Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-24899: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-06T00:15Z
Repository: https://github.com/contao/contao
Language: PHP
Files changed: core-bundle/src/Resources/contao/pages/PageRegular.php
Commit date: 2022-05-05 08:32:15 +0200
Commit message: Merge pull request from GHSA-m8x6-6r63-qvj2


Diff: diff --git a/core-bundle/src/Resources/contao/pages/PageRegular.php b/core-bundle/src/Resources/contao/pages/PageRegular.php
index c0e20167c..00cf842b9 100644
--- a/core-bundle/src/Resources/contao/pages/PageRegular.php
+++ b/core-bundle/src/Resources/contao/pages/PageRegular.php
@@ -228,16 +228,16 @@ class PageRegular extends Frontend
 		// Remove shy-entities (see #2709)
 		$this->Template->mainTitle = str_replace('[-]', '', $this->Template->mainTitle);
 		$this->Template->pageTitle = str_replace('[-]', '', $this->Template->pageTitle);
 
 		// Meta robots tag
-		$this->Template->robots = $headBag->getMetaRobots();
+		$this->Template->robots = htmlspecialchars($headBag->getMetaRobots());
 
 		// Canonical
 		if ($objPage->enableCanonical)
 		{
-			$this->Template->canonical = $headBag->getCanonicalUriForRequest($request);
+			$this->Template->canonical = htmlspecialchars($headBag->getCanonicalUriForRequest($request));
 		}
 
 		// Fall back to the default title tag
 		if (!$objLayout->titleTag)
 		{

Vulnerable code: 		$this->Template->robots = $headBag->getMetaRobots();
			$this->Template->canonical = $headBag->getCanonicalUriForRequest($request);
Fixed code: 		$this->Template->robots = htmlspecialchars($headBag->getMetaRobots());
			$this->Template->canonical = htmlspecialchars($headBag->getCanonicalUriForRequest($request));
CVE-2023-29200: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2023-04-25T18:15Z
Repository: https://github.com/contao/contao
Language: PHP
Files changed: core-bundle/src/Resources/contao/drivers/DC_Folder.php
Commit date: 2023-04-25 11:14:31 +0200
Commit message: Merge pull request from GHSA-fp7q-xhhw-6rj3


Diff: diff --git a/core-bundle/src/Resources/contao/drivers/DC_Folder.php b/core-bundle/src/Resources/contao/drivers/DC_Folder.php
index 72f96231a8..c8e8a97b7a 100644
--- a/core-bundle/src/Resources/contao/drivers/DC_Folder.php
+++ b/core-bundle/src/Resources/contao/drivers/DC_Folder.php
@@ -2523,10 +2523,17 @@ class DC_Folder extends DataContainer implements \listable, \editable
 		if (!Environment::get('isAjaxRequest'))
 		{
 			return '';
 		}
 
+		$this->isValid($strFolder);
+
+		if (!is_dir($this->strRootDir . '/' . $strFolder) || !$this->isMounted($strFolder))
+		{
+			throw new AccessDeniedException('Folder "' . $strFolder . '" is not mounted or cannot be found.');
+		}
+
 		/** @var Session $objSession */
 		$objSession = System::getContainer()->get('session');
 
 		$blnClipboard = false;
 		$arrClipboard = $objSession->get('CLIPBOARD');
@@ -2945,11 +2952,11 @@ class DC_Folder extends DataContainer implements \listable, \editable
 		if (!$strFolder)
 		{
 			return false;
 		}
 
-		if (empty($this->arrFilemounts))
+		if (empty($this->arrFilemounts) && !\is_array($GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root']) && $GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root'] !== false)
 		{
 			return true;
 		}
 
 		$path = $strFolder;

Vulnerable code: 		if (empty($this->arrFilemounts))
Fixed code: 		$this->isValid($strFolder);

		if (!is_dir($this->strRootDir . '/' . $strFolder) || !$this->isMounted($strFolder))
		{
			throw new AccessDeniedException('Folder "' . $strFolder . '" is not mounted or cannot be found.');
		}

		if (empty($this->arrFilemounts) && !\is_array($GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root']) && $GLOBALS['TL_DCA'][$this->strTable]['list']['sorting']['root'] !== false)
CVE-2023-1000: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Published: 2024-04-27T09:15Z
Repository: https://github.com/cyanomiko/dcnnt-py
Language: Python
Files changed: dcnnt/plugins/notifications.py
Commit date: 2023-08-14 09:24:18 +0400
Commit message: Fix command ijection vulnerability

Fix passing of unescaped text to the arguments of notification command
in dcnnt/plugins/notifications.py

This is a high-risk vulnerability that can lead to RCE and allow arbitrary code
execution on the server while the notification showing.

All text received over the network MUST be escaped before being transmitted to
the database or to the shell command arguments.

Diff: diff --git a/dcnnt/plugins/notifications.py b/dcnnt/plugins/notifications.py
index b70bc7d..3e4255d 100644
--- a/dcnnt/plugins/notifications.py
+++ b/dcnnt/plugins/notifications.py
@@ -1,7 +1,8 @@
 import logging
 import subprocess
+from shlex import quote
 
 from .base import Plugin
 from ..common import *
 
 
@@ -51,8 +52,8 @@ class NotificationsPlugin(Plugin):
                         try:
                             open(icon_path, 'wb').write(icon_data)
                         except Exception as e:
                             self.log(e, logging.WARNING)
                     icon = icon_path if icon_data else ''
-                    command = cmd.format(uin=uin, name=name, icon=icon, text=text, title=title, package=package)
+                    command = cmd.format(uin=quote(uin), name=quote(name), icon=quote(icon), text=quote(text), title=quote(title), package=quote(package))
                     self.log('Execute: "{}"'.format(command))
                     subprocess.call(command, shell=True)

Vulnerable code:                     command = cmd.format(uin=uin, name=name, icon=icon, text=text, title=title, package=package)
Fixed code: from shlex import quote
                    command = cmd.format(uin=quote(uin), name=quote(name), icon=quote(icon), text=quote(text), title=quote(title), package=quote(package))
CVE-2018-3723: Improper Input Validation (CWE-20)
value: defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.8
Published: 2018-06-07T02:29Z
Repository: https://github.com/jonschlinkert/defaults-deep
Language: JavaScript
Files changed: index.js
Commit date: 2018-02-07 11:52:35 -0500
Commit message: exclude __proto__

Diff: diff --git a/index.js b/index.js
index 14474d5..452fa17 100644
--- a/index.js
+++ b/index.js
@@ -14,10 +14,14 @@ lazy('for-own', 'forOwn');
 function defaultsDeep(target, objects) {
   target = target || {};
 
   function copy(target, current) {
     lazy.forOwn(current, function (value, key) {
+      if (key === '__proto__') {
+        return;
+      }
+
       var val = target[key];
       // add the missing property, or allow a null property to be updated
       if (val == null) {
         target[key] = value;
       } else if (lazy.isObject(val) && lazy.isObject(value)) {

Fixed code:       if (key === '__proto__') {
        return;
      }
CVE-2022-21697: Server-Side Request Forgery (SSRF) (CWE-918)
value: Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.1
Published: 2022-01-25T14:15Z
Repository: https://github.com/jupyterhub/jupyter-server-proxy
Language: Unknown
Commit date: 2022-01-24 22:30:00 +0000
Commit message: Merge pull request from GHSA-gcv9-6737-pjqw

validate proxied paths starting with /
CVE-2024-28179: Insufficient Information (NVD-CWE-noinfo)
value: Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing unauthenticated access to anyone who had network access to the Jupyter server endpoint. This vulnerability can allow unauthenticated remote access to any websocket endpoint set up to be accessible via Jupyter Server Proxy. In many cases, this leads to remote unauthenticated arbitrary code execution, due to how affected instances use websockets. The websocket endpoints exposed by `jupyter_server` itself is not affected. Projects that do not rely on websockets are also not affected. Versions 3.2.3 and 4.1.1 contain a fix for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-20T20:15Z
Repository: https://github.com/jupyterhub/jupyter-server-proxy
Language: Unknown
Commit date: 2024-03-13 09:34:28 +0100
Commit message: Merge pull request from GHSA-w3vc-fx9p-wp4v

Check authentication when websockets open
CVE-2024-35225: Insufficient Information (NVD-CWE-noinfo)
value: Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/proxy` endpoint accepts a `host` path segment in the format `/proxy/<host>`. When this endpoint is called with an invalid `host` value, `jupyter-server-proxy` replies with a response that includes the value of `host`, without sanitization [2]. A third-party actor can leverage this by sending a phishing link with an invalid `host` value containing custom JavaScript to a user. When the user clicks this phishing link, the browser renders the response of `GET /proxy/<host>`, which runs the custom JavaScript contained in `host` set by the actor. As any arbitrary JavaScript can be run after the user clicks on a phishing link, this issue permits extensive access to the user's JupyterLab instance for an actor. Patches are included in versions 4.2.0 and 3.2.4. As a workaround, server operators who are unable to upgrade can disable the `jupyter-server-proxy` extension.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-11T22:15Z
Repository: https://github.com/jupyterhub/jupyter-server-proxy
Language: Unknown
Commit date: 2024-06-11 16:32:35 +0100
Commit message: Merge pull request from GHSA-fvcq-4x64-hqxr

Escape invalid host when displayed in html
CVE-2020-36625: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-12-22T10:15Z
Repository: https://github.com/destinygg/chat
Language: Unknown
Commit date: 2020-07-30 17:54:43 -0400
Commit message: Merge pull request #35 from 11k/fix-origin-check

Fix WebSocket upgrade CSRF vulnerability
CVE-2020-26280: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web applications users can enter rich text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Code that will be executed when other users read the respective text. An attacker could utilize this vulnerability be used to manipulate votes of other users, hijack the moderators session or simply disturb the meeting. The vulnerability was introduced with 6eae497abeab234418dfbd9d299e831eff86ed45 on 16.04.2020, which is first included in the 3.2 release. It has been patched in version 3.3 ( in commit f3809fc8a97ee305d721662a75f788f9e9d21938, merged in master on 20.11.2020).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 8.9
Published: 2020-12-18T19:15Z
Repository: https://github.com/OpenSlides/OpenSlides
Language: Python
Files changed: server/openslides/utils/validate.py
Commit date: 2020-11-20 16:10:32 +0100
Commit message: Fixed HTML attribute validation

Diff: diff --git a/server/openslides/utils/validate.py b/server/openslides/utils/validate.py
index 14dacee5d..1aa61edb6 100644
--- a/server/openslides/utils/validate.py
+++ b/server/openslides/utils/validate.py
@@ -41,16 +41,44 @@ allowed_tags_strict = [
 ]
 allowed_tags_permissive = allowed_tags_strict + [
     "video",
 ]
 
+allowed_attributes = [
+    "align",
+    "alt",
+    "autoplay",
+    "background",
+    "bgcolor",
+    "border",
+    "class",
+    "colspan",
+    "controls",
+    "dir",
+    "height",
+    "hidden",
+    "href",
+    "hreflang",
+    "id",
+    "lang",
+    "loop",
+    "muted",
+    "poster",
+    "preload",
+    "rel",
+    "rowspan",
+    "scope",
+    "sizes",
+    "src",
+    "srcset",
+    "start",
+    "style",
+    "target",
+    "title",
+    "width",
+]
 
-def allow_all(tag: str, name: str, value: str) -> bool:
-    return True
-
-
-allowed_attributes = allow_all
 allowed_styles = [
     "color",
     "background-color",
     "height",
     "width",

Vulnerable code: def allow_all(tag: str, name: str, value: str) -> bool:
    return True


allowed_attributes = allow_all
Fixed code: allowed_attributes = [
    "align",
    "alt",
    "autoplay",
    "background",
    "bgcolor",
    "border",
    "class",
    "colspan",
    "controls",
    "dir",
    "height",
    "hidden",
    "href",
    "hreflang",
    "id",
    "lang",
    "loop",
    "muted",
    "poster",
    "preload",
    "rel",
    "rowspan",
    "scope",
    "sizes",
    "src",
    "srcset",
    "start",
    "style",
    "target",
    "title",
    "width",
]
CVE-2018-3720: Insufficient Information (NVD-CWE-noinfo)
value: assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2018-06-07T02:29Z
Repository: https://github.com/jonschlinkert/assign-deep
Language: JavaScript
Files changed: index.js
Commit date: 2018-02-07 11:20:22 -0500
Commit message: exclude __proto__

Diff: diff --git a/index.js b/index.js
index b2e74cf..c5dc494 100644
--- a/index.js
+++ b/index.js
@@ -35,11 +35,11 @@ function assign(target/*, objects*/) {
 
 function extend(target, obj) {
   assignSymbols(target, obj);
 
   for (var key in obj) {
-    if (hasOwn(obj, key)) {
+    if (key !== '__proto__' && hasOwn(obj, key)) {
       var val = obj[key];
       if (isObject(val)) {
         if (typeOf(target[key]) === 'undefined' && typeOf(val) === 'function') {
           target[key] = val;
         }

Vulnerable code:     if (hasOwn(obj, key)) {
Fixed code:     if (key !== '__proto__' && hasOwn(obj, key)) {
CVE-2020-7758: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2020-11-02T22:15Z
Repository: https://github.com/browserless/chrome
Language: TypeScript
Files changed: src/routes.ts
Commit date: 2020-10-26 10:28:01 -0700
Commit message: Ensure workspace files are _in_ the workspace DIR

Diff: diff --git a/src/routes.ts b/src/routes.ts
index e426faa..031fc4b 100644
--- a/src/routes.ts
+++ b/src/routes.ts
@@ -155,13 +155,16 @@ export const getRoutes = ({
       if (!file) {
         return res.sendStatus(400);
       }
 
       const filePath = path.join(workspaceDir, file);
-
       const hasFile = await exists(filePath);
 
+      if (!filePath.includes(workspaceDir)) {
+        return res.sendStatus(404);
+      }
+
       if (!hasFile) {
         return res.sendStatus(404);
       }
 
       const stats = await lstat(filePath);
@@ -183,10 +186,14 @@ export const getRoutes = ({
       }
 
       const filePath = path.join(workspaceDir, file);
       const hasFile = await exists(filePath);
 
+      if (!filePath.includes(workspaceDir)) {
+        return res.sendStatus(404);
+      }
+
       if (!hasFile) {
         return res.sendStatus(404);
       }
 
       rimraf(filePath, _.noop);

Fixed code:       if (!filePath.includes(workspaceDir)) {
        return res.sendStatus(404);
      }

      if (!filePath.includes(workspaceDir)) {
        return res.sendStatus(404);
      }
CVE-2021-38593: Out-of-bounds Write (CWE-787)
value: Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill and QPaintEngineEx::stroke).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2021-08-12T02:15Z
Repository: https://github.com/qt/qtbase
Language: C++
Files changed: src/gui/painting/qpaintengineex.cpp
Commit date: 2021-07-27 17:44:30 +0200
Commit message: Improve fix for avoiding huge number of tiny dashes

Some pathological cases were not caught by the previous fix.

Fixes: QTBUG-95239
Pick-to: 6.2 6.1 5.15
Change-Id: I0337ee3923ff93ccb36c4d7b810a9c0667354cc5
Reviewed-by: Robert Löhning <robert.loehning@qt.io>

Diff: diff --git a/src/gui/painting/qpaintengineex.cpp b/src/gui/painting/qpaintengineex.cpp
index 2997d53310..22e9a621c3 100644
--- a/src/gui/painting/qpaintengineex.cpp
+++ b/src/gui/painting/qpaintengineex.cpp
@@ -424,11 +424,11 @@ void QPaintEngineEx::stroke(const QVectorPath &path, const QPen &inPen)
             patternLength += qMax(pattern.at(i), qreal(0));
         if (pen.widthF())
             patternLength *= pen.widthF();
         if (qFuzzyIsNull(patternLength)) {
             pen.setStyle(Qt::NoPen);
-        } else if (extent / patternLength > 10000) {
+        } else if (qFuzzyIsNull(extent) || extent / patternLength > 10000) {
             // approximate stream of tiny dashes with semi-transparent solid line
             pen.setStyle(Qt::SolidLine);
             QColor color(pen.color());
             color.setAlpha(color.alpha() / 2);
             pen.setColor(color);

Vulnerable code:         } else if (extent / patternLength > 10000) {
Fixed code:         } else if (qFuzzyIsNull(extent) || extent / patternLength > 10000) {
CVE-2016-9566: Permissions, Privileges, and Access Controls (CWE-264)
value: base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 7.8
Published: 2016-12-15T22:59Z
Repository: https://github.com/NagiosEnterprises/nagioscore
Language: Unknown
Commit date: 2016-12-07 10:28:50 -0600
Commit message: Merge branch 'maint'
CVE-2016-9566: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.8
Published: 2016-12-15T22:59Z
Repository: https://github.com/NagiosEnterprises/nagioscore
Language: Unknown
Commit date: 2016-12-07 10:28:50 -0600
Commit message: Merge branch 'maint'
CVE-2017-12847: Improper Initialization (CWE-665)
value: Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command.
CWE description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CVSS v3 base score: 6.3
Published: 2017-08-23T21:29Z
Repository: https://github.com/NagiosEnterprises/nagioscore
Language: Other
Files changed: configure.ac
Commit date: 2017-08-04 20:27:08 -0400
Commit message: configure.ac: use /run/nagios.lock as the default lockfile path.

The previous default path for the lockfile was located in
$localstatedir, which is generally writable by the nagios user. That
presents a security risk, since the nagios user can delete the
lockfile and replace it with another file containing the PID of a
root-owned process. This commit changes the default lockfile path to
/run/nagios.lock, and completes the fix for Github issue #404.

Diff: diff --git a/configure.ac b/configure.ac
index 111b53e3..93460bb8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -265,13 +265,13 @@ AC_ARG_WITH(init_dir,
 AC_SUBST(init_dir)
 
 dnl User can override lock file location
 AC_ARG_WITH(lockfile,
 	AC_HELP_STRING([--with-lockfile=<path>],
-		[sets path and file name for lock file]),
+		[sets path for lock file (default: /run/nagios.lock)]),
 	lockfile=$withval,
-	lockfile=$localstatedir/nagios.lock
+	lockfile=/run/nagios.lock
 )
 AC_SUBST(lockfile)
 
 dnl Determine the library to be used by the iobroker
 

Vulnerable code: 		[sets path and file name for lock file]),
	lockfile=$localstatedir/nagios.lock
Fixed code: 		[sets path for lock file (default: /run/nagios.lock)]),
	lockfile=/run/nagios.lock
CVE-2018-25094: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in ???????????????? Online Accounting System up to 1.4.0 and classified as problematic. This issue affects some unknown processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The identifier of the patch is 9d9618422b980335bb30be612ea90f4f56cb992c. It is recommended to upgrade the affected component. The identifier VDB-246641 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-12-03T11:15Z
Repository: https://github.com/59160781/project
Language: PHP
Files changed: ckeditor/filemanager/browser/default/image.php
Commit date: 2018-03-18 22:46:27 +0700
Commit message: fix a critical security vulnerability

/ckeditor/filemanager/browser/default/image.php?fid=/settings/database.php&id=&w=&h=
/ckeditor/filemanager/browser/default/image.php?fid=../../../etc/passwd&id=&w=&h
Diff: diff --git a/ckeditor/filemanager/browser/default/image.php b/ckeditor/filemanager/browser/default/image.php
index 65382ae..b29102e 100644
--- a/ckeditor/filemanager/browser/default/image.php
+++ b/ckeditor/filemanager/browser/default/image.php
@@ -1,12 +1,15 @@
 <?php
 // ckeditor/filemanager/browser/default/image.php
-if (isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
+
+if ( isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
   // load Kotchasan
   include '../../../../load.php';
   // Initial Kotchasan Framework
   Kotchasan::createWebApplication('Gcms\Config');
+  // hotfix: these checks need to be changed later
+  if(!Kotchasan\Login::isMember() || strpos($_REQUEST['fid'], '..') === false || strpos($_REQUEST['fid'], '.php') === false) exit();
   // ค่าที่ส่งมา
   $id = ROOT_PATH.$_REQUEST['fid'];
   $idW = $_GET['w'];
   $idH = $_GET['h'];
   if ($id != '' && is_file($id)) {

Vulnerable code: if (isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
Fixed code: 
if ( isset($_REQUEST['fid']) && isset($_GET['w']) && isset($_GET['h'])) {
  // hotfix: these checks need to be changed later
  if(!Kotchasan\Login::isMember() || strpos($_REQUEST['fid'], '..') === false || strpos($_REQUEST['fid'], '.php') === false) exit();
CVE-2020-14156: Incorrect Default Permissions (CWE-276)
value: user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 8.8
Published: 2020-06-15T18:15Z
Repository: https://github.com/openbmc/phosphor-host-ipmid
Language: C++
Files changed: user_channel/passwd_mgr.cpp
Commit date: 2020-04-08 16:58:55 -0700
Commit message: Use more restrictive permissions on /etc/ipmi-pass

This forces the permissions on /etc/ipmi-pass to be 0600 or RW only by
owner. This is to prevent non-owners from reading the file, even though
it is obfuscated to make it harder for ipmi passwords to leak.

Tested: change ipmi passwords and see that the /etc/ipmi-pass file has
        0600 permissions.

Change-Id: I4be0b8a65f98ced031493f7767879eb054e1ee84
Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>

Diff: diff --git a/user_channel/passwd_mgr.cpp b/user_channel/passwd_mgr.cpp
index 66bdef0..5e0b30d 100644
--- a/user_channel/passwd_mgr.cpp
+++ b/user_channel/passwd_mgr.cpp
@@ -442,12 +442,12 @@ int PasswdMgr::updatePasswdSpecialFile(const std::string& userName,
         close(fd);
         log<level::DEBUG>("Error creating temp file");
         return -EIO;
     }
 
-    // Set the file mode as of actual ipmi-pass file.
-    if (fchmod(fileno((temp)()), st.st_mode) < 0)
+    // Set the file mode as read-write for owner only
+    if (fchmod(fileno((temp)()), S_IRUSR | S_IWUSR) < 0)
     {
         log<level::DEBUG>("Error setting fchmod for temp file");
         return -EIO;
     }
 

Vulnerable code:     // Set the file mode as of actual ipmi-pass file.
    if (fchmod(fileno((temp)()), st.st_mode) < 0)
Fixed code:     // Set the file mode as read-write for owner only
    if (fchmod(fileno((temp)()), S_IRUSR | S_IWUSR) < 0)
CVE-2020-15100: Allocation of Resources Without Limits or Throttling (CWE-770)
value: In freewvs before 0.1.1, a user could create a large file that freewvs will try to read, which will terminate a scan process. This has been patched in 0.1.1.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 3.3
Published: 2020-07-14T20:15Z
Repository: https://github.com/schokokeksorg/freewvs
Language: Other
Files changed: freewvs
Commit date: 2020-06-10 10:15:22 +0200
Commit message: limit data we read from file to avoid DoS via large files

Diff: diff --git a/freewvs b/freewvs
index a7a1bac..80e46df 100755
--- a/freewvs
+++ b/freewvs
@@ -123,11 +123,11 @@ for fdir in opts.dirs:
                         mfile = os.path.join(root, filename)
                         try:
                             file = open(mfile, errors='replace')
                         except OSError:
                             continue
-                        filestr = file.read()
+                        filestr = file.read(200000)
                         file.close()
 
                         if (('extra_match' in det
                              and det['extra_match'] not in filestr)
                                 or ('extra_nomatch' in det

Vulnerable code:                         filestr = file.read()
Fixed code:                         filestr = file.read(200000)
CVE-2020-15101: Uncontrolled Recursion (CWE-674)
value: In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users. This has been patched in 0.1.1.
CWE description: The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
CVSS v3 base score: 3.3
Published: 2020-07-14T22:15Z
Repository: https://github.com/schokokeksorg/freewvs
Language: Other
Files changed: freewvs
Commit date: 2020-06-09 19:12:59 +0200
Commit message: protect against deep recursion of directories

Diff: diff --git a/freewvs b/freewvs
index 2c16e23..36f89e7 100755
--- a/freewvs
+++ b/freewvs
@@ -107,11 +107,15 @@ if opts.xml:
     print('<freewvs>')
 
 # start the search
 
 for fdir in opts.dirs:
-    for root, _, files in os.walk(fdir):
+    for root, dirs, files in os.walk(fdir):
+        # this protects us against nested directories causing
+        # an exception
+        if root.count(os.sep) > 500:
+            del dirs[:]
         for filename in scanfiles.intersection(files):
             for item in jconfig:
                 if not opts.thirdparty and 'thirdparty' in item:
                     continue
                 for det in item['detection']:

Vulnerable code:     for root, _, files in os.walk(fdir):
Fixed code:     for root, dirs, files in os.walk(fdir):
        # this protects us against nested directories causing
        # an exception
        if root.count(os.sep) > 500:
            del dirs[:]
CVE-2021-46561: Incorrect Authorization (CWE-863)
value: controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new organization.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.2
Published: 2022-01-26T18:15Z
Repository: https://github.com/CVEProject/cve-services
Language: Unknown
Commit date: 2021-12-09 12:35:00 -0500
Commit message: Merge pull request #534 from CVEProject/hotfix/restrict_org_change

Keep Org Admins from changing user's org.
CVE-2021-21386: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2021-03-24T21:15Z
Repository: https://github.com/dwisiswant0/apkleaks
Language: Python
Files changed: apkleaks/apkleaks.py
Commit date: 2021-03-14 22:25:42 +0700
Commit message: Escapes decompiling arguments

Diff: diff --git a/apkleaks/apkleaks.py b/apkleaks/apkleaks.py
index c51c75e..e1e084f 100644
--- a/apkleaks/apkleaks.py
+++ b/apkleaks/apkleaks.py
@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
 from apkleaks.colors import clr
 from contextlib import closing
 from distutils.spawn import find_executable
+from pipes import quote
 from pyaxmlparser import APK
 from urllib.request import urlopen
 from zipfile import ZipFile
 import io
 import json
@@ -82,12 +83,13 @@ class APKLeaks:
 				dex = self.tempdir + "/" + self.apk.package + ".dex"
 				with open(dex, "wb") as classes:
 					classes.write(zipped.read("classes.dex"))
 			except Exception as e:
 				sys.exit(self.writeln(str(e), clr.WARNING))
-		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
-		os.system(dec)
+		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
+		comm = "%s" % (" ".join(quote(arg) for arg in args))
+		os.system(comm)
 		return self.tempdir
 
 	def unique(self, list): 
 		x = numpy.array(list) 
 		return (numpy.unique(x))

Vulnerable code: 		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
		os.system(dec)
Fixed code: from pipes import quote
		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
		comm = "%s" % (" ".join(quote(arg) for arg in args))
		os.system(comm)
CVE-2021-21386: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 9.8
Published: 2021-03-24T21:15Z
Repository: https://github.com/dwisiswant0/apkleaks
Language: Python
Files changed: apkleaks/apkleaks.py
Commit date: 2021-03-14 22:25:42 +0700
Commit message: Escapes decompiling arguments

Diff: diff --git a/apkleaks/apkleaks.py b/apkleaks/apkleaks.py
index c51c75e..e1e084f 100644
--- a/apkleaks/apkleaks.py
+++ b/apkleaks/apkleaks.py
@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
 from apkleaks.colors import clr
 from contextlib import closing
 from distutils.spawn import find_executable
+from pipes import quote
 from pyaxmlparser import APK
 from urllib.request import urlopen
 from zipfile import ZipFile
 import io
 import json
@@ -82,12 +83,13 @@ class APKLeaks:
 				dex = self.tempdir + "/" + self.apk.package + ".dex"
 				with open(dex, "wb") as classes:
 					classes.write(zipped.read("classes.dex"))
 			except Exception as e:
 				sys.exit(self.writeln(str(e), clr.WARNING))
-		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
-		os.system(dec)
+		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
+		comm = "%s" % (" ".join(quote(arg) for arg in args))
+		os.system(comm)
 		return self.tempdir
 
 	def unique(self, list): 
 		x = numpy.array(list) 
 		return (numpy.unique(x))

Vulnerable code: 		dec = "%s %s -d %s --deobf" % (self.jadx, dex, self.tempdir)
		os.system(dec)
Fixed code: from pipes import quote
		args = [self.jadx, dex, "-d", self.tempdir, "--deobf"]
		comm = "%s" % (" ".join(quote(arg) for arg in args))
		os.system(comm)
CVE-2023-3302: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 7.8
Published: 2023-06-23T13:15Z
Repository: https://github.com/admidio/admidio
Language: PHP
Files changed: adm_program/system/classes/ListConfiguration.php
Commit date: 2023-06-08 08:12:02 +0200
Commit message: Excel export could lead to execute apps #1433

Diff: diff --git a/adm_program/system/classes/ListConfiguration.php b/adm_program/system/classes/ListConfiguration.php
index f5b5ed475..dd4b645e4 100644
--- a/adm_program/system/classes/ListConfiguration.php
+++ b/adm_program/system/classes/ListConfiguration.php
@@ -231,11 +231,13 @@ class ListConfiguration extends TableLists
             }
         }
 
         // format value for csv export
         if ($format === 'csv') {
-            $outputContent = $content;
+            $content = preg_replace("/\t/", "\\t", $content);
+            $content = preg_replace("/\r?\n/", "\\n", $content);
+            $outputContent = preg_replace("/^[@=+-]/", "#", $content);
         }
         // pdf should show only text and not much html content
         elseif ($format === 'pdf') {
             $outputContent = $content;
         }

Vulnerable code:             $outputContent = $content;
Fixed code:             $content = preg_replace("/\t/", "\\t", $content);
            $content = preg_replace("/\r?\n/", "\\n", $content);
            $outputContent = preg_replace("/^[@=+-]/", "#", $content);
CVE-2022-1187: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-19T21:15Z
Repository: https://github.com/macbookandrew/wp-youtube-live
Language: PHP
Files changed: inc/admin.php
Commit date: 2022-03-31 10:10:37 +0800
Commit message: Fix a reflected cross-site scripting vulnerability

CVE-2022-1187
Diff: diff --git a/inc/admin.php b/inc/admin.php
index c78036d..45b1b5f 100644
--- a/inc/admin.php
+++ b/inc/admin.php
@@ -343,11 +343,11 @@ function refresh_youtube_live_upcoming_cache( $action = NULL, $nonce = NULL ) {
         $nonce = $_POST['nonce'];
         $action = $_POST['action'];
     }
 
     if ( ! wp_verify_nonce( $nonce, 'wpYTcache_nonce' ) ) {
-        die( 'Invalid nonce.' . var_export( $_POST, true ) );
+        die( 'Invalid nonce.');
     }
 
     $youtube_options = get_option( 'youtube_live_settings' );
     $youtube_live = new EmbedYoutubeLiveStreaming( $youtube_options['youtube_live_channel_id'], $youtube_options['youtube_live_api_key'] );
 

Vulnerable code:         die( 'Invalid nonce.' . var_export( $_POST, true ) );
Fixed code:         die( 'Invalid nonce.');
CVE-2017-1000492: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-01-03T01:29Z
Repository: https://github.com/leanote/desktop-app
Language: JavaScript
Files changed: public/js/app/note.js
Commit date: 2017-11-29 11:21:35 +0800
Commit message: Starred notes XXS

Diff: diff --git a/public/js/app/note.js b/public/js/app/note.js
index e649be6..e7ea05c 100644
--- a/public/js/app/note.js
+++ b/public/js/app/note.js
@@ -954,12 +954,14 @@ Note.clearAll = function() {
 // render note
 Note.renderNote = function(note) {
     if (!note) {
         return;
     }
+    var title = note.Title || '';
+    title = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>');
     // title
-    $("#noteTitle").val(note.Title);
+    $("#noteTitle").val(title);
 
     // 当前正在编辑的
     // tags
     Tag.input.setTags(note.Tags);
 };
@@ -1995,11 +1997,11 @@ Note.renderStars = function(notes) {
     var notes = notes || me.starNotes;
     me.starNotes = notes;
     me.starNotesO.html('');
     for (var i = 0; i < notes.length; ++i) {
         var note = notes[i];
-        var t = tt(me.starItemT, note.NoteId, note.Title || getMsg('Untitled'));
+        var t = tt(me.starItemT, note.NoteId, trimTitle(note.Title) || getMsg('Untitled'));
         me.starNotesO.append(t);
     }
 
     if (notes.length == 0) {
         me.starNotesO.html('<p class="no-info">' + getMsg('No Starred Note') + '</p>');

Vulnerable code:     $("#noteTitle").val(note.Title);
        var t = tt(me.starItemT, note.NoteId, note.Title || getMsg('Untitled'));
Fixed code:     var title = note.Title || '';
    title = title.replace(/&lt;/g, '<').replace(/&gt;/g, '>');
    $("#noteTitle").val(title);
        var t = tt(me.starItemT, note.NoteId, trimTitle(note.Title) || getMsg('Untitled'));
CVE-2012-1107: Insufficient Information (NVD-CWE-noinfo)
value: The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted sampleRate in an ape file, which triggers a divide-by-zero error.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2012-09-06T18:55Z
Repository: https://github.com/taglib/taglib
Language: C++
Files changed: taglib/ape/apeproperties.cpp
Commit date: 2012-03-04 11:51:05 +0100
Commit message: Make sure to not try dividing by zero

Diff: diff --git a/taglib/ape/apeproperties.cpp b/taglib/ape/apeproperties.cpp
index aab9d25..4f14d6c 100644
--- a/taglib/ape/apeproperties.cpp
+++ b/taglib/ape/apeproperties.cpp
@@ -191,11 +191,11 @@ void APE::Properties::analyzeCurrent()
 
   uint totalFrames = header.mid(12, 4).toUInt(false);
   uint blocksPerFrame = header.mid(4, 4).toUInt(false);
   uint finalFrameBlocks = header.mid(8, 4).toUInt(false);
   uint totalBlocks = totalFrames > 0 ? (totalFrames -  1) * blocksPerFrame + finalFrameBlocks : 0;
-  d->length = totalBlocks / d->sampleRate;
+  d->length = d->sampleRate > 0 ? totalBlocks / d->sampleRate : 0;
   d->bitrate = d->length > 0 ? ((d->streamLength * 8L) / d->length) / 1000 : 0;
 }
 
 void APE::Properties::analyzeOld()
 {

Vulnerable code:   d->length = totalBlocks / d->sampleRate;
Fixed code:   d->length = d->sampleRate > 0 ? totalBlocks / d->sampleRate : 0;