Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-26164: Uncontrolled Resource Consumption (CWE-400)
value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2020-10-07T19:15Z
Repository: https://github.com/KDE/kdeconnect-kde
Language: C++
Files changed: core/backends/lan/lanlinkprovider.cpp
Commit date: 2020-10-02 12:52:08 +0200
Commit message: Do not let lanlink connections stay open for long without authenticating

If there's no information received, close the socket to try again.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.

Diff: diff --git a/core/backends/lan/lanlinkprovider.cpp b/core/backends/lan/lanlinkprovider.cpp
index aeabc7f3..542f658e 100644
--- a/core/backends/lan/lanlinkprovider.cpp
+++ b/core/backends/lan/lanlinkprovider.cpp
@@ -390,10 +390,20 @@ void LanLinkProvider::newConnection()
         connect(socket, &QAbstractSocket::disconnected,
                 socket, &QObject::deleteLater);
         connect(socket, &QIODevice::readyRead,
                 this, &LanLinkProvider::dataReceived);
 
+        QTimer* timer = new QTimer(socket);
+        timer->setSingleShot(true);
+        timer->setInterval(1000);
+        connect(socket, &QSslSocket::encrypted,
+                timer, &QObject::deleteLater);
+        connect(timer, &QTimer::timeout, socket, [socket] {
+            qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Host timed out without sending any identity." << socket->peerAddress();
+            socket->disconnectFromHost();
+        });
+        timer->start();
     }
 }
 
 //I'm the new device and this is the answer to my UDP identity packet (data received)
 void LanLinkProvider::dataReceived()

Fixed code:         QTimer* timer = new QTimer(socket);
        timer->setSingleShot(true);
        timer->setInterval(1000);
        connect(socket, &QSslSocket::encrypted,
                timer, &QObject::deleteLater);
        connect(timer, &QTimer::timeout, socket, [socket] {
            qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Host timed out without sending any identity." << socket->peerAddress();
            socket->disconnectFromHost();
        });
        timer->start();
CVE-2020-26164: Uncontrolled Resource Consumption (CWE-400)
value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2020-10-07T19:15Z
Repository: https://github.com/KDE/kdeconnect-kde
Language: C++
Files changed: core/backends/lan/lanlinkprovider.cpp
Commit date: 2020-10-02 12:52:08 +0200
Commit message: Limit identity packets to 8KiB

Healthy identity packages shouldn't be that big and we don't want to
allow systems around us to send us ever humongous packages that will
just leave us without any memory.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.

Diff: diff --git a/core/backends/lan/lanlinkprovider.cpp b/core/backends/lan/lanlinkprovider.cpp
index 0e14922ed..aeabc7f30 100644
--- a/core/backends/lan/lanlinkprovider.cpp
+++ b/core/backends/lan/lanlinkprovider.cpp
@@ -397,10 +397,18 @@ void LanLinkProvider::newConnection()
 
 //I'm the new device and this is the answer to my UDP identity packet (data received)
 void LanLinkProvider::dataReceived()
 {
     QSslSocket* socket = qobject_cast<QSslSocket*>(sender());
+    //the size here is arbitrary and is now at 8192 bytes. It needs to be considerably long as it includes the capabilities but there needs to be a limit
+    //Tested between my systems and I get around 2000 per identity package.
+    if (socket->bytesAvailable() > 8192) {
+        qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Suspiciously long identity package received. Closing connection." << socket->peerAddress() << socket->bytesAvailable();
+        socket->disconnectFromHost();
+        return;
+    }
+
 #if QT_VERSION < QT_VERSION_CHECK(5,7,0)
     if (!socket->canReadLine())
         return;
 #else
     socket->startTransaction();

Fixed code:     //the size here is arbitrary and is now at 8192 bytes. It needs to be considerably long as it includes the capabilities but there needs to be a limit
    //Tested between my systems and I get around 2000 per identity package.
    if (socket->bytesAvailable() > 8192) {
        qCWarning(KDECONNECT_CORE) << "LanLinkProvider/newConnection: Suspiciously long identity package received. Closing connection." << socket->peerAddress() << socket->bytesAvailable();
        socket->disconnectFromHost();
        return;
    }
CVE-2020-26164: Uncontrolled Resource Consumption (CWE-400)
value: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2020-10-07T19:15Z
Repository: https://github.com/KDE/kdeconnect-kde
Language: C++
Files changed: core/backends/lan/lanlinkprovider.cpp
Commit date: 2020-10-02 12:52:08 +0200
Commit message: Limit the ports we try to connect to to the port range of KDE Connect

So we can't trigger connections to other services.

Thanks Matthias Gerstner <mgerstner@suse.de> for reporting this.

Diff: diff --git a/core/backends/lan/lanlinkprovider.cpp b/core/backends/lan/lanlinkprovider.cpp
index 10f76d35e..d07e0b61f 100644
--- a/core/backends/lan/lanlinkprovider.cpp
+++ b/core/backends/lan/lanlinkprovider.cpp
@@ -239,10 +239,15 @@ void LanLinkProvider::udpBroadcastReceived()
             delete receivedPacket;
             continue;
         }
 
         int tcpPort = receivedPacket->get<int>(QStringLiteral("tcpPort"));
+        if (tcpPort < MIN_TCP_PORT || tcpPort > MAX_TCP_PORT) {
+            qCDebug(KDECONNECT_CORE) << "TCP port outside of kdeconnect's range";
+            delete receivedPacket;
+            continue;
+        }
 
         //qCDebug(KDECONNECT_CORE) << "Received Udp identity packet from" << sender << " asking for a tcp connection on port " << tcpPort;
 
         if (m_receivedIdentityPackets.size() > MAX_REMEMBERED_IDENTITY_PACKETS) {
             qCWarning(KDECONNECT_CORE) << "Too many remembered identities, ignoring" << receivedPacket->get<QString>(QStringLiteral("deviceId")) << "received via UDP";

Fixed code:         if (tcpPort < MIN_TCP_PORT || tcpPort > MAX_TCP_PORT) {
            qCDebug(KDECONNECT_CORE) << "TCP port outside of kdeconnect's range";
            delete receivedPacket;
            continue;
        }
CVE-2017-9454: Out-of-bounds Read (CWE-125)
value: Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted DNS response.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-08-18T14:29Z
Repository: https://github.com/resiprocate/resiprocate
Language: C
Files changed: rutil/dns/ares/ares_parse_a_reply.c
Commit date: 2017-06-26 09:30:31 +0200
Commit message: ares: Prevent buffer overlow in ares_parse_a_reply (CVE-2017-9454)

This buffer overflow is in the embedded copy of ares that will be
used unless the external alternative c-ares is used by specifying
the configure argument --with-c-ares.

It has been found with LibFuzzer from the LLVM project.

Diff: diff --git a/rutil/dns/ares/ares_parse_a_reply.c b/rutil/dns/ares/ares_parse_a_reply.c
index 2733fe442..100f3848d 100644
--- a/rutil/dns/ares/ares_parse_a_reply.c
+++ b/rutil/dns/ares/ares_parse_a_reply.c
@@ -101,10 +101,16 @@ int ares_parse_a_reply(const unsigned char *abuf, int alen,
 	}
       rr_type = DNS_RR_TYPE(aptr);
       rr_class = DNS_RR_CLASS(aptr);
       rr_len = DNS_RR_LEN(aptr);
       aptr += RRFIXEDSZ;
+      if (aptr + rr_len > abuf + alen)
+	{
+	  free(rr_name);
+	  status = ARES_EBADRESP;
+	  break;
+	}
 
       if (rr_class == C_IN && rr_type == T_A
 	  && rr_len == sizeof(struct in_addr)
 	  && strcasecmp(rr_name, hostname) == 0)
 	{

Fixed code:       if (aptr + rr_len > abuf + alen)
	{
	  free(rr_name);
	  status = ARES_EBADRESP;
	  break;
	}
CVE-2023-38997: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: Python
Files changed: src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py
Commit date: 2023-06-28 17:18:43 +0200
Commit message: Services: Captive Portal - safeguard template overlay distribution.

Diff: diff --git a/src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py b/src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py
index 9cd3a6c2d..2508164b3 100755
--- a/src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py
+++ b/src/opnsense/scripts/OPNsense/CaptivePortal/overlay_template.py
@@ -38,19 +38,19 @@ from lib import Config
 
 if len(sys.argv) > 1:
     cnf = Config()
     zoneid = sys.argv[1]
     target_directory = '/var/captiveportal/zone%s/htdocs/' % zoneid
-    template_data = cnf.fetch_template_data(sys.argv[1])
+    template_data = cnf.fetch_template_data(zoneid)
     if template_data is not None and len(template_data) > 20:
         print ('overlay user template package for zone %s' % zoneid)
         zip_content = base64.b64decode(template_data)
         input_data = BytesIO(zip_content)
         with zipfile.ZipFile(input_data, mode='r', compression=zipfile.ZIP_DEFLATED) as zf_in:
             for zf_info in zf_in.infolist():
-                if zf_info.filename[-1] != '/':
-                    target_filename = '%s%s' % (target_directory, zf_info.filename)
+                target_filename = '%s%s' % (target_directory, zf_info.filename)
+                if os.path.realpath(target_filename).startswith(target_directory):
                     file_target_directory = '/'.join(target_filename.split('/')[:-1])
                     if not os.path.isdir(file_target_directory):
                         os.makedirs(file_target_directory)
                     with open(target_filename, 'wb') as f_out:
                         f_out.write(zf_in.read(zf_info.filename))

Vulnerable code:     template_data = cnf.fetch_template_data(sys.argv[1])
                if zf_info.filename[-1] != '/':
                    target_filename = '%s%s' % (target_directory, zf_info.filename)
Fixed code:     template_data = cnf.fetch_template_data(zoneid)
                target_filename = '%s%s' % (target_directory, zf_info.filename)
                if os.path.realpath(target_filename).startswith(target_directory):
CVE-2023-38998: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: Other
Files changed: src/etc/inc/authgui.inc
Commit date: 2023-07-04 20:52:13 +0200
Commit message: login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete

(bugfix https://github.com/opnsense/core/commit/3c2f32ec8dd1fb0da72e677b40163527fdaec7da)

Diff: diff --git a/src/etc/inc/authgui.inc b/src/etc/inc/authgui.inc
index e3a422be34..492499ba15 100644
--- a/src/etc/inc/authgui.inc
+++ b/src/etc/inc/authgui.inc
@@ -186,11 +186,16 @@ function session_auth()
                 auth_log(sprintf("Successful login for user '%s' from: %s", $_POST['usernamefld'], $_SERVER['REMOTE_ADDR']), LOG_NOTICE);
             }
             if (!empty($_GET['url'])) {
                 $tmp_url_parts = parse_url($_GET['url']);
                 if ($tmp_url_parts !== false) {
-                    $redir_uri = $tmp_url_parts['path'];
+                    $redir_uri = sprintf(
+                        '%s://%s/%s',
+                        isset($_SERVER['HTTPS']) ? 'https' : 'http',
+                        $_SERVER['HTTP_HOST'],
+                        ltrim($tmp_url_parts['path'], '/')
+                    );
                     $redir_uri .= !empty($tmp_url_parts['query']) ? "?" . $tmp_url_parts['query'] : "";
                     $redir_uri .= !empty($tmp_url_parts['fragment']) ? "#" . $tmp_url_parts['fragment'] : "";
                     header(url_safe("Location: {$redir_uri}"));
                 }
             } elseif (!empty($_SESSION['user_shouldChangePassword'])) {

Vulnerable code:                     $redir_uri = $tmp_url_parts['path'];
Fixed code:                     $redir_uri = sprintf(
                        '%s://%s/%s',
                        isset($_SERVER['HTTPS']) ? 'https' : 'http',
                        $_SERVER['HTTP_HOST'],
                        ltrim($tmp_url_parts['path'], '/')
                    );
CVE-2023-38999: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php
Commit date: 2023-07-03 09:34:59 +0200
Commit message: Power - do not allow state modification on GET for halt and reboot

Diff: diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php b/src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php
index c705b283db..e1681b6299 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Core/Api/SystemController.php
@@ -40,24 +40,26 @@ use OPNsense\Core\Backend;
  */
 class SystemController extends ApiControllerBase
 {
     public function haltAction()
     {
-        $backend = new Backend();
-        $backend->configdRun('system halt', true);
-        return [
-            'status' => 'ok'
-        ];
+        if ($this->request->isPost()) {
+            (new Backend())->configdRun('system halt', true);
+            return ['status' => 'ok'];
+        } else {
+            return ['status' => 'failed'];
+        }
     }
 
     public function rebootAction()
     {
-        $backend = new Backend();
-        $backend->configdRun('system reboot', true);
-        return [
-            'status' => 'ok'
-        ];
+        if ($this->request->isPost()) {
+            (new Backend())->configdRun('system reboot', true);
+            return ['status' => 'ok'];
+        } else {
+            return ['status' => 'failed'];
+        }
     }
 
     public function statusAction()
     {
         $this->sessionClose();

Vulnerable code:         $backend = new Backend();
        $backend->configdRun('system halt', true);
        return [
            'status' => 'ok'
        ];
        $backend = new Backend();
        $backend->configdRun('system reboot', true);
        return [
            'status' => 'ok'
        ];
Fixed code:         if ($this->request->isPost()) {
            (new Backend())->configdRun('system halt', true);
            return ['status' => 'ok'];
        } else {
            return ['status' => 'failed'];
        }
        if ($this->request->isPost()) {
            (new Backend())->configdRun('system reboot', true);
            return ['status' => 'ok'];
        } else {
            return ['status' => 'failed'];
        }
CVE-2023-39000: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php
Commit date: 2023-06-29 21:46:58 +0200
Commit message: System:Logging - Sanitize user input. An alfanum filter might be possible as well to strip module and scope, but might break some external plugins not on our radar.

Diff: diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php b/src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php
index bf05d78b64..66414f0227 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Diagnostics/LogController.php
@@ -36,12 +36,12 @@ use OPNsense\Base\IndexController;
 class LogController extends IndexController
 {
     public function renderPage($module, $scope)
     {
         $this->view->pick('OPNsense/Diagnostics/log');
-        $this->view->module = $module;
-        $this->view->scope = $scope;
+        $this->view->module = htmlspecialchars($module, ENT_QUOTES | ENT_HTML401);
+        $this->view->scope = htmlspecialchars($scope, ENT_QUOTES | ENT_HTML401);
         $this->view->service = '';
         $this->view->default_log_severity = 'Warning';
 
         $service = $module == 'core' ? $scope : $module;
 

Vulnerable code:         $this->view->module = $module;
        $this->view->scope = $scope;
Fixed code:         $this->view->module = htmlspecialchars($module, ENT_QUOTES | ENT_HTML401);
        $this->view->scope = htmlspecialchars($scope, ENT_QUOTES | ENT_HTML401);
CVE-2023-39001: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: Other
Files changed: src/opnsense/service/templates/OPNsense/Cron/user.cron
Commit date: 2023-07-03 09:27:48 +0200
Commit message: System/Settings/Cron  - improve escaping in /var/cron/tabs/nobody generation.

Diff: diff --git a/src/opnsense/service/templates/OPNsense/Cron/user.cron b/src/opnsense/service/templates/OPNsense/Cron/user.cron
index d693d15b0b..424b6d407d 100644
--- a/src/opnsense/service/templates/OPNsense/Cron/user.cron
+++ b/src/opnsense/service/templates/OPNsense/Cron/user.cron
@@ -8,13 +8,13 @@ PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
 {% if helpers.exists('OPNsense.cron.jobs') %}
 #minute	hour	mday	month	wday	command
 {%  for job in helpers.toList('OPNsense.cron.jobs.job') %}
 {%   if job.enabled|default('0') == '1' %}
 # Origin/Description: {{job.origin}}/{{job.description}}
-{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
+{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
    if job.parameters %}{%
-      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%
+      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
       endfor %}{% endif %}
 
 {%   endif %}
 {%  endfor %}
 {% endif %}

Vulnerable code: {{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%
Fixed code: {{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
CVE-2023-39002: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/www/system_camanager.php, src/www/system_certmanager.php
Commit date: 2023-06-29 22:06:31 +0200
Commit message: System: Trust: Authorities - Sanitize $act parameter

Diff: diff --git a/src/www/system_camanager.php b/src/www/system_camanager.php
index dd5b670cc4..d509cb710b 100644
--- a/src/www/system_camanager.php
+++ b/src/www/system_camanager.php
@@ -430,10 +430,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         }
     }
 }
 
 legacy_html_escape_form_data($pconfig);
+$act = htmlspecialchars($act,  ENT_QUOTES | ENT_HTML401);
 
 include("head.inc");
 
 ?>
 <body>
diff --git a/src/www/system_certmanager.php b/src/www/system_certmanager.php
index 7057052704..3f1e1e3db8 100644
--- a/src/www/system_certmanager.php
+++ b/src/www/system_certmanager.php
@@ -810,10 +810,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
 }
 
 legacy_html_escape_form_data($pconfig);
 legacy_html_escape_form_data($a_ca);
 legacy_html_escape_form_data($a_cert);
+$act = htmlspecialchars($act,  ENT_QUOTES | ENT_HTML401);
 
 include("head.inc");
 
 ?>
 <body>

Fixed code: $act = htmlspecialchars($act,  ENT_QUOTES | ENT_HTML401);
$act = htmlspecialchars($act,  ENT_QUOTES | ENT_HTML401);
CVE-2023-39006: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/www/crash_reporter.php
Commit date: 2023-07-03 10:19:23 +0200
Commit message: System: Firmware: Reporter - escape reports

Diff: diff --git a/src/www/crash_reporter.php b/src/www/crash_reporter.php
index 93cbdbc423..450637d563 100644
--- a/src/www/crash_reporter.php
+++ b/src/www/crash_reporter.php
@@ -273,11 +273,11 @@ legacy_html_escape_form_data($pconfig);
 <?php endif ?>
 <?php
               foreach ($crash_reports as $report => $content):?>
                   <p>
                     <?=$report;?>:<br/>
-                    <pre><?=$content;?></pre>
+                    <pre><?=html_safe($content);?></pre>
                   </p>
 <?php
               endforeach;
             else:?>
 

Vulnerable code:                     <pre><?=$content;?></pre>
Fixed code:                     <pre><?=html_safe($content);?></pre>
CVE-2023-39007: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
Commit date: 2023-06-29 21:29:32 +0200
Commit message: System:Settings:Cron - cleanse user input in /ui/cron/item/open/...

Diff: diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php b/src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
index a94d63382f..8c8b742510 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Cron/ItemController.php
@@ -41,11 +41,11 @@ class ItemController extends \OPNsense\Base\IndexController
      * @param null $uuid cron item to open
      * @throws \Exception
      */
     public function openAction($uuid = null)
     {
-        $this->view->selected_uuid = $uuid;
+        $this->view->selected_uuid = htmlspecialchars($uuid, ENT_QUOTES | ENT_HTML401);
         // include dialog form definitions
         $this->view->formDialogEdit = $this->getForm("dialogEdit");
         $this->view->pick('OPNsense/Cron/index');
     }
 }

Vulnerable code:         $this->view->selected_uuid = $uuid;
Fixed code:         $this->view->selected_uuid = htmlspecialchars($uuid, ENT_QUOTES | ENT_HTML401);
CVE-2023-39008: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-08-09T19:15Z
Repository: https://github.com/opnsense/core
Language: Other
Files changed: src/opnsense/service/templates/OPNsense/Cron/user.cron
Commit date: 2023-07-03 09:27:48 +0200
Commit message: System/Settings/Cron  - improve escaping in /var/cron/tabs/nobody generation.

Diff: diff --git a/src/opnsense/service/templates/OPNsense/Cron/user.cron b/src/opnsense/service/templates/OPNsense/Cron/user.cron
index d693d15b0b..424b6d407d 100644
--- a/src/opnsense/service/templates/OPNsense/Cron/user.cron
+++ b/src/opnsense/service/templates/OPNsense/Cron/user.cron
@@ -8,13 +8,13 @@ PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
 {% if helpers.exists('OPNsense.cron.jobs') %}
 #minute	hour	mday	month	wday	command
 {%  for job in helpers.toList('OPNsense.cron.jobs.job') %}
 {%   if job.enabled|default('0') == '1' %}
 # Origin/Description: {{job.origin}}/{{job.description}}
-{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
+{{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
    if job.parameters %}{%
-      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%
+      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
       endfor %}{% endif %}
 
 {%   endif %}
 {%  endfor %}
 {% endif %}

Vulnerable code: {{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command}}{%
      for param in job.parameters|shlex_split %} {{param|shlex_quote}}{%
Fixed code: {{job.minutes}}	{{job.hours}}	{{job.days}}	{{job.months}}	{{job.weekdays}}	/usr/local/sbin/configctl -d {{job.command|replace("\n", "")|shlex_quote}}{%
      for param in job.parameters|shlex_split %} {{param|replace("\n", "")|shlex_quote}}{%
CVE-2023-44275: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-28T05:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/www/index.php
Commit date: 2023-09-19 19:46:28 +0200
Commit message: Lobby: Dashboard - fix data cleansing issue in column_count and sequences.

Diff: diff --git a/src/www/index.php b/src/www/index.php
index 59c816ede7..2613c772e3 100644
--- a/src/www/index.php
+++ b/src/www/index.php
@@ -35,10 +35,11 @@ config_read_array('widgets');
 
 $widgetCollection = array();
 
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     $pconfig = $config['widgets'];
+    legacy_html_escape_form_data($pconfig);
     // set default dashboard view
     $pconfig['sequence'] = !empty($pconfig['sequence']) ? $pconfig['sequence'] : '';
     $pconfig['column_count'] = !empty($pconfig['column_count']) ? $pconfig['column_count'] : 2;
     // build list of widgets
     $widgetSeqParts = explode(",", $pconfig['sequence']);
@@ -68,11 +69,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         $config['widgets']['sequence'] = $_POST['sequence'];
     } elseif (isset($config['widgets']['sequence'])) {
         unset($config['widgets']['sequence']);
     }
     if (!empty($_POST['column_count'])) {
-        $config['widgets']['column_count'] = $_POST['column_count'];
+        $config['widgets']['column_count'] = filter_var($_POST['column_count'], FILTER_SANITIZE_NUMBER_INT);
     } elseif(isset($config['widgets']['column_count'])) {
         unset($config['widgets']['column_count']);
     }
     write_config('Widget configuration has been changed');
     header(url_safe('Location: /index.php'));

Vulnerable code:         $config['widgets']['column_count'] = $_POST['column_count'];
Fixed code:     legacy_html_escape_form_data($pconfig);
        $config['widgets']['column_count'] = filter_var($_POST['column_count'], FILTER_SANITIZE_NUMBER_INT);
CVE-2023-44276: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-28T05:15Z
Repository: https://github.com/opnsense/core
Language: PHP
Files changed: src/www/index.php
Commit date: 2023-09-19 19:46:28 +0200
Commit message: Lobby: Dashboard - fix data cleansing issue in column_count and sequences.

Diff: diff --git a/src/www/index.php b/src/www/index.php
index 59c816ede7..2613c772e3 100644
--- a/src/www/index.php
+++ b/src/www/index.php
@@ -35,10 +35,11 @@ config_read_array('widgets');
 
 $widgetCollection = array();
 
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     $pconfig = $config['widgets'];
+    legacy_html_escape_form_data($pconfig);
     // set default dashboard view
     $pconfig['sequence'] = !empty($pconfig['sequence']) ? $pconfig['sequence'] : '';
     $pconfig['column_count'] = !empty($pconfig['column_count']) ? $pconfig['column_count'] : 2;
     // build list of widgets
     $widgetSeqParts = explode(",", $pconfig['sequence']);
@@ -68,11 +69,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
         $config['widgets']['sequence'] = $_POST['sequence'];
     } elseif (isset($config['widgets']['sequence'])) {
         unset($config['widgets']['sequence']);
     }
     if (!empty($_POST['column_count'])) {
-        $config['widgets']['column_count'] = $_POST['column_count'];
+        $config['widgets']['column_count'] = filter_var($_POST['column_count'], FILTER_SANITIZE_NUMBER_INT);
     } elseif(isset($config['widgets']['column_count'])) {
         unset($config['widgets']['column_count']);
     }
     write_config('Widget configuration has been changed');
     header(url_safe('Location: /index.php'));

Vulnerable code:         $config['widgets']['column_count'] = $_POST['column_count'];
Fixed code:     legacy_html_escape_form_data($pconfig);
        $config['widgets']['column_count'] = filter_var($_POST['column_count'], FILTER_SANITIZE_NUMBER_INT);
CVE-2023-31779: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-05-22T13:15Z
Repository: https://github.com/wekan/wekan
Language: JavaScript
Files changed: models/cardCommentReactions.js
Commit date: 2023-04-18 01:30:54 +0300
Commit message: Security fix to ReactionBleed in WeKan. It is XSS in feature "Reaction to comment".

Thanks to Alexander Starikov at Jet Infosystems (https://jetinfosystems.com/).

Diff: diff --git a/models/cardCommentReactions.js b/models/cardCommentReactions.js
index 17c2a1236..9975f3a2b 100644
--- a/models/cardCommentReactions.js
+++ b/models/cardCommentReactions.js
@@ -1,7 +1,16 @@
 const commentReactionSchema = new SimpleSchema({
-  reactionCodepoint: { type: String, optional: false },
+  reactionCodepoint: {
+    type: String,
+    optional: false,
+    max: 9, // max length of reaction code
+    custom() {
+      if (!this.value.match(/^&#\d{4,6};$/)) { // regex for only valid reactions
+        return "incorrectReactionCode";
+      }
+    },
+  },
   userIds: { type: [String], defaultValue: [] }
 });
 
 CardCommentReactions = new Mongo.Collection('card_comment_reactions');
 

Vulnerable code:   reactionCodepoint: { type: String, optional: false },
Fixed code:   reactionCodepoint: {
    type: String,
    optional: false,
    max: 9, // max length of reaction code
    custom() {
      if (!this.value.match(/^&#\d{4,6};$/)) { // regex for only valid reactions
        return "incorrectReactionCode";
      }
    },
  },
CVE-2024-24762: Inefficient Regular Expression Complexity (CWE-1333)
value: `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2024-02-05T15:15Z
Repository: https://github.com/encode/starlette
Language: Other
Files changed: pyproject.toml
Commit date: 2024-02-03 05:34:10 -0700
Commit message: Merge pull request from GHSA-93gm-qmq6-w238


Diff: diff --git a/pyproject.toml b/pyproject.toml
index 9909fb8..48562e7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,11 +34,11 @@ dependencies = [
 
 [project.optional-dependencies]
 full = [
     "itsdangerous",
     "jinja2",
-    "python-multipart",
+    "python-multipart>=0.0.7",
     "pyyaml",
     "httpx>=0.22.0",
 ]
 
 [project.urls]

Vulnerable code:     "python-multipart",
Fixed code:     "python-multipart>=0.0.7",
CVE-2022-24777: Reachable Assertion (CWE-617)
value: grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2022-03-25T17:15Z
Repository: https://github.com/grpc/grpc-swift
Language: Unknown
Commit date: 2022-03-23 11:22:01 +0000
Commit message: Merge pull request from GHSA-r6ww-5963-7r95

Better handle client sending GOAWAY
CVE-2018-1281: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLC_PS_ROOT_URI once a scheduler node is initialized. This exposes the instance running MXNet to any attackers reachable via the interface they didn't expect to be listening on. For example: If a user wants to run a clustered setup locally, they may specify to run on 127.0.0.1. But since MXNet will listen on 0.0.0.0, it makes the port accessible on all network interfaces.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2018-06-08T19:29Z
Repository: https://github.com/dmlc/ps-lite
Language: C
Files changed: src/zmq_van.h
Commit date: 2017-11-21 12:07:50 -0800
Commit message: Avoid listening on all interfaces by default

Diff: diff --git a/src/zmq_van.h b/src/zmq_van.h
index c54d650..f6a14cc 100644
--- a/src/zmq_van.h
+++ b/src/zmq_van.h
@@ -61,11 +61,12 @@ class ZMQVan : public Van {
   int Bind(const Node& node, int max_retry) override {
     receiver_ = zmq_socket(context_, ZMQ_ROUTER);
     CHECK(receiver_ != NULL)
         << "create receiver socket failed: " << zmq_strerror(errno);
     int local = GetEnv("DMLC_LOCAL", 0);
-    std::string addr = local ? "ipc:///tmp/" : "tcp://*:";
+    std::string hostname = node.hostname.empty() ? "*" : node.hostname;
+    std::string addr = local ? "ipc:///tmp/" : "tcp://" + hostname + ":";
     int port = node.port;
     unsigned seed = static_cast<unsigned>(time(NULL)+port);
     for (int i = 0; i < max_retry+1; ++i) {
       auto address = addr + std::to_string(port);
       if (zmq_bind(receiver_, address.c_str()) == 0) break;

Vulnerable code:     std::string addr = local ? "ipc:///tmp/" : "tcp://*:";
Fixed code:     std::string hostname = node.hostname.empty() ? "*" : node.hostname;
    std::string addr = local ? "ipc:///tmp/" : "tcp://" + hostname + ":";
CVE-2014-2383: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2014-04-28T14:09Z
Repository: https://github.com/dompdf/dompdf
Language: PHP
Files changed: dompdf.php, include/dompdf.cls.php
Commit date: 2014-03-10 18:57:58 -0700
Commit message: Remove pre-processing of PHP code, disallow I/O streams as file input

Diff: diff --git a/dompdf.php b/dompdf.php
index e7c0a4e..a9052fa 100755
--- a/dompdf.php
+++ b/dompdf.php
@@ -225,10 +225,14 @@ switch ( $sapi ) {
     if ( strpos($file, DOMPDF_CHROOT) !== 0 ) {
       throw new DOMPDF_Exception("Permission denied on $file. The file could not be found under the directory specified by DOMPDF_CHROOT.");
     }
   }
   
+  if($file_parts['protocol'] === 'php://') {
+    throw new DOMPDF_Exception("Permission denied on $file. This script does not allow PHP streams.");
+  }
+  
   $outfile = "dompdf_out.pdf"; # Don't allow them to set the output file
   $save_file = false; # Don't save the file
   
   break;
 }
diff --git a/include/dompdf.cls.php b/include/dompdf.cls.php
index a5658cb..1be1f82 100644
--- a/include/dompdf.cls.php
+++ b/include/dompdf.cls.php
@@ -578,17 +578,10 @@ class DOMPDF {
     // FIXME: roll this into the encoding detection using UTF-8/16/32 BOM (http://us2.php.net/manual/en/function.mb-detect-encoding.php#91051)?
     if ( substr($str, 0, 3) == chr(0xEF).chr(0xBB).chr(0xBF) ) {
       $str = substr($str, 3);
     }
 
-    // Parse embedded php, first-pass
-    if ( $this->get_option("enable_php") ) {
-      ob_start();
-      eval("?" . ">$str");
-      $str = ob_get_clean();
-    }
-
     // if the document contains non utf-8 with a utf-8 meta tag chars and was 
     // detected as utf-8 by mbstring, problems could happen.
     // http://devzone.zend.com/article/8855
     if ( $encoding !== 'UTF-8' ) {
       $re = '/<meta ([^>]*)((?:charset=[^"\' ]+)([^>]*)|(?:charset=["\'][^"\' ]+["\']))([^>]*)>/i';

Vulnerable code:     // Parse embedded php, first-pass
    if ( $this->get_option("enable_php") ) {
      ob_start();
      eval("?" . ">$str");
      $str = ob_get_clean();
    }

Fixed code:   if($file_parts['protocol'] === 'php://') {
    throw new DOMPDF_Exception("Permission denied on $file. This script does not allow PHP streams.");
  }
CVE-2022-0085: Server-Side Request Forgery (SSRF) (CWE-918)
value: Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 5.3
Published: 2022-06-28T15:15Z
Repository: https://github.com/dompdf/dompdf
Language: PHP
Files changed: src/Options.php, tests/DompdfTest.php
Commit date: 2022-06-14 10:35:24 -0400
Commit message: Add a default context

- creates a user agent
- disables following redirects

Diff: diff --git a/src/Options.php b/src/Options.php
index 478503f3..69c43bd9 100644
--- a/src/Options.php
+++ b/src/Options.php
@@ -296,10 +296,22 @@ class Options
         $this->setRootDir($rootDir);
         $this->setTempDir(sys_get_temp_dir());
         $this->setFontDir($rootDir . "/lib/fonts");
         $this->setFontCache($this->getFontDir());
 
+        $ver = "";
+        $versionFile = realpath(__DIR__ . "/../VERSION");
+        if (file_exists($versionFile) && ($version = trim(file_get_contents($versionFile))) !== false && $version !== '$Format:<%h>$') {
+            $ver = "/$version";
+        }
+        $this->setHttpContext([
+            "http" => [
+                "follow_location" => false,
+                "user_agent" => "Dompdf$ver https://github.com/dompdf/dompdf"
+            ]
+        ]);
+
         if (null !== $attributes) {
             $this->set($attributes);
         }
     }
 
diff --git a/tests/DompdfTest.php b/tests/DompdfTest.php
index b53da966..dcd763e9 100644
--- a/tests/DompdfTest.php
+++ b/tests/DompdfTest.php
@@ -19,11 +19,10 @@ class DompdfTest extends TestCase
         $this->assertSame("", $dompdf->getBaseHost());
         $this->assertSame("", $dompdf->getBasePath());
         $this->assertIsArray($dompdf->getCallbacks());
         $this->assertInstanceOf(Stylesheet::class, $dompdf->getCss());
         $this->assertNull($dompdf->getDom());
-        $this->assertNull($dompdf->getHttpContext());
         $this->assertInstanceOf(Options::class, $dompdf->getOptions());
         $this->assertFalse($dompdf->getQuirksmode());
         $this->assertNull($dompdf->getTree());
     }
 

Vulnerable code:         $this->assertNull($dompdf->getHttpContext());
Fixed code:         $ver = "";
        $versionFile = realpath(__DIR__ . "/../VERSION");
        if (file_exists($versionFile) && ($version = trim(file_get_contents($versionFile))) !== false && $version !== '$Format:<%h>$') {
            $ver = "/$version";
        }
        $this->setHttpContext([
            "http" => [
                "follow_location" => false,
                "user_agent" => "Dompdf$ver https://github.com/dompdf/dompdf"
            ]
        ]);