Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-39528: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.6
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:24:14 +0200
Commit message: Merge remote-tracking branch 'ghsa-hpf4-v7v2-95p2/fix-advisory-1' into release/8.1.1
CVE-2023-39529: Insufficient Information (NVD-CWE-noinfo)
value: PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.1
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:24:46 +0200
Commit message: Merge remote-tracking branch 'ghsa-2rf5-3fw8-qm47/advisory-fix-3' into release/8.1.1
CVE-2023-39530: Improper Input Validation (CWE-20)
value: PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.1
Published: 2023-08-07T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-07-20 10:25:10 +0200
Commit message: Merge remote-tracking branch 'ghsa-v4gr-v679-42p7/advisory-fix-1' into release/8.1.1
CVE-2023-43663: Improper Privilege Management (CWE-269)
value: PrestaShop is an Open Source e-commerce web application. In affected versions any module can be disabled or uninstalled from back office, even with low user right. This allows low privileged users to disable portions of a shops functionality. Commit `ce1f6708` addresses this issue and is included in version 8.1.2. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 4.3
Published: 2023-09-28T19:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-09-28 10:33:42 +0200
Commit message: Merge pull request from GHSA-6jmf-2pfc-q9m7

Filter dashboard hooks in ajax method
CVE-2023-43664: Improper Privilege Management (CWE-269)
value: PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 4.3
Published: 2023-09-28T19:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-09-28 10:34:56 +0200
Commit message: Merge pull request from GHSA-gvrg-62jp-rf7j

Check user has view access before fetching module hooks
CVE-2024-21627: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-01-02T21:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-12-13 15:38:33 +0100
Commit message: Merge remote-tracking branch '46rq/advisory-fix-1' into 8.1.x
CVE-2024-21628: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-01-02T22:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2023-12-13 15:38:46 +0100
Commit message: Merge remote-tracking branch 'm4wf/advisory-fix-1' into 8.1.x
CVE-2024-26129: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2024-02-19T22:15Z
Repository: https://github.com/PrestaShop/PrestaShop
Language: Unknown
Commit date: 2024-02-19 11:32:50 +0100
Commit message: Merge pull request from GHSA-3366-9287-7qpr

Fix theme_dir tpl variable
CVE-2023-25812: Insufficient Information (NVD-CWE-noinfo)
value: Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId  with the special header `X-Amz-Bypass-Governance-Retention: true`.  However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted.  All users are advised to upgrade. There are no known workarounds for this issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2023-02-21T21:15Z
Repository: https://github.com/minio/minio
Language: Go
Files changed: cmd/bucket-object-lock.go
Commit date: 2023-02-17 07:53:34 +0530
Commit message: fix: evaluate BypassGov policy action in deletion correctly (#16635)


Diff: diff --git a/cmd/bucket-object-lock.go b/cmd/bucket-object-lock.go
index 1ffcb8cc7e..cbfc557a2c 100644
--- a/cmd/bucket-object-lock.go
+++ b/cmd/bucket-object-lock.go
@@ -154,15 +154,12 @@ func enforceRetentionBypassForDelete(ctx context.Context, r *http.Request, bucke
 					return ErrObjectLocked
 				}
 				return ErrNone
 			}
 			// https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html#object-lock-retention-modes
-			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention
-			// or s3:GetBucketObjectLockConfiguration permissions, the operation will succeed.
-			govBypassPerms1 := checkRequestAuthType(ctx, r, policy.BypassGovernanceRetentionAction, bucket, object.ObjectName)
-			govBypassPerms2 := checkRequestAuthType(ctx, r, policy.GetBucketObjectLockConfigurationAction, bucket, object.ObjectName)
-			if govBypassPerms1 != ErrNone && govBypassPerms2 != ErrNone {
+			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention, the operation will succeed.
+			if checkRequestAuthType(ctx, r, policy.BypassGovernanceRetentionAction, bucket, object.ObjectName) != ErrNone {
 				return ErrAccessDenied
 			}
 		}
 	}
 	return ErrNone

Vulnerable code: 			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention
			// or s3:GetBucketObjectLockConfiguration permissions, the operation will succeed.
			govBypassPerms1 := checkRequestAuthType(ctx, r, policy.BypassGovernanceRetentionAction, bucket, object.ObjectName)
			govBypassPerms2 := checkRequestAuthType(ctx, r, policy.GetBucketObjectLockConfigurationAction, bucket, object.ObjectName)
			if govBypassPerms1 != ErrNone && govBypassPerms2 != ErrNone {
Fixed code: 			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention, the operation will succeed.
			if checkRequestAuthType(ctx, r, policy.BypassGovernanceRetentionAction, bucket, object.ObjectName) != ErrNone {
CVE-2023-28433: Insufficient Information (NVD-CWE-noinfo)
value: Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2023-03-22T21:15Z
Repository: https://github.com/minio/minio
Language: Go
Files changed: cmd/generic-handlers.go
Commit date: 2023-03-20 00:35:25 -0700
Commit message: fix: convert '\' to '/' on windows (#16852)


Diff: diff --git a/cmd/generic-handlers.go b/cmd/generic-handlers.go
index 70abff453c..c6850719c5 100644
--- a/cmd/generic-handlers.go
+++ b/cmd/generic-handlers.go
@@ -20,10 +20,11 @@ package cmd
 import (
 	"fmt"
 	"net"
 	"net/http"
 	"path"
+	"path/filepath"
 	"runtime/debug"
 	"strings"
 	"sync/atomic"
 	"time"
 
@@ -347,11 +348,11 @@ func hasBadHost(host string) error {
 }
 
 // Check if the incoming path has bad path components,
 // such as ".." and "."
 func hasBadPathComponent(path string) bool {
-	path = strings.TrimSpace(path)
+	path = filepath.ToSlash(strings.TrimSpace(path)) // For windows '\' must be converted to '/'
 	for _, p := range strings.Split(path, SlashSeparator) {
 		switch strings.TrimSpace(p) {
 		case dotdotComponent:
 			return true
 		case dotComponent:

Vulnerable code: 	path = strings.TrimSpace(path)
Fixed code: 	"path/filepath"
	path = filepath.ToSlash(strings.TrimSpace(path)) // For windows '\' must be converted to '/'
CVE-2021-3632: Improper Authentication (CWE-287)
value: A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2022-08-26T16:15Z
Repository: https://github.com/keycloak/keycloak
Language: Java
Files changed: services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java
Commit date: 2021-08-03 10:49:45 -0300
Commit message: Prevent security flaw using passwordless authentication

If you register without an password or delete your last token your account can be hijacked. This is can be done by simply trying to login in that moment where the account is without a token. You get the "normal" registration dialog and can capture the complete account.

Diff: diff --git a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java
index a51558d9e4..8e0783d7d8 100644
--- a/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java
+++ b/services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java
@@ -51,6 +51,12 @@ public class WebAuthnPasswordlessAuthenticatorFactory extends WebAuthnAuthentica
 
     @Override
     public String getId() {
         return PROVIDER_ID;
     }
+
+    @Override
+    public boolean isUserSetupAllowed() {
+        return false;
+    }
+
 }

Fixed code: 
    @Override
    public boolean isUserSetupAllowed() {
        return false;
    }
CVE-2023-40235: Insufficient Information (NVD-CWE-noinfo)
value: An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource. If the provided resource is a UNC path pointing to a share server that does not accept a guest account, the host will try to authenticate on the share by using the current user's session. NOTE: this issue occurs because Archi uses an unsafe configuration of the Eclipse Modeling Framework.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2023-08-10T23:15Z
Repository: https://github.com/archimatetool/archi
Language: Java
Files changed: com.archimatetool.model/src/com/archimatetool/model/util/ArchimateResourceFactory.java
Commit date: 2023-07-14 13:59:40 +0100
Commit message: Set OPTION_USE_PACKAGE_NS_URI_AS_LOCATION to false

- See https://github.com/archimatetool/archi/issues/946

Diff: diff --git a/com.archimatetool.model/src/com/archimatetool/model/util/ArchimateResourceFactory.java b/com.archimatetool.model/src/com/archimatetool/model/util/ArchimateResourceFactory.java
index 34b052cf..2b5072a3 100644
--- a/com.archimatetool.model/src/com/archimatetool/model/util/ArchimateResourceFactory.java
+++ b/com.archimatetool.model/src/com/archimatetool/model/util/ArchimateResourceFactory.java
@@ -92,10 +92,12 @@ public class ArchimateResourceFactory extends ResourceFactoryImpl {
         resource.getDefaultLoadOptions().put(XMLResource.OPTION_ENCODING, "UTF-8"); //$NON-NLS-1$
         
         resource.getDefaultLoadOptions().put(XMLResource.OPTION_DEFER_IDREF_RESOLUTION, Boolean.TRUE);
         resource.setIntrinsicIDToEObjectMap(new HashMap<String, EObject>());
         
+        // Don't allow loading an unregistered URI in case of exploits
+        resource.getDefaultLoadOptions().put(XMLResource.OPTION_USE_PACKAGE_NS_URI_AS_LOCATION, false);
         
         Map<String, Object> parserFeatures = new HashMap<String, Object>();
         // Don't allow DTD loading in case of XSS exploits
         parserFeatures.put("http://apache.org/xml/features/disallow-doctype-decl", Boolean.TRUE); //$NON-NLS-1$
         parserFeatures.put("http://apache.org/xml/features/nonvalidating/load-external-dtd", Boolean.FALSE); //$NON-NLS-1$

Fixed code:         // Don't allow loading an unregistered URI in case of exploits
        resource.getDefaultLoadOptions().put(XMLResource.OPTION_USE_PACKAGE_NS_URI_AS_LOCATION, false);
CVE-2016-10703: Improper Input Validation (CWE-20)
value: A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-12-14T19:29Z
Repository: https://github.com/jfhbrook/node-ecstatic
Language: JavaScript
Files changed: lib/ecstatic.js
Commit date: 2016-08-09 12:37:41 -0400
Commit message: Remove stripping of null bytes

This was at one point necessary because of an old bug in url.parse

See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4

But this opens up a regex dos attack vector! D:

Based on some research (ie asking #node-dev if this is still an issue),
it's *probably* not an issue. :)

Diff: diff --git a/lib/ecstatic.js b/lib/ecstatic.js
index 115de99..efc333e 100755
--- a/lib/ecstatic.js
+++ b/lib/ecstatic.js
@@ -50,13 +50,25 @@ var ecstatic = module.exports = function (dir, options) {
 
 
   return function middleware (req, res, next) {
 
     // Strip any null bytes from the url
+    // This was at one point necessary because of an old bug in url.parse
+    //
+    // See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
+    // See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4
+    //
+    // But this opens up a regex dos attack vector! D:
+    //
+    // Based on some research (ie asking #node-dev if this is still an issue),
+    // it's *probably* not an issue. :)
+    /*
     while(req.url.indexOf('%00') !== -1) {
       req.url = req.url.replace(/\%00/g, '');
     }
+    */
+
     // Figure out the path for the file from the given url
     var parsed = url.parse(req.url);
     try {
       decodeURIComponent(req.url); // check validity of url
       var pathname = decodePathname(parsed.pathname);

Fixed code:     // This was at one point necessary because of an old bug in url.parse
    //
    // See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
    // See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4
    //
    // But this opens up a regex dos attack vector! D:
    //
    // Based on some research (ie asking #node-dev if this is still an issue),
    // it's *probably* not an issue. :)
    /*
    */
CVE-2015-8947: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.6
Published: 2016-07-19T10:59Z
Repository: https://github.com/behdad/harfbuzz
Language: C++
Files changed: src/hb-ot-layout-gpos-table.hh
Commit date: 2015-10-13 00:30:50 -0400
Commit message: Fix another memory access issue discovered by libFuzzer

Fixes https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679

Diff: diff --git a/src/hb-ot-layout-gpos-table.hh b/src/hb-ot-layout-gpos-table.hh
index ca98cb7a..568b5f63 100644
--- a/src/hb-ot-layout-gpos-table.hh
+++ b/src/hb-ot-layout-gpos-table.hh
@@ -702,20 +702,22 @@ struct PairPosFormat1
 
   inline bool sanitize (hb_sanitize_context_t *c) const
   {
     TRACE_SANITIZE (this);
 
+    if (!c->check_struct (this)) return_trace (false);
+
     unsigned int len1 = valueFormat1.get_len ();
     unsigned int len2 = valueFormat2.get_len ();
     PairSet::sanitize_closure_t closure = {
       this,
       &valueFormat1,
       len1,
       1 + len1 + len2
     };
 
-    return_trace (c->check_struct (this) && coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
+    return_trace (coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
   }
 
   protected:
   USHORT	format;			/* Format identifier--format = 1 */
   OffsetTo<Coverage>

Vulnerable code:     return_trace (c->check_struct (this) && coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
Fixed code:     if (!c->check_struct (this)) return_trace (false);

    return_trace (coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));
CVE-2016-2052: Insufficient Information (NVD-CWE-noinfo)
value: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.6
Published: 2016-01-25T11:59Z
Repository: https://github.com/behdad/harfbuzz
Language: C++
Files changed: src/hb-ot-font.cc
Commit date: 2015-10-15 12:54:28 -0300
Commit message: [ot-font] Fix hmtx wrong table length check

Discovered by libFuzzer.  Ouch!

https://github.com/behdad/harfbuzz/issues/139#issuecomment-148289957

Diff: diff --git a/src/hb-ot-font.cc b/src/hb-ot-font.cc
index 3102784e..69d2503a 100644
--- a/src/hb-ot-font.cc
+++ b/src/hb-ot-font.cc
@@ -57,11 +57,11 @@ struct hb_ot_face_metrics_accelerator_t
     this->num_advances = _hea->numberOfLongMetrics;
     hb_blob_destroy (_hea_blob);
 
     this->blob = OT::Sanitizer<OT::_mtx>::sanitize (face->reference_table (_mtx_tag));
     if (unlikely (!this->num_advances ||
-		  2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob)))
+		  2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob)))
     {
       this->num_metrics = this->num_advances = 0;
       hb_blob_destroy (this->blob);
       this->blob = hb_blob_get_empty ();
     }

Vulnerable code: 		  2 * (this->num_advances + this->num_metrics) < hb_blob_get_length (this->blob)))
Fixed code: 		  2 * (this->num_advances + this->num_metrics) > hb_blob_get_length (this->blob)))
CVE-2014-9760: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary web script or HTML via the username.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-02-13T18:59Z
Repository: https://github.com/gosa-project/gosa-core
Language: PHP
Files changed: html/index.php
Commit date: 2014-06-12 13:51:29 +0000
Commit message: escape html entities to fix xss at the login screen


git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@21276 594d385d-05f5-0310-b6e9-bd551577e9d8

Diff: diff --git a/html/index.php b/html/index.php
index 364301e9..ab83e113 100644
--- a/html/index.php
+++ b/html/index.php
@@ -386,11 +386,11 @@ if (($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['login'])) || $htacces
     }
 }
 
 /* Fill template with required values */
 $smarty->assign ('date', gmdate("D, d M Y H:i:s"));
-$smarty->assign ('username', $username);
+$smarty->assign ('username', set_post($username));
 $smarty->assign ('personal_img', get_template_path('images/login-head.png'));
 $smarty->assign ('password_img', get_template_path('images/password.png'));
 $smarty->assign ('directory_img', get_template_path('images/ldapserver.png'));
 
 /* Some error to display? */

Vulnerable code: $smarty->assign ('username', $username);
Fixed code: $smarty->assign ('username', set_post($username));
CVE-2018-1000528: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-06-26T16:29Z
Repository: https://github.com/gosa-project/gosa-core
Language: PHP
Files changed: html/password.php
Commit date: 2018-06-04 14:03:39 +0200
Commit message: (see #14)
escape html entities for uid to avoid code execution

Diff: diff --git a/html/password.php b/html/password.php
index 0b93bf955..7492667b8 100644
--- a/html/password.php
+++ b/html/password.php
@@ -303,11 +303,11 @@ foreach (array('uid', 'method', 'directory') as $index) {
 $params= preg_replace('/^&amp;/', '?', $params);
 $smarty->assign('params', $params);
 
 /* Fill template with required values */
 $smarty->assign('date', gmdate("D, d M Y H:i:s"));
-$smarty->assign('uid', $uid);
+$smarty->assign('uid', set_post($uid));
 $smarty->assign('password_img', get_template_path('images/password.png'));
 
 /* Displasy SSL mode warning? */
 if ($ssl != "" && $config->get_cfg_value("core","warnSSL") == 'true') {
     $smarty->assign(

Vulnerable code: $smarty->assign('uid', $uid);
Fixed code: $smarty->assign('uid', set_post($uid));
CVE-2024-34342: Insufficient Information (NVD-CWE-noinfo)
value: react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-07T15:15Z
Repository: https://github.com/mozilla/pdf.js
Language: Unknown
Commit date: 2024-04-28 23:27:47 +0200
Commit message: Merge pull request #18015 from calixteman/rm_eval_font_loader

Simplify the way to pass the glyph drawing instructions from the worker to the main thread
CVE-2016-10245: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-05-24T17:29Z
Repository: https://github.com/doxygen/doxygen
Language: PHP
Files changed: templates/html/search_opensearch.php
Commit date: 2016-03-25 19:55:20 +0100
Commit message: Bug 762934 - External search does not properly escape user supplied data, resulting in vulnerability

Diff: diff --git a/templates/html/search_opensearch.php b/templates/html/search_opensearch.php
index e3a46343..58ee4ab2 100644
--- a/templates/html/search_opensearch.php
+++ b/templates/html/search_opensearch.php
@@ -1,10 +1,11 @@
 <script language="PHP">
 require "search_functions.php";
 
 $mode = array_key_exists('v', $_GET)?$_GET['v']:"";
 $query = array_key_exists('query', $_GET)?$_GET['query']:"";
+$query = preg_replace("/[^a-zA-Z0-9\-\_\.\x80-\xFF]/i", " ", $query );
 
 $query_results = run_query($query);
 
 switch ($mode)
 {

Fixed code: $query = preg_replace("/[^a-zA-Z0-9\-\_\.\x80-\xFF]/i", " ", $query );
CVE-2021-32855: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-21T15:15Z
Repository: https://github.com/Vanessa219/vditor
Language: TypeScript
Files changed: src/ts/util/fixBrowserBehavior.ts, types/index.d.ts
Commit date: 2021-09-21 21:34:38 +0800
Commit message: :lock: https://github.com/Vanessa219/vditor/issues/1085

Diff: diff --git a/src/ts/util/fixBrowserBehavior.ts b/src/ts/util/fixBrowserBehavior.ts
index 144d26d4..4e24348b 100644
--- a/src/ts/util/fixBrowserBehavior.ts
+++ b/src/ts/util/fixBrowserBehavior.ts
@@ -1353,11 +1353,11 @@ export const paste = async (vditor: IVditor, event: (ClipboardEvent | DragEvent)
     // process word
     const doc = new DOMParser().parseFromString(textHTML, "text/html");
     if (doc.body) {
         textHTML = doc.body.innerHTML;
     }
-
+    textHTML = Lute.Sanitize(textHTML);
     vditor.wysiwyg.getComments(vditor);
 
     // process code
     const height = vditor[vditor.currentMode].element.scrollHeight;
     const code = processPasteCode(textHTML, textPlain, vditor.currentMode);
diff --git a/types/index.d.ts b/types/index.d.ts
index ba578fb6..3427b5b9 100644
--- a/types/index.d.ts
+++ b/types/index.d.ts
@@ -116,10 +116,12 @@ declare class Lute {
 
     public static GetHeadingID(node: ILuteNode): string;
 
     public static NewNodeID(): string;
 
+    public static Sanitize(html: string): string;
+
     private constructor();
 
     public SetJSRenderers(options?: {
         renderers: {
             HTML2VditorDOM?: ILuteRender,
@@ -230,10 +232,11 @@ declare const webkitAudioContext: {
     new(contextOptions?: AudioContextOptions): AudioContext,
 };
 
 interface ITips {
     [index: string]: string;
+
     alignCenter: string;
     alignLeft: string;
     alignRight: string;
     alternateText: string;
     bold: string;

Fixed code:     textHTML = Lute.Sanitize(textHTML);
    public static Sanitize(html: string): string;
CVE-2023-50248: Improper Handling of Length Parameter Inconsistency (CWE-130)
value: CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `Authorization` header) with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error, the attacker need to have permissions to create or edit datasets. This vulnerability has been patched in CKAN 2.10.3 and 2.9.10.
CWE description: The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
CVSS v3 base score: 6.5
Published: 2023-12-13T21:15Z
Repository: https://github.com/ckan/ckan
Language: Unknown
Commit date: 2023-12-13 14:12:02 +0100
Commit message: Merge pull request from GHSA-7fgc-89cx-w8j5

Sanitize indexes in tuple keys when flattening dicts
CVE-2024-27097: Insufficient Information (NVD-CWE-noinfo)
value: A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-13T21:15Z
Repository: https://github.com/ckan/ckan
Language: Unknown
Commit date: 2024-03-13 13:01:28 +0100
Commit message: Merge pull request from GHSA-8g38-3m6v-232j

use repr for logging user input
CVE-2020-7761: Insufficient Information (NVD-CWE-noinfo)
value: This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2020-11-05T11:15Z
Repository: https://github.com/absolunet/kafe
Language: JavaScript
Files changed: src/kafe/string-validate.js
Commit date: 2020-11-04 19:28:35 -0500
Commit message: Switch email pattern to practical implementation of RFC 5322

Diff: diff --git a/src/kafe/string-validate.js b/src/kafe/string-validate.js
index 4bb7bc3..5c527f9 100644
--- a/src/kafe/string-validate.js
+++ b/src/kafe/string-validate.js
@@ -44,11 +44,14 @@
 	*	// returns true
 	*/
 	validate.isEmail = function(str) {
 		str = str.replace(/^\s*|\s*$/g, '');
 		str = str.replace(/^\t*|\t*$/g, '');
-		return (/^\w+([\.\+-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test(str));
+
+		// Practical implementation of RFC 5322
+		// https://www.regular-expressions.info/email.html
+		return (/^[a-z0-9!#$%&'*+/=?^_‘{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_‘{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(str));
 	};
 
 
 	/**
 	* Checks if a string is a valid or part of a valid Canadian postal code.

Vulnerable code: 		return (/^\w+([\.\+-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test(str));
Fixed code: 
		// Practical implementation of RFC 5322
		// https://www.regular-expressions.info/email.html
		return (/^[a-z0-9!#$%&'*+/=?^_‘{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_‘{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(str));
CVE-2024-32881: Insufficient Information (NVD-CWE-noinfo)
value: Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal Slack access. This issue was patched in version 3.63.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-26T21:15Z
Repository: https://github.com/danswer-ai/danswer
Language: Python
Files changed: backend/danswer/server/manage/slack_bot.py
Commit date: 2024-04-17 21:38:00 -0700
Commit message: Slack improvement

Diff: diff --git a/backend/danswer/server/manage/slack_bot.py b/backend/danswer/server/manage/slack_bot.py
index 2ea59a63..19003f09 100644
--- a/backend/danswer/server/manage/slack_bot.py
+++ b/backend/danswer/server/manage/slack_bot.py
@@ -190,15 +190,18 @@ def list_slack_bot_configs(
         for slack_bot_config_model in slack_bot_config_models
     ]
 
 
 @router.put("/admin/slack-bot/tokens")
-def put_tokens(tokens: SlackBotTokens) -> None:
+def put_tokens(
+    tokens: SlackBotTokens,
+    _: User | None = Depends(current_admin_user),
+) -> None:
     save_tokens(tokens=tokens)
 
 
 @router.get("/admin/slack-bot/tokens")
-def get_tokens() -> SlackBotTokens:
+def get_tokens(_: User | None = Depends(current_admin_user)) -> SlackBotTokens:
     try:
         return fetch_tokens()
     except ConfigNotFoundError:
         raise HTTPException(status_code=404, detail="No tokens found")

Vulnerable code: def put_tokens(tokens: SlackBotTokens) -> None:
def get_tokens() -> SlackBotTokens:
Fixed code: def put_tokens(
    tokens: SlackBotTokens,
    _: User | None = Depends(current_admin_user),
) -> None:
def get_tokens(_: User | None = Depends(current_admin_user)) -> SlackBotTokens:
CVE-2017-20182: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Mobile Vikings Django AJAX Utilities up to 1.2.1 and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The patch is named 329eb1dd1580ca1f9d4f95bc69939833226515c9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222611.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-10T02:15Z
Repository: https://github.com/mvpoland/django-ajax-utilities
Language: JavaScript
Files changed: django_ajax/static/ajax-utilities/js/pagination.js
Commit date: 2017-11-29 15:53:46 +0100
Commit message: Improve XSS protection

Modern browsers treat the backslash as normal slashes when used in the URLs. So instead of using the hash value "#page://google.com", we can use "#page:/\google.com" to bypasses the XSS protection
Diff: diff --git a/django_ajax/static/ajax-utilities/js/pagination.js b/django_ajax/static/ajax-utilities/js/pagination.js
index f26db5f..dbeb260 100644
--- a/django_ajax/static/ajax-utilities/js/pagination.js
+++ b/django_ajax/static/ajax-utilities/js/pagination.js
@@ -50,12 +50,13 @@ var Pagination = new function() {
             if (next.length)
                 next_url = next.attr('href');
 
             function ajax(url, handler) {
                 // URL should start with a slash, but cannot start with two slashes.
+		// we cannot start with "/\". Modern browsers handle backslashes as normal slashes.
                 // (Otherwise we have an XSS vulnerability.)
-                if (url[0] != '/' || url[1] == '/')
+                if (url[0] != '/' || url[1] == '/' || url.startsWith("/\\")
                     url = (''+location).replace( /[#\?].*/, '') + url;
 
                 // Append 'xhr' to make sure all content is loaded.
                 if (url.indexOf('&xhr') < 0 && url.indexOf('?xhr') < 0)
                     if (url.indexOf('?') < 0)

Vulnerable code:                 if (url[0] != '/' || url[1] == '/')
Fixed code: 		// we cannot start with "/\". Modern browsers handle backslashes as normal slashes.
                if (url[0] != '/' || url[1] == '/' || url.startsWith("/\\")
CVE-2020-5280: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2020-03-25T18:15Z
Repository: https://github.com/http4s/http4s
Language: Unknown
Commit date: 2020-03-24 21:47:23 -0400
Commit message: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix ghsa-66q9-f7ff-mmx6 for 0.20.x
CVE-2020-5280: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2020-03-25T18:15Z
Repository: https://github.com/http4s/http4s
Language: Unknown
Commit date: 2020-03-24 21:47:23 -0400
Commit message: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix ghsa-66q9-f7ff-mmx6 for 0.21.x
CVE-2020-5280: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expose resources outside of the configured location. This issue is patched in versions 0.18.26, 0.20.20, and 0.21.2. Note that 0.19.0 is a deprecated release and has never been supported.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2020-03-25T18:15Z
Repository: https://github.com/http4s/http4s
Language: Unknown
Commit date: 2020-03-24 21:47:23 -0400
Commit message: Merge pull request from GHSA-66q9-f7ff-mmx6

Fix GHSA-66q9-f7ff-mmx6
CVE-2021-21294: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. http4s provides a general "MaxActiveRequests" middleware mechanism for limiting open connections, but it is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. In 0.21.17, 0.22.0-M2, and 1.0.0-M14, a new "maxConnections" property, with a default value of 1024, has been added to the `BlazeServerBuilder`. Setting the value to a negative number restores unbounded behavior, but is strongly disrecommended. The NIO2 backend does not respect `maxConnections`. Its use is now deprecated in http4s-0.21, and the option is removed altogether starting in http4s-0.22. There are several possible workarounds described in the refrenced GitHub Advisory GHSA-xhv5-w9c5-2r2w.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2021-02-02T22:15Z
Repository: https://github.com/http4s/http4s
Language: Unknown
Commit date: 2021-02-02 10:51:01 -0500
Commit message: Merge pull request from GHSA-xhv5-w9c5-2r2w

Fix ghsa-xhv5-w9c5-2r2w for 1.0.x
CVE-2022-24803: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-04-01T00:15Z
Repository: https://github.com/jirutka/asciidoctor-include-ext
Language: Ruby
Files changed: lib/asciidoctor/include_ext/include_processor.rb
Commit date: 2022-03-30 00:52:06 +0200
Commit message: Make #read_lines code more robust, avoid using IO.open directly

Diff: diff --git a/lib/asciidoctor/include_ext/include_processor.rb b/lib/asciidoctor/include_ext/include_processor.rb
index 5bd52d0..c2723d0 100644
--- a/lib/asciidoctor/include_ext/include_processor.rb
+++ b/lib/asciidoctor/include_ext/include_processor.rb
@@ -111,14 +111,20 @@ module Asciidoctor::IncludeExt
     # @param selector [#to_proc, nil] predicate to filter lines that should be
     #   included in the output. It must accept two arguments: line and
     #   the line number. If `nil` is given, all lines are passed.
     # @return [Array<String>] an array of read lines.
     def read_lines(path, selector)
-      if selector
-        IO.foreach(path).select.with_index(1, &selector)
-      else
-        URI.open(path, &:read)
+      # IO.open is deliberately not used directly to avoid potential security risks.
+      # TODO: Get rid of 'open-uri' (URI.open).
+      io = target_http?(path) ? URI : File
+
+      io.open(path) do |f|
+        if selector
+          f.each.select.with_index(1, &selector)
+        else
+          f.read
+        end
       end
     end
 
     # Finds and initializes a lines selector that can handle the specified include.
     #

Vulnerable code:       if selector
        IO.foreach(path).select.with_index(1, &selector)
      else
        URI.open(path, &:read)
Fixed code:       # IO.open is deliberately not used directly to avoid potential security risks.
      # TODO: Get rid of 'open-uri' (URI.open).
      io = target_http?(path) ? URI : File

      io.open(path) do |f|
        if selector
          f.each.select.with_index(1, &selector)
        else
          f.read
        end