Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-10061: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2019-03-26T01:29Z
Repository: https://github.com/peterbraden/node-opencv
Language: JavaScript
Files changed: README.md, src/FaceRecognizer.h, utils/find-opencv.js
Commit date: 2019-03-20 09:36:36 +0000
Commit message: Fix install script

Diff: diff --git a/README.md b/README.md
index d0d0c9f..2b5ed75 100755
--- a/README.md
+++ b/README.md
@@ -11,12 +11,11 @@ People are using node-opencv to fly control quadrocoptors, detect faces from
 webcam images and annotate video streams. If you're using it for something
 cool, I'd love to hear about it!
 
 ## Install
 
-You'll need OpenCV 2.3.1 or newer installed before installing node-opencv.  Note
-that OpenCV 3.x is not yet fully supported.
+You'll need OpenCV 2.3.1 or newer installed before installing node-opencv.
 
 ## Specific for macOS
 Install OpenCV using brew
 ```bash
 brew tap homebrew/science
diff --git a/src/FaceRecognizer.h b/src/FaceRecognizer.h
index a147229..8e75253 100644
--- a/src/FaceRecognizer.h
+++ b/src/FaceRecognizer.h
@@ -6,10 +6,11 @@
 #include <opencv2/face.hpp>
 namespace cv {
   using cv::face::FaceRecognizer;
 }
 #else
+#warning using opencv2 contrib
 #include "opencv2/contrib/contrib.hpp"
 #endif
 
 class FaceRecognizerWrap: public Nan::ObjectWrap {
 public:
diff --git a/utils/find-opencv.js b/utils/find-opencv.js
index ece7a66..be1cfa8 100644
--- a/utils/find-opencv.js
+++ b/utils/find-opencv.js
@@ -1,10 +1,17 @@
 "use strict";
 
 var exec = require("child_process").exec;
 var fs = require("fs");
-var flag = "--exists";
+
+var flags = {
+  '--cflags' : '--cflags',
+  '--libs' : '--libs'
+}
+var flag = flags[process.argv[2]] || '--exists'
+
+
 
 // Normally |pkg-config opencv ...| could report either OpenCV 2.x or OpenCV 3.y
 // depending on what is installed.  To enable both 2.x and 3.y to co-exist on
 // the same machine, the opencv.pc for 3.y can be installed as opencv3.pc and
 // then selected by |export PKG_CONFIG_OPENCV3=1| before building node-opencv.

Vulnerable code: You'll need OpenCV 2.3.1 or newer installed before installing node-opencv.  Note
that OpenCV 3.x is not yet fully supported.
var flag = "--exists";
Fixed code: You'll need OpenCV 2.3.1 or newer installed before installing node-opencv.
#warning using opencv2 contrib

var flags = {
  '--cflags' : '--cflags',
  '--libs' : '--libs'
}
var flag = flags[process.argv[2]] || '--exists'
CVE-2019-10061: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2019-03-26T01:29Z
Repository: https://github.com/peterbraden/node-opencv
Language: JavaScript
Files changed: utils/find-opencv.js
Commit date: 2019-03-20 08:45:23 +0000
Commit message: Remove untrusted input to exec

Diff: diff --git a/utils/find-opencv.js b/utils/find-opencv.js
index c3731ad..ece7a66 100644
--- a/utils/find-opencv.js
+++ b/utils/find-opencv.js
@@ -1,26 +1,26 @@
 "use strict";
 
 var exec = require("child_process").exec;
 var fs = require("fs");
-var flag = process.argv[2] || "--exists";
+var flag = "--exists";
 
 // Normally |pkg-config opencv ...| could report either OpenCV 2.x or OpenCV 3.y
 // depending on what is installed.  To enable both 2.x and 3.y to co-exist on
 // the same machine, the opencv.pc for 3.y can be installed as opencv3.pc and
 // then selected by |export PKG_CONFIG_OPENCV3=1| before building node-opencv.
-var opencv = process.env.PKG_CONFIG_OPENCV3 === "1" ? "opencv3" : '"opencv >= 2.3.1"';
+var opencv = process.env.PKG_CONFIG_OPENCV3 === "1" ? "opencv3" : ' "opencv >= 2.3.1"';
 
 function main(){
     //Try using pkg-config, but if it fails and it is on Windows, try the fallback
     exec("pkg-config " + opencv + " " + flag, function(error, stdout, stderr){
         if(error){
             if(process.platform === "win32"){
                 fallback();
             }
             else{
-                throw new Error("ERROR: failed to run: pkg-config", opencv, flag);
+              throw new Error("ERROR: failed to run: pkg-config" + opencv + " " + flag + " - Is OpenCV installed?");
             }
         }
         else{
             console.log(stdout);
         }

Vulnerable code: var flag = process.argv[2] || "--exists";
var opencv = process.env.PKG_CONFIG_OPENCV3 === "1" ? "opencv3" : '"opencv >= 2.3.1"';
                throw new Error("ERROR: failed to run: pkg-config", opencv, flag);
Fixed code: var flag = "--exists";
var opencv = process.env.PKG_CONFIG_OPENCV3 === "1" ? "opencv3" : ' "opencv >= 2.3.1"';
              throw new Error("ERROR: failed to run: pkg-config" + opencv + " " + flag + " - Is OpenCV installed?");
CVE-2015-2296: Other (NVD-CWE-Other)
value: The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-03-18T16:59Z
Repository: https://github.com/kennethreitz/requests
Language: Python
Files changed: requests/sessions.py
Commit date: 2015-03-14 08:49:55 +0000
Commit message: Don't ascribe cookies to the target domain.

Diff: diff --git a/requests/sessions.py b/requests/sessions.py
index 4f30696..9d5498c 100644
--- a/requests/sessions.py
+++ b/requests/sessions.py
@@ -169,11 +169,11 @@ class SessionRedirectMixin(object):
             try:
                 del headers['Cookie']
             except KeyError:
                 pass
 
-            extract_cookies_to_jar(prepared_request._cookies, prepared_request, resp.raw)
+            extract_cookies_to_jar(prepared_request._cookies, req, resp.raw)
             prepared_request._cookies.update(self.cookies)
             prepared_request.prepare_cookies(prepared_request._cookies)
 
             # Rebuild auth and proxy information.
             proxies = self.rebuild_proxies(prepared_request, proxies)

Vulnerable code:             extract_cookies_to_jar(prepared_request._cookies, prepared_request, resp.raw)
Fixed code:             extract_cookies_to_jar(prepared_request._cookies, req, resp.raw)
CVE-2016-15025: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is c17092fd4103143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221484.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-20T10:15Z
Repository: https://github.com/johnpapa/generator-hottowel
Language: JavaScript
Files changed: app/templates/src/server/_app.js
Commit date: 2016-04-13 21:00:39 +0100
Commit message: Mitigate against reflected XSS attacks

Mitigate against reflected XSS attacks in production by returning
the custom 404 response object instead of express' default 404
response

This was discovered using the Burp pen test tool and successfully tested
by passing an arbitrary url parameter GET /images/?41b68(a)184a9=1

Diff: diff --git a/app/templates/src/server/_app.js b/app/templates/src/server/_app.js
index 73fa921..e68f734 100644
--- a/app/templates/src/server/_app.js
+++ b/app/templates/src/server/_app.js
@@ -28,10 +28,21 @@ switch (environment) {
     app.use(express.static('./build/'));
     // Any invalid calls for templateUrls are under app/* and should return 404
     app.use('/app/*', function(req, res, next) {
       four0four.send404(req, res);
     });
+    // Invalid calls to assets should return the custom error object to mitigate 
+    // against XSS reflected attacks
+    app.use('/js/*', function(req, res, next) {
+        four0four.send404(req, res);
+    });
+    app.use('/images/*', function(req, res, next) {
+        four0four.send404(req, res);
+    });
+    app.use('/styles/*', function(req, res, next) {
+        four0four.send404(req, res);
+    });
     // Any deep link calls should return index.html
     app.use('/*', express.static('./build/index.html'));
     break;
   default:
     console.log('** DEV **');

Fixed code:     // Invalid calls to assets should return the custom error object to mitigate 
    // against XSS reflected attacks
    app.use('/js/*', function(req, res, next) {
        four0four.send404(req, res);
    });
    app.use('/images/*', function(req, res, next) {
        four0four.send404(req, res);
    });
    app.use('/styles/*', function(req, res, next) {
        four0four.send404(req, res);
    });
CVE-2021-40864: Insufficient Information (NVD-CWE-noinfo)
value: The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-09-10T19:15Z
Repository: https://github.com/ONLYOFFICE/plugin-translator
Language: HTML
Files changed: index.html, index_widget.html, scripts/translate.js
Commit date: 2021-04-28 13:20:12 +0300
Commit message: Added escaping characters

Diff: diff --git a/index.html b/index.html
index 47fbb52..ae422a7 100644
--- a/index.html
+++ b/index.html
@@ -2,10 +2,11 @@
 <html lang="en">
 <head>
 	<meta charset="UTF-8">
 	<title>translate</title>
     <script type="text/javascript" src="https://onlyoffice.github.io/sdkjs-plugins/v1/plugins.js"></script>
+	<script type="text/javascript" src="https://onlyoffice.github.io/sdkjs-plugins/v1/plugins-ui.js"></script>
 	<script src="scripts/translate.js"></script>
 	<style>
 		html, body {
 			width: 100%;
 			height: 100%;
diff --git a/index_widget.html b/index_widget.html
index 51fcbef..5f2b52b 100644
--- a/index_widget.html
+++ b/index_widget.html
@@ -146,11 +146,11 @@
 				setTimeout(()=> Ps.update(), 600);
 			}
 			else
 			{
 				if (msg.data !== "onchange_goog-te-combo") {
-				document.getElementById("google_translate_element").innerHTML = msg.data;
+				document.getElementById("google_translate_element").innerHTML = escape(msg.data);
 				}
 				timeOut = setTimeout(function() {
 					document.getElementById("google_translate_element").style.opacity = 1;
 					Ps.update();
 					if (msg.data.length)
diff --git a/scripts/translate.js b/scripts/translate.js
index 7644da0..e102f42 100644
--- a/scripts/translate.js
+++ b/scripts/translate.js
@@ -28,11 +28,11 @@
 			document.getElementById("iframe_parent").appendChild(ifr);
 			isInit = true;
 			ifr.onload = function() {
 				if (ifr.contentWindow.document.readyState == 'complete')
 					setTimeout(function() {
-						ifr.contentDocument.getElementById("google_translate_element").innerHTML = text;
+						ifr.contentDocument.getElementById("google_translate_element").innerHTML = escape(text);
 						if (text.length)
 							ifr.contentDocument.getElementById("div_btn").classList.remove("hidden");
 					}, 500);
 				
 				var selectElement = ifr.contentDocument.getElementsByClassName('goog-te-combo')[0];

Vulnerable code: 				document.getElementById("google_translate_element").innerHTML = msg.data;
						ifr.contentDocument.getElementById("google_translate_element").innerHTML = text;
Fixed code: 	<script type="text/javascript" src="https://onlyoffice.github.io/sdkjs-plugins/v1/plugins-ui.js"></script>
				document.getElementById("google_translate_element").innerHTML = escape(msg.data);
						ifr.contentDocument.getElementById("google_translate_element").innerHTML = escape(text);
CVE-2022-25317: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-18T06:15Z
Repository: https://github.com/cerebrate-project/cerebrate
Language: PHP
Files changed: templates/element/genericElements/Form/genericForm.php
Commit date: 2022-02-03 23:56:23 +0100
Commit message: fix: [security] genericForm reflected XSS in form descriptions for user controlled descriptions

- accessible via the MISP local tool setting change
- sanitise the description

- as reported by Dawid Czarnecki from Zigrin Security

Diff: diff --git a/templates/element/genericElements/Form/genericForm.php b/templates/element/genericElements/Form/genericForm.php
index 2e509ba..7d7552d 100644
--- a/templates/element/genericElements/Form/genericForm.php
+++ b/templates/element/genericElements/Form/genericForm.php
@@ -104,11 +104,11 @@
             'title' => empty($data['title']) ? sprintf('%s %s', $actionName, $modelName) : h($data['title']),
             'body' => sprintf(
                 '%s%s%s%s%s%s',
                 empty($data['description']) ? '' : sprintf(
                     '<div class="pb-2 fw-light">%s</div>',
-                    $data['description']
+                    h($data['description'])
                 ),
                 $ajaxFlashMessage,
                 $formCreate,
                 $fieldsString,
                 empty($metaTemplateString) ? '' : $this->element(
@@ -129,11 +129,11 @@
     } else if (!empty($raw)) {
         echo sprintf(
             '%s%s%s%s%s%s',
             empty($data['description']) ? '' : sprintf(
                 '<div class="pb-2">%s</div>',
-                $data['description']
+                h($data['description'])
             ),
             $ajaxFlashMessage,
             $formCreate,
             $fieldsString,
             empty($metaTemplateString) ? '' : $this->element(
@@ -155,11 +155,11 @@
             empty($data['title']) ? sprintf('%s %s', $actionName, $modelName) : h($data['title']),
             $formCreate,
             $ajaxFlashMessage,
             empty($data['description']) ? '' : sprintf(
                 '<div class="pb-3 fw-light">%s</div>',
-                $data['description']
+                h($data['description'])
             ),
             sprintf('<div class="panel">%s</div>', $fieldsString),
             empty($metaTemplateString) ? '' : $this->element(
                 'genericElements/accordion_scaffold', [
                     'children' => [

Vulnerable code:                     $data['description']
                $data['description']
                $data['description']
Fixed code:                     h($data['description'])
                h($data['description'])
                h($data['description'])
CVE-2022-25320: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2022-02-18T06:15Z
Repository: https://github.com/cerebrate-project/cerebrate
Language: PHP
Files changed: src/Controller/UserSettingsController.php
Commit date: 2022-02-04 00:45:42 +0100
Commit message: fix: [security] user settings allow enumeration of usernames

- as reported by Dawid Czarnecki from Zigrin Security

Diff: diff --git a/src/Controller/UserSettingsController.php b/src/Controller/UserSettingsController.php
index 02affce5..7f9690ab 100644
--- a/src/Controller/UserSettingsController.php
+++ b/src/Controller/UserSettingsController.php
@@ -34,13 +34,20 @@ class UserSettingsController extends AppController
         $responsePayload = $this->CRUD->getResponsePayload();
         if (!empty($responsePayload)) {
             return $responsePayload;
         }
         if (!empty($this->request->getQuery('Users_id'))) {
-            $settingsForUser = $this->UserSettings->Users->find()->where([
+            $conditions = [
                 'id' => $this->request->getQuery('Users_id')
-            ])->first();
+            ];
+            if (empty($currentUser['role']['perm_admin'])) {
+                $conditions['organisation_id'] = $currentUser['organisation_id'];
+            }
+            $settingsForUser = $this->UserSettings->Users->find()->where($conditions)->first();
+            if (empty($settingsForUser)) {
+                throw new NotFoundException(__('Invalid {0}.', __('user')));
+            }
             $this->set('settingsForUser', $settingsForUser);
         }
     }
 
     public function view($id)
@@ -231,11 +238,11 @@ class UserSettingsController extends AppController
         }
         $this->set('user_id', $this->ACL->getUser()->id);
     }
 
     /**
-     * isLoggedUserAllowedToEdit 
+     * isLoggedUserAllowedToEdit
      *
      * @param int|\App\Model\Entity\UserSetting $setting
      * @return boolean
      */
     private function isLoggedUserAllowedToEdit($setting): bool

Vulnerable code:             $settingsForUser = $this->UserSettings->Users->find()->where([
            ])->first();
     * isLoggedUserAllowedToEdit 
Fixed code:             $conditions = [
            ];
            if (empty($currentUser['role']['perm_admin'])) {
                $conditions['organisation_id'] = $currentUser['organisation_id'];
            }
            $settingsForUser = $this->UserSettings->Users->find()->where($conditions)->first();
            if (empty($settingsForUser)) {
                throw new NotFoundException(__('Invalid {0}.', __('user')));
            }
     * isLoggedUserAllowedToEdit
CVE-2023-26468: Insufficient Information (NVD-CWE-noinfo)
value: Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.1
Published: 2023-02-24T00:15Z
Repository: https://github.com/cerebrate-project/cerebrate
Language: PHP
Files changed: src/Controller/AuthKeysController.php
Commit date: 2023-02-23 14:57:42 +0100
Commit message: security: [authkey:add] Restrict creation of API keys for users in the same org and for other org_admins


Diff: diff --git a/src/Controller/AuthKeysController.php b/src/Controller/AuthKeysController.php
index 978810c4..bfca38d2 100644
--- a/src/Controller/AuthKeysController.php
+++ b/src/Controller/AuthKeysController.php
@@ -69,12 +69,16 @@ class AuthKeysController extends AppController
         $currentUser = $this->ACL->getUser();
         if (empty($currentUser['role']['perm_admin'])) {
             if (empty($currentUser['role']['perm_org_admin'])) {
                 $userConditions['id'] = $currentUser['id'];
             } else {
-                $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0])->all()->extract('id')->toList();
-                $userConditions['role_id IN'] = $role_ids;
+                $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0, 'perm_org_admin' => 0])->all()->extract('id')->toList();
+                $userConditions['organisation_id'] = $currentUser['organisation_id'];
+                $userConditions['OR'] = [
+                    ['role_id IN' => $role_ids],
+                    ['id' => $currentUser['id']],
+                ];
             }
         }
         $users = $this->Users->find('list');
         if (!empty($userConditions)) {
             $users->where($userConditions);

Vulnerable code:                 $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0])->all()->extract('id')->toList();
                $userConditions['role_id IN'] = $role_ids;
Fixed code:                 $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0, 'perm_org_admin' => 0])->all()->extract('id')->toList();
                $userConditions['organisation_id'] = $currentUser['organisation_id'];
                $userConditions['OR'] = [
                    ['role_id IN' => $role_ids],
                    ['id' => $currentUser['id']],
                ];
CVE-2023-28883: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-03-27T03:15Z
Repository: https://github.com/cerebrate-project/cerebrate
Language: PHP
Files changed: src/Controller/InstanceController.php, src/Model/Table/InstanceTable.php
Commit date: 2023-03-25 09:23:45 +0100
Commit message: fix: [security] blind SQL injection in searchAll

- As reported by Zigrin Security

Diff: diff --git a/src/Controller/InstanceController.php b/src/Controller/InstanceController.php
index 5caf6ee52..e641940bd 100644
--- a/src/Controller/InstanceController.php
+++ b/src/Controller/InstanceController.php
@@ -36,10 +36,11 @@ class InstanceController extends AppController
     public function searchAll()
     {
         $searchValue = $this->request->getQuery('search');
         $model = $this->request->getQuery('model', null);
         $limit = $this->request->getQuery('limit', 5);
+        $limit = is_numeric($limit) ? $limit : 5;
         if (!empty($this->request->getQuery('show_all', false))) {
             $limit = null;
         }
         $data = [];
         if (!empty($searchValue)) {
diff --git a/src/Model/Table/InstanceTable.php b/src/Model/Table/InstanceTable.php
index 624fe7afa..afd04e0fd 100644
--- a/src/Model/Table/InstanceTable.php
+++ b/src/Model/Table/InstanceTable.php
@@ -79,11 +79,11 @@ class InstanceTable extends AppTable
             $statistics[$model] = $this->getActivityStatisticsForModel($table, $days);
         }
         return $statistics;
     }
 
-    public function searchAll($value, $user, $limit=5, $model=null)
+    public function searchAll($value, $user, int $limit=5, $model=null)
     {
         $results = [];
         $models = $this->seachAllTables;
         if (!is_null($model)) {
             if (in_array($model, array_keys($this->seachAllTables))) {

Vulnerable code:     public function searchAll($value, $user, $limit=5, $model=null)
Fixed code:         $limit = is_numeric($limit) ? $limit : 5;
    public function searchAll($value, $user, int $limit=5, $model=null)
CVE-2023-41908: Missing Authorization (CWE-862)
value: Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2023-09-05T07:15Z
Repository: https://github.com/cerebrate-project/cerebrate
Language: PHP
Files changed: config/bootstrap.php, config/routes.php
Commit date: 2023-09-04 10:30:51 +0200
Commit message: chg: [config] Force usage of secure cookie for session and csrf protection

Diff: diff --git a/config/bootstrap.php b/config/bootstrap.php
index 739122d87..6da31baea 100644
--- a/config/bootstrap.php
+++ b/config/bootstrap.php
@@ -171,10 +171,18 @@ ConnectionManager::setConfig(Configure::consume('Datasources'));
 TransportFactory::setConfig(Configure::consume('EmailTransport'));
 Mailer::setConfig(Configure::consume('Email'));
 Log::setConfig(Configure::consume('Log'));
 Security::setSalt(Configure::consume('Security.salt'));
 
+Configure::write('Session', [
+    'defaults' => 'php',
+    'ini' => [
+        'session.cookie_httponly' => true,
+        'session.cookie_secure' => true,
+    ]
+]);
+
 /*
  * Setup detectors for mobile and tablet.
  */
 ServerRequest::addDetector('mobile', function ($request) {
     $detector = new \Detection\MobileDetect();
diff --git a/config/routes.php b/config/routes.php
index ac1ab265c..32712cd7b 100644
--- a/config/routes.php
+++ b/config/routes.php
@@ -47,10 +47,11 @@ $routes->setRouteClass(DashedRoute::class);
 $routes->scope('/', function (RouteBuilder $builder) {
     $builder->setExtensions(['json']);
     // Register scoped middleware for in scopes.
     $builder->registerMiddleware('csrf', new CsrfProtectionMiddleware([
         'httponly' => true,
+        'secure' => true,
     ]));
     /*
      * Apply a middleware to the current route scope.
      * Requires middleware to be registered through `Application::routes()` with `registerMiddleware()`
      * Dirty way of disabling the middleware if the AUTHORIZATION header is set

Fixed code: Configure::write('Session', [
    'defaults' => 'php',
    'ini' => [
        'session.cookie_httponly' => true,
        'session.cookie_secure' => true,
    ]
]);

        'secure' => true,
CVE-2015-5356: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-07-01T16:59Z
Repository: https://github.com/GetSimpleCMS/GetSimpleCMS
Language: PHP
Files changed: admin/filebrowser.php
Commit date: 2015-06-16 09:09:12 -0500
Commit message: fix #1059

Diff: diff --git a/admin/filebrowser.php b/admin/filebrowser.php
index f1ef74c..4ad2719 100644
--- a/admin/filebrowser.php
+++ b/admin/filebrowser.php
@@ -18,11 +18,11 @@ $filesSorted=null;$dirsSorted=null;
 
 $path = (isset($_GET['path'])) ? "../data/uploads/".$_GET['path'] : "../data/uploads/";
 $subPath = (isset($_GET['path'])) ? $_GET['path'] : "";
 if(!path_is_safe($path,GSDATAUPLOADPATH)) die();
 $returnid = isset($_GET['returnid']) ? var_out($_GET['returnid']) : "";
-$func = (isset($_GET['func'])) ? $_GET['func'] : "";
+$func = (isset($_GET['func'])) ? var_out($_GET['func']) : "";
 $path = tsl($path);
 // check if host uses Linux (used for displaying permissions
 $isUnixHost = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' ? false : true);
 $CKEditorFuncNum = isset($_GET['CKEditorFuncNum']) ? var_out($_GET['CKEditorFuncNum']) : '';
 $sitepath = suggest_site_path();
@@ -50,11 +50,10 @@ $LANG_header = preg_replace('/(?:(?<=([a-z]{2}))).*/', '', $LANG);
             	window.opener.document.getElementById('<?php echo $returnid; ?>').focus();
                 window.opener.document.getElementById('<?php echo $returnid; ?>').value=$url;
             }
         <?php 
 			if (isset($_GET['func'])){
-			$func = @$_GET['func'];
 		?>
 				if(window.opener){
 					if(typeof window.opener.<?php echo $func; ?> == 'function') {
 						window.opener.<?php echo $func; ?>('<?php echo $returnid; ?>');
 					}

Vulnerable code: $func = (isset($_GET['func'])) ? $_GET['func'] : "";
			$func = @$_GET['func'];
Fixed code: $func = (isset($_GET['func'])) ? var_out($_GET['func']) : "";
CVE-2022-40673: Missing Authorization (CWE-862)
value: KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 7.8
Published: 2022-09-14T11:15Z
Repository: https://github.com/JonMagon/KDiskMark
Language: C++
Files changed: src/helper.cpp
Commit date: 2022-09-04 21:55:49 +0300
Commit message: Add missing authorization checking in Helper::flushPageCache()


Diff: diff --git a/src/helper.cpp b/src/helper.cpp
index f25ff31..ea1642a 100644
--- a/src/helper.cpp
+++ b/src/helper.cpp
@@ -188,10 +188,14 @@ void Helper::startBenchmarkTest(int measuringTime, int fileSize, int randomReadP
     });
 }
 
 QVariantMap Helper::flushPageCache()
 {
+    if (!isCallerAuthorized()) {
+        return {};
+    }
+
     QVariantMap reply;
     reply[QStringLiteral("success")] = true;
 
     if (!isCallerAuthorized()) {
         reply[QStringLiteral("success")] = false;

Fixed code:     if (!isCallerAuthorized()) {
        return {};
    }
CVE-2022-4105: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-11-21T20:15Z
Repository: https://github.com/kiwitcms/kiwi
Language: Python
Files changed: tcms/core/history.py
Commit date: 2022-11-07 16:34:59 +0000
Commit message: Clean HTML input when generating history diff

helps us prevent XSS attacks

Diff: diff --git a/tcms/core/history.py b/tcms/core/history.py
index abc2edc2..76a9fccc 100644
--- a/tcms/core/history.py
+++ b/tcms/core/history.py
@@ -6,10 +6,12 @@ from django.http import HttpResponseRedirect
 from django.template.defaultfilters import safe
 from django.utils.translation import gettext_lazy as _
 from simple_history.admin import SimpleHistoryAdmin
 from simple_history.models import HistoricalRecords
 
+from tcms.core.templatetags.extra_filters import bleach_input
+
 
 def diff_objects(old_instance, new_instance, fields):
     """
     Diff two objects by examining the given fields and
     return a string.
@@ -18,10 +20,17 @@ def diff_objects(old_instance, new_instance, fields):
 
     for field in fields:
         field_diff = []
         old_value = getattr(old_instance, field.attname)
         new_value = getattr(new_instance, field.attname)
+
+        # clean stored XSS
+        if isinstance(old_value, str):
+            old_value = bleach_input(old_value)
+        if isinstance(new_value, str):
+            new_value = bleach_input(new_value)
+
         for line in difflib.unified_diff(
             str(old_value).split("\n"),
             str(new_value).split("\n"),
             fromfile=field.attname,
             tofile=field.attname,

Fixed code: from tcms.core.templatetags.extra_filters import bleach_input


        # clean stored XSS
        if isinstance(old_value, str):
            old_value = bleach_input(old_value)
        if isinstance(new_value, str):
            new_value = bleach_input(new_value)
CVE-2020-36564: Improper Input Validation (CWE-20)
value: Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2022-12-27T22:15Z
Repository: https://github.com/justinas/nosurf
Language: Unknown
Commit date: 2020-08-30 18:00:32 +0300
Commit message: Merge pull request #60 from aeneasr/fix-verify

Resolve critical vulnerability allowing arbitrary tokens to pass as matching
CVE-2021-29482: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2021-04-28T19:15Z
Repository: https://github.com/ulikunitz/xz
Language: Go
Files changed: bits.go, bits_test.go
Commit date: 2020-08-19 21:59:10 +0200
Commit message: xz: fix a security issue for readUvarint

readUvarint could be provided a sequence of bytes where the application
would never stop. That is the same issue that has been recently
reported for the Go Standard Library as CVE-2020-16845.

The fix simply adds a check for the number of bytes read and reports an
overflow after more than 10 bytes are read, which is
$\ceil{\frac{64}{7}}$.

The commit also includes a test to ensure that the error is returned.

I thank Github user 0xdecaf for reporting the issue.

Diff: diff --git a/bits.go b/bits.go
index 364213d..dc8f328 100644
--- a/bits.go
+++ b/bits.go
@@ -52,20 +52,25 @@ func putUvarint(p []byte, x uint64) int {
 // errOverflow indicates an overflow of the 64-bit unsigned integer.
 var errOverflowU64 = errors.New("xz: uvarint overflows 64-bit unsigned integer")
 
 // readUvarint reads a uvarint from the given byte reader.
 func readUvarint(r io.ByteReader) (x uint64, n int, err error) {
+	const maxUvarintLen = 10
+
 	var s uint
 	i := 0
 	for {
 		b, err := r.ReadByte()
 		if err != nil {
 			return x, i, err
 		}
 		i++
+		if i > maxUvarintLen {
+			return x, i, errOverflowU64
+		}
 		if b < 0x80 {
-			if i > 10 || i == 10 && b > 1 {
+			if i == maxUvarintLen && b > 1 {
 				return x, i, errOverflowU64
 			}
 			return x | uint64(b)<<s, i, nil
 		}
 		x |= uint64(b&0x7f) << s
diff --git a/bits_test.go b/bits_test.go
index 8530056..acf2303 100644
--- a/bits_test.go
+++ b/bits_test.go
@@ -29,5 +29,16 @@ func TestUvarint(t *testing.T) {
 		if x != u {
 			t.Fatalf("readUvarint returned 0x%x; want 0x%x", x, u)
 		}
 	}
 }
+
+func TestUvarIntCVE_2020_16845(t *testing.T) {
+	var a = []byte{0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+		0x88, 0x89, 0x8a, 0x8b}
+
+	r := bytes.NewReader(a)
+	_, _, err := readUvarint(r)
+	if err != errOverflowU64 {
+		t.Fatalf("readUvarint overflow not detected")
+	}
+}

Vulnerable code: 			if i > 10 || i == 10 && b > 1 {
Fixed code: 	const maxUvarintLen = 10

		if i > maxUvarintLen {
			return x, i, errOverflowU64
		}
			if i == maxUvarintLen && b > 1 {

func TestUvarIntCVE_2020_16845(t *testing.T) {
	var a = []byte{0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
		0x88, 0x89, 0x8a, 0x8b}

	r := bytes.NewReader(a)
	_, _, err := readUvarint(r)
	if err != errOverflowU64 {
		t.Fatalf("readUvarint overflow not detected")
	}
}
CVE-2022-2652: Use of Externally-Controlled Format String (CWE-134)
value: Depending on the way the format strings in the card label are crafted it's possible to leak kernel stack memory. There is also the possibility for DoS due to the v4l2loopback kernel module crashing when providing the card label on request (reproduce e.g. with many %s modifiers in a row).
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 6
Published: 2022-08-04T10:15Z
Repository: https://github.com/umlaeute/v4l2loopback
Language: C
Files changed: v4l2loopback.c
Commit date: 2022-08-03 15:09:17 +0200
Commit message: add explicit format specifier to printf() invocations

CWE-134

Diff: diff --git a/v4l2loopback.c b/v4l2loopback.c
index 8c88ae8..5038054 100644
--- a/v4l2loopback.c
+++ b/v4l2loopback.c
@@ -754,11 +754,11 @@ static int vidioc_querycap(struct file *file, void *priv,
 		((struct v4l2loopback_private *)video_get_drvdata(dev->vdev))
 			->device_nr;
 	__u32 capabilities = V4L2_CAP_STREAMING | V4L2_CAP_READWRITE;
 
 	strlcpy(cap->driver, "v4l2 loopback", sizeof(cap->driver));
-	snprintf(cap->card, labellen, dev->card_label);
+	snprintf(cap->card, labellen, "%s", dev->card_label);
 	snprintf(cap->bus_info, sizeof(cap->bus_info),
 		 "platform:v4l2loopback-%03d", device_nr);
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 1, 0)
 	/* since 3.1.0, the v4l2-core system is supposed to set the version */
@@ -2492,11 +2492,11 @@ static int v4l2_loopback_add(struct v4l2_loopback_config *conf, int *ret_nr)
 		err = -ENOMEM;
 		goto out_unregister;
 	}
 
 	MARK();
-	snprintf(dev->vdev->name, sizeof(dev->vdev->name), dev->card_label);
+	snprintf(dev->vdev->name, sizeof(dev->vdev->name), "%s", dev->card_label);
 
 	vdev_priv->device_nr = nr;
 
 	init_vdev(dev->vdev, nr);
 	dev->vdev->v4l2_dev = &dev->v4l2_dev;

Vulnerable code: 	snprintf(cap->card, labellen, dev->card_label);
	snprintf(dev->vdev->name, sizeof(dev->vdev->name), dev->card_label);
Fixed code: 	snprintf(cap->card, labellen, "%s", dev->card_label);
	snprintf(dev->vdev->name, sizeof(dev->vdev->name), "%s", dev->card_label);
CVE-2018-13982: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-09-18T21:29Z
Repository: https://github.com/smarty-php/smarty
Language: PHP
Files changed: libs/sysplugins/smarty_security.php
Commit date: 2018-04-26 21:38:08 +0200
Commit message: - bugfix  regarding Security Vulnerability did not solve the problem under Linux

Diff: diff --git a/libs/sysplugins/smarty_security.php b/libs/sysplugins/smarty_security.php
index 2706fad2b..5378c3900 100644
--- a/libs/sysplugins/smarty_security.php
+++ b/libs/sysplugins/smarty_security.php
@@ -637,25 +637,29 @@ class Smarty_Security
      */
     private function _checkDir($filepath, $dirs)
     {
         $directory = dirname($this->smarty->_realpath($filepath, true)) . DIRECTORY_SEPARATOR;
         $_directory = array();
-        while (true) {
+        if (!preg_match('#[\\\\/][.][.][\\\\/]#',$directory)) {
+            while (true) {
              // test if the directory is trusted
             if (isset($dirs[ $directory ])) {
                return $_directory;
             }
             // abort if we've reached root
             if (!preg_match('#[\\\\/][^\\\\/]+[\\\\/]$#', $directory)) {
                 // give up
-                throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
+                break;
             }
             // remember the directory to add it to _resource_dir in case we're successful
             $_directory[ $directory ] = true;
            // bubble up one level
             $directory = preg_replace('#[\\\\/][^\\\\/]+[\\\\/]$#', DIRECTORY_SEPARATOR, $directory);
+            }
         }
+        // give up
+        throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
     }
 
     /**
      * Loads security class and enables security
      *

Vulnerable code:         while (true) {
                throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
Fixed code:         if (!preg_match('#[\\\\/][.][.][\\\\/]#',$directory)) {
            while (true) {
                break;
            }
        // give up
        throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
CVE-2018-13982: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-09-18T21:29Z
Repository: https://github.com/smarty-php/smarty
Language: PHP
Files changed: change_log.txt, libs/Smarty.class.php
Commit date: 2018-04-24 16:14:10 +0200
Commit message: Release version 3.1.32

Diff: diff --git a/change_log.txt b/change_log.txt
index a3ebcc36b..5765a1718 100644
--- a/change_log.txt
+++ b/change_log.txt
@@ -1,6 +1,6 @@
-﻿===== 3.1.32 - dev ===
+﻿===== 3.1.32 ===== (24.04.2018)
 24.04.2018
  - bugfix  possible Security Vulnerability in Smarty_Security class.
 
 26.03.2018
  - bugfix plugins may not be loaded if {function} or {block} tags are executed in nocache mode
diff --git a/libs/Smarty.class.php b/libs/Smarty.class.php
index 0ce8fdea4..597fbbf0c 100644
--- a/libs/Smarty.class.php
+++ b/libs/Smarty.class.php
@@ -19,17 +19,17 @@
  * For questions, help, comments, discussion, etc., please join the
  * Smarty mailing list. Send a blank e-mail to
  * smarty-discussion-subscribe@googlegroups.com
  *
  * @link      http://www.smarty.net/
- * @copyright 2017 New Digital Group, Inc.
- * @copyright 2017 Uwe Tews
+ * @copyright 2018 New Digital Group, Inc.
+ * @copyright 2018 Uwe Tews
  * @author    Monte Ohrt <monte at ohrt dot com>
- * @author    Uwe Tews
+ * @author    Uwe Tews   <uwe dot tews at gmail dot com>
  * @author    Rodney Rehm
  * @package   Smarty
- * @version   3.1.32-dev
+ * @version   3.1.32
  */
 /**
  * set SMARTY_DIR to absolute path to Smarty library files.
  * Sets SMARTY_DIR only if user application has not already defined it.
  */
@@ -110,11 +110,11 @@ require_once SMARTY_SYSPLUGINS_DIR . 'smarty_internal_resource_file.php';
 class Smarty extends Smarty_Internal_TemplateBase
 {
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '3.1.32-dev-46';
+    const SMARTY_VERSION = '3.1.32';
     /**
      * define variable scopes
      */
     const SCOPE_LOCAL    = 1;
     const SCOPE_PARENT   = 2;

Vulnerable code: ﻿===== 3.1.32 - dev ===
 * @copyright 2017 New Digital Group, Inc.
 * @copyright 2017 Uwe Tews
 * @author    Uwe Tews
 * @version   3.1.32-dev
    const SMARTY_VERSION = '3.1.32-dev-46';
Fixed code: ﻿===== 3.1.32 ===== (24.04.2018)
 * @copyright 2018 New Digital Group, Inc.
 * @copyright 2018 Uwe Tews
 * @author    Uwe Tews   <uwe dot tews at gmail dot com>
 * @version   3.1.32
    const SMARTY_VERSION = '3.1.32';
CVE-2022-29221: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2022-05-24T15:15Z
Repository: https://github.com/smarty-php/smarty
Language: Unknown
Commit date: 2022-05-17 14:55:47 +0200
Commit message: Merge branch 'security/blockfunctioninjection'
CVE-2023-28447: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-28T21:15Z
Repository: https://github.com/smarty-php/smarty
Language: Unknown
Commit date: 2023-03-28 21:46:46 +0200
Commit message: Merge branch 'js_escape_security_fix'
CVE-2024-39687: Insufficient Information (NVD-CWE-noinfo)
value: Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-05T18:15Z
Repository: https://github.com/dahlia/fedify
Language: Unknown
Commit date: 2024-07-05 11:00:44 +0900
Commit message: Merge pull request from GHSA-p9cg-vqcc-grcx

Address a SSRF vulnerability in the built-in document loader