Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-5736: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.6
Published: 2019-02-11T19:29Z
Repository: https://github.com/opencontainers/runc
Language: Unknown
Commit date: 2019-02-08 18:58:10 +1100
Commit message: merge branch 'cve-2019-5736'

  nsenter: clone /proc/self/exe to avoid exposing host binary to container

Fixes: CVE-2019-5736
LGTMs: @cyphar @crosbymichael
CVE-2021-43784: Integer Overflow or Wraparound (CWE-190)
value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte array attribute could result in the length overflowing and the attribute contents being parsed as netlink messages for container configuration. This vulnerability requires the attacker to have some control over the configuration of the container and would allow the attacker to bypass the namespace restrictions of the container by simply adding their own netlink payload which disables all namespaces. The main users impacted are those who allow untrusted images with untrusted configurations to run on their machines (such as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one may try disallowing untrusted namespace paths from your container. It should be noted that untrusted namespace paths would allow the attacker to disable namespace protections entirely even in the absence of this bug.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5
Published: 2021-12-06T18:15Z
Repository: https://github.com/opencontainers/runc
Language: Unknown
Commit date: 2021-12-06 15:30:29 +1100
Commit message: Merge pull request from GHSA-v95c-p5hm-xq8f

runc init: avoid netlink message length overflows
CVE-2022-29162: Incorrect Default Permissions (CWE-276)
value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 7.8
Published: 2022-05-17T21:15Z
Repository: https://github.com/opencontainers/runc
Language: Unknown
Commit date: 2022-05-12 08:15:42 +1000
Commit message: Merge pull request from GHSA-f3fp-gc8g-vw66

runc: do not set inheritable capabilities
CVE-2023-25809: Improper Preservation of Permissions (CWE-281)
value: runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

CWE description: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CVSS v3 base score: 6.3
Published: 2023-03-29T19:15Z
Repository: https://github.com/opencontainers/runc
Language: Unknown
Commit date: 2023-03-29 14:18:15 +0800
Commit message: Merge pull request from GHSA-m8cg-xc2p-r3fc

rootless: fix /sys/fs/cgroup mounts
CVE-2024-21626: Exposure of Resource to Wrong Sphere (CWE-668)
value: runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue. 
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 8.6
Published: 2024-01-31T22:15Z
Repository: https://github.com/opencontainers/runc
Language: Unknown
Commit date: 2024-02-01 07:04:29 +1100
Commit message: Merge pull request from GHSA-xr7r-f8xq-vfvv

fix GHSA-xr7r-f8xq-vfvv and harden fd leaks
CVE-2022-24900: Exposure of Resource to Wrong Sphere (CWE-668)
value: Piano LED Visualizer is software that allows LED lights to light up as a person plays a piano connected to a computer. Version 1.3 and prior are vulnerable to a path traversal attack. The `os.path.join` call is unsafe for use with untrusted input. When the `os.path.join` call encounters an absolute path, it ignores all the parameters it has encountered till that point and starts working with the new absolute path. Since the "malicious" parameter represents an absolute path, the result of `os.path.join` ignores the static directory completely. Hence, untrusted input is passed via the `os.path.join` call to `flask.send_file` can lead to path traversal attacks. A patch with a fix is available on the `master` branch of the GitHub repository. This can also be fixed by preventing flow of untrusted data to the vulnerable `send_file` function. In case the application logic necessiates this behaviour, one can either use the `flask.safe_join` to join untrusted paths or replace `flask.send_file` calls with `flask.send_from_directory` calls.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 8.6
Published: 2022-04-29T14:15Z
Repository: https://github.com/onlaj/Piano-LED-Visualizer
Language: Unknown
Commit date: 2022-04-29 15:11:57 +0200
Commit message: Merge pull request #351 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
CVE-2023-46729: Server-Side Request Forgery (SSRF) (CWE-918)
value: sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 6.1
Published: 2023-11-10T01:15Z
Repository: https://github.com/getsentry/sentry-javascript
Language: TypeScript
Files changed: packages/nextjs/src/config/withSentryConfig.ts
Commit date: 2023-10-31 09:11:01 +0100
Commit message: fix(nextjs): Strictly validate tunnel target parameters (#9415)


Diff: diff --git a/packages/nextjs/src/config/withSentryConfig.ts b/packages/nextjs/src/config/withSentryConfig.ts
index 07a22a815..48afb25f8 100644
--- a/packages/nextjs/src/config/withSentryConfig.ts
+++ b/packages/nextjs/src/config/withSentryConfig.ts
@@ -102,16 +102,16 @@ function setUpTunnelRewriteRules(userNextConfig: NextConfigObject, tunnelPath: s
       source: `${tunnelPath}(/?)`,
       has: [
         {
           type: 'query',
           key: 'o', // short for orgId - we keep it short so matching is harder for ad-blockers
-          value: '(?<orgid>.*)',
+          value: '(?<orgid>[a-fA-F0-9]*)',
         },
         {
           type: 'query',
           key: 'p', // short for projectId - we keep it short so matching is harder for ad-blockers
-          value: '(?<projectid>.*)',
+          value: '(?<projectid>\\d*)',
         },
       ],
       destination: 'https://o:orgid.ingest.sentry.io/api/:projectid/envelope/?hsts=0',
     };
 

Vulnerable code:           value: '(?<orgid>.*)',
          value: '(?<projectid>.*)',
Fixed code:           value: '(?<orgid>[a-fA-F0-9]*)',
          value: '(?<projectid>\\d*)',
CVE-2017-7875: Out-of-bounds Write (CWE-787)
value: In wallpaper.c in feh before v2.18.3, if a malicious client pretends to be the E17 window manager, it is possible to trigger an out-of-boundary heap write while receiving an IPC message. An integer overflow leads to a buffer overflow and/or a double free.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-04-14T18:59Z
Repository: https://github.com/derf/feh
Language: C
Files changed: src/wallpaper.c
Commit date: 2017-03-23 16:45:20 +0100
Commit message: Fix double-free/OOB-write while receiving IPC data

If a malicious client pretends to be the E17 window manager, it is
possible to trigger an out of boundary heap write while receiving an
IPC message.

The length of the already received message is stored in an unsigned
short, which overflows after receiving 64 KB of data. It's comparably
small amount of data and therefore achievable for an attacker.

When len overflows, realloc() will either be called with a small value
and therefore chars will be appended out of bounds, or len + 1 will be
exactly 0, in which case realloc() behaves like free(). This could be
abused for a later double-free attack as it's even possible to overwrite
the free information -- but this depends on the malloc implementation.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

Diff: diff --git a/src/wallpaper.c b/src/wallpaper.c
index a11a50d..93994b3 100644
--- a/src/wallpaper.c
+++ b/src/wallpaper.c
@@ -793,11 +793,11 @@ char *enl_wait_for_reply(void)
 
 char *enl_ipc_get(const char *msg_data)
 {
 
 	static char *message = NULL;
-	static unsigned short len = 0;
+	static size_t len = 0;
 	char buff[13], *ret_msg = NULL;
 	register unsigned char i;
 	unsigned char blen;
 
 	if (msg_data == IPC_TIMEOUT) {

Vulnerable code: 	static unsigned short len = 0;
Fixed code: 	static size_t len = 0;
CVE-2024-24751: Improper Access Control (CWE-284)
value: sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Published: 2024-02-13T19:15Z
Repository: https://github.com/derhansen/sf_event_mgt
Language: Unknown
Commit date: 2024-02-13 08:58:41 +0100
Commit message: Merge branch 'task/security-fix-admin-module'
CVE-2024-24751: Incorrect Authorization (CWE-863)
value: sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, because the `RedirectResponse` from the `$this->redirect()` function was never handled. This issue has been addressed in version 7.4.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Published: 2024-02-13T19:15Z
Repository: https://github.com/derhansen/sf_event_mgt
Language: Unknown
Commit date: 2024-02-13 08:58:41 +0100
Commit message: Merge branch 'task/security-fix-admin-module'
CVE-2013-4584: Improper Handling of Exceptional Conditions (CWE-755)
value: Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 5.9
Published: 2019-11-15T15:15Z
Repository: https://github.com/horms/perdition
Language: C
Files changed: perdition/perdition.c
Commit date: 2013-11-07 23:31:16 -0500
Commit message: Use specified ciphers for outgoing STARTLS connections

Perdition(8) says:

        --ssl_outgoing_ciphers STRING:

              Cipher list when making outgoing SSL or TLS connections as
              per ciphers(1). If empty ("") then openssl's default will
              be used.  (default "")

However, this is only the case for outgoing connections that do not use
STARTTLS (the perdition terminology is confusing here, since what it
calls "TLS" actually means "start as cleartext, negotiate to encrypted
via STARTTLS" and what it calls "SSL" actually means "start SSL or TLS
session, run service inside that").


This is a security concern because it means that perdition is not
obeying the specifications of the administrator, and may accept weaker
ciphersuites than instructed on its backhaul connections.

Consider the case where an administrator wants to offer relatively
promiscuous IMAP connections to their end users -- if the user's MUA
only has some weak cipher suite or cleartext IMAP, we want to accept the
weak ciphersuite as better than nothing.  However, the admin's backend
IMAP servers are all under her control, and she knows that they are
capable of stronger ciphersuites.  in this case, ssl_listen_ciphers will
allow weak ciphers, and ssl_outgoing_ciphers will be strict and require
high security, to at least protect the link between perdition and the
backend IMAP server.

However, if this outgoing connection happens to use IMAP+STARTTLS
instead of IMAPS, the bug described here will offer weak ciphersuites to
the backend IMAP server.

This is CVE-2013-4584
This is Debian Bug #729028

Signed-off-by: Simon Horman <horms@verge.net.au>

Diff: diff --git a/perdition/perdition.c b/perdition/perdition.c
index 07ba355..53ad984 100644
--- a/perdition/perdition.c
+++ b/perdition/perdition.c
@@ -983,11 +983,11 @@ int main (int argc, char **argv, char **envp){
 
 #ifdef WITH_SSL_SUPPORT
     else if((opt.ssl_mode & SSL_MODE_TLS_OUTGOING) &&
           (status & PROTOCOL_S_STARTTLS)) {
       server_io=perdition_ssl_client_connection(server_io, opt.ssl_ca_file, 
-		      opt.ssl_ca_path, opt.ssl_listen_ciphers, servername);
+		      opt.ssl_ca_path, opt.ssl_outgoing_ciphers, servername);
       if(!server_io) {
         VANESSA_LOGGER_DEBUG("perdition_ssl_connection outgoing");
         VANESSA_LOGGER_ERR("Fatal error establishing SSL connection");
         perdition_exit_cleanly(-1);
       }

Vulnerable code: 		      opt.ssl_ca_path, opt.ssl_listen_ciphers, servername);
Fixed code: 		      opt.ssl_ca_path, opt.ssl_outgoing_ciphers, servername);
CVE-2021-4253: Improper Neutralization (CWE-707)
value: A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ticket Handler. The manipulation of the argument site_id leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 7a1f90bd2a0ce95b8338ec0926902da975ec64d9. It is recommended to apply a patch to fix this issue. VDB-216210 is the identifier assigned to this vulnerability.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/ctrlo/lenio
Language: Perl
Files changed: lib/Lenio.pm
Commit date: 2021-02-09 07:10:16 +0000
Commit message: Fix reflected XSS

Diff: diff --git a/lib/Lenio.pm b/lib/Lenio.pm
index 99b942f..0f1aced 100644
--- a/lib/Lenio.pm
+++ b/lib/Lenio.pm
@@ -644,10 +644,13 @@ any ['get', 'post'] => '/ticket/:id?' => require_login sub {
         # Existing ticket, get task from DB
         $task = $ticket->task;
     }
     elsif (defined($id) && !body_parameters->get('submit'))
     {
+        my $site_id = query_parameters->get('site_id')
+            ? int(query_parameters->get('site_id'))
+            : session('site_id');
         # If applicable, Prefill ticket fields with initial values based on task
         if ($task)
         {
             my $sid  = $task->site_task_local && $task->site_task_local->site_id; # site_id associated with local task
             # See if the user has permission to view associated task
@@ -658,17 +661,17 @@ any ['get', 'post'] => '/ticket/:id?' => require_login sub {
                     name        => $task->name,
                     description => $task->description,
                     planned     => $date,
                     actionee    => $task->global ? 'external' : 'local',
                     task_id     => $task->id,
-                    site_id     => query_parameters->get('site_id') || session('site_id'),
+                    site_id     => $site_id,
                 });
             }
         }
         else {
             $ticket = rset('Ticket')->new({
-                site_id => query_parameters->get('site_id') || session('site_id'),
+                site_id => $site_id,
             });
         }
     }
     elsif (defined($id))
     {

Vulnerable code:                     site_id     => query_parameters->get('site_id') || session('site_id'),
                site_id => query_parameters->get('site_id') || session('site_id'),
Fixed code:         my $site_id = query_parameters->get('site_id')
            ? int(query_parameters->get('site_id'))
            : session('site_id');
                    site_id     => $site_id,
                site_id => $site_id,
CVE-2021-4254: Improper Neutralization (CWE-707)
value: A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The manipulation of the argument notice.notice.text leads to cross site scripting. The attack can be launched remotely. The name of the patch is aa300555343c1c081951fcb68bfb6852fbba7451. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216211.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/ctrlo/lenio
Language: Other
Files changed: views/layouts/main.tt
Commit date: 2021-02-08 20:14:25 +0000
Commit message: Fix XSS in notices

Diff: diff --git a/views/layouts/main.tt b/views/layouts/main.tt
index 1228b85..ca25f82 100644
--- a/views/layouts/main.tt
+++ b/views/layouts/main.tt
@@ -143,11 +143,11 @@
     [% END %]
 
     [% FOR notice IN login.login_notices %]
         <div class="alert alert-info alert-dismissable" data-someid="[% notice.id %]">
         <button id="my-alert" type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
-        [% notice.notice.text %]
+        [% notice.notice.text | html %]
         </div>
     [% END %]
 
     [% FOR message IN messages %]
         <div class="alert alert-[% message.bootstrap_color %]">

Vulnerable code:         [% notice.notice.text %]
Fixed code:         [% notice.notice.text | html %]
CVE-2021-4255: Improper Neutralization (CWE-707)
value: A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. The manipulation of the argument contractor.name leads to cross site scripting. The attack may be launched remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216212.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/ctrlo/lenio
Language: Other
Files changed: views/contractor.tt, views/index.tt
Commit date: 2021-02-08 20:13:02 +0000
Commit message: Fix more XSS issues

Diff: diff --git a/views/contractor.tt b/views/contractor.tt
index 027d385..b151aca 100644
--- a/views/contractor.tt
+++ b/views/contractor.tt
@@ -45,11 +45,11 @@
 	    </tr>
 
 	    [% FOR contractor IN contractors %]
 	    <tr>
 		<td class="col-sm-1"><a href="/contractor/[% contractor.id %]">[% contractor.id %]</a></td>
-		<td class="col-sm-10">[% contractor.name %]</td>
+		<td class="col-sm-10">[% contractor.name | html %]</td>
 	    </tr>
 	    [% END %]
 	</table> 
     [% ELSE %]
 	<p>There are no existing contractors</p>
diff --git a/views/index.tt b/views/index.tt
index 7f35422..757ec23 100644
--- a/views/index.tt
+++ b/views/index.tt
@@ -13,13 +13,13 @@
                 <th>Relevant uncompleted ticket</th>
             </tr>
 
             [% FOR task IN tasks %]
                 <tr>
-                    <td>[% task.name %]
+                    <td>[% task.name | html %]
                     </td>
-                    <td>[% task.site.org.name %] ([% task.site.name %])</td>
+                    <td>[% task.site.org.name | html %] ([% task.site.name | html %])</td>
                     <td>
                         [% IF task.last_completed %]
                             <a href="/ticket/[% task.last_completed_id %]">[% task.last_completed.strftime(dateformat) %]</a>
                         [% ELSE %]
                             (never)

Vulnerable code: 		<td class="col-sm-10">[% contractor.name %]</td>
                    <td>[% task.name %]
                    <td>[% task.site.org.name %] ([% task.site.name %])</td>
Fixed code: 		<td class="col-sm-10">[% contractor.name | html %]</td>
                    <td>[% task.name | html %]
                    <td>[% task.site.org.name | html %] ([% task.site.name | html %])</td>
CVE-2021-4256: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of the argument task.name/task.site.org.name leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier VDB-216213 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/ctrlo/lenio
Language: Other
Files changed: views/contractor.tt, views/index.tt
Commit date: 2021-02-08 20:13:02 +0000
Commit message: Fix more XSS issues

Diff: diff --git a/views/contractor.tt b/views/contractor.tt
index 027d385..b151aca 100644
--- a/views/contractor.tt
+++ b/views/contractor.tt
@@ -45,11 +45,11 @@
 	    </tr>
 
 	    [% FOR contractor IN contractors %]
 	    <tr>
 		<td class="col-sm-1"><a href="/contractor/[% contractor.id %]">[% contractor.id %]</a></td>
-		<td class="col-sm-10">[% contractor.name %]</td>
+		<td class="col-sm-10">[% contractor.name | html %]</td>
 	    </tr>
 	    [% END %]
 	</table> 
     [% ELSE %]
 	<p>There are no existing contractors</p>
diff --git a/views/index.tt b/views/index.tt
index 7f35422..757ec23 100644
--- a/views/index.tt
+++ b/views/index.tt
@@ -13,13 +13,13 @@
                 <th>Relevant uncompleted ticket</th>
             </tr>
 
             [% FOR task IN tasks %]
                 <tr>
-                    <td>[% task.name %]
+                    <td>[% task.name | html %]
                     </td>
-                    <td>[% task.site.org.name %] ([% task.site.name %])</td>
+                    <td>[% task.site.org.name | html %] ([% task.site.name | html %])</td>
                     <td>
                         [% IF task.last_completed %]
                             <a href="/ticket/[% task.last_completed_id %]">[% task.last_completed.strftime(dateformat) %]</a>
                         [% ELSE %]
                             (never)

Vulnerable code: 		<td class="col-sm-10">[% contractor.name %]</td>
                    <td>[% task.name %]
                    <td>[% task.site.org.name %] ([% task.site.name %])</td>
Fixed code: 		<td class="col-sm-10">[% contractor.name | html %]</td>
                    <td>[% task.name | html %]
                    <td>[% task.site.org.name | html %] ([% task.site.name | html %])</td>
CVE-2021-4257: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.name/check.name/task.tasktype.name/task.name leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 698c5fa465169d6f23c6a41ca4b1fc9a7869013a. It is recommended to apply a patch to fix this issue. VDB-216214 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/ctrlo/lenio
Language: Other
Files changed: views/task.tt
Commit date: 2021-02-08 20:05:12 +0000
Commit message: Fix XSS issues in tasks

Diff: diff --git a/views/task.tt b/views/task.tt
index 6e45579..be7411a 100644
--- a/views/task.tt
+++ b/views/task.tt
@@ -215,11 +215,11 @@
         [% IF login.is_admin %]
         </form>
         [% END %]
 
         [% IF site.id %]
-            <h3>Site Manager Checks ([% site.org.name %] - [% site.name %])
+            <h3>Site Manager Checks ([% site.org.name | html %] - [% site.name | html %])
                 <small>
                     <a data-toggle="modal" data-target="#modal_download" href="">Download</a>
                 </small>
             </h3>
             <p>
@@ -233,11 +233,11 @@
                         <th>Last done</th>
                     </tr>
 
                     [% FOR check IN site_checks %]
                         <tr>
-                            <td><a href="/check_edit/[% check.id %]">[% check.name %]</a></td>
+                            <td><a href="/check_edit/[% check.id %]">[% check.name | html %]</a></td>
                             <td>[% check.period_qty %] [% check.period_unit %][% IF check.period_qty > 1 %]s[% END %]</td>
                             [% IF site.id %]
                                 <td>[% check.last_completed.strftime(dateformat) %]</td>
                             [% END %]
                         </tr>

Vulnerable code:             <h3>Site Manager Checks ([% site.org.name %] - [% site.name %])
                            <td><a href="/check_edit/[% check.id %]">[% check.name %]</a></td>
Fixed code:             <h3>Site Manager Checks ([% site.org.name | html %] - [% site.name | html %])
                            <td><a href="/check_edit/[% check.id %]">[% check.name | html %]</a></td>
CVE-2019-25102: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. The patch is identified as 015a719bf5cdc561feea05500ecb3274ef609cd2. It is recommended to upgrade the affected component. VDB-220638 is the identifier assigned to this vulnerability.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-02-12T14:15Z
Repository: https://github.com/ariabuckles/simple-markdown
Language: JavaScript
Files changed: simple-markdown.js
Commit date: 2019-09-26 11:23:25 -0700
Commit message: Fix ReDoS with autolink

Patterns like <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ currently exhibit O(n^3) complexity, allowing a 5KB document to take 7174ms to parse. With this change, it drops to O(n^2) and 73ms.
Diff: diff --git a/simple-markdown.js b/simple-markdown.js
index 3828dcc..80015c5 100644
--- a/simple-markdown.js
+++ b/simple-markdown.js
@@ -1314,11 +1314,11 @@ var defaultRules /* : DefaultRules */ = {
         react: function() { return ' | '; },
         html: function() { return ' &vert; '; },
     },
     autolink: {
         order: currOrder++,
-        match: inlineRegex(/^<([^ >]+:\/[^ >]+)>/),
+        match: inlineRegex(/^<([^: >]+:\/[^ >]+)>/),
         parse: function(capture, parse, state) {
             return {
                 type: "link",
                 content: [{
                     type: "text",

Vulnerable code:         match: inlineRegex(/^<([^ >]+:\/[^ >]+)>/),
Fixed code:         match: inlineRegex(/^<([^: >]+:\/[^ >]+)>/),
CVE-2016-9126: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-03-28T02:59Z
Repository: https://github.com/revive-adserver/revive-adserver
Language: HTML
Files changed: lib/templates/admin/dashboard/audit.html
Commit date: 2016-03-01 16:23:09 +0100
Commit message: Fix h1 report 97073

Persistent XSS
--------------

Tengku Zahasman has reported via HackerOne that usernames were not properly
escaped when displayed in the audit trail widget of the dashboard upon login,
allowing persistent XSS attacks. An authenticated user with enough privileges
to create other users could exploit the vulnerability to access the
administrator account.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 5.6 (AV:N/AC:H/Au:S/C:C/I:P/A:N)

Diff: diff --git a/lib/templates/admin/dashboard/audit.html b/lib/templates/admin/dashboard/audit.html
index 98ae782c4a..3aebbef3a5 100644
--- a/lib/templates/admin/dashboard/audit.html
+++ b/lib/templates/admin/dashboard/audit.html
@@ -28,11 +28,11 @@
         <ul class="widgetList auditList">
            {foreach from=$aAuditData key=key item=aValue}
             <li>
                 <div class="title">
                     <a target="_top" href="userlog-audit-detailed.php?auditId={$aValue.auditid}">
-                        {$aValue.desc}
+                        {$aValue.desc|escape}
                     </a>
                 </div>
                 <div>
                     <span class="date">{$aValue.updated|date_format:"%d %b %Y"}</span>
                 </div>

Vulnerable code:                         {$aValue.desc}
Fixed code:                         {$aValue.desc|escape}
CVE-2016-9128: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-03-28T02:59Z
Repository: https://github.com/revive-adserver/revive-adserver
Language: PHP
Files changed: plugins_repo/openXInvocationTags/plugins/invocationTags/oxInvocationTags/spc.class.php
Commit date: 2016-03-01 16:23:09 +0100
Commit message: Fix h1 report 99004

Reflected XSS
-------------

The HackerOne user @decidedlygray has reported that the affiliate-preview.php
script in www/admin is vulnerable to a reflected XSS attack via the "charset"
parameter. If the target system is running a Revive Adserver version older
than 3.2.2, such a vulnerability could be used by an attacker to steal the
session ID of an authenticated user, by tricking them into visiting a
specifically crafted URL.

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-79
CVSSv2: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

Diff: diff --git a/plugins_repo/openXInvocationTags/plugins/invocationTags/oxInvocationTags/spc.class.php b/plugins_repo/openXInvocationTags/plugins/invocationTags/oxInvocationTags/spc.class.php
index 5674ae3bd1..36a8cd5316 100644
--- a/plugins_repo/openXInvocationTags/plugins/invocationTags/oxInvocationTags/spc.class.php
+++ b/plugins_repo/openXInvocationTags/plugins/invocationTags/oxInvocationTags/spc.class.php
@@ -231,11 +231,11 @@ class Plugins_InvocationTags_OxInvocationTags_Spc extends Plugins_InvocationTags
                         $optionName = $this->translate("Option - SSL");
                         $optionValue = intval($mi->$feature) ? $GLOBALS['strYes'] : $GLOBALS['strNo'];
                         break;
                 case 'charset':
                         $optionName = $GLOBALS['strCharset'];
-                        $optionValue = empty($mi->$feature) ? $GLOBALS['strAutoDetect'] : $mi->$feature;
+                        $optionValue = empty($mi->$feature) ? $GLOBALS['strAutoDetect'] : htmlspecialchars($mi->$feature);
                         break;
                 default:
                         $optionName = $feature;
                         $optionValue = htmlspecialchars(stripslashes($mi->$feature));
                         break;

Vulnerable code:                         $optionValue = empty($mi->$feature) ? $GLOBALS['strAutoDetect'] : $mi->$feature;
Fixed code:                         $optionValue = empty($mi->$feature) ? $GLOBALS['strAutoDetect'] : htmlspecialchars($mi->$feature);
CVE-2017-12904: Improper Neutralization of Special Elements in Data Query Logic (CWE-943)
value: Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
CWE description: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
CVSS v3 base score: 8.8
Published: 2017-08-23T14:29Z
Repository: https://github.com/akrennmair/newsbeuter
Language: C++
Files changed: src/controller.cpp
Commit date: 2017-08-17 21:06:48 +0300
Commit message: Sanitize inputs to bookmark-cmd (#591)

Newsbeuter didn't properly shell-escape the arguments passed to
bookmarking command, which allows a remote attacker to perform remote
code execution by crafting an RSS item whose title and/or URL contain
something interpretable by the shell (most notably subshell
invocations.)

This has been reported by Jeriko One <jeriko.one@gmx.us>, complete with
PoC and a patch.

This vulnerability was assigned CVE-2017-12904.

Diff: diff --git a/src/controller.cpp b/src/controller.cpp
index fde8513..40db06c 100644
--- a/src/controller.cpp
+++ b/src/controller.cpp
@@ -1342,16 +1342,16 @@ std::string controller::bookmark(
 		const std::string& feed_title)
 {
 	std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd");
 	bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive");
 	if (bookmark_cmd.length() > 0) {
-		std::string cmdline = strprintf::fmt("%s '%s' %s %s %s",
+		std::string cmdline = strprintf::fmt("%s '%s' '%s' '%s' '%s'",
 		                                       bookmark_cmd,
 		                                       utils::replace_all(url,"'", "%27"),
-		                                       quote_empty(stfl::quote(title)),
-		                                       quote_empty(stfl::quote(description)),
-		                                       quote_empty(stfl::quote(feed_title)));
+		                                       utils::replace_all(title,"'", "%27"),
+		                                       utils::replace_all(description,"'", "%27"),
+		                                       utils::replace_all(feed_title,"'", "%27"));
 
 		LOG(level::DEBUG, "controller::bookmark: cmd = %s", cmdline);
 
 		if (is_interactive) {
 			v->push_empty_formaction();

Vulnerable code: 		std::string cmdline = strprintf::fmt("%s '%s' %s %s %s",
		                                       quote_empty(stfl::quote(title)),
		                                       quote_empty(stfl::quote(description)),
		                                       quote_empty(stfl::quote(feed_title)));
Fixed code: 		std::string cmdline = strprintf::fmt("%s '%s' '%s' '%s' '%s'",
		                                       utils::replace_all(title,"'", "%27"),
		                                       utils::replace_all(description,"'", "%27"),
		                                       utils::replace_all(feed_title,"'", "%27"));
CVE-2017-14500: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2017-09-17T05:29Z
Repository: https://github.com/akrennmair/newsbeuter
Language: C++
Files changed: src/pb_controller.cpp, src/queueloader.cpp
Commit date: 2017-09-16 21:01:06 +0300
Commit message: Work around shell code in podcast names (#598)

Diff: diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
index e46594f3..a6581f5e 100644
--- a/src/pb_controller.cpp
+++ b/src/pb_controller.cpp
@@ -365,13 +365,13 @@ void pb_controller::play_file(const std::string& file) {
 	std::string cmdline;
 	std::string player = cfg->get_configvalue("player");
 	if (player == "")
 		return;
 	cmdline.append(player);
-	cmdline.append(" \"");
-	cmdline.append(utils::replace_all(file,"\"", "\\\""));
-	cmdline.append("\"");
+	cmdline.append(" '");
+	cmdline.append(utils::replace_all(file,"'", "%27"));
+	cmdline.append("'");
 	stfl::reset();
 	utils::run_interactively(cmdline, "pb_controller::play_file");
 }
 
 
diff --git a/src/queueloader.cpp b/src/queueloader.cpp
index 15047b6e..980f185d 100644
--- a/src/queueloader.cpp
+++ b/src/queueloader.cpp
@@ -128,11 +128,11 @@ std::string queueloader::get_filename(const std::string& str) {
 		char lbuf[128];
 		time_t t = time(nullptr);
 		strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
 		fn.append(lbuf);
 	} else {
-		fn.append(base);
+		fn.append(utils::replace_all(base, "'", "%27"));
 	}
 	return fn;
 }
 
 }

Vulnerable code: 	cmdline.append(" \"");
	cmdline.append(utils::replace_all(file,"\"", "\\\""));
	cmdline.append("\"");
		fn.append(base);
Fixed code: 	cmdline.append(" '");
	cmdline.append(utils::replace_all(file,"'", "%27"));
	cmdline.append("'");
		fn.append(utils::replace_all(base, "'", "%27"));
CVE-2022-4927: Other (NVD-CWE-Other)
value: A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/_refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be initiated remotely. Upgrading to version 1.0.71 is able to address this issue. The patch is named abe9f57123e0c278ae190cd7402a623d66c51375. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222287.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.1
Published: 2023-03-05T20:15Z
Repository: https://github.com/ualbertalib/NEOSDiscovery
Language: Ruby
Files changed: app/views/bookmarks/_refworks.html.erb
Commit date: 2022-01-04 14:58:27 -0700
Commit message: Reverse Tabnabbing

When opening a link in a new tab without setting rel: "noopener noreferrer", the new tab can control the parent tab's location. For example, an attacker could redirect to a phishing page.

Diff: diff --git a/app/views/bookmarks/_refworks.html.erb b/app/views/bookmarks/_refworks.html.erb
index 193b800..d168b93 100644
--- a/app/views/bookmarks/_refworks.html.erb
+++ b/app/views/bookmarks/_refworks.html.erb
@@ -1,5 +1,10 @@
 <% if @document_list.any? {|d| d.exports_as? :refworks_marc_txt } %>
   <li class="refworks">
-    <%= link_to t('blacklight.tools.refworks'), refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), :class => "btn btn-default", :id => "refworksLink", :target => "_blank" %>
+    <%= link_to t('blacklight.tools.refworks'), 
+                refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), 
+                class: "btn btn-default", 
+                id: "refworksLink", 
+                rel: 'noopener noreferrer',
+                target: "_blank" %>
   </li>
 <% end %>

Vulnerable code:     <%= link_to t('blacklight.tools.refworks'), refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), :class => "btn btn-default", :id => "refworksLink", :target => "_blank" %>
Fixed code:     <%= link_to t('blacklight.tools.refworks'), 
                refworks_export_url(url: bookmarks_export_url(:refworks_marc_txt, search_state.params_for_search)), 
                class: "btn btn-default", 
                id: "refworksLink", 
                rel: 'noopener noreferrer',
                target: "_blank" %>