Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-19841: Out-of-bounds Read (CWE-125)
value: The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2018-12-04T09:29Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: src/open_utils.c
Commit date: 2018-11-29 21:53:51 -0800
Commit message: issue #54: fix potential out-of-bounds heap read

Diff: diff --git a/src/open_utils.c b/src/open_utils.c
index 80051fc..4fe0d67 100644
--- a/src/open_utils.c
+++ b/src/open_utils.c
@@ -1256,17 +1256,17 @@ int WavpackVerifySingleBlock (unsigned char *buffer, int verify_checksum)
 
             WavpackLittleEndianToNative ((WavpackHeader *) buffer, WavpackHeaderFormat);
 #endif
 
             if (meta_bc == 4) {
-                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff))
+                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))
                     return FALSE;
             }
             else {
                 csum ^= csum >> 16;
 
-                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff))
+                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff))
                     return FALSE;
             }
 
             checksum_passed++;
         }

Vulnerable code:                 if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff))
                if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff))
Fixed code:                 if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))
                if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff))
CVE-2018-7253: Out-of-bounds Read (CWE-125)
value: The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2018-02-19T23:29Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: cli/dsdiff.c
Commit date: 2018-02-10 16:01:39 -0800
Commit message: issue #28, do not overwrite heap on corrupt DSDIFF file

Diff: diff --git a/cli/dsdiff.c b/cli/dsdiff.c
index 410dc1c..c016df9 100644
--- a/cli/dsdiff.c
+++ b/cli/dsdiff.c
@@ -151,11 +151,21 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
 
             if (debug_logging_mode)
                 error_line ("dsdiff file version = 0x%08x", version);
         }
         else if (!strncmp (dff_chunk_header.ckID, "PROP", 4)) {
-            char *prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
+            char *prop_chunk;
+
+            if (dff_chunk_header.ckDataSize < 4 || dff_chunk_header.ckDataSize > 1024) {
+                error_line ("%s is not a valid .DFF file!", infilename);
+                return WAVPACK_SOFT_ERROR;
+            }
+
+            if (debug_logging_mode)
+                error_line ("got PROP chunk of %d bytes total", (int) dff_chunk_header.ckDataSize);
+
+            prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
 
             if (!DoReadFile (infile, prop_chunk, (uint32_t) dff_chunk_header.ckDataSize, &bcount) ||
                 bcount != dff_chunk_header.ckDataSize) {
                     error_line ("%s is not a valid .DFF file!", infilename);
                     free (prop_chunk);

Vulnerable code:             char *prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
Fixed code:             char *prop_chunk;

            if (dff_chunk_header.ckDataSize < 4 || dff_chunk_header.ckDataSize > 1024) {
                error_line ("%s is not a valid .DFF file!", infilename);
                return WAVPACK_SOFT_ERROR;
            }

            if (debug_logging_mode)
                error_line ("got PROP chunk of %d bytes total", (int) dff_chunk_header.ckDataSize);

            prop_chunk = malloc ((size_t) dff_chunk_header.ckDataSize);
CVE-2019-1010317: Use of Uninitialized Resource (CWE-908)
value: WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseCaffHeaderConfig (caff.c:486). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/f68a9555b548306c5b1ee45199ccdc4a16a6101b.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 5.5
Published: 2019-07-11T20:15Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: cli/caff.c
Commit date: 2019-03-04 21:09:41 -0800
Commit message: issue #66: make sure CAF files have a "desc" chunk

Diff: diff --git a/cli/caff.c b/cli/caff.c
index 2a5e2d92..a35da742 100644
--- a/cli/caff.c
+++ b/cli/caff.c
@@ -150,11 +150,11 @@ static struct {
 
 #define NUM_LAYOUTS (sizeof (layouts) / sizeof (layouts [0]))
 
 int ParseCaffHeaderConfig (FILE *infile, char *infilename, char *fourcc, WavpackContext *wpc, WavpackConfig *config)
 {
-    uint32_t chan_chunk = 0, channel_layout = 0, bcount;
+    uint32_t chan_chunk = 0, desc_chunk = 0, channel_layout = 0, bcount;
     unsigned char *channel_identities = NULL;
     unsigned char *channel_reorder = NULL;
     int64_t total_samples = 0, infilesize;
     CAFFileHeader caf_file_header;
     CAFChunkHeader caf_chunk_header;
@@ -216,10 +216,11 @@ int ParseCaffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpack
                     error_line ("%s", WavpackGetErrorMessage (wpc));
                     return WAVPACK_SOFT_ERROR;
             }
 
             WavpackBigEndianToNative (&caf_audio_format, CAFAudioFormatFormat);
+            desc_chunk = 1;
 
             if (debug_logging_mode) {
                 char formatstr [5];
 
                 memcpy (formatstr, caf_audio_format.mFormatID, 4);
@@ -456,11 +457,11 @@ int ParseCaffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpack
             free (caf_channel_layout);
         }
         else if (!strncmp (caf_chunk_header.mChunkType, "data", 4)) {     // on the data chunk, get size and exit loop
             uint32_t mEditCount;
 
-            if (!DoReadFile (infile, &mEditCount, sizeof (mEditCount), &bcount) ||
+            if (!desc_chunk || !DoReadFile (infile, &mEditCount, sizeof (mEditCount), &bcount) ||
                 bcount != sizeof (mEditCount)) {
                     error_line ("%s is not a valid .CAF file!", infilename);
                     return WAVPACK_SOFT_ERROR;
             }
             else if (!(config->qmode & QMODE_NO_STORE_WRAPPER) &&

Vulnerable code:     uint32_t chan_chunk = 0, channel_layout = 0, bcount;
            if (!DoReadFile (infile, &mEditCount, sizeof (mEditCount), &bcount) ||
Fixed code:     uint32_t chan_chunk = 0, desc_chunk = 0, channel_layout = 0, bcount;
            desc_chunk = 1;
            if (!desc_chunk || !DoReadFile (infile, &mEditCount, sizeof (mEditCount), &bcount) ||
CVE-2019-1010319: Use of Uninitialized Resource (CWE-908)
value: WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component is: ParseWave64HeaderConfig (wave64.c:211). The attack vector is: Maliciously crafted .wav file. The fixed version is: After commit https://github.com/dbry/WavPack/commit/33a0025d1d63ccd05d9dbaa6923d52b1446a62fe.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 5.5
Published: 2019-07-11T20:15Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: cli/wave64.c
Commit date: 2019-03-05 21:21:48 -0800
Commit message: issue #68: clear WaveHeader at start to prevent uninitialized read

Diff: diff --git a/cli/wave64.c b/cli/wave64.c
index 7beffe6e..59548b13 100644
--- a/cli/wave64.c
+++ b/cli/wave64.c
@@ -54,10 +54,11 @@ int ParseWave64HeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
     Wave64FileHeader filehdr;
     WaveHeader WaveHeader;
     int format_chunk = 0;
     uint32_t bcount;
 
+    CLEAR (WaveHeader);
     infilesize = DoGetFileSize (infile);
     memcpy (&filehdr, fourcc, 4);
 
     if (!DoReadFile (infile, ((char *) &filehdr) + 4, sizeof (Wave64FileHeader) - 4, &bcount) ||
         bcount != sizeof (Wave64FileHeader) - 4 || memcmp (filehdr.ckID, riff_guid, sizeof (riff_guid)) ||

Fixed code:     CLEAR (WaveHeader);
CVE-2019-11498: Access of Uninitialized Pointer (CWE-824)
value: WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 6.5
Published: 2019-04-24T05:29Z
Repository: https://github.com/dbry/WavPack
Language: C
Files changed: cli/dsdiff.c
Commit date: 2019-03-05 21:32:27 -0800
Commit message: issue #67: make sure sample rate is specified and non-zero in DFF files

Diff: diff --git a/cli/dsdiff.c b/cli/dsdiff.c
index f357181c..193adeec 100644
--- a/cli/dsdiff.c
+++ b/cli/dsdiff.c
@@ -179,11 +179,11 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
             }
 
             if (!strncmp (prop_chunk, "SND ", 4)) {
                 char *cptr = prop_chunk + 4, *eptr = prop_chunk + dff_chunk_header.ckDataSize;
                 uint16_t numChannels = 0, chansSpecified, chanMask = 0;
-                uint32_t sampleRate;
+                uint32_t sampleRate = 0;
 
                 while (eptr - cptr >= sizeof (dff_chunk_header)) {
                     memcpy (&dff_chunk_header, cptr, sizeof (dff_chunk_header));
                     cptr += sizeof (dff_chunk_header);
                     WavpackBigEndianToNative (&dff_chunk_header, DFFChunkHeaderFormat);
@@ -278,11 +278,11 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
 
             free (prop_chunk);
         }
         else if (!strncmp (dff_chunk_header.ckID, "DSD ", 4)) {
 
-            if (!config->num_channels) {
+            if (!config->num_channels || !config->sample_rate) {
                 error_line ("%s is not a valid .DFF file!", infilename);
                 return WAVPACK_SOFT_ERROR;
             }
 
             total_samples = dff_chunk_header.ckDataSize / config->num_channels;

Vulnerable code:                 uint32_t sampleRate;
            if (!config->num_channels) {
Fixed code:                 uint32_t sampleRate = 0;
            if (!config->num_channels || !config->sample_rate) {
CVE-2024-27297: Insufficient Information (NVD-CWE-noinfo)
value: Nix is a package manager for Linux and other Unix systems. A fixed-output derivations on Linux can send file descriptors to files in the Nix store to another program running on the host (or another fixed-output derivation) via Unix domain sockets in the abstract namespace. This allows to modify the output of the derivation, after Nix has registered the path as "valid" and immutable in the Nix database. In particular, this allows the output of fixed-output derivations to be modified from their expected content. This issue has been addressed in versions 2.3.18 2.18.2 2.19.4 and 2.20.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-11T22:15Z
Repository: https://github.com/NixOS/nix
Language: Unknown
Commit date: 2024-03-07 11:56:24 +0100
Commit message: Merge pull request from GHSA-2ffj-w4mj-pg37

Sandbox escape 2.20
CVE-2020-15155: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 7.3
Published: 2020-08-28T22:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2020-08-19 16:36:04 +0900
Commit message: Merge pull request from GHSA-4r3m-j6x5-48m3

fix security/advisories/GHSA-4r3m-j6x5-48m3
CVE-2020-15159: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 7.6
Published: 2020-08-28T22:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2020-08-25 12:04:37 +0900
Commit message: Merge pull request from GHSA-673x-f5wx-fxpw

fix security/advisories/GHSA-4r3m-j6x5-48m3
CVE-2020-15273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 8.1
Published: 2020-10-30T19:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2020-10-25 19:54:26 +0900
Commit message: Merge pull request from GHSA-wpww-4jf4-4hx8

テーマ編集の許可設定値を追加、デフォルトでは編集不可
CVE-2020-15276: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 8.7
Published: 2020-10-30T19:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2020-10-29 11:40:47 +0900
Commit message: Merge pull request from GHSA-fw5q-j9p4-3vxg

ブログコメントの名前表示を改善
CVE-2020-15277: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2020-10-30T18:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2020-10-29 11:41:25 +0900
Commit message: Merge pull request from GHSA-6fmv-q269-55cw

fix #1531 1532 1533 #1534 管理画面の文字列出力を改善
CVE-2021-41279: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2021-11-26T18:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2021-11-25 15:19:42 +0900
Commit message: Merge pull request from GHSA-4x2f-54wr-4hjg

* 固定ページプレビュー実行時に入力内容検証を追加

* SimpleZipの利用を停止しZipArchiveの利用に切り替え

* 不要コード除去

* BcZip利用時、ZipArchiveをopenしていない場合エラーログが出力される問題を改善
CVE-2022-39325: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management system of baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. Users of baserCMS are advised to upgrade as soon as possible. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-11-25T20:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2022-11-24 16:07:00 +0900
Commit message: Merge remote-tracking branch 'basercms-ghsa-395x-wv32-44v5/advisory-fix-1' into dev-4
CVE-2023-25654: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-03-23T20:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: lib/Baser/Model/BcAppModel.php
Commit date: 2023-02-27 17:25:17 +0900
Commit message: fix CVE-2023-25654

ファイル更新時のValidationを改善

Diff: diff --git a/lib/Baser/Model/BcAppModel.php b/lib/Baser/Model/BcAppModel.php
index ef6eefa95e..b7f967bb61 100755
--- a/lib/Baser/Model/BcAppModel.php
+++ b/lib/Baser/Model/BcAppModel.php
@@ -930,18 +930,26 @@ class BcAppModel extends Model
 	 * @param string $ext 許可する拡張子
 	 */
 	public function fileExt($check, $exts)
 	{
 		$file = $check[key($check)];
+		if (!is_array($exts)) {
+			$exts = explode(',', $exts);
+		}
+
+		// FILES形式のチェック
 		if (!empty($file['name'])) {
-			if (!is_array($exts)) {
-				$exts = explode(',', $exts);
-			}
 			$ext = decodeContent($file['type'], $file['name']);
-			if (in_array($ext, $exts)) {
-				return true;
-			} else {
+			if (!in_array($ext, $exts)) {
+				return false;
+			}
+		}
+
+		// 更新時の文字列チェック
+		if (is_string($file)) {
+			$ext = pathinfo($file, PATHINFO_EXTENSION);
+			if (!in_array($ext, $exts)) {
 				return false;
 			}
 		}
 		return true;
 	}

Vulnerable code: 			if (!is_array($exts)) {
				$exts = explode(',', $exts);
			}
			if (in_array($ext, $exts)) {
				return true;
			} else {
Fixed code: 		if (!is_array($exts)) {
			$exts = explode(',', $exts);
		}

		// FILES形式のチェック
			if (!in_array($ext, $exts)) {
				return false;
			}
		}

		// 更新時の文字列チェック
		if (is_string($file)) {
			$ext = pathinfo($file, PATHINFO_EXTENSION);
			if (!in_array($ext, $exts)) {
CVE-2023-25654: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-03-23T20:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: lib/Baser/Model/BcAppModel.php
Commit date: 2023-03-10 13:56:48 +0900
Commit message: fix CVE-2023-25654

戻り値が変更されてしまう挙動を修正

Diff: diff --git a/lib/Baser/Model/BcAppModel.php b/lib/Baser/Model/BcAppModel.php
index b7f967bb61..c6158a5d1e 100755
--- a/lib/Baser/Model/BcAppModel.php
+++ b/lib/Baser/Model/BcAppModel.php
@@ -943,11 +943,11 @@ class BcAppModel extends Model
 				return false;
 			}
 		}
 
 		// 更新時の文字列チェック
-		if (is_string($file)) {
+		if (!empty($file) && is_string($file)) {
 			$ext = pathinfo($file, PATHINFO_EXTENSION);
 			if (!in_array($ext, $exts)) {
 				return false;
 			}
 		}

Vulnerable code: 		if (is_string($file)) {
Fixed code: 		if (!empty($file) && is_string($file)) {
CVE-2023-25654: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-03-23T20:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2023-03-23 16:14:23 +0900
Commit message: Merge pull request from GHSA-h4cc-fxpp-pgw9

fix CVE-2023-25654
CVE-2023-25655: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-03-23T20:15Z
Repository: https://github.com/baserproject/basercms
Language: Unknown
Commit date: 2023-03-23 16:14:44 +0900
Commit message: Merge pull request from GHSA-mfvg-qwcw-qvc8

fix CVE-2023-25655
CVE-2023-51450: Insufficient Information (NVD-CWE-noinfo)
value: baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-22T15:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
Commit date: 2024-02-22 15:20:00 +0900
Commit message: Merge pull request from GHSA-jjxq-m8h3-4vw5


Diff: diff --git a/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php b/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
index fa5df4a33ed..4bf1cae7606 100644
--- a/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
+++ b/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
@@ -61,11 +61,11 @@ class BcAdminFormHelper extends BcFormHelper
                         'deleteSpan' => ['class' => 'bca-file__delete'],
                         'deleteCheckbox' => ['class' => 'bca-file__delete-input', 'id' => true],
                         'deleteLabel' => ['class' => 'bca-file__delete-label'],
                         'figure' => ['class' => 'bca-file__figure'],
                         'img' => ['class' => 'bca-file__img'],
-                        'figcaption' => ['class' => 'bca-file__figcaption']
+                        'figcaption' => ['class' => 'bca-file__figcaption', 'escape' => true]
                     ], $options);
                     break;
                 case 'dateTimePicker':
                     $containerClass = 'bca-datetimepicker';
                     $options = array_replace_recursive([

Vulnerable code:                         'figcaption' => ['class' => 'bca-file__figcaption']
Fixed code:                         'figcaption' => ['class' => 'bca-file__figcaption', 'escape' => true]
CVE-2024-26128: Insufficient Information (NVD-CWE-noinfo)
value: baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the content management feature. Version 5.0.9 contains a fix for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-22T19:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
Commit date: 2024-02-22 15:20:00 +0900
Commit message: Merge pull request from GHSA-jjxq-m8h3-4vw5


Diff: diff --git a/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php b/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
index fa5df4a33ed..4bf1cae7606 100644
--- a/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
+++ b/plugins/baser-core/src/View/Helper/BcAdminFormHelper.php
@@ -61,11 +61,11 @@ class BcAdminFormHelper extends BcFormHelper
                         'deleteSpan' => ['class' => 'bca-file__delete'],
                         'deleteCheckbox' => ['class' => 'bca-file__delete-input', 'id' => true],
                         'deleteLabel' => ['class' => 'bca-file__delete-label'],
                         'figure' => ['class' => 'bca-file__figure'],
                         'img' => ['class' => 'bca-file__img'],
-                        'figcaption' => ['class' => 'bca-file__figcaption']
+                        'figcaption' => ['class' => 'bca-file__figcaption', 'escape' => true]
                     ], $options);
                     break;
                 case 'dateTimePicker':
                     $containerClass = 'bca-datetimepicker';
                     $options = array_replace_recursive([

Vulnerable code:                         'figcaption' => ['class' => 'bca-file__figcaption']
Fixed code:                         'figcaption' => ['class' => 'bca-file__figcaption', 'escape' => true]
CVE-2016-9121: Inadequate Encryption Strength (CWE-326)
value: go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 9.1
Published: 2017-03-28T02:59Z
Repository: https://github.com/square/go-jose
Language: Unknown
Commit date: 2016-08-31 11:56:16 -0700
Commit message: Merge branch 'cs/164590'

* cs/164590:
  Check for invalid ECDH keys in headers, JWKs
  Do not accept invalid public keys in DeriveECDHES function

Diff: diff --cc jwk.go
index bbed805,effd329..17f9a98
--- a/jwk.go
+++ b/jwk.go
@@@ -21,16 -21,15 +21,17 @@@ import 
  	"crypto/ecdsa"
  	"crypto/elliptic"
  	"crypto/rsa"
  	"crypto/x509"
  	"encoding/base64"
+ 	"errors"
  	"fmt"
  	"math/big"
  	"reflect"
  	"strings"
 +
 +	"github.com/square/go-jose/json"
  )
  
  // rawJsonWebKey represents a public or private key in JWK format, used for parsing/serializing.
  type rawJsonWebKey struct {
  	Use string      `json:"use,omitempty"`
CVE-2016-9122: Improper Access Control (CWE-284)
value: go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 7.5
Published: 2017-03-28T02:59Z
Repository: https://github.com/square/go-jose
Language: Unknown
Commit date: 2016-09-22 16:24:13 -0700
Commit message: Merge pull request #111 from square/cs/better-multi

Improve multi-recipient/multi-sig handling
CVE-2017-20185: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Fuzzy SWMP. It has been rated as problematic. This issue affects some unknown processing of the file swmp.php of the component GET Parameter Handler. The manipulation of the argument theme leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 792bcab637cb8c3bd251d8fc8771512c5329a93e. It is recommended to apply a patch to fix this issue. The identifier VDB-230669 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-06T02:15Z
Repository: https://github.com/fuzzymannerz/swmp
Language: PHP
Files changed: php/swmp.php
Commit date: 2017-05-26 09:24:48 +0200
Commit message: Fixed an XSS vulnerability and 'Undefined index' error for 'theme' GET parameter (#12)

* Fixed an 'index not found' error when there is no 'theme' parameter in the URL

* Fixes XSS vulnerability with `theme` URL parameter and reverts to default theme if theme doesn't exist.

Diff: diff --git a/php/swmp.php b/php/swmp.php
index d7f4588..2d667be 100644
--- a/php/swmp.php
+++ b/php/swmp.php
@@ -48,11 +48,10 @@ $cputemp       = getCpuTemperature($all_errors);
 
 $cpudata = getCpuLoadData($all_errors);
 
 $ramdata = getRamInfo($all_errors);
 
-
 $swap = getSwapData($all_errors);
 $network = getNetworkData($all_errors);
 $disk = getDiskData($all_errors);
 
 //===================================================
@@ -73,8 +72,11 @@ $wtitle = str_replace("{kernel}", $kernel, $wtitle);
 
 //===================================================
 
 // Allow the user to specify the theme in the address
 
-if ($_GET['theme']) {
-    $config['theme'] = $_GET['theme'];
+if (isset($_GET['theme'])) {
+    $theme = basename($_GET['theme']);
+    
+    if(file_exists("css/themes/{$theme}.css"))
+        $config['theme'] = $theme;
 }

Vulnerable code: 
if ($_GET['theme']) {
    $config['theme'] = $_GET['theme'];
Fixed code: if (isset($_GET['theme'])) {
    $theme = basename($_GET['theme']);
    
    if(file_exists("css/themes/{$theme}.css"))
        $config['theme'] = $theme;
CVE-2018-8050: Improper Input Validation (CWE-20)
value: The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2018-03-11T06:29Z
Repository: https://github.com/sshock/AFFLIBv3
Language: C++
Files changed: lib/afflib_pages.cpp
Commit date: 2018-03-10 18:05:39 -0700
Commit message: Sanity check size passed to malloc...

Add sanity check before calling malloc in af_get_page() function to
avoid undefined behavior (e.g., seg fault) when dealing with a corrupt
AFF image with an invalid pagesize.

Issue found by Luis Rocha (luiscrocha@gmail.com).

Diff: diff --git a/lib/afflib_pages.cpp b/lib/afflib_pages.cpp
index 2569c2a..f8cf775 100644
--- a/lib/afflib_pages.cpp
+++ b/lib/afflib_pages.cpp
@@ -217,10 +217,15 @@ int af_get_page(AFFILE *af,int64_t pagenum,unsigned char *data,size_t *bytes)
 	if(af_get_page_raw(af,pagenum,&pageflag,compressed_data,&compressed_data_len)){
 	    free(compressed_data);
 	    return -3;			// read error
 	}
 
+	/* Sanity check to avoid undefined behaviour when calling malloc below with pagesize from a corrupt AFF image. */
+	if(af->image_pagesize <= 0 || af->image_pagesize > 16*1024*1024)
+	    return -1;
+
+
 	/* Now uncompress directly into the buffer provided by the caller, unless the caller didn't
 	 * provide a buffer. If that happens, allocate our own...
 	 */
 	int res = -1;			// 0 is success
 	bool free_data = false;

Fixed code: 	/* Sanity check to avoid undefined behaviour when calling malloc below with pagesize from a corrupt AFF image. */
	if(af->image_pagesize <= 0 || af->image_pagesize > 16*1024*1024)
	    return -1;
CVE-2021-23351: Insufficient Information (NVD-CWE-noinfo)
value: The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.9
Published: 2021-03-08T05:15Z
Repository: https://github.com/pires/go-proxyproto
Language: Unknown
Commit date: 2021-03-04 10:33:45 +0000
Commit message: Merge pull request #71 from isedev/feature/issue-69-tests

Disallow header parsing beyond 107 bytes
CVE-2023-35784: Double Free (CWE-415)
value: A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 9.8
Published: 2023-06-16T20:15Z
Repository: https://github.com/libressl/openbsd
Language: C
Files changed: src/lib/libssl/s3_lib.c
Commit date: 2023-05-16 14:10:43 +0000
Commit message: add missing pointer invalidation

ok tb

Diff: diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 9e76cf93d..4229b2e9e 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: s3_lib.c,v 1.242 2022/11/26 16:08:55 tb Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.243 2023/05/16 14:10:43 jcs Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
@@ -1578,10 +1578,11 @@ ssl3_free(SSL *s)
 
 	tls_buffer_free(s->s3->hs.tls13.quic_read_buffer);
 
 	sk_X509_NAME_pop_free(s->s3->hs.tls12.ca_names, X509_NAME_free);
 	sk_X509_pop_free(s->verified_chain, X509_free);
+	s->verified_chain = NULL;
 
 	tls1_transcript_free(s);
 	tls1_transcript_hash_free(s);
 
 	free(s->s3->alpn_selected);

Vulnerable code: /* $OpenBSD: s3_lib.c,v 1.242 2022/11/26 16:08:55 tb Exp $ */
Fixed code: /* $OpenBSD: s3_lib.c,v 1.243 2023/05/16 14:10:43 jcs Exp $ */
	s->verified_chain = NULL;
CVE-2023-35784: Use After Free (CWE-416)
value: A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2023-06-16T20:15Z
Repository: https://github.com/libressl/openbsd
Language: C
Files changed: src/lib/libssl/s3_lib.c
Commit date: 2023-05-16 14:10:43 +0000
Commit message: add missing pointer invalidation

ok tb

Diff: diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 9e76cf93d..4229b2e9e 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: s3_lib.c,v 1.242 2022/11/26 16:08:55 tb Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.243 2023/05/16 14:10:43 jcs Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
@@ -1578,10 +1578,11 @@ ssl3_free(SSL *s)
 
 	tls_buffer_free(s->s3->hs.tls13.quic_read_buffer);
 
 	sk_X509_NAME_pop_free(s->s3->hs.tls12.ca_names, X509_NAME_free);
 	sk_X509_pop_free(s->verified_chain, X509_free);
+	s->verified_chain = NULL;
 
 	tls1_transcript_free(s);
 	tls1_transcript_hash_free(s);
 
 	free(s->s3->alpn_selected);

Vulnerable code: /* $OpenBSD: s3_lib.c,v 1.242 2022/11/26 16:08:55 tb Exp $ */
Fixed code: /* $OpenBSD: s3_lib.c,v 1.243 2023/05/16 14:10:43 jcs Exp $ */
	s->verified_chain = NULL;
CVE-2017-16759: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.9
Published: 2017-11-09T22:29Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: html/install.php, includes/dbFacile.php
Commit date: 2017-08-18 21:29:12 +0100
Commit message: security: Security Patch to deal with reported vulnerabilties (#7164)

* WIP: Security Patch

* Update install.php

Styling fix

* Update install.php

* Update dbFacile.php

* Fix whitespace

Diff: diff --git a/html/install.php b/html/install.php
index 26d92b278..139876554 100644
--- a/html/install.php
+++ b/html/install.php
@@ -1,10 +1,10 @@
 <?php
 session_start();
 if (empty($_POST) && !empty($_SESSION) && !isset($_REQUEST['stage'])) {
     $_POST = $_SESSION;
-} else {
+} elseif (!file_exists("../config.php")) {
     $_SESSION = array_replace($_SESSION, $_POST);
 }
 
 $stage = isset($_POST['stage']) ? $_POST['stage'] : 0;
 
@@ -50,11 +50,13 @@ $add_email = @$_POST['add_email'] ?: '';
 
 
 // Check we can connect to MySQL DB, if not, back to stage 1 :)
 if ($stage > 1) {
     try {
-        dbConnect();
+        if ($stage != 6) {
+            dbConnect();
+        }
         if ($stage == 2 && $_SESSION['build-ok'] == true) {
             $stage = 3;
             $msg = "It appears that the database is already setup so have moved onto stage $stage";
         }
     } catch (\LibreNMS\Exceptions\DatabaseConnectException $e) {
diff --git a/includes/dbFacile.php b/includes/dbFacile.php
index 4c617d032..f2376dd76 100644
--- a/includes/dbFacile.php
+++ b/includes/dbFacile.php
@@ -56,10 +56,11 @@ function dbConnect($host = null, $user = '', $password = '', $database = '', $po
     $database = empty($database) ? $config['db_name'] : $database;
     $port = empty($port) ? $config['db_port'] : $port;
     $socket = empty($socket) ? $config['db_socket'] : $socket;
 
     $database_link = mysqli_connect('p:' . $host, $user, $password, null, $port, $socket);
+    mysqli_options($database_link, MYSQLI_OPT_LOCAL_INFILE, false);
     if ($database_link === false) {
         $error = mysqli_connect_error();
         if ($error == 'No such file or directory') {
             $error = 'Could not connect to ' . $host;
         }

Vulnerable code: } else {
        dbConnect();
Fixed code: } elseif (!file_exists("../config.php")) {
        if ($stage != 6) {
            dbConnect();
        }
    mysqli_options($database_link, MYSQLI_OPT_LOCAL_INFILE, false);
CVE-2017-16759: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.9
Published: 2017-11-09T22:29Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: html/install.php, includes/dbFacile.php
Commit date: 2017-08-18 21:49:31 +0100
Commit message: security: Security Patch to deal with reported vulnerabilties (#7164)

* WIP: Security Patch

* Update install.php

Styling fix

* Update install.php

* Update dbFacile.php

* Fix whitespace

Diff: diff --git a/html/install.php b/html/install.php
index 06769f44a..47a751f0a 100644
--- a/html/install.php
+++ b/html/install.php
@@ -1,10 +1,10 @@
 <?php
 session_start();
 if (empty($_POST) && !empty($_SESSION) && !isset($_REQUEST['stage'])) {
     $_POST = $_SESSION;
-} else {
+} elseif (!file_exists("../config.php")) {
     $_SESSION = array_replace($_SESSION, $_POST);
 }
 
 $stage = isset($_POST['stage']) ? $_POST['stage'] : 0;
 
@@ -50,11 +50,13 @@ $add_email = @$_POST['add_email'] ?: '';
 
 
 // Check we can connect to MySQL DB, if not, back to stage 1 :)
 if ($stage > 1) {
     try {
-        dbConnect();
+        if ($stage != 6) {
+            dbConnect();
+        }
         if ($stage == 2 && $_SESSION['build-ok'] == true) {
             $stage = 3;
             $msg = "It appears that the database is already setup so have moved onto stage $stage";
         }
     } catch (\LibreNMS\Exceptions\DatabaseConnectException $e) {
diff --git a/includes/dbFacile.php b/includes/dbFacile.php
index 4c617d032..f2376dd76 100644
--- a/includes/dbFacile.php
+++ b/includes/dbFacile.php
@@ -56,10 +56,11 @@ function dbConnect($host = null, $user = '', $password = '', $database = '', $po
     $database = empty($database) ? $config['db_name'] : $database;
     $port = empty($port) ? $config['db_port'] : $port;
     $socket = empty($socket) ? $config['db_socket'] : $socket;
 
     $database_link = mysqli_connect('p:' . $host, $user, $password, null, $port, $socket);
+    mysqli_options($database_link, MYSQLI_OPT_LOCAL_INFILE, false);
     if ($database_link === false) {
         $error = mysqli_connect_error();
         if ($error == 'No such file or directory') {
             $error = 'Could not connect to ' . $host;
         }

Vulnerable code: } else {
        dbConnect();
Fixed code: } elseif (!file_exists("../config.php")) {
        if ($stage != 6) {
            dbConnect();
        }
    mysqli_options($database_link, MYSQLI_OPT_LOCAL_INFILE, false);
CVE-2020-15877: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2020-07-21T17:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: routes/web.php
Commit date: 2020-07-08 18:04:48 -0500
Commit message: Fix settings access (#11915)

normal users could access
Diff: diff --git a/routes/web.php b/routes/web.php
index 7985cbe7e3..6b8fc2e01c 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -41,11 +41,11 @@ Route::group(['middleware' => ['auth'], 'guard' => 'auth'], function () {
     Route::group(['prefix' => 'maps', 'namespace' => 'Maps'], function () {
         Route::get('devicedependency', 'DeviceDependencyController@dependencyMap');
     });
 
     // admin pages
-    Route::group(['guard' => 'admin'], function () {
+    Route::group(['middleware' => ['can:admin']], function () {
         Route::get('settings/{tab?}/{section?}', 'SettingsController@index')->name('settings');
         Route::put('settings/{name}', 'SettingsController@update')->name('settings.update');
         Route::delete('settings/{name}', 'SettingsController@destroy')->name('settings.destroy');
     });
 

Vulnerable code:     Route::group(['guard' => 'admin'], function () {
Fixed code:     Route::group(['middleware' => ['can:admin']], function () {