Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-28368: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.8
Published: 2022-04-03T03:15Z
Repository: https://github.com/dompdf/dompdf
Language: PHP
Files changed: src/FontMetrics.php
Commit date: 2022-03-21 17:08:15 -0400
Commit message: Match installed font filename extension to type

fixes #2598

Diff: diff --git a/src/FontMetrics.php b/src/FontMetrics.php
index 8a525cbc..316fe147 100644
--- a/src/FontMetrics.php
+++ b/src/FontMetrics.php
@@ -204,11 +204,10 @@ class FontMetrics
         if (isset($entry[$styleString]) && $localFile == $entry[$styleString]) {
             return true;
         }
 
         $cacheEntry = $localFile;
-        $localFile .= ".".strtolower(pathinfo(parse_url($remoteFile, PHP_URL_PATH), PATHINFO_EXTENSION));
 
         $entry[$styleString] = $cacheEntry;
 
         // Download the remote file
         [$protocol] = Helpers::explode_url($remoteFile);
@@ -256,10 +255,17 @@ class FontMetrics
         if (!$font) {
             unlink($localTempFile);
             return false;
         }
 
+        switch ($font->getFontType()) {
+            case "TrueType":
+            default:
+                $localFile .= ".ttf";
+                break;
+        }
+
         $font->parse();
         $font->saveAdobeFontMetrics("$cacheEntry.ufm");
         $font->close();
 
         unlink($localTempFile);

Vulnerable code:         $localFile .= ".".strtolower(pathinfo(parse_url($remoteFile, PHP_URL_PATH), PATHINFO_EXTENSION));
Fixed code:         switch ($font->getFontType()) {
            case "TrueType":
            default:
                $localFile .= ".ttf";
                break;
        }
CVE-2023-23924: Incorrect Authorization (CWE-863)
value: Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 9.8
Published: 2023-02-01T00:15Z
Repository: https://github.com/dompdf/dompdf
Language: PHP
Files changed: src/Image/Cache.php
Commit date: 2023-01-31 08:10:39 -0500
Commit message: SVG parsing - comparing the tag name in a case insensitive way

This patch will avoid bypassing the uri validation if the tag name have some uppercased letters.
Diff: diff --git a/src/Image/Cache.php b/src/Image/Cache.php
index f337bbb4..6141cb50 100644
--- a/src/Image/Cache.php
+++ b/src/Image/Cache.php
@@ -131,11 +131,11 @@ class Cache
                 $parser = xml_parser_create("utf-8");
                 xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, false);
                 xml_set_element_handler(
                     $parser,
                     function ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {
-                        if ($name === "image") {
+                        if (strtolower($name) === "image") {
                             $attributes = array_change_key_case($attributes, CASE_LOWER);
                             $url = $attributes["xlink:href"] ?? $attributes["href"];
                             if (!empty($url)) {
                                 $inner_full_url = Helpers::build_url($parsed_url["protocol"], $parsed_url["host"], $parsed_url["path"], $url);
                                 if ($inner_full_url === $full_url) {

Vulnerable code:                         if ($name === "image") {
Fixed code:                         if (strtolower($name) === "image") {
CVE-2015-10065: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2023-01-17T23:15Z
Repository: https://github.com/AenBleidd/FiND
Language: C++
Files changed: validator/my_validator.cpp
Commit date: 2015-01-28 13:53:02 +0000
Commit message: fixed overflow vulnerability
Diff: diff --git a/validator/my_validator.cpp b/validator/my_validator.cpp
index dcb8c59..f1cc4c5 100644
--- a/validator/my_validator.cpp
+++ b/validator/my_validator.cpp
@@ -53,11 +53,12 @@ int init_result(RESULT & result, void*& data) {
 		}
 	}
 	log_messages.printf(MSG_DEBUG, "Check result\n");
 
 	char buff[256];
-	n = fscanf(f, "%s", buff);
+	//n = fscanf(f, "%s", buff);
+	fgets(buff, 256, f);
 	char * pch;
 	pch = strtok(buff, " ,");
 	if (pch != NULL) {
 		dp->receptor = pch;
 	} else {

Vulnerable code: 	n = fscanf(f, "%s", buff);
Fixed code: 	//n = fscanf(f, "%s", buff);
	fgets(buff, 256, f);
CVE-2021-4247: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 7.5
Published: 2022-12-18T08:15Z
Repository: https://github.com/OWASP/NodeGoat
Language: JavaScript
Files changed: app/routes/research.js
Commit date: 2021-01-26 13:37:11 +0000
Commit message: Fix TypeError when server-side request fails

In addition to the intended SSRF vulnerability, it was possible to
crash the server with maliciously chosen query parameters.

Closes #225

Diff: diff --git a/app/routes/research.js b/app/routes/research.js
index 3e04cfe..c3ae59d 100644
--- a/app/routes/research.js
+++ b/app/routes/research.js
@@ -11,19 +11,21 @@ function ResearchHandler(db) {
 
     this.displayResearch = (req, res) => {
 
         if (req.query.symbol) {
             const url = req.query.url + req.query.symbol;
-            return needle.get(url, (error, newResponse) => {
+            return needle.get(url, (error, newResponse, body) => {
                 if (!error && newResponse.statusCode === 200) {
                     res.writeHead(200, {
                         "Content-Type": "text/html"
                     });
                 }
                 res.write("<h1>The following is the stock information you requested.</h1>\n\n");
                 res.write("\n\n");
-                res.write(newResponse.body);
+                if (body) {
+                    res.write(body);
+                }
                 return res.end();
             });
         }
 
         return res.render("research", {

Vulnerable code:             return needle.get(url, (error, newResponse) => {
                res.write(newResponse.body);
Fixed code:             return needle.get(url, (error, newResponse, body) => {
                if (body) {
                    res.write(body);
                }
CVE-2019-19274: Out-of-bounds Read (CWE-125)
value: typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2019-11-26T15:15Z
Repository: https://github.com/python/typed_ast
Language: C
Files changed: ast3/Python/ast.c
Commit date: 2019-04-09 12:51:30 -0700
Commit message: Fix two out-of-bounds array reads (#99)

The patch is taken from a commit to the CPython repo with the message:

bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.
Diff: diff --git a/ast3/Python/ast.c b/ast3/Python/ast.c
index 9eeaf15..b50412e 100644
--- a/ast3/Python/ast.c
+++ b/ast3/Python/ast.c
@@ -1443,11 +1443,11 @@ handle_keywordonly_args(struct compiling *c, const node *n, int start,
                           c->c_arena);
                 if (!arg)
                     goto error;
                 asdl_seq_SET(kwonlyargs, j++, arg);
                 i += 1; /* the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 /* arg will be equal to the last argument processed */
                 arg->type_comment = NEW_TYPE_COMMENT(ch);
@@ -1642,11 +1642,11 @@ ast_for_arguments(struct compiling *c, const node *n)
                 assert(TYPE(ch) == tfpdef || TYPE(ch) == vfpdef);
                 kwarg = ast_for_arg(c, ch);
                 if (!kwarg)
                     return NULL;
                 i += 2; /* the double star and the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 assert(i);
 

Vulnerable code:                 if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)
Fixed code:                 if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2019-19275: Out-of-bounds Read (CWE-125)
value: typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2019-11-26T15:15Z
Repository: https://github.com/python/typed_ast
Language: C
Files changed: ast3/Python/ast.c
Commit date: 2019-04-09 12:51:30 -0700
Commit message: Fix two out-of-bounds array reads (#99)

The patch is taken from a commit to the CPython repo with the message:

bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.
Diff: diff --git a/ast3/Python/ast.c b/ast3/Python/ast.c
index 9eeaf15..b50412e 100644
--- a/ast3/Python/ast.c
+++ b/ast3/Python/ast.c
@@ -1443,11 +1443,11 @@ handle_keywordonly_args(struct compiling *c, const node *n, int start,
                           c->c_arena);
                 if (!arg)
                     goto error;
                 asdl_seq_SET(kwonlyargs, j++, arg);
                 i += 1; /* the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 /* arg will be equal to the last argument processed */
                 arg->type_comment = NEW_TYPE_COMMENT(ch);
@@ -1642,11 +1642,11 @@ ast_for_arguments(struct compiling *c, const node *n)
                 assert(TYPE(ch) == tfpdef || TYPE(ch) == vfpdef);
                 kwarg = ast_for_arg(c, ch);
                 if (!kwarg)
                     return NULL;
                 i += 2; /* the double star and the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
                 assert(i);
 

Vulnerable code:                 if (TYPE(CHILD(n, i)) == COMMA)
                if (TYPE(CHILD(n, i)) == COMMA)
Fixed code:                 if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
CVE-2020-27163: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-10-16T03:15Z
Repository: https://github.com/erikdubbelboer/phpRedisAdmin
Language: PHP
Files changed: login.php
Commit date: 2020-10-14 16:03:41 +0000
Commit message: Fix XSS

Diff: diff --git a/login.php b/login.php
index dc0a887..82c5514 100644
--- a/login.php
+++ b/login.php
@@ -23,11 +23,11 @@ require 'includes/header.inc.php';
     <?php endif; ?>
 
     <label for="inputUser" class="sr-only">Username</label>
     <input type="text" name="username" id="inputUser" class="form-control"
            placeholder="Username"
-           value="<?= isset($_POST['username']) ? $_POST['username'] : '' ?>"
+           value="<?= isset($_POST['username']) ? htmlentities($_POST['username'], defined('ENT_SUBSTITUTE') ? (ENT_QUOTES | ENT_SUBSTITUTE) : ENT_QUOTES, 'utf-8') : '' ?>"
            required <?= isset($_POST['username']) ? '' : 'autofocus' ?>>
 
     <label for="inputPassword" class="sr-only">Password</label>
     <input type="password" name="password" id="inputPassword" class="form-control"
            placeholder="Password"

Vulnerable code:            value="<?= isset($_POST['username']) ? $_POST['username'] : '' ?>"
Fixed code:            value="<?= isset($_POST['username']) ? htmlentities($_POST['username'], defined('ENT_SUBSTITUTE') ? (ENT_QUOTES | ENT_SUBSTITUTE) : ENT_QUOTES, 'utf-8') : '' ?>"
CVE-2021-4259: Use of Wrong Operator in String Comparison (CWE-597)
value: A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267.
CWE description: The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
CVSS v3 base score: 9.8
Published: 2022-12-19T14:15Z
Repository: https://github.com/erikdubbelboer/phpRedisAdmin
Language: PHP
Files changed: includes/login.inc.php
Commit date: 2021-10-05 18:45:52 +0000
Commit message: Fix magic hash attack

Diff: diff --git a/includes/login.inc.php b/includes/login.inc.php
index 75ed28d..8cfb26d 100644
--- a/includes/login.inc.php
+++ b/includes/login.inc.php
@@ -54,11 +54,11 @@ function authHttpDigest()
 
     $password = md5($login['name'].':'.$realm.':'.$login['password']);
 
     $response = md5($password.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']));
 
-    if ($data['response'] != $response) {
+    if ($data['response'] !== $response) {
       header('HTTP/1.1 401 Unauthorized');
       header('WWW-Authenticate: Digest realm="'.$realm.'",qop="auth",nonce="'.uniqid().'",opaque="'.$opaque.'"');
       die('Invalid username and/or password combination.');
     }
 

Vulnerable code:     if ($data['response'] != $response) {
Fixed code:     if ($data['response'] !== $response) {
CVE-2024-28247: Insufficient Information (NVD-CWE-noinfo)
value: The Pi-hole is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software. A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user.If the URL that is in the list of "Adslists" begins with "file*" it is understood that it is updating from a local file, on the other hand if it does not begin with "file*" depending on the state of the response it does one thing or another. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen. This vulnerability is fixed by 5.18.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-27T19:15Z
Repository: https://github.com/pi-hole/pi-hole
Language: Unknown
Commit date: 2024-03-27 18:02:44 +0000
Commit message: Merge pull request from GHSA-95g6-7q26-mp9x

Only use local files (file://) when they have explicit permissions a+r
CVE-2024-34361: Insufficient Information (NVD-CWE-noinfo)
value: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-05T19:15Z
Repository: https://github.com/pi-hole/pi-hole
Language: Shell
Files changed: gravity.sh
Commit date: 2024-07-05 18:35:19 +0100
Commit message: Add protocol validation when downloading blocklist from URL

Signed-off-by: DL6ER <dl6er@dl6er.de>

Diff: diff --git a/gravity.sh b/gravity.sh
index 636cde0d..c4622ead 100755
--- a/gravity.sh
+++ b/gravity.sh
@@ -584,10 +584,16 @@ gravity_DownloadBlocklistFromUrl() {
         download=false
       fi
     fi
   fi
 
+  # Check for allowed protocols
+  if [[ $url != "http"* && $url != "https"* && $url != "file"* && $url != "ftp"* && $url != "ftps"* && $url != "sftp"* ]]; then
+    echo -e "${OVER}  ${CROSS} ${str} Invalid protocol specified, ignoring list"
+    download=false
+  fi
+
   if [[ "${download}" == true ]]; then
     # shellcheck disable=SC2086
     httpCode=$(curl --connect-timeout ${curl_connect_timeout} -s -L ${compression} ${cmd_ext} ${heisenbergCompensator} -w "%{http_code}" "${url}" -o "${listCurlBuffer}" 2> /dev/null)
   fi
 

Fixed code:   # Check for allowed protocols
  if [[ $url != "http"* && $url != "https"* && $url != "file"* && $url != "ftp"* && $url != "ftps"* && $url != "sftp"* ]]; then
    echo -e "${OVER}  ${CROSS} ${str} Invalid protocol specified, ignoring list"
    download=false
  fi
CVE-2023-37468: Cleartext Storage of Sensitive Information (CWE-312)
value: Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.


CWE description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CVSS v3 base score: 5.5
Published: 2023-07-13T21:15Z
Repository: https://github.com/thm-mni-ii/feedbacksystem
Language: Scala
Files changed: modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/LoginController.scala
Commit date: 2023-06-22 14:26:44 +0200
Commit message: Merge pull request from GHSA-g28r-8wg3-7349

passwords
Diff: diff --git a/modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/LoginController.scala b/modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/LoginController.scala
index a6cd859e..a64d2db1 100644
--- a/modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/LoginController.scala
+++ b/modules/fbs-core/api/src/main/scala/de/thm/ii/fbs/controller/LoginController.scala
@@ -116,15 +116,15 @@ class LoginController extends CasClientConfigurerAdapter {
       val login = for {
         username <- jsonNode.retrive("username").asText()
         password <- jsonNode.retrive("password").asText()
         ldapUser <- ldapService.login(username, password)
         user <- loadUserFromLdap(ldapUser.getAttribute("uid").getStringValue)
-      } yield (user, password)
+      } yield user
 
       login match {
-        case Some((user, password)) =>
-          val localUser = userService.find(user.username).getOrElse(userService.create(user, password))
+        case Some((user)) =>
+          val localUser = userService.find(user.username).getOrElse(userService.create(user, null))
           authService.renewAuthentication(localUser, response)
         case None => throw new UnauthorizedException()
       }
     } else {
       throw new ForbiddenException()

Vulnerable code:       } yield (user, password)
        case Some((user, password)) =>
          val localUser = userService.find(user.username).getOrElse(userService.create(user, password))
Fixed code:       } yield user
        case Some((user)) =>
          val localUser = userService.find(user.username).getOrElse(userService.create(user, null))
CVE-2024-25107: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-02-08T23:15Z
Repository: https://github.com/miraheze/WikiDiscover
Language: Unknown
Commit date: 2024-02-08 21:23:28 +0100
Commit message: Merge pull request from GHSA-cfcf-94jv-455f

Merge changes from WikiDiscover-ghsa-cfcf-94jv-455f
CVE-2021-43861: Other (NVD-CWE-Other)
value: Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.4
Published: 2021-12-30T14:15Z
Repository: https://github.com/mermaid-js/mermaid
Language: Unknown
Commit date: 2021-12-29 11:29:46 +0100
Commit message: Merge pull request from GHSA-p3rp-vmj9-gv6v

Advisory fix 1
CVE-2022-31108: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. This issue may lead to `Information Disclosure` via CSS selectors and functions able to generate HTTP requests. This also allows an attacker to change the document in ways which may lead a user to perform unintended actions, such as clicking on a link, etc. This issue has been resolved in version 9.1.3. Users are advised to upgrade. Users unable to upgrade should ensure that user input is adequately escaped before embedding it in CSS blocks.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-28T19:15Z
Repository: https://github.com/mermaid-js/mermaid
Language: Unknown
Commit date: 2022-06-28 18:55:12 +0200
Commit message: Merge pull request from GHSA-x3vm-38hw-55wf

CSS Injection security issue
CVE-2020-26238: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2020-11-25T00:15Z
Repository: https://github.com/jmrozanec/cron-utils
Language: XML
Files changed: pom.xml
Commit date: 2020-11-17 14:53:58 +0100
Commit message: Update dependencies to fix security vulnerability.

Diff: diff --git a/pom.xml b/pom.xml
index bd1252e..f8972d8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,15 +119,16 @@
             <artifactId>quartz</artifactId>
             <version>2.3.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
-            <groupId>org.hibernate</groupId>
-            <artifactId>hibernate-validator</artifactId>
+            <groupId>org.apache.bval</groupId>
+            <artifactId>bval-jsr</artifactId>
+            <version>1.1.2</version>
+            <!--The Hibernate dependency is no longer used, due to security vulnerabilities -->
             <!-- https://stackoverflow.com/questions/48323244/java-lang-nosuchmethoderror-javax-validation-bootstrapconfiguration-getclockproExecutionTimeQuartzIntegrationTest -->
             <!-- https://stackoverflow.com/questions/24386771/javax-validation-validationexception-hv000183-unable-to-load-javax-el-express -->
-            <version>5.3.6.Final</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>javax.el</groupId>
             <artifactId>javax.el-api</artifactId>

Vulnerable code:             <groupId>org.hibernate</groupId>
            <artifactId>hibernate-validator</artifactId>
            <version>5.3.6.Final</version>
Fixed code:             <groupId>org.apache.bval</groupId>
            <artifactId>bval-jsr</artifactId>
            <version>1.1.2</version>
            <!--The Hibernate dependency is no longer used, due to security vulnerabilities -->
CVE-2021-41269: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2021-11-15T21:15Z
Repository: https://github.com/jmrozanec/cron-utils
Language: Unknown
Commit date: 2021-10-30 15:11:58 +0200
Commit message: Merge pull request #493 from pwntester/patch-1

Prevent arbitrary EL expression evaluation
CVE-2021-41269: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2021-11-15T21:15Z
Repository: https://github.com/jmrozanec/cron-utils
Language: Unknown
Commit date: 2021-10-30 15:12:11 +0200
Commit message: Merge pull request #494 from NielsDoucet/RCE-fix

Resolve RCE vulnerability.
CVE-2017-14313: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-09-12T00:29Z
Repository: https://github.com/michaelryanmcneill/shibboleth
Language: PHP
Files changed: shibboleth.php
Commit date: 2016-03-20 23:41:37 +0800
Commit message: escape url after add_query_arg

Diff: diff --git a/shibboleth.php b/shibboleth.php
index 4ecddc9..f03b5ef 100644
--- a/shibboleth.php
+++ b/shibboleth.php
@@ -458,11 +458,11 @@ add_filter( 'shibboleth_user_nicename', 'sanitize_user' );
  * deployers can style this however they choose.
  */
 function shibboleth_login_form() {
 	$login_url = add_query_arg('action', 'shibboleth');
 	$login_url = remove_query_arg('reauth', $login_url);
-	echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
+	echo '<p id="shibboleth_login"><a href="' . esc_url($login_url) . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
 }
 add_action('login_form', 'shibboleth_login_form');
 
 
 /**

Vulnerable code: 	echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
Fixed code: 	echo '<p id="shibboleth_login"><a href="' . esc_url($login_url) . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>';
CVE-2022-23220: Missing Authentication for Critical Function (CWE-306)
value: USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu, Debian, and Gentoo.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 7.8
Published: 2022-01-21T16:15Z
Repository: https://github.com/gregkh/usbview
Language: Other
Files changed: org.freedesktop.pkexec.usbview.policy
Commit date: 2022-01-21 14:32:41 +0100
Commit message: org.freedesktop.pkexec.usbview.policy: fix a local root privilege escalation issue via pkexec (CVE-2022-23220).

The polkit policy allowed unprivileged users to run usbview as root with
arbitrary command line arguments, allowing a local root exploit.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Diff: diff --git a/org.freedesktop.pkexec.usbview.policy b/org.freedesktop.pkexec.usbview.policy
index 0f0bb34..d2c477d 100644
--- a/org.freedesktop.pkexec.usbview.policy
+++ b/org.freedesktop.pkexec.usbview.policy
@@ -6,12 +6,12 @@
   <action id="org.freedesktop.pkexec.usbview">
     <description>Run USBview</description>
     <message>Authentication is required to view USB bus</message>
     <icon_name>usbview_icon</icon_name>
     <defaults>
-      <allow_any>yes</allow_any>
-      <allow_inactive>yes</allow_inactive>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
       <allow_active>auth_admin_keep</allow_active>
     </defaults>
     <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/usbview</annotate>
     <annotate key="org.freedesktop.policykit.exec.allow_gui">TRUE</annotate>
   </action>

Vulnerable code:       <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
Fixed code:       <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
CVE-2016-1245: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messages. The root cause was relying on BUFSIZ to be compatible with a message size; however, BUFSIZ is system-dependent.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-02-22T23:59Z
Repository: https://github.com/Quagga/quagga
Language: C
Files changed: zebra/rtadv.c
Commit date: 2016-10-17 17:41:36 +0100
Commit message: zebra: stack overrun in IPv6 RA receive code (CVE-2016-1245)

The IPv6 RA code also receives ICMPv6 RS and RA messages.
Unfortunately, by bad coding practice, the buffer size specified on
receiving such messages mixed up 2 constants that in fact have
different values.

The code itself has:
 #define RTADV_MSG_SIZE 4096
While BUFSIZ is system-dependent, in my case (x86_64 glibc):
 /usr/include/_G_config.h:#define _G_BUFSIZ 8192
 /usr/include/libio.h:#define _IO_BUFSIZ _G_BUFSIZ
 /usr/include/stdio.h:# define BUFSIZ _IO_BUFSIZ

FreeBSD, OpenBSD, NetBSD and Illumos are not affected, since all of them
have BUFSIZ == 1024.

As the latter is passed to the kernel on recvmsg(), it's possible to
overwrite 4kB of stack -- with ICMPv6 packets that can be globally sent
to any of the system's addresses (using fragmentation to get to 8k).

(The socket has filters installed limiting this to RS and RA packets,
but does not have a filter for source address or TTL.)

Issue discovered by trying to test other stuff, which randomly caused
the stack to be smaller than 8kB in that code location, which then
causes the kernel to report EFAULT (Bad address).

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
Reviewed-by: Donald Sharp <sharpd@cumulusnetworks.com>

Diff: diff --git a/zebra/rtadv.c b/zebra/rtadv.c
index d4ef1b88..2f62714d 100644
--- a/zebra/rtadv.c
+++ b/zebra/rtadv.c
@@ -480,11 +480,11 @@ rtadv_read (struct thread *thread)
   zvrf->rtadv.ra_read = NULL;
 
   /* Register myself. */
   rtadv_event (zvrf, RTADV_READ, sock);
 
-  len = rtadv_recv_packet (sock, buf, BUFSIZ, &from, &ifindex, &hoplimit);
+  len = rtadv_recv_packet (sock, buf, sizeof (buf), &from, &ifindex, &hoplimit);
 
   if (len < 0) 
     {
       zlog_warn ("router solicitation recv failed: %s.", safe_strerror (errno));
       return len;

Vulnerable code:   len = rtadv_recv_packet (sock, buf, BUFSIZ, &from, &ifindex, &hoplimit);
Fixed code:   len = rtadv_recv_packet (sock, buf, sizeof (buf), &from, &ifindex, &hoplimit);
CVE-2018-25049: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-12-27T09:15Z
Repository: https://github.com/nmanousos/email-existence
Language: JavaScript
Files changed: index.js
Commit date: 2018-02-22 09:51:52 -0500
Commit message: security: address REDOS by rejecting long emails

The email regex /^\S+@\S+$/ is vulnerable to REDOS on very long emails.
Emails should not be longer than 300 characters per the RFC errata.
Reject emails longer than this.

Diff: diff --git a/index.js b/index.js
index eb65f66..1b7307f 100644
--- a/index.js
+++ b/index.js
@@ -4,14 +4,26 @@ var dns = require('dns'),
 	async = require('async');
 
 module.exports = function (email, callback, timeout, from_email) {
 	timeout = timeout || 5000;
 	from_email = from_email || email;
+
+	/* Does it look like a valid email? */
+
+	/* Our email regex is vulnerable to REDOS on very large input.
+	 *  Valid emails shouldn't be more than 300 characters anyway.
+	 *  https://www.rfc-editor.org/errata_search.php?eid=1690 */
+	const MAX_EMAIL_LEN = 300;
+	if (MAX_EMAIL_LEN < email.length) {
+		callback(null, false);
+		return;
+	}
 	if (!/^\S+@\S+$/.test(email)) {
 		callback(null, false);
 		return;
 	}
+
 	dns.resolveMx(email.split('@')[1], function(err, addresses){
 		if (err || addresses.length === 0) {
 			callback(err, false);
 			return;
 		}

Fixed code: 
	/* Does it look like a valid email? */

	/* Our email regex is vulnerable to REDOS on very large input.
	 *  Valid emails shouldn't be more than 300 characters anyway.
	 *  https://www.rfc-editor.org/errata_search.php?eid=1690 */
	const MAX_EMAIL_LEN = 300;
	if (MAX_EMAIL_LEN < email.length) {
		callback(null, false);
		return;
	}
CVE-2022-4407: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-11T15:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/index.php
Commit date: 2022-11-27 10:51:46 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/index.php b/phpmyfaq/admin/index.php
index bc83627834..312c59daa7 100755
--- a/phpmyfaq/admin/index.php
+++ b/phpmyfaq/admin/index.php
@@ -117,10 +117,11 @@ if (function_exists('mb_language') && in_array($mbLanguage, $validMbStrings)) {
 //
 $action = Filter::filterInput(INPUT_GET, 'action', FILTER_UNSAFE_RAW);
 if (is_null($action)) {
     $action = Filter::filterInput(INPUT_POST, 'action', FILTER_UNSAFE_RAW);
 }
+$action = Strings::htmlentities($action);
 
 //
 // Get CSRF Token
 //
 $csrfToken = Filter::filterInput(INPUT_GET, 'csrf', FILTER_UNSAFE_RAW);

Fixed code: $action = Strings::htmlentities($action);
CVE-2023-0307: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 9.8
Published: 2023-01-15T22:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php
Commit date: 2022-12-23 07:22:03 +0100
Commit message: fix: added missing check on password length

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index 4ad6d05a8a..00ba955a4a 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -774,18 +774,21 @@ switch ($action) {
         if ($password !== $confirm) {
             $message = ['error' => $PMF_LANG['ad_user_error_passwordsDontMatch']];
             break;
         }
 
-        $userData = [
-            'display_name' => $userName,
-            'email' => $email,
-            'is_visible' => $isVisible === 'on' ? 1 : 0
-        ];
-        $success = $user->setUserData($userData);
-
-        if (0 !== strlen($password) && 0 !== strlen($confirm)) {
+        if (strlen($password) <= 7 || strlen($confirm) <= 7) {
+            $message = ['error' => $PMF_LANG['ad_passwd_fail']];
+            break;
+        } else {
+            $userData = [
+                'display_name' => $userName,
+                'email' => $email,
+                'is_visible' => $isVisible === 'on' ? 1 : 0
+            ];
+            $success = $user->setUserData($userData);
+
             foreach ($user->getAuthContainer() as $author => $auth) {
                 if ($auth->setReadOnly()) {
                     continue;
                 }
                 if (!$auth->update($user->getLogin(), $password)) {

Vulnerable code:         $userData = [
            'display_name' => $userName,
            'email' => $email,
            'is_visible' => $isVisible === 'on' ? 1 : 0
        ];
        $success = $user->setUserData($userData);

        if (0 !== strlen($password) && 0 !== strlen($confirm)) {
Fixed code:         if (strlen($password) <= 7 || strlen($confirm) <= 7) {
            $message = ['error' => $PMF_LANG['ad_passwd_fail']];
            break;
        } else {
            $userData = [
                'display_name' => $userName,
                'email' => $email,
                'is_visible' => $isVisible === 'on' ? 1 : 0
            ];
            $success = $user->setUserData($userData);
CVE-2023-0309: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-15T22:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/header.php
Commit date: 2022-12-18 12:25:52 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/header.php b/phpmyfaq/admin/header.php
index 8078375c40..4be1a1c57d 100644
--- a/phpmyfaq/admin/header.php
+++ b/phpmyfaq/admin/header.php
@@ -233,11 +233,11 @@ switch ($action) {
   <meta charset="utf-8">
 
   <title>
     <?= Strings::htmlentities($faqConfig->getTitle(), ENT_QUOTES) ?> - powered by phpMyFAQ <?= System::getVersion() ?>
   </title>
-  <base href="<?= $faqSystem->getSystemUri($faqConfig) ?>admin/">
+  <base href="<?= Strings::htmlentities($faqConfig->getDefaultUrl()) ?>admin/">
 
   <meta name="description" content="Only Chuck Norris can divide by zero.">
   <meta name="author" content="phpMyFAQ Team">
   <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
   <meta name="application-name" content="phpMyFAQ <?= System::getVersion() ?>">

Vulnerable code:   <base href="<?= $faqSystem->getSystemUri($faqConfig) ?>admin/">
Fixed code:   <base href="<?= Strings::htmlentities($faqConfig->getDefaultUrl()) ?>admin/">