Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-25108: Improper Handling of Insufficient Permissions or Privileges  (CWE-280)
value: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
Published: 2024-02-12T20:15Z
Repository: https://github.com/pixelfed/pixelfed
Language: Unknown
Commit date: 2024-02-09 19:44:27 -0700
Commit message: Merge pull request from GHSA-gccq-h3xj-jgvf

[staging] Implement proper OAuth authorization on API endpoints
CVE-2024-25108: Improper Authorization (CWE-285)
value: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Published: 2024-02-12T20:15Z
Repository: https://github.com/pixelfed/pixelfed
Language: Unknown
Commit date: 2024-02-09 19:44:27 -0700
Commit message: Merge pull request from GHSA-gccq-h3xj-jgvf

[staging] Implement proper OAuth authorization on API endpoints
CVE-2024-25108: Incorrect Authorization (CWE-863)
value: Pixelfed is an open source photo sharing platform. When processing requests authorization was improperly and insufficiently checked, allowing attackers to access far more functionality than users intended, including to the administrative and moderator functionality of the Pixelfed server. This vulnerability affects every version of Pixelfed between v0.10.4 and v0.11.9, inclusive. A proof of concept of this vulnerability exists. This vulnerability affects every local user of a Pixelfed server, and can potentially affect the servers' ability to federate. Some user interaction is required to setup the conditions to be able to exercise the vulnerability, but the attacker could conduct this attack time-delayed manner, where user interaction is not actively required. This vulnerability has been addressed in version 0.11.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Published: 2024-02-12T20:15Z
Repository: https://github.com/pixelfed/pixelfed
Language: Unknown
Commit date: 2024-02-09 19:44:27 -0700
Commit message: Merge pull request from GHSA-gccq-h3xj-jgvf

[staging] Implement proper OAuth authorization on API endpoints
CVE-2017-0376: Reachable Assertion (CWE-617)
value: The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2017-06-09T17:29Z
Repository: https://github.com/torproject/tor
Language: Other
Files changed: changes/trove-2017-005, src/or/relay.c
Commit date: 2017-06-08 09:21:10 -0400
Commit message: TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell

On an hidden service rendezvous circuit, a BEGIN_DIR could be sent
(maliciously) which would trigger a tor_assert() because
connection_edge_process_relay_cell() thought that the circuit is an
or_circuit_t but is an origin circuit in reality.

Fixes #22494

Reported-by: Roger Dingledine <arma@torproject.org>
Signed-off-by: David Goulet <dgoulet@torproject.org>

Diff: diff --git a/changes/trove-2017-005 b/changes/trove-2017-005
new file mode 100644
index 0000000000..cebb013f86
--- /dev/null
+++ b/changes/trove-2017-005
@@ -0,0 +1,7 @@
+  o Major bugfixes (hidden service, relay, security):
+    - Fix an assertion failure caused by receiving a BEGIN_DIR cell on
+      a hidden service rendezvous circuit. Fixes bug 22494, tracked as
+      TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found
+      by armadev.
+
+
diff --git a/src/or/relay.c b/src/or/relay.c
index 7f06c6e145..59b79f95c9 100644
--- a/src/or/relay.c
+++ b/src/or/relay.c
@@ -1295,11 +1295,12 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
       if (conn) {
         log_fn(LOG_PROTOCOL_WARN, domain,
                "Begin cell for known stream. Dropping.");
         return 0;
       }
-      if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
+      if (rh.command == RELAY_COMMAND_BEGIN_DIR &&
+          circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
         /* Assign this circuit and its app-ward OR connection a unique ID,
          * so that we can measure download times. The local edge and dir
          * connection will be assigned the same ID when they are created
          * and linked. */
         static uint64_t next_id = 0;

Vulnerable code:       if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
Fixed code:   o Major bugfixes (hidden service, relay, security):
    - Fix an assertion failure caused by receiving a BEGIN_DIR cell on
      a hidden service rendezvous circuit. Fixes bug 22494, tracked as
      TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found
      by armadev.


      if (rh.command == RELAY_COMMAND_BEGIN_DIR &&
          circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) {
CVE-2008-5619: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2008-12-17T02:30Z
Repository: https://github.com/PHPMailer/PHPMailer
Language: Markdown
Files changed: README.md
Commit date: 2016-07-22 12:05:21 +0200
Commit message: Add security notices

Diff: diff --git a/README.md b/README.md
index 4eeecaf..6f45a78 100644
--- a/README.md
+++ b/README.md
@@ -137,10 +137,18 @@ There is a PHPUnit test script in the [test](https://github.com/PHPMailer/PHPMai
 
 Build status: [![Build Status](https://travis-ci.org/PHPMailer/PHPMailer.svg)](https://travis-ci.org/PHPMailer/PHPMailer)
 
 If this isn't passing, is there something you can do to help?
 
+## Security
+
+Please follow responsible disclosure - report any security problems found to the maintainers privately.
+
+PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=) an SMTP injection bug.
+
+PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file.
+
 ## Contributing
 
 Please submit bug reports, suggestions and pull requests to the [GitHub issue tracker](https://github.com/PHPMailer/PHPMailer/issues).
 
 We're particularly interested in fixing edge-cases, expanding test coverage and updating translations.

Fixed code: ## Security

Please follow responsible disclosure - report any security problems found to the maintainers privately.

PHPMailer versions prior to 5.2.14 (released November 2015) are vulnerable to [CVE-2015-8476](https://web.nvd.nist.gov/view/vuln/detail?vulnId=) an SMTP injection bug.

PHPMailer versions prior to 5.2.10 (released May 2015) are vulnerable to [CVE-2008-5619](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5619), a remote code execution vulnerability in the bundled html2text library. This file was removed in 5.2.10, so if you are using a version prior to that and make use of the html2text function, it's vitally important that you upgrade and remove this file.
CVE-2023-28430: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} – the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript’s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2023-03-27T22:15Z
Repository: https://github.com/OneSignal/react-native-onesignal
Language: Unknown
Commit date: 2023-03-10 14:24:06 -0800
Commit message: Merge pull request #1497 from OneSignal/zapier-fix

Update Zapier.yml
CVE-2023-28430: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: OneSignal is an email, sms, push notification, and in-app message service for mobile apps.The Zapier.yml workflow is triggered on issues (types: [closed]) (i.e., when an Issue is closed). The workflow starts with full write-permissions GitHub repository token since the default workflow permissions on Organization/Repository level are set to read-write. This workflow runs the following step with data controlled by the comment `(${{ github.event.issue.title }} – the full title of the Issue)`, allowing an attacker to take over the GitHub Runner and run custom commands, potentially stealing any secret (if used), or altering the repository. This issue was found with CodeQL using javascript’s Expression injection in Actions query. This issue has been addressed in the repositories github action. No actions are required by users. This issue is also tracked as `GHSL-2023-051`.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2023-03-27T22:15Z
Repository: https://github.com/OneSignal/react-native-onesignal
Language: Unknown
Commit date: 2023-01-04 14:04:11 -0800
Commit message: Merge pull request #1474 from OneSignal/actions/add_release_drafter

Adding the release drafter action
CVE-2024-26133: Insufficient Information (NVD-CWE-noinfo)
value: EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances that use custom projections are affected by this vulnerability. User passwords may become accessible to those who have access to the chunk files on disk, and users who have read access to system streams. Only users in the `$admins` group can access system streams by default. ESDB 23.10.1, 22.10.5, 21.10.11, and 20.10.6 contain a patch for this issue. Users should upgrade EventStoreDB, reset the passwords for current and previous members of `$admins` and `$ops` groups, and, if a password was reused in any other system, reset it in those systems to a unique password to follow best practices. If an upgrade cannot be done immediately, reset the passwords for current and previous members of `$admins` and `$ops` groups. Avoid creating custom projections until the patch has been applied.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-21T17:15Z
Repository: https://github.com/EventStore/EventStore
Language: Unknown
Commit date: 2024-02-21 16:00:19 +0000
Commit message: Merge pull request #4162 from EventStore/hayley-jean/update-changelog-cve

Update changelog for security release
CVE-2017-10807: Improper Authentication (CWE-287)
value: JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2017-07-04T15:29Z
Repository: https://github.com/jabberd2/jabberd2
Language: C
Files changed: c2s/main.c, sx/sasl.c
Commit date: 2017-07-01 17:23:52 +0200
Commit message: Fixed offered SASL mechanism check

Diff: diff --git a/c2s/main.c b/c2s/main.c
index 1efa365..7972c54 100644
--- a/c2s/main.c
+++ b/c2s/main.c
@@ -560,10 +560,12 @@ static int _c2s_sx_sasl_callback(int cb, void *arg, void **res, sx_t s, void *cb
 
             strncpy(mechbuf, mech, sizeof(mechbuf));
             mechbuf[sizeof(mechbuf)-1]='\0';
             for(i = 0; mechbuf[i]; i++) mechbuf[i] = tolower(mechbuf[i]);
 
+            log_debug(ZONE, "sx sasl callback: check mech (mech=%s)", mechbuf);
+
             /* get host for request */
             host = xhash_get(c2s->hosts, s->req_to);
             if(host == NULL) {
                 log_write(c2s->log, LOG_WARNING, "SASL callback for non-existing host: %s", s->req_to);
                 return sx_sasl_ret_FAIL;
diff --git a/sx/sasl.c b/sx/sasl.c
index 96d4408..d52f6af 100644
--- a/sx/sasl.c
+++ b/sx/sasl.c
@@ -330,11 +330,11 @@ static void _sx_sasl_client_process(sx_t s, sx_plugin_t p, Gsasl_session *sd, co
     assert(ctx->cb);
 
     if(mech != NULL) {
         _sx_debug(ZONE, "auth request from client (mechanism=%s)", mech);
 
-        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech)) {
+        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech) || (ctx->cb)(sx_sasl_cb_CHECK_MECH, (void*)mech, NULL, s, ctx->cbarg) != sx_sasl_ret_OK) {
              _sx_debug(ZONE, "client requested mechanism (%s) that we didn't offer", mech);
              _sx_nad_write(s, _sx_sasl_failure(s, _sasl_err_INVALID_MECHANISM, NULL), 0);
              return;
         }
 

Vulnerable code:         if(!gsasl_server_support_p(ctx->gsasl_ctx, mech)) {
Fixed code:             log_debug(ZONE, "sx sasl callback: check mech (mech=%s)", mechbuf);

        if(!gsasl_server_support_p(ctx->gsasl_ctx, mech) || (ctx->cb)(sx_sasl_cb_CHECK_MECH, (void*)mech, NULL, s, ctx->cbarg) != sx_sasl_ret_OK) {
CVE-2019-13127: Improper Input Validation (CWE-20)
value: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.1
Published: 2019-07-01T15:15Z
Repository: https://github.com/jgraph/mxgraph
Language: JavaScript
Files changed: javascript/examples/grapheditor/www/js/Dialogs.js
Commit date: 2019-06-12 10:51:21 +0100
Commit message: Added validation of input color codes
Diff: diff --git a/javascript/examples/grapheditor/www/js/Dialogs.js b/javascript/examples/grapheditor/www/js/Dialogs.js
index 2ac178a74..f168e69e9 100644
--- a/javascript/examples/grapheditor/www/js/Dialogs.js
+++ b/javascript/examples/grapheditor/www/js/Dialogs.js
@@ -202,18 +202,25 @@ var ColorDialog = function(editorUi, color, apply, cancelFn)
 	var applyFunction = (apply != null) ? apply : this.createApplyFunction();
 	
 	var applyBtn = mxUtils.button(mxResources.get('apply'), function()
 	{
 		var color = input.value;
-		ColorDialog.addRecentColor(color, 12);
+		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
+		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
 		
-		if (color != 'none' && color.charAt(0) != '#')
+		if (colorValid)
 		{
-			color = '#' + color;
+			ColorDialog.addRecentColor(color, 12);
+			
+			if (color != 'none' && color.charAt(0) != '#')
+			{
+				color = '#' + color;
+			}
+
+			applyFunction(color);			
 		}
 
-		applyFunction(color);
 		editorUi.hideDialog();
 	});
 	applyBtn.className = 'geBtn gePrimaryBtn';
 	buttons.appendChild(applyBtn);
 	

Vulnerable code: 		ColorDialog.addRecentColor(color, 12);
		if (color != 'none' && color.charAt(0) != '#')
			color = '#' + color;
		applyFunction(color);
Fixed code: 		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
		if (colorValid)
			ColorDialog.addRecentColor(color, 12);
			
			if (color != 'none' && color.charAt(0) != '#')
			{
				color = '#' + color;
			}

			applyFunction(color);
CVE-2019-13127: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input validation/sanitization of a color field leads to XSS. This is associated with javascript/examples/grapheditor/www/js/Dialogs.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-07-01T15:15Z
Repository: https://github.com/jgraph/mxgraph
Language: JavaScript
Files changed: javascript/examples/grapheditor/www/js/Dialogs.js
Commit date: 2019-06-12 10:51:21 +0100
Commit message: Added validation of input color codes
Diff: diff --git a/javascript/examples/grapheditor/www/js/Dialogs.js b/javascript/examples/grapheditor/www/js/Dialogs.js
index 2ac178a74..f168e69e9 100644
--- a/javascript/examples/grapheditor/www/js/Dialogs.js
+++ b/javascript/examples/grapheditor/www/js/Dialogs.js
@@ -202,18 +202,25 @@ var ColorDialog = function(editorUi, color, apply, cancelFn)
 	var applyFunction = (apply != null) ? apply : this.createApplyFunction();
 	
 	var applyBtn = mxUtils.button(mxResources.get('apply'), function()
 	{
 		var color = input.value;
-		ColorDialog.addRecentColor(color, 12);
+		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
+		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
 		
-		if (color != 'none' && color.charAt(0) != '#')
+		if (colorValid)
 		{
-			color = '#' + color;
+			ColorDialog.addRecentColor(color, 12);
+			
+			if (color != 'none' && color.charAt(0) != '#')
+			{
+				color = '#' + color;
+			}
+
+			applyFunction(color);			
 		}
 
-		applyFunction(color);
 		editorUi.hideDialog();
 	});
 	applyBtn.className = 'geBtn gePrimaryBtn';
 	buttons.appendChild(applyBtn);
 	

Vulnerable code: 		ColorDialog.addRecentColor(color, 12);
		if (color != 'none' && color.charAt(0) != '#')
			color = '#' + color;
		applyFunction(color);
Fixed code: 		// https://stackoverflow.com/questions/8027423/how-to-check-if-a-string-is-a-valid-hex-color-representation/8027444
		var colorValid  = /(^#?[0-9A-F]{6}$)|(^#[0-9A-F]{3}$)/i.test(color);
		if (colorValid)
			ColorDialog.addRecentColor(color, 12);
			
			if (color != 'none' && color.charAt(0) != '#')
			{
				color = '#' + color;
			}

			applyFunction(color);
CVE-2022-1544: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 7.8
Published: 2022-05-01T12:15Z
Repository: https://github.com/luyadev/yii-helpers
Language: Unknown
Commit date: 2022-04-21 14:44:04 +0200
Commit message: Merge pull request #7 from luyadev/csv-sanitizer

Csv sanitizer
CVE-2022-23079: Improper Encoding or Escaping of Output (CWE-116)
value: In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Published: 2022-06-22T13:15Z
Repository: https://github.com/motor-admin/motor-admin
Language: Ruby
Files changed: app/controllers/api/admin_users_controller.rb, app/controllers/application_controller.rb
Commit date: 2022-01-20 18:39:40 +0200
Commit message: do not use request host in for devise

Diff: diff --git a/app/controllers/api/admin_users_controller.rb b/app/controllers/api/admin_users_controller.rb
index fff3f70..1be027c 100644
--- a/app/controllers/api/admin_users_controller.rb
+++ b/app/controllers/api/admin_users_controller.rb
@@ -40,11 +40,11 @@ module Api
     def reset_password
       @admin_user = Motor::AdminUser.find(params[:admin_user_id])
 
       authorize!(:manage, @admin_user)
 
-      Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }
+      Devise::Mailer.default_url_options = { host: ENV['HOST'], protocol: request.protocol, port: request.port }
 
       @admin_user.send_reset_password_instructions
 
       head :ok
     end
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 40fe443..c725535 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -5,11 +5,11 @@ class ApplicationController < ActionController::Base
   before_action :maybe_redirect_from_setup
 
   before_action :authenticate_admin_user!, unless: :setup_path?
 
   before_action do
-    Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }
+    Devise::Mailer.default_url_options = { host: ENV['HOST'], protocol: request.protocol, port: request.port }
   end
 
   private
 
   def current_ability

Vulnerable code:       Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }
    Devise::Mailer.default_url_options = { host: request.host, protocol: request.protocol, port: request.port }
Fixed code:       Devise::Mailer.default_url_options = { host: ENV['HOST'], protocol: request.protocol, port: request.port }
    Devise::Mailer.default_url_options = { host: ENV['HOST'], protocol: request.protocol, port: request.port }
CVE-2020-28268: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.5
Published: 2020-11-15T23:15Z
Repository: https://github.com/hlfshell/controlled-merge
Language: Unknown
Commit date: 2020-10-29 19:31:43 -0700
Commit message: merge :Merge pull request #3 from hlfshell/fix/security_vuln

Fix: Security Vulnerability - check attr
CVE-2017-6837: Improper Input Validation (CWE-20)
value: WAVE.cpp in Audio File Library (aka audiofile) 0.3.6 allows remote attackers to cause a denial of service (crash) via vectors related to a large number of coefficients.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.5
Published: 2017-03-20T16:59Z
Repository: https://github.com/antlarr/audiofile
Language: C++
Files changed: libaudiofile/WAVE.cpp
Commit date: 2017-03-06 13:57:32 +0100
Commit message: Always check the number of coefficients

When building the library with NDEBUG, asserts are eliminated
so it's better to always check that the number of coefficients
is inside the array range.

This fixes the 00191-audiofile-indexoob issue in #41

Diff: diff --git a/libaudiofile/WAVE.cpp b/libaudiofile/WAVE.cpp
index 0e81cf7..61f9541 100644
--- a/libaudiofile/WAVE.cpp
+++ b/libaudiofile/WAVE.cpp
@@ -279,10 +279,16 @@ status WAVEFile::parseFormat(const Tag &id, uint32_t size)
 			readU16(&samplesPerBlock);
 			readU16(&numCoefficients);
 
 			/* numCoefficients should be at least 7. */
 			assert(numCoefficients >= 7 && numCoefficients <= 255);
+			if (numCoefficients < 7 || numCoefficients > 255)
+			{
+				_af_error(AF_BAD_HEADER,
+						"Bad number of coefficients");
+				return AF_FAIL;
+			}
 
 			m_msadpcmNumCoefficients = numCoefficients;
 
 			for (int i=0; i<m_msadpcmNumCoefficients; i++)
 			{

Fixed code: 			if (numCoefficients < 7 || numCoefficients > 255)
			{
				_af_error(AF_BAD_HEADER,
						"Bad number of coefficients");
				return AF_FAIL;
			}
CVE-2018-25071: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this issue. The patch is identified as c25ff7fe83a2cda1fcb365b182365adc3ffae332. It is recommended to upgrade the affected component. VDB-217610 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T12:15Z
Repository: https://github.com/roxlukas/lmeve
Language: PHP
Files changed: wwwroot/ccpwgl/proxy.php
Commit date: 2018-12-31 11:14:37 +0100
Commit message: Security update
fixed a possible SQL injection
Diff: diff --git a/wwwroot/ccpwgl/proxy.php b/wwwroot/ccpwgl/proxy.php
index bf70320..e11faf2 100644
--- a/wwwroot/ccpwgl/proxy.php
+++ b/wwwroot/ccpwgl/proxy.php
@@ -66,11 +66,11 @@ function insert_log($ip,$fetch,$ok,$ref,$cacheInUse,$url,$http_code,$size) {
         );");
     }
 }
 
 //get fetch var
-$addr=$_GET['fetch'];
+$addr = secureGETstr('fetch');
 
 //prepare logging vars
 if ($LM_CCPWGL_PROXYAUDIT) {
     $ip=$_SERVER['REMOTE_ADDR'];
     $ref = $_SERVER['HTTP_REFERER'];

Vulnerable code: $addr=$_GET['fetch'];
Fixed code: $addr = secureGETstr('fetch');
CVE-2023-30628: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,
the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-04-24T22:15Z
Repository: https://github.com/kiwitcms/enterprise
Language: YAML
Files changed: .github/workflows/changelog.yml
Commit date: 2023-04-24 18:17:26 +0300
Commit message: Pass untrusted input via intermediate ENV vars in CI jobs

Diff: diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index e2947a9..6bc5c47 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -14,15 +14,17 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
 
     - name: check-source-branch-and-modified-files
+      env:
+        HEAD_REF: ${{ github.head_ref }}
       run: |
-        echo "INFO: source branch is: ${{ github.head_ref }}"
+        echo "INFO: source branch is: $HEAD_REF"
 
         # if this PR modifies README.md or setup.py file it needs to come from a branch
         # that follows the pattern 'prepare/vX.Y' b/c we want to run some extra jobs for such branches!
-        if [[ ! "${{ github.head_ref }}" =~ ^prepare/v.+$ ]]; then
+        if [[ ! "$HEAD_REF" =~ ^prepare/v.+$ ]]; then
             echo "FAIL: Modifications to README.md or setup.py are only accepted from 'prepare/vX.Y' branches!"
             echo "INFO: Otherwise aarch64 jobs in Circle CI will not be executed."
             exit 1
         fi

Vulnerable code:         echo "INFO: source branch is: ${{ github.head_ref }}"
        if [[ ! "${{ github.head_ref }}" =~ ^prepare/v.+$ ]]; then
Fixed code:       env:
        HEAD_REF: ${{ github.head_ref }}
        echo "INFO: source branch is: $HEAD_REF"
        if [[ ! "$HEAD_REF" =~ ^prepare/v.+$ ]]; then
CVE-2020-26232: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 5.4
Published: 2020-11-24T21:15Z
Repository: https://github.com/jupyter-server/jupyter_server
Language: Unknown
Commit date: 2020-11-18 09:17:16 -0800
Commit message: Merge pull request from GHSA-grfj-wjv9-4f9v

[1.0.x] Fix GHSA-grfj-wjv9-4f9v
CVE-2020-26275: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/".
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2020-12-21T18:15Z
Repository: https://github.com/jupyter-server/jupyter_server
Language: Unknown
Commit date: 2020-12-16 14:03:59 -0800
Commit message: Merge pull request from GHSA-9f66-54xg-pc2c

sync _redirect_safe with upstream
CVE-2022-24757: Insertion of Sensitive Information into Log File (CWE-532)
value: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 7.5
Published: 2022-03-23T21:15Z
Repository: https://github.com/jupyter-server/jupyter_server
Language: Python
Files changed: jupyter_server/log.py
Commit date: 2022-03-15 10:34:29 -0500
Commit message: Merge pull request from GHSA-p737-p57g-4cpr


Diff: diff --git a/jupyter_server/log.py b/jupyter_server/log.py
index 3fd63c70d..0f21185b3 100644
--- a/jupyter_server/log.py
+++ b/jupyter_server/log.py
@@ -48,9 +48,13 @@ def log_request(handler):
     if status >= 400:
         # log bad referers
         ns["referer"] = request.headers.get("Referer", "None")
         msg = msg + " referer={referer}"
     if status >= 500 and status != 502:
-        # log all headers if it caused an error
-        log_method(json.dumps(dict(request.headers), indent=2))
+        # Log a subset of the headers if it caused an error.
+        headers = {}
+        for header in ['Host', 'Accept', 'Referer', 'User-Agent']:
+            if header in request.headers:
+                headers[header] = request.headers[header]
+        log_method(json.dumps(headers, indent=2))
     log_method(msg.format(**ns))
     prometheus_log_method(handler)

Vulnerable code:         # log all headers if it caused an error
        log_method(json.dumps(dict(request.headers), indent=2))
Fixed code:         # Log a subset of the headers if it caused an error.
        headers = {}
        for header in ['Host', 'Accept', 'Referer', 'User-Agent']:
            if header in request.headers:
                headers[header] = request.headers[header]
        log_method(json.dumps(headers, indent=2))
CVE-2023-40170: Improper Access Control (CWE-284)
value: jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 6.1
Published: 2023-08-28T21:15Z
Repository: https://github.com/jupyter-server/jupyter_server
Language: Python
Files changed: jupyter_server/base/handlers.py
Commit date: 2023-08-17 20:27:05 -0700
Commit message: Merge pull request from GHSA-64x5-55rw-9974

lost in forward-port PR 478

Co-authored-by: Zachary Sailer <zsailer@apple.com>
Diff: diff --git a/jupyter_server/base/handlers.py b/jupyter_server/base/handlers.py
index dfeb73ea82..d77a787aaf 100644
--- a/jupyter_server/base/handlers.py
+++ b/jupyter_server/base/handlers.py
@@ -853,10 +853,11 @@ class AuthenticatedFileHandler(JupyterHandler, web.StaticFileHandler):
 
     @web.authenticated
     @authorized
     def get(self, path, **kwargs):
         """Get a file by path."""
+        self.check_xsrf_cookie()
         if os.path.splitext(path)[1] == ".ipynb" or self.get_argument("download", None):
             name = path.rsplit("/", 1)[-1]
             self.set_attachment_header(name)
 
         return web.StaticFileHandler.get(self, path, **kwargs)

Fixed code:         self.check_xsrf_cookie()
CVE-2023-40170: Missing Authentication for Critical Function (CWE-306)
value: jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via  "Open image in new tab". This issue has been addressed in commit `87a49272728` which has been included in release `2.7.2`. Users are advised to upgrade. Users unable to upgrade may use the lower performance `--ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler`, which implements the correct checks.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 6.1
Published: 2023-08-28T21:15Z
Repository: https://github.com/jupyter-server/jupyter_server
Language: Python
Files changed: jupyter_server/base/handlers.py
Commit date: 2023-08-17 20:27:05 -0700
Commit message: Merge pull request from GHSA-64x5-55rw-9974

lost in forward-port PR 478

Co-authored-by: Zachary Sailer <zsailer@apple.com>
Diff: diff --git a/jupyter_server/base/handlers.py b/jupyter_server/base/handlers.py
index dfeb73ea82..d77a787aaf 100644
--- a/jupyter_server/base/handlers.py
+++ b/jupyter_server/base/handlers.py
@@ -853,10 +853,11 @@ class AuthenticatedFileHandler(JupyterHandler, web.StaticFileHandler):
 
     @web.authenticated
     @authorized
     def get(self, path, **kwargs):
         """Get a file by path."""
+        self.check_xsrf_cookie()
         if os.path.splitext(path)[1] == ".ipynb" or self.get_argument("download", None):
             name = path.rsplit("/", 1)[-1]
             self.set_attachment_header(name)
 
         return web.StaticFileHandler.get(self, path, **kwargs)

Fixed code:         self.check_xsrf_cookie()
CVE-2020-19626: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31, allows remote attackers to inject arbitrary web script or HTML, via /admin/settings/sites/new.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-03-26T15:15Z
Repository: https://github.com/craftcms/cms
Language: Markdown
Files changed: CHANGELOG-v3.md, src/templates/settings/sections/_edit.html
Commit date: 2019-06-27 09:41:17 -0700
Commit message: Fixed an XSS vulnerability.

Diff: diff --git a/CHANGELOG-v3.md b/CHANGELOG-v3.md
index 56d5fb19e7..78aaaafc86 100644
--- a/CHANGELOG-v3.md
+++ b/CHANGELOG-v3.md
@@ -1,7 +1,12 @@
 # Release Notes for Craft CMS 3.x
 
+## Unreleased
+
+### Security
+- Fixed an XSS vulnerability.
+
 ## 3.1.32.1 - 2019-06-25
 
 ### Fixed
 - Fixed a couple Windows compatibility issues.
 
diff --git a/src/templates/settings/sections/_edit.html b/src/templates/settings/sections/_edit.html
index e7f0c12c4e..e28fdb1ec3 100644
--- a/src/templates/settings/sections/_edit.html
+++ b/src/templates/settings/sections/_edit.html
@@ -66,11 +66,11 @@
                 {% set siteErrors = siteErrors|merge(errors) %}
             {% endfor %}
         {% endif %}
         {% set siteRows = siteRows|merge({
             (site.handle): {
-                heading: site.name|t('site'),
+                heading: site.name|t('site')|e,
                 enabled: include('_includes/forms/lightswitch', {
                     name: 'sites['~site.handle~'][enabled]',
                     on: brandNewSection or siteSettings,
                     value: site.id,
                     small: true

Vulnerable code:                 heading: site.name|t('site'),
Fixed code: ## Unreleased

### Security
- Fixed an XSS vulnerability.

                heading: site.name|t('site')|e,
CVE-2022-37250: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-16T15:15Z
Repository: https://github.com/craftcms/cms
Language: PHP
Files changed: src/helpers/Cp.php
Commit date: 2022-07-29 15:48:30 -0700
Commit message: Another XSS

Diff: diff --git a/src/helpers/Cp.php b/src/helpers/Cp.php
index d3722fa1940..acadf3ddb2b 100644
--- a/src/helpers/Cp.php
+++ b/src/helpers/Cp.php
@@ -1167,11 +1167,10 @@ JS, [
     {
         $config += [
             'name' => null,
         ];
 
-        $label = $address->title;
         $canDelete = $address->canDelete(Craft::$app->getUser()->getIdentity());
         $actionMenuId = sprintf('address-card-action-menu-%s', mt_rand());
 
         return
             Html::beginTag('li', [
@@ -1181,14 +1180,14 @@ JS, [
                     'draftId' => $address->draftId,
                 ],
             ]) .
             ($config['name'] ? Html::hiddenInput("{$config['name']}[]", (string)$address->id) : '') .
             Html::beginTag('div', ['class' => 'address-card-header']) .
-            Html::tag('h2', $address->title, [
+            Html::tag('h2', Html::encode($address->title), [
                 'class' => array_filter([
                     'address-card-label',
-                    !$label ? 'hidden' : null,
+                    !$address->title ? 'hidden' : null,
                 ]),
             ]) .
             ($canDelete
                 ? Html::beginTag('div', [
                     'class' => 'address-card-header-actions',
@@ -1199,11 +1198,11 @@ JS, [
                 Html::button('', [
                     'class' => ['btn', 'menubtn'],
                     'title' => Craft::t('app', 'Actions'),
                     'aria' => [
                         'controls' => $actionMenuId,
-                        'label' => sprintf('%s %s', $label ?? Craft::t('app', 'New Address'), Craft::t('app', 'Settings')),
+                        'label' => sprintf('%s %s', $address->title ? Html::encode($address->title) : Craft::t('app', 'New Address'), Craft::t('app', 'Settings')),
                     ],
                     'data' => [
                         'icon' => 'settings',
                         'disclosure-trigger' => true,
                     ],

Vulnerable code:         $label = $address->title;
            Html::tag('h2', $address->title, [
                    !$label ? 'hidden' : null,
                        'label' => sprintf('%s %s', $label ?? Craft::t('app', 'New Address'), Craft::t('app', 'Settings')),
Fixed code:             Html::tag('h2', Html::encode($address->title), [
                    !$address->title ? 'hidden' : null,
                        'label' => sprintf('%s %s', $address->title ? Html::encode($address->title) : Craft::t('app', 'New Address'), Craft::t('app', 'Settings')),