:46:53 +0100
Commit message: Merge branch 'directory-xss'
CVE-2019-10255: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-03-28T16:29Z
Repository: https://github.com/jupyter/notebook
Language: Other
Files changed: docs/source/changelog.rst
Commit date: 2019-03-27 16:19:10 +0100
Commit message: changelog for redirect check

and update cve for 5.7.6

Diff: diff --git a/docs/source/changelog.rst b/docs/source/changelog.rst
index 8e64a212fc..c0e226e4e4 100644
--- a/docs/source/changelog.rst
+++ b/docs/source/changelog.rst
@@ -29,25 +29,25 @@ We strongly recommend that you upgrade pip to version 9+ of pip before upgrading
 - Fix regression in restarting kernels in 5.7.5.
   The restart handler would return before restart was completed.
 - Further improve compatibility with tornado 6 with improved
   checks for when websockets are closed.
 - Fix regression in 5.7.6 on Windows where .js files could have the wrong mime-type.
+- Fix Open Redirect vulnerability where certain malicious URLs could redirect from the Jupyter login page to a malicious site after a successful login. A CVE has been requested for this vulnerability.
 
 .. _release-5.7.6:
 
 5.7.6
 -----
 
-5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability,
+5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability (CVE-2019–9644),
 where files at a known URL could be included in a page from an unauthorized website if the user is logged into a Jupyter server.
 The fix involves setting the ``X-Content-Type-Options: nosniff``
 header, and applying CSRF checks previously on all non-GET
 API requests to GET requests to API endpoints and the /files/ endpoint.
 
 The attacking page is able to access some contents of files when using Internet Explorer through script errors,
 but this has not been demonstrated with other browsers.
-A CVE has been requested for this vulnerability.
 
 .. _release-5.7.5:
 
 5.7.5
 -----

Vulnerable code: 5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability,
A CVE has been requested for this vulnerability.
Fixed code: - Fix Open Redirect vulnerability where certain malicious URLs could redirect from the Jupyter login page to a malicious site after a successful login. A CVE has been requested for this vulnerability.
5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability (CVE-2019–9644),
CVE-2019-10255: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-03-28T16:29Z
Repository: https://github.com/jupyter/notebook
Language: Python
Files changed: notebook/auth/login.py
Commit date: 2019-03-27 21:43:40 +0100
Commit message: protect against chrome mishandling backslash as slash in URLs

Diff: diff --git a/notebook/auth/login.py b/notebook/auth/login.py
index d8289d7329..8dbd6112fc 100644
--- a/notebook/auth/login.py
+++ b/notebook/auth/login.py
@@ -37,10 +37,14 @@ class LoginHandler(IPythonHandler):
 
         Otherwise use default (self.base_url if unspecified).
         """
         if default is None:
             default = self.base_url
+        # protect chrome users from mishandling unescaped backslashes.
+        # \ is not valid in urls, but some browsers treat it as /
+        # instead of %5C, causing `\\` to behave as `//`
+        url = url.replace("\\", "%5C")
         parsed = urlparse(url)
         if parsed.netloc or not (parsed.path + '/').startswith(self.base_url):
             # require that next_url be absolute path within our path
             allow = False
             # OR pass our cross-origin check

Fixed code:         # protect chrome users from mishandling unescaped backslashes.
        # \ is not valid in urls, but some browsers treat it as /
        # instead of %5C, causing `\\` to behave as `//`
        url = url.replace("\\", "%5C")
CVE-2024-1230: Insufficient Information (NVD-CWE-noinfo)
value: The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybe_disconnect_simpleshop function. This makes it possible for unauthenticated attackers to disconnect the site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T14:45Z
Repository: https://github.com/redbitcz/simpleshop-wp-plugin
Language: PHP
Files changed: src/Settings.php
Commit date: 2024-02-08 14:55:32 +0100
Commit message: Add nonce verification to SimpleShop disconnect feature

The commit ensures security by adding nonce verification to the option to disconnect SimpleShop. Before this, the "Disconnect SimpleShop" link lacked this verification. Now, the option checks the '_wpnonce' query parameter with nonce before proceeding.

Diff: diff --git a/src/Settings.php b/src/Settings.php
index eb5ada0..9114910 100644
--- a/src/Settings.php
+++ b/src/Settings.php
@@ -81,13 +81,19 @@ class Settings {
 		$escaped_value,
 		$object_id,
 		$object_type,
 		$field_type_object
 	) {
+		$url = add_query_arg( [
+			'_wpnonce'              => wp_create_nonce(),
+			'page'                  => 'ssc_options',
+			'disconnect_simpleshop' => 1,
+		], admin_url( 'admin.php' ) );
+
 		printf(
 			'<a href="%s">%s</a>',
-			htmlspecialchars( admin_url( 'admin.php?page=ssc_options&disconnect_simpleshop=1' ), ENT_QUOTES ),
+			htmlspecialchars( $url, ENT_QUOTES ),
 			__( 'Disconnect SimpleShop', 'simpleshop-cz' )
 		);
 	}
 
 	/**
@@ -337,10 +343,14 @@ SimpleShop.cz - <i>Everyone can sell with us</i>'
 
 	/**
 	 * Maybe delete the API keys
 	 */
 	public function maybe_disconnect_simpleshop() {
+		if ( ! wp_verify_nonce( $_GET['_wpnonce'] ) ) {
+			return;
+		}
+
 		if ( ! isset( $_GET['disconnect_simpleshop'] ) || $_GET['disconnect_simpleshop'] !== '1' ) {
 			return;
 		}
 
 		// Unset only API keys, leave the other settings saved

Vulnerable code: 			htmlspecialchars( admin_url( 'admin.php?page=ssc_options&disconnect_simpleshop=1' ), ENT_QUOTES ),
Fixed code: 		$url = add_query_arg( [
			'_wpnonce'              => wp_create_nonce(),
			'page'                  => 'ssc_options',
			'disconnect_simpleshop' => 1,
		], admin_url( 'admin.php' ) );

			htmlspecialchars( $url, ENT_QUOTES ),
		if ( ! wp_verify_nonce( $_GET['_wpnonce'] ) ) {
			return;
		}
CVE-2022-3552: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2022-10-17T21:15Z
Repository: https://github.com/boxbilling/boxbilling
Language: Unknown
Commit date: 2021-08-07 18:57:44 -0700
Commit message: Merge pull request #932 from BenNottelling/Remove-Filemanager

Remove the obsolete and non-functional file manager
CVE-2018-1000524: Integer Overflow or Wraparound (CWE-190)
value: miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of service. This attack appear to be exploitable via the victim must load a specially-crafted map which calls SetLayerSize in its entry script. This vulnerability appears to have been fixed in 5.0.3, 5.1.5, 5.2.10 and later.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2018-06-26T16:29Z
Repository: https://github.com/fatcerberus/minisphere
Language: C
Files changed: src/minisphere/map_engine.c
Commit date: 2018-06-13 01:12:57 -0400
Commit message: Fix integer overflow in layer_resize in map_engine.c (#268)

* Fix integer overflow in layer_resize in map_engine.c

There's a buffer overflow bug in the function layer_resize. It allocates
a buffer `tilemap` with size `x_size * y_size * sizeof(struct map_tile)`.
But it didn't check for integer overflow, so if x_size and y_size are
very large, it's possible that the buffer size is smaller than needed,
causing a buffer overflow later.

PoC: `SetLayerSize(0, 0x7FFFFFFF, 0x7FFFFFFF);`

* move malloc to a separate line

Diff: diff --git a/src/minisphere/map_engine.c b/src/minisphere/map_engine.c
index 0d47a326..cba8a612 100644
--- a/src/minisphere/map_engine.c
+++ b/src/minisphere/map_engine.c
@@ -1034,19 +1034,22 @@ layer_resize(int layer, int x_size, int y_size)
 	int                 tile_width;
 	int                 tile_height;
 	struct map_tile*    tilemap;
 	struct map_trigger* trigger;
 	struct map_zone*    zone;
+	size_t              tilemap_size;
 
 	int x, y, i;
 
 	old_width = s_map->layers[layer].width;
 	old_height = s_map->layers[layer].height;
 
 	// allocate a new tilemap and copy the old layer tiles into it.  we can't simply realloc
 	// because the tilemap is a 2D array.
-	if (!(tilemap = malloc(x_size * y_size * sizeof(struct map_tile))))
+	tilemap_size = x_size * y_size * sizeof(struct map_tile);
+	if (x_size == 0 || tilemap_size / x_size / sizeof(struct map_tile) != y_size
+		|| !(tilemap = malloc(tilemap_size)))
 		return false;
 	for (x = 0; x < x_size; ++x) {
 		for (y = 0; y < y_size; ++y) {
 			if (x < old_width && y < old_height) {
 				tilemap[x + y * x_size] = s_map->layers[layer].tilemap[x + y * old_width];

Vulnerable code: 	if (!(tilemap = malloc(x_size * y_size * sizeof(struct map_tile))))
Fixed code: 	size_t              tilemap_size;
	tilemap_size = x_size * y_size * sizeof(struct map_tile);
	if (x_size == 0 || tilemap_size / x_size / sizeof(struct map_tile) != y_size
		|| !(tilemap = malloc(tilemap_size)))
CVE-2020-15124: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive information. The vulnerability has been fixed in version 4.8.3
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2020-07-22T18:15Z
Repository: https://github.com/intranda/goobi-viewer-core
Language: Java
Files changed: goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
Commit date: 2020-07-22 10:39:06 +0200
Commit message: Don't allow filepaths as Filename when requesting source files
Diff: diff --git a/goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java b/goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
index ba0deed85..95dc6d8a0 100644
--- a/goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
+++ b/goobi-viewer-core/src/main/java/io/goobi/viewer/controller/DataFileTools.java
@@ -184,10 +184,12 @@ public class DataFileTools {
      * @throws io.goobi.viewer.exceptions.PresentationException if any.
      * @throws io.goobi.viewer.exceptions.IndexUnreachableException if any.
      */
     public static Path getDataFilePath(String pi, String dataFolderName, String altDataFolderName, String fileName)
             throws PresentationException, IndexUnreachableException {
+        //make sure fileName is a pure filename and not a path
+        fileName = Paths.get(fileName).getFileName().toString();
         java.nio.file.Path dataFolderPath = getDataFolder(pi, dataFolderName);
         if (StringUtils.isNotBlank(fileName)) {
             dataFolderPath = dataFolderPath.resolve(fileName);
         }
         if (StringUtils.isNotBlank(altDataFolderName) && !Files.exists(dataFolderPath)) {

Fixed code:         //make sure fileName is a pure filename and not a path
        fileName = Paths.get(fileName).getFileName().toString();
CVE-2023-29015: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment. The vulnerability has been fixed in version 23.03.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-06T20:15Z
Repository: https://github.com/intranda/goobi-viewer-core
Language: Other
Files changed: goobi-viewer-core/src/main/resources/META-INF/resources/resources/includes/user/userComments.xhtml
Commit date: 2023-03-24 17:15:00 +0100
Commit message: escape comment text; fixes #24585
Diff: diff --git a/goobi-viewer-core/src/main/resources/META-INF/resources/resources/includes/user/userComments.xhtml b/goobi-viewer-core/src/main/resources/META-INF/resources/resources/includes/user/userComments.xhtml
index 155eff1c9d..8f4e0f4e9c 100644
--- a/goobi-viewer-core/src/main/resources/META-INF/resources/resources/includes/user/userComments.xhtml
+++ b/goobi-viewer-core/src/main/resources/META-INF/resources/resources/includes/user/userComments.xhtml
@@ -49,11 +49,13 @@
 							<img src="#{comment.creator.avatarUrl}" alt="User avatar" />
 						</div>
 
 						<!-- COMMENT METADATA -->
 						<div class="user-comments__comment-metadata">
-							<span class="user-comments__comment-metadata-creator">#{comment.creator.displayNameEscaped}</span>
+							<span class="user-comments__comment-metadata-creator">
+							    #{comment.creator.displayNameEscaped}
+							</span>
 							<span class="user-comments__comment-metadata-date">#{navigationHelper.getLocalDate(comment.dateCreated)}</span>
 						</div>
 
 					</div>
 
@@ -75,11 +77,12 @@
 								</div>
 							</ui:fragment>
 
 								<!-- COMMENT TEXT -->
 								<div class="user-comments__comment-content-text in">
-									#{comment.displayText}</div>
+									<h:outputText value="#{comment.displayText}" escape="true" />
+								</div>
 
 									<!-- EDIT COMMENT -->
 									<ui:fragment
 										rendered="#{userBean.user == comment.creator or commentBean.isMayEditCommentsForRecord(activeDocumentBean.viewManager.pi)}">
 										<div class="user-comments__action-wrapper">

Vulnerable code: 							<span class="user-comments__comment-metadata-creator">#{comment.creator.displayNameEscaped}</span>
									#{comment.displayText}</div>
Fixed code: 							<span class="user-comments__comment-metadata-creator">
							    #{comment.creator.displayNameEscaped}
							</span>
									<h:outputText value="#{comment.displayText}" escape="true" />
								</div>
CVE-2021-41139: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible to craft the URI with malicious JavaScript, use social engineering to convince logged on user to click on such link, and have the attacker-supplied JavaScript to be executed in user's browser. This issue is patched in version 1.19.30.5600. As a workaround, one may introduce `ttValidDbDateFormatDate` function as in the latest version and add a call to it within the access checks block in time.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-10-13T17:15Z
Repository: https://github.com/anuko/timetracker
Language: PHP
Files changed: initialize.php, time.php
Commit date: 2021-10-12 20:01:36 +0000
Commit message: Added a check for passed in date to time.php.

Diff: diff --git a/initialize.php b/initialize.php
index 105507363..e0b38f4d5 100644
--- a/initialize.php
+++ b/initialize.php
@@ -10,11 +10,11 @@ error_reporting(E_ALL & ~E_NOTICE & ~E_STRICT); // & ~E_DEPRECATED);
 // E_ALL tends to change as PHP evolves, therefore we use & here instead of exclusive OR (^).
 
 // Disable displaying errors on screen.
 ini_set('display_errors', 'Off');
 
-define("APP_VERSION", "1.19.29.5598");
+define("APP_VERSION", "1.19.30.5599");
 define("APP_DIR", dirname(__FILE__));
 define("LIBRARY_DIR", APP_DIR."/WEB-INF/lib");
 define("TEMPLATE_DIR", APP_DIR."/WEB-INF/templates");
 // Date format for database and URI parameters.
 define('DB_DATEFORMAT', '%Y-%m-%d');
diff --git a/time.php b/time.php
index 1bee1129c..61e771f8b 100644
--- a/time.php
+++ b/time.php
@@ -30,10 +30,16 @@ if ($request->isPost()) {
   if ($userChanged && !($user->can('track_time') && $user->isUserValid((int)$request->getParameter('user')))) {
     header('Location: access_denied.php'); // User changed, but no right or wrong user id.
     exit();
   }
 }
+// If we are passed in a date, make sure it is in correct format.
+$date = $request->getParameter('date');
+if ($date && !ttValidDate($date)) {
+  header('Location: access_denied.php');
+  exit();
+}
 // End of access checks.
 
 // Determine user for whom we display this page.
 if ($request->isPost() && $userChanged) {
   $user_id = (int)$request->getParameter('user');

Vulnerable code: define("APP_VERSION", "1.19.29.5598");
Fixed code: define("APP_VERSION", "1.19.30.5599");
// If we are passed in a date, make sure it is in correct format.
$date = $request->getParameter('date');
if ($date && !ttValidDate($date)) {
  header('Location: access_denied.php');
  exit();
}