Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-4732: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2022-12-27T15:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/other.php, src/MicroweberPackages/App/functions/plupload.php
Commit date: 2022-12-05 10:46:54 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/functions/other.php b/src/MicroweberPackages/App/functions/other.php
index 4f6137bbfb6..39ff9f86ce4 100644
--- a/src/MicroweberPackages/App/functions/other.php
+++ b/src/MicroweberPackages/App/functions/other.php
@@ -1209,5 +1209,19 @@ if (!function_exists('mergeScreenshotParts')) {
         }
 
         imagepng($targetImage, $outputFilename, 8);
     }
 }
+if (!function_exists('sanitize_path')) {
+
+    function sanitize_path($path)
+    {
+        $path = str_replace('..', '', $path);
+        $path = str_replace('./', '', $path);
+        $path = str_replace('.\\', '', $path);
+        $path = str_replace(';', '', $path);
+        $path = str_replace('&&', '', $path);
+        $path = str_replace('|', '', $path);
+        $path = str_replace('>', '', $path);
+        return $path;
+    }
+}
diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index 5890b2ae9ff..751eede78b6 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -283,12 +283,11 @@ if (isset($_REQUEST['path']) and trim($_REQUEST['path']) != '' and trim($_REQUES
     //$path = urldecode($path);
     $path = str_replace('%2F', '/', $path);
     //$path = str_replace('%25252F','/',$path);
 
     $path = normalize_path($path, 0);
-
-    $path = str_replace('..', '', $path);
+    $path = sanitize_path($path);
     $path = str_replace($path_restirct, '', $path);
 
     // $target_path = userfiles_path() . DS . $path;
     $target_path = media_uploads_path() . DS . $path;
     $target_path = normalize_path($target_path, 1);

Vulnerable code: 
    $path = str_replace('..', '', $path);
Fixed code: if (!function_exists('sanitize_path')) {

    function sanitize_path($path)
    {
        $path = str_replace('..', '', $path);
        $path = str_replace('./', '', $path);
        $path = str_replace('.\\', '', $path);
        $path = str_replace(';', '', $path);
        $path = str_replace('&&', '', $path);
        $path = str_replace('|', '', $path);
        $path = str_replace('>', '', $path);
        return $path;
    }
}
    $path = sanitize_path($path);
CVE-2023-1081: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-02-28T02:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Helper/XSSClean.php
Commit date: 2023-01-31 18:46:27 +0200
Commit message: fix of #990

Diff: diff --git a/src/MicroweberPackages/Helper/XSSClean.php b/src/MicroweberPackages/Helper/XSSClean.php
index 6cac2b9ebff..59bd9ed6162 100644
--- a/src/MicroweberPackages/Helper/XSSClean.php
+++ b/src/MicroweberPackages/Helper/XSSClean.php
@@ -118,10 +118,11 @@ class XSSClean
             'ontransitionstart',
             'onafterprint',
             'onauxclick',
             'onbeforecopy',
             'onbeforecut',
+            'onbeforeinput',
             'onblur',
             'onchange',
             'onclick',
             'onclose',
             'oncontextmenu',

Fixed code:             'onbeforeinput',
CVE-2023-1877: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-04-05T17:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/Http/Middleware/XSS.php
Commit date: 2023-02-24 11:27:43 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/Http/Middleware/XSS.php b/src/MicroweberPackages/App/Http/Middleware/XSS.php
index 5e484618b2c..438045334cf 100644
--- a/src/MicroweberPackages/App/Http/Middleware/XSS.php
+++ b/src/MicroweberPackages/App/Http/Middleware/XSS.php
@@ -16,10 +16,12 @@ class XSS
         if (($request->isMethod('post')  or $request->isMethod('patch') or $request->isMethod('put') ) and !empty($input)) {
             $clean = new HTMLClean();
             array_walk_recursive($input, function (&$input) use ($clean) {
                 if (is_string($input)) {
                     $input = $clean->clean($input);
+                    // clean also blade curly braces
+                    $input = str_replace(['{{', '}}'], ['&#123;&#123;', '&#125;&#125;'], $input);
                 }
             });
         }
 
         $request->merge($input);

Fixed code:                     // clean also blade curly braces
                    $input = str_replace(['{{', '}}'], ['&#123;&#123;', '&#125;&#125;'], $input);
CVE-2023-2014: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-04-13T02:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/settings/group/template.php
Commit date: 2023-03-13 11:27:54 +0200
Commit message: update

Diff: diff --git a/userfiles/modules/settings/group/template.php b/userfiles/modules/settings/group/template.php
index 2edfa9e001f..391b5df92a3 100644
--- a/userfiles/modules/settings/group/template.php
+++ b/userfiles/modules/settings/group/template.php
@@ -56,11 +56,11 @@
     $selected_template =  $data['option_value'];
 
     $change_template = false;
     if(isset($_GET['template'])){
         $change_template = true;
-        $selected_template = $_GET['template'];
+        $selected_template = e($_GET['template']);
     }
     $selected_template = xss_clean($selected_template);
     ?>
 <?php if($change_template){ ?>
     <div class="alert alert-dismissible alert-primary">

Vulnerable code:         $selected_template = $_GET['template'];
Fixed code:         $selected_template = e($_GET['template']);
CVE-2023-2239: Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
value: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
CWE description: The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CVSS v3 base score: 6.5
Published: 2023-04-22T17:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/Models/User.php
Commit date: 2023-03-22 11:46:51 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/User/Models/User.php b/src/MicroweberPackages/User/Models/User.php
index 19a066a7f3c..606e7ea59c9 100644
--- a/src/MicroweberPackages/User/Models/User.php
+++ b/src/MicroweberPackages/User/Models/User.php
@@ -62,10 +62,16 @@ class User extends Authenticatable implements MustVerifyEmail
         'api_key',
         'remember_token',
         'oauth_token',
         'oauth_token_secret',
         'password_reset_hash',
+        'two_factor_recovery_codes',
+        'two_factor_secret',
+        'subscr_id',
+        'oauth_uid',
+        'oauth_provider',
+        'last_login_ip',
         'password',
         'is_admin',
     ];
 
     //protected $hidden = array('password', 'remember_token');

Fixed code:         'two_factor_recovery_codes',
        'two_factor_secret',
        'subscr_id',
        'oauth_uid',
        'oauth_provider',
        'last_login_ip',
CVE-2023-2240: Improper Privilege Management (CWE-269)
value: Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2023-04-22T01:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/routes/api.php
Commit date: 2023-03-22 11:46:55 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/User/routes/api.php b/src/MicroweberPackages/User/routes/api.php
index 0baae9df145..35e9c65acdb 100644
--- a/src/MicroweberPackages/User/routes/api.php
+++ b/src/MicroweberPackages/User/routes/api.php
@@ -130,7 +130,7 @@ Route::name('api.')
             ])
             ->excludedMiddleware(
            'api'
         );;
 
-        Route::apiResource('user', 'UserApiController');
+        Route::apiResource('user', 'UserApiController')->middleware(['admin']);
     });

Vulnerable code:         Route::apiResource('user', 'UserApiController');
Fixed code:         Route::apiResource('user', 'UserApiController')->middleware(['admin']);
CVE-2023-47379: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-11-08T17:15Z
Repository: https://github.com/microweber/microweber
Language: Unknown
Commit date: 2023-10-30 15:51:28 +0200
Commit message: Merge branch 'dev' of github.com:microweber/microweber into dev
CVE-2016-10128: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-03-24T15:59Z
Repository: https://github.com/libgit2/libgit2
Language: C
Files changed: src/transports/smart_pkt.c
Commit date: 2017-01-06 17:11:44 +0000
Commit message: smart_pkt: verify packet length exceeds PKT_LEN_SIZE

Each packet line in the Git protocol is prefixed by a four-byte
length of how much data will follow, which we parse in
`git_pkt_parse_line`. The transmitted length can either be equal
to zero in case of a flush packet or has to be at least of length
four, as it also includes the encoded length itself. Not
checking this may result in a buffer overflow as we directly pass
the length to functions which accept a `size_t` length as
parameter.

Fix the issue by verifying that non-flush packets have at least a
length of `PKT_LEN_SIZE`.

Diff: diff --git a/src/transports/smart_pkt.c b/src/transports/smart_pkt.c
index 2297cc94f..6fe53b931 100644
--- a/src/transports/smart_pkt.c
+++ b/src/transports/smart_pkt.c
@@ -425,10 +425,18 @@ int git_pkt_parse_line(
 	 * enough in the buffer to satisfy this line
 	 */
 	if (bufflen > 0 && bufflen < (size_t)len)
 		return GIT_EBUFS;
 
+	/*
+	 * The length has to be exactly 0 in case of a flush
+	 * packet or greater than PKT_LEN_SIZE, as the decoded
+	 * length includes its own encoded length of four bytes.
+	 */
+	if (len != 0 && len < PKT_LEN_SIZE)
+		return GIT_ERROR;
+
 	line += PKT_LEN_SIZE;
 	/*
 	 * TODO: How do we deal with empty lines? Try again? with the next
 	 * line?
 	 */

Fixed code: 	/*
	 * The length has to be exactly 0 in case of a flush
	 * packet or greater than PKT_LEN_SIZE, as the decoded
	 * length includes its own encoded length of four bytes.
	 */
	if (len != 0 && len < PKT_LEN_SIZE)
		return GIT_ERROR;
CVE-2016-10130: Improper Access Control (CWE-284)
value: The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.9
Published: 2017-03-24T15:59Z
Repository: https://github.com/libgit2/libgit2
Language: C
Files changed: src/transports/http.c
Commit date: 2017-01-06 17:09:39 +0000
Commit message: http: check certificate validity before clobbering the error variable
Diff: diff --git a/src/transports/http.c b/src/transports/http.c
index ad28c5889..155fd7b30 100644
--- a/src/transports/http.c
+++ b/src/transports/http.c
@@ -622,17 +622,16 @@ static int http_connect(http_subtransport *t)
 	error = git_stream_connect(t->io);
 
 	if ((!error || error == GIT_ECERTIFICATE) && t->owner->certificate_check_cb != NULL &&
 	    git_stream_is_encrypted(t->io)) {
 		git_cert *cert;
-		int is_valid;
+		int is_valid = (error == GIT_OK);
 
 		if ((error = git_stream_certificate(&cert, t->io)) < 0)
 			return error;
 
 		giterr_clear();
-		is_valid = error != GIT_ECERTIFICATE;
 		error = t->owner->certificate_check_cb(cert, is_valid, t->connection_data.host, t->owner->message_cb_payload);
 
 		if (error < 0) {
 			if (!giterr_last())
 				giterr_set(GITERR_NET, "user cancelled certificate check");

Vulnerable code: 		int is_valid;
		is_valid = error != GIT_ECERTIFICATE;
Fixed code: 		int is_valid = (error == GIT_OK);
CVE-2018-8098: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2018-03-14T00:29Z
Repository: https://github.com/libgit2/libgit2
Language: C
Files changed: src/index.c
Commit date: 2018-03-10 10:24:18 +0000
Commit message: index: error out on unreasonable prefix-compressed path lengths

When computing the complete path length from the encoded
prefix-compressed path, we end up just allocating the complete path
without ever checking what the encoded path length actually is. This can
easily lead to a denial of service by just encoding an unreasonable long
path name inside of the index. Git already enforces a maximum path
length of 4096 bytes. As we also have that enforcement ready in some
places, just make sure that the resulting path is smaller than
GIT_PATH_MAX.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reported-by: Vivek Parikh <viv0411.parikh@gmail.com>

Diff: diff --git a/src/index.c b/src/index.c
index 20586f52c..a867547fb 100644
--- a/src/index.c
+++ b/src/index.c
@@ -2377,10 +2377,14 @@ static int read_entry(
 		prefix_len = last_len - strip_len;
 		suffix_len = strlen(path_ptr + varint_len);
 
 		GITERR_CHECK_ALLOC_ADD(&path_len, prefix_len, suffix_len);
 		GITERR_CHECK_ALLOC_ADD(&path_len, path_len, 1);
+
+		if (path_len > GIT_PATH_MAX)
+			return index_error_invalid("unreasonable path length");
+
 		tmp_path = git__malloc(path_len);
 		GITERR_CHECK_ALLOC(tmp_path);
 
 		memcpy(tmp_path, last, prefix_len);
 		memcpy(tmp_path + prefix_len, path_ptr + varint_len, suffix_len + 1);

Fixed code: 
		if (path_len > GIT_PATH_MAX)
			return index_error_invalid("unreasonable path length");
CVE-2020-12278: Use of Incorrectly-Resolved Name or Reference (CWE-706)
value: An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
CWE description: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 9.8
Published: 2020-04-27T17:15Z
Repository: https://github.com/libgit2/libgit2
Language: C
Files changed: src/path.c, tests/path/dotgit.c
Commit date: 2019-12-10 18:01:06 +1000
Commit message: path: also guard `.gitmodules` against NTFS Alternate Data Streams

We just safe-guarded `.git` against NTFS Alternate Data Stream-related
attack vectors, and now it is time to do the same for `.gitmodules`.

Note: In the added regression test, we refrain from verifying all kinds
of variations between short names and NTFS Alternate Data Streams: as
the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it
is enough to test one in order to know that all of them are guarded
against.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Diff: diff --git a/src/path.c b/src/path.c
index 7844da6722..b3a8fc32f8 100644
--- a/src/path.c
+++ b/src/path.c
@@ -1644,11 +1644,11 @@ GIT_INLINE(bool) verify_dotgit_ntfs(git_repository *repo, const char *path, size
 GIT_INLINE(bool) only_spaces_and_dots(const char *path)
 {
 	const char *c = path;
 
 	for (;; c++) {
-		if (*c == '\0')
+		if (*c == '\0' || *c == ':')
 			return true;
 		if (*c != ' ' && *c != '.')
 			return false;
 	}
 
diff --git a/tests/path/dotgit.c b/tests/path/dotgit.c
index 3099669451..ceb7330d24 100644
--- a/tests/path/dotgit.c
+++ b/tests/path/dotgit.c
@@ -114,6 +114,7 @@ void test_path_dotgit__dotgit_modules(void)
 void test_path_dotgit__dotgit_modules_symlink(void)
 {
 	cl_assert_equal_b(true, git_path_isvalid(NULL, ".gitmodules", 0, GIT_PATH_REJECT_DOT_GIT_HFS|GIT_PATH_REJECT_DOT_GIT_NTFS));
 	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_HFS));
 	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS));
+	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules . .::$DATA", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS));
 }

Vulnerable code: 		if (*c == '\0')
Fixed code: 		if (*c == '\0' || *c == ':')
	cl_assert_equal_b(false, git_path_isvalid(NULL, ".gitmodules . .::$DATA", S_IFLNK, GIT_PATH_REJECT_DOT_GIT_NTFS));
CVE-2024-24575: Uncontrolled Resource Consumption (CWE-400)
value: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2024-02-06T22:16Z
Repository: https://github.com/libgit2/libgit2
Language: C
Files changed: src/revparse.c, tests/refs/revparse.c
Commit date: 2022-01-30 22:25:59 -0500
Commit message: revparse: support bare '@'

A bare '@' revision syntax represents HEAD.  Support it as such.

Diff: diff --git a/src/revparse.c b/src/revparse.c
index 5d3ff77ed9..9bc28e9fcc 100644
--- a/src/revparse.c
+++ b/src/revparse.c
@@ -797,10 +797,13 @@ static int revparse(
 					goto cleanup;
 
 				if (temp_object != NULL)
 					base_rev = temp_object;
 				break;
+			} else if (spec[pos+1] == '\0') {
+				spec = "HEAD";
+				break;
 			}
 			/* fall through */
 
 		default:
 			if ((error = ensure_left_hand_identifier_is_not_known_yet(base_rev, reference)) < 0)
diff --git a/tests/refs/revparse.c b/tests/refs/revparse.c
index 5fb7585047..0bd2ae5bc2 100644
--- a/tests/refs/revparse.c
+++ b/tests/refs/revparse.c
@@ -879,5 +879,12 @@ void test_refs_revparse__uneven_sizes(void)
 				"a65fedf39aefe402d3bb6e24df4d4f5fe4547750");
 
 	test_object("a65fedf39aefe402d3bb6e24df4d",
 				"a65fedf39aefe402d3bb6e24df4d4f5fe4547750");
 }
+
+void test_refs_revparse__parses_at_head(void)
+{
+	test_id("HEAD", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750", NULL, GIT_REVSPEC_SINGLE);
+	test_id("@{0}", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750", NULL, GIT_REVSPEC_SINGLE);
+	test_id("@", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750", NULL, GIT_REVSPEC_SINGLE);
+}

Fixed code: 			} else if (spec[pos+1] == '\0') {
				spec = "HEAD";
				break;

void test_refs_revparse__parses_at_head(void)
{
	test_id("HEAD", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750", NULL, GIT_REVSPEC_SINGLE);
	test_id("@{0}", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750", NULL, GIT_REVSPEC_SINGLE);
	test_id("@", "a65fedf39aefe402d3bb6e24df4d4f5fe4547750", NULL, GIT_REVSPEC_SINGLE);
}
CVE-2019-25092: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function print_user_ip_log of the file include/layout/user.inc.php of the component Admin Panel. The manipulation of the argument $entry['ip'] leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.2.0 is able to address this issue. The name of the patch is e0b6965f8dde608a3d2621617c05695eb406cbb9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216955.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-12-28T09:15Z
Repository: https://github.com/Nakiami/mellivora
Language: PHP
Files changed: include/layout/user.inc.php
Commit date: 2019-11-21 21:00:05 +1100
Commit message: fix hostname lookup xss in admin panel reported in issue 123 by Sin42

Diff: diff --git a/include/layout/user.inc.php b/include/layout/user.inc.php
index 0bff9ca..66efb3d 100644
--- a/include/layout/user.inc.php
+++ b/include/layout/user.inc.php
@@ -298,11 +298,11 @@ function print_user_ip_log($user_id, $limit = 0) {
 
     foreach($entries as $entry) {
         echo '
         <tr>
             <td><a href="',Config::get('MELLIVORA_CONFIG_SITE_ADMIN_URL'),'list_ip_log.php?ip=',htmlspecialchars($entry['ip']),'">',htmlspecialchars($entry['ip']),'</a></td>
-            <td>',(Config::get('MELLIVORA_CONFIG_GET_IP_HOST_BY_ADDRESS') ? gethostbyaddr($entry['ip']) : '<i>Lookup disabled in config</i>'),'</td>
+            <td>',(Config::get('MELLIVORA_CONFIG_GET_IP_HOST_BY_ADDRESS') ? htmlspecialchars(gethostbyaddr($entry['ip'])) : '<i>Lookup disabled in config</i>'),'</td>
             <td>',date_time($entry['added']),'</td>
             <td>',date_time($entry['last_used']),'</td>
             <td>',number_format($entry['times_used']),'</td>
         </tr>
         ';

Vulnerable code:             <td>',(Config::get('MELLIVORA_CONFIG_GET_IP_HOST_BY_ADDRESS') ? gethostbyaddr($entry['ip']) : '<i>Lookup disabled in config</i>'),'</td>
Fixed code:             <td>',(Config::get('MELLIVORA_CONFIG_GET_IP_HOST_BY_ADDRESS') ? htmlspecialchars(gethostbyaddr($entry['ip'])) : '<i>Lookup disabled in config</i>'),'</td>
CVE-2020-15257: Incorrect Resource Transfer Between Spheres (CWE-669)
value: containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.
CWE description: The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
CVSS v3 base score: 5.2
Published: 2020-12-01T03:15Z
Repository: https://github.com/containerd/containerd
Language: Unknown
Commit date: 2020-11-30 10:32:18 -0800
Commit message: Merge pull request from GHSA-36xw-fx78-c5r4

Use path based unix socket for shims
CVE-2022-31030: Uncontrolled Resource Consumption (CWE-400)
value: containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2022-06-09T14:15Z
Repository: https://github.com/containerd/containerd
Language: Unknown
Commit date: 2022-06-06 10:19:23 -0700
Commit message: Merge pull request from GHSA-5ffw-gxpp-mxpf

Limit the response size of ExecSync
CVE-2018-1002204: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2018-07-25T17:29Z
Repository: https://github.com/cthackers/adm-zip
Language: Unknown
Commit date: 2018-04-23 10:20:56 +0300
Commit message: Merge pull request #212 from aviadatsnyk/master

fix: prevent extracting archived files outside of target path.  Credit to Snyk Security Research Team for disclosure and fixing the issue.
CVE-2022-21710: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:&lt;img src=x onerror=alert()&gt;}}`. This issue has a patch in version 2.3.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-24T20:15Z
Repository: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription
Language: JSON
Files changed: extension.json
Commit date: 2022-01-21 15:48:19 -0800
Commit message: build: bump version to 2.3.4
Diff: diff --git a/extension.json b/extension.json
index f108a4e..ec3ced7 100644
--- a/extension.json
+++ b/extension.json
@@ -1,9 +1,9 @@
 {
 	"name": "ShortDescription",
 	"license-name": "GPL-3.0-or-later",
-	"version": "2.3.3",
+	"version": "2.3.4",
 	"url": "https://www.mediawiki.org/wiki/Extension:ShortDescription",
 	"author": [
 		"alistair3149"
 	],
 	"namemsg": "shortdescription",

Vulnerable code: 	"version": "2.3.3",
Fixed code: 	"version": "2.3.4",
CVE-2022-21710: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:&lt;img src=x onerror=alert()&gt;}}`. This issue has a patch in version 2.3.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-24T20:15Z
Repository: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription
Language: PHP
Files changed: includes/Hooks/ActionsHooks.php, modules/ext.shortDescription.js
Commit date: 2022-01-21 00:38:57 -0800
Commit message: fix: unsanitized shortdesc property

Diff: diff --git a/includes/Hooks/ActionsHooks.php b/includes/Hooks/ActionsHooks.php
index 053b75d..9109e46 100644
--- a/includes/Hooks/ActionsHooks.php
+++ b/includes/Hooks/ActionsHooks.php
@@ -30,9 +30,9 @@ class ActionsHooks implements InfoActionHook {
 			return;
 		}
 
 		$pageInfo['header-basic'][] = [
 			$context->msg( 'shortdescription-info-label' ),
-			$shortdesc
+			htmlspecialchars( $shortdesc )
 		];
 	}
 }
diff --git a/modules/ext.shortDescription.js b/modules/ext.shortDescription.js
index f6e1d33..6cc87c7 100644
--- a/modules/ext.shortDescription.js
+++ b/modules/ext.shortDescription.js
@@ -5,10 +5,10 @@ function main() {
 	if ( shortdesc ) {
 		tagline = document.getElementById( 'siteSub' );
 		// Wikipedia uses shortdescription class
 		// Added for gadgets and extension compatibility
 		tagline.classList.add( 'ext-shortdesc', 'shortdescription' );
-		tagline.innerHTML = shortdesc;
+		tagline.innerHTML = mw.html.escape( shortdesc );
 	}
 }
 
 main();

Vulnerable code: 			$shortdesc
		tagline.innerHTML = shortdesc;
Fixed code: 			htmlspecialchars( $shortdesc )
		tagline.innerHTML = mw.html.escape( shortdesc );
CVE-2021-41134: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-11-03T18:15Z
Repository: https://github.com/jupyter/nbdime
Language: Unknown
Commit date: 2021-10-25 23:51:55 +0100
Commit message: Merge pull request from GHSA-p6rw-44q7-3fw4

Safer handling of user strings
CVE-2024-24811: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2024-02-07T15:15Z
Repository: https://github.com/zopefoundation/Products.SQLAlchemyDA
Language: Unknown
Commit date: 2024-02-07 14:14:50 +0000
Commit message: Merge pull request from GHSA-r3jc-3qmm-w3pw

Add missing security declarations on the database adapter class
CVE-2018-7247: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2018-02-19T18:29Z
Repository: https://github.com/DanBloomberg/leptonica
Language: C
Files changed: prog/htmlviewer.c
Commit date: 2018-02-16 14:37:09 +0100
Commit message: prog/htmlviewer: Catch unbound memory access (CID 1386222)

rootname can have any size, so limit the amount of copied bytes.

Signed-off-by: Stefan Weil <sw@weilnetz.de>

Diff: diff --git a/prog/htmlviewer.c b/prog/htmlviewer.c
index 2ed1561c..820c06d9 100644
--- a/prog/htmlviewer.c
+++ b/prog/htmlviewer.c
@@ -169,13 +169,13 @@ SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;
         /* Capture the filenames in the input directory */
     if ((safiles = getFilenamesInDirectory(dirin)) == NULL)
         return ERROR_INT("safiles not made", procName, 1);
 
         /* Generate output text file names */
-    sprintf(charbuf, "%s/%s.html", dirout, rootname);
+    snprintf(charbuf, sizeof(charbuf), "%s/%s.html", dirout, rootname);
     mainname = stringNew(charbuf);
-    sprintf(charbuf, "%s/%s-links.html", dirout, rootname);
+    snprintf(charbuf, sizeof(charbuf), "%s/%s-links.html", dirout, rootname);
     linkname = stringNew(charbuf);
     linknameshort = stringJoin(rootname, "-links.html");
 
         /* Generate the thumbs and views */
     sathumbs = sarrayCreate(0);
@@ -195,11 +195,11 @@ SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;
 
             /* Make and store the thumbnail images */
         pixGetDimensions(pix, &w, NULL, &d);
         factor = (l_float32)thumbwidth / (l_float32)w;
         pixthumb = pixScale(pix, factor, factor);
-        sprintf(charbuf, "%s_thumb_%03d", rootname, index);
+        snprintf(charbuf, sizeof(charbuf), "%s_thumb_%03d", rootname, index);
         sarrayAddString(sathumbs, charbuf, L_COPY);
         outname = genPathname(dirout, charbuf);
         WriteFormattedPix(outname, pixthumb);
         lept_free(outname);
         pixDestroy(&pixthumb);

Vulnerable code:     sprintf(charbuf, "%s/%s.html", dirout, rootname);
    sprintf(charbuf, "%s/%s-links.html", dirout, rootname);
        sprintf(charbuf, "%s_thumb_%03d", rootname, index);
Fixed code:     snprintf(charbuf, sizeof(charbuf), "%s/%s.html", dirout, rootname);
    snprintf(charbuf, sizeof(charbuf), "%s/%s-links.html", dirout, rootname);
        snprintf(charbuf, sizeof(charbuf), "%s_thumb_%03d", rootname, index);
CVE-2020-36278: Out-of-bounds Read (CWE-125)
value: Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2021-03-12T00:15Z
Repository: https://github.com/DanBloomberg/leptonica
Language: C
Files changed: src/ccbord.c
Commit date: 2020-06-14 22:52:40 -0700
Commit message: Issue 23433 in oss-fuzz: Heap-buffer-overflow in findNextBorderPixel()
* Check pix boundary when looking for the next pixel.

Diff: diff --git a/src/ccbord.c b/src/ccbord.c
index c6237025..4e6363e2 100644
--- a/src/ccbord.c
+++ b/src/ccbord.c
@@ -1078,10 +1078,12 @@ l_uint32  *line;
     qpos = *pqpos;
     for (i = 1; i < 8; i++) {
         pos = (qpos + i) % 8;
         npx = px + xpostab[pos];
         npy = py + ypostab[pos];
+        if (npx < 0 || npx >= w || npy < 0 || npy >= h)
+            continue;
         line = data + npy * wpl;
         val = GET_DATA_BIT(line, npx);
         if (val) {
             *pnpx = npx;
             *pnpy = npy;

Fixed code:         if (npx < 0 || npx >= w || npy < 0 || npy >= h)
            continue;
CVE-2020-36280: Out-of-bounds Read (CWE-125)
value: Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2021-03-12T00:15Z
Repository: https://github.com/DanBloomberg/leptonica
Language: C
Files changed: prog/dewarptest1.c, src/tiffio.c
Commit date: 2020-06-22 23:02:43 -0700
Commit message: Issue 23654 in oss-fuzz: Heap-buffer-overflow in pixReadFromTiffStream
  * Increase scanline buffer for reading gray+alpha and converting to RGBA

Diff: diff --git a/prog/dewarptest1.c b/prog/dewarptest1.c
index e22558ec..076c6084 100644
--- a/prog/dewarptest1.c
+++ b/prog/dewarptest1.c
@@ -50,10 +50,12 @@ L_DEWARPA  *dewa;
 PIX        *pixs, *pixn, *pixg, *pixb, *pixd, *pixt1, *pixt2;
 PIX        *pixs2, *pixn2, *pixg2, *pixb2, *pixd2;
 
     setLeptDebugOK(1);
     lept_mkdir("lept/model");
+    lept_rmdir("lept/dewmod");
+    lept_mkdir("lept/dewmod");
 
 /*    pixs = pixRead("1555.007.jpg"); */
     pixs = pixRead("cat.035.jpg");
 /*    pixs = pixRead("cat.010.jpg"); */
 
@@ -158,12 +160,10 @@ PIX        *pixs2, *pixn2, *pixg2, *pixb2, *pixd2;
         /* Generate the big pdf file */
     convertFilesToPdf("/tmp/lept/dewtest", NULL, 135, 1.0, 0, 0, "Dewarp Test",
                       "/tmp/lept/dewarptest1.pdf");
     lept_stderr("pdf file made: /tmp/lept/model/dewarptest1.pdf\n");
 
-    lept_rmdir("lept/dewmod");
-    lept_rmdir("lept/dewtest");
     pixDestroy(&pixs);
     pixDestroy(&pixn);
     pixDestroy(&pixg);
     pixDestroy(&pixb);
     pixDestroy(&pixd);
diff --git a/src/tiffio.c b/src/tiffio.c
index e6493673..951ac085 100644
--- a/src/tiffio.c
+++ b/src/tiffio.c
@@ -600,11 +600,11 @@ PIXCMAP   *cmap;
             pixEndianTwoByteSwap(pix);
         LEPT_FREE(linebuf);
     } else if (spp == 2 && bps == 8) {  /* gray plus alpha */
         L_INFO("gray+alpha is not supported; converting to RGBA\n", procName);
         pixSetSpp(pix, 4);
-        linebuf = (l_uint8 *)LEPT_CALLOC(tiffbpl + 1, sizeof(l_uint8));
+        linebuf = (l_uint8 *)LEPT_CALLOC(2 * tiffbpl + 1, sizeof(l_uint8));
         pixdata = pixGetData(pix);
         for (i = 0; i < h; i++) {
             if (TIFFReadScanline(tif, linebuf, i, 0) < 0) {
                 LEPT_FREE(linebuf);
                 pixDestroy(&pix);

Vulnerable code:     lept_rmdir("lept/dewmod");
    lept_rmdir("lept/dewtest");
        linebuf = (l_uint8 *)LEPT_CALLOC(tiffbpl + 1, sizeof(l_uint8));
Fixed code:     lept_rmdir("lept/dewmod");
    lept_mkdir("lept/dewmod");
        linebuf = (l_uint8 *)LEPT_CALLOC(2 * tiffbpl + 1, sizeof(l_uint8));
CVE-2020-36281: Out-of-bounds Read (CWE-125)
value: Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2021-03-12T01:15Z
Repository: https://github.com/DanBloomberg/leptonica
Language: C
Files changed: src/colorquant1.c
Commit date: 2020-05-11 11:17:30 -0700
Commit message: Fixed issue 22140 in oss-fuzz: Heap-buffer-overflow
* color quantized pix must be 8 bpp before extra colors are added.

Diff: diff --git a/src/colorquant1.c b/src/colorquant1.c
index 52ddd386..c7a817d6 100644
--- a/src/colorquant1.c
+++ b/src/colorquant1.c
@@ -3313,11 +3313,11 @@ pixFewColorsOctcubeQuantMixed(PIX       *pixs,
 {
 l_int32    i, j, w, h, wplc, wplm, wpld, ncolors, index;
 l_int32    rval, gval, bval, val, minval, maxval;
 l_int32   *lut;
 l_uint32  *datac, *datam, *datad, *linec, *linem, *lined;
-PIX       *pixc, *pixm, *pixg, *pixd;
+PIX       *pix1, *pixc, *pixm, *pixg, *pixd;
 PIXCMAP   *cmap, *cmapd;
 
     PROCNAME("pixFewColorsOctcubeQuantMixed");
 
     if (!pixs || pixGetDepth(pixs) != 32)
@@ -3330,12 +3330,14 @@ PIXCMAP   *cmap, *cmapd;
     if (diffthresh <= 0) diffthresh = 20;
     if (minfract <= 0.0) minfract = 0.05;
     if (maxspan <= 2) maxspan = 15;
 
         /* Start with a simple fixed octcube quantizer. */
-    if ((pixc = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
+    if ((pix1 = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
         return (PIX *)ERROR_PTR("too many colors", procName, NULL);
+    pixc = pixConvertTo8(pix1, 1);  /* must be 8 bpp */
+    pixDestroy(&pix1);
 
         /* Identify and save color entries in the colormap.  Set up a LUT
          * that returns -1 for any gray pixel. */
     cmap = pixGetColormap(pixc);
     ncolors = pixcmapGetCount(cmap);

Vulnerable code: PIX       *pixc, *pixm, *pixg, *pixd;
    if ((pixc = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
Fixed code: PIX       *pix1, *pixc, *pixm, *pixg, *pixd;
    if ((pix1 = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
    pixc = pixConvertTo8(pix1, 1);  /* must be 8 bpp */
    pixDestroy(&pix1);
CVE-2023-27583: Use of Hard-coded Credentials (CWE-798)
value: PanIndex is a network disk directory index. In Panindex prior to version 3.1.3,  a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a patch for the issue. As a workaround, one may change the JWT key in the source code before compiling the project.
  

CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2023-03-13T21:15Z
Repository: https://github.com/px-org/PanIndex
Language: Go
Files changed: control/middleware/jwt.go, dao/db.go
Commit date: 2023-03-13 10:13:05 +0800
Commit message: :bug:Fix login security issues

Diff: diff --git a/control/middleware/jwt.go b/control/middleware/jwt.go
index afffa30..5ca05b5 100644
--- a/control/middleware/jwt.go
+++ b/control/middleware/jwt.go
@@ -18,11 +18,11 @@ const (
 )
 
 func JWTMiddlewar() (*jwt.GinJWTMiddleware, error) {
 	authMiddleware, err := jwt.New(&jwt.GinJWTMiddleware{
 		Realm:       "PanIndex Zone",
-		Key:         []byte("PanIndex"),
+		Key:         []byte(module.GloablConfig.JwtSignKey),
 		Timeout:     (time.Duration(LoginTimeOut)) * time.Hour,
 		MaxRefresh:  (time.Duration(LoginTimeOut)) * time.Hour,
 		IdentityKey: identityKey,
 		PayloadFunc: func(data interface{}) jwt.MapClaims {
 			if v, ok := data.(*User); ok {
diff --git a/dao/db.go b/dao/db.go
index 2fe4362..cbc1471 100644
--- a/dao/db.go
+++ b/dao/db.go
@@ -71,10 +71,11 @@ var InitConfigItems = []module.ConfigItem{
 	{"dav_mode", "0", "dav"},
 	{"dav_down_mode", "1", "dav"},
 	{"dav_user", "webdav", "dav"},
 	{"dav_password", "1234", "dav"},
 	{"proxy", "", "common"},
+	{"jwt_sign_key", uuid.NewV4().String(), "common"},
 }
 
 type Db interface {
 	CreateDb(dsn string) //get dao connection
 }

Vulnerable code: 		Key:         []byte("PanIndex"),
Fixed code: 		Key:         []byte(module.GloablConfig.JwtSignKey),
	{"jwt_sign_key", uuid.NewV4().String(), "common"},