Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-32661: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.3
Published: 2021-06-03T18:15Z
Repository: https://github.com/backstage/backstage
Language: Other
Files changed: .changeset/techdocs-fresh-and-clean.md, .github/styles/vocab.txt
Commit date: 2021-05-31 18:01:38 +0200
Commit message: Initial changeset.

Signed-off-by: Eric Peterson <ericpeterson@spotify.com>

Diff: diff --git a/.changeset/techdocs-fresh-and-clean.md b/.changeset/techdocs-fresh-and-clean.md
new file mode 100644
index 000000000..52d9988c3
--- /dev/null
+++ b/.changeset/techdocs-fresh-and-clean.md
@@ -0,0 +1,6 @@
+---
+'@backstage/techdocs-common': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...
diff --git a/.github/styles/vocab.txt b/.github/styles/vocab.txt
index b8f028a2a..d91b84029 100644
--- a/.github/styles/vocab.txt
+++ b/.github/styles/vocab.txt
@@ -208,10 +208,11 @@ routable
 Routable
 rst
 rsync
 ruleset
 sam
+sanitization
 scaffolded
 scaffolder
 Scaffolder
 seb
 semlas

Fixed code: ---
'@backstage/techdocs-common': patch
'@backstage/plugin-techdocs': patch
---

Fixes multiple XSS and sanitization bypass vulnerabilities in TechDocs. For details, see [ link to security advisories here ] ...
sanitization
CVE-2023-25571: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4, and `@backstage/plugin-catalog-backend` prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack.

This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` version 1.2.0 and greater will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same. In addition, the catalog model v0.12.4 and greater as well as the catalog backend v1.7.2 and greater now has additional validation built in that prevents `javascript:` URLs in known annotations. As a workaround, the general practice of limiting access to modifying catalog content and requiring code reviews greatly help mitigate this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-02-14T18:15Z
Repository: https://github.com/backstage/backstage
Language: Unknown
Commit date: 2023-02-14 14:21:23 +0100
Commit message: Merge pull request from GHSA-7hv8-3fr9-j2hv

catalog xss fixes
CVE-2023-35926: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities  that may not have a fix, the plugin has switched to using a different sandbox library. A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data. This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.9
Published: 2023-06-22T14:15Z
Repository: https://github.com/backstage/backstage
Language: TypeScript
Files changed: plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
Commit date: 2023-06-16 14:01:45 +0200
Commit message: feat: replace vm2 sandbox with isolated-vm

Co-authored-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Johan Haals <johan.haals@gmail.com>
Signed-off-by: blam <ben@blam.sh>

Diff: diff --git a/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts b/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
index 0a553665c91..488604e9812 100644
--- a/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
+++ b/plugins/scaffolder-backend/src/lib/templating/SecureTemplater.ts
@@ -113,10 +113,11 @@ export class SecureTemplater {
     const {
       cookiecutterCompat,
       templateFilters = {},
       templateGlobals = {},
     } = options;
+
     const isolate = new Isolate({ memoryLimit: 128 });
     const context = await isolate.createContext();
     const contextGlobal = context.global;
 
     const nunjucksSource = await fs.readFile(
CVE-2015-10131: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-03-31T06:15Z
Repository: https://github.com/wp-plugins/tfo-graphviz
Language: PHP
Files changed: tfo-graphviz-admin.php
Commit date: 2015-05-24 00:19:55 +0000
Commit message: fix possible XSS vector


git-svn-id: https://plugins.svn.wordpress.org/tfo-graphviz/trunk@1166455 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/tfo-graphviz-admin.php b/tfo-graphviz-admin.php
index 615cc3b..f7fc0c3 100644
--- a/tfo-graphviz-admin.php
+++ b/tfo-graphviz-admin.php
@@ -96,11 +96,11 @@ class TFO_Graphviz_Admin extends TFO_Graphviz {
 		}
 
 		check_admin_referer('tfo-graphviz');
 
 		if ($this->update(stripslashes_deep($_POST['tfo-graphviz']))) {
-			wp_redirect(add_query_arg('updated', '', wp_get_referer()));
+			wp_redirect(esc_url_raw(add_query_arg('updated', '', wp_get_referer())));
 			exit;
 		}
 	}
 
 
@@ -343,11 +343,11 @@ tr.tfo-graphviz-method-<?php echo $current_method; ?> {
 	<div class='wrap'>
 	<h2><?php _e( 'TFO Graphviz Options', 'tfo-graphviz' ); ?></h2>
 
 	<?php if ( empty( $errors ) ) $this->test_image(); ?>
 
-	<form action="<?php echo clean_url( remove_query_arg( 'updated' ) ); ?>" method="post">
+	<form action="<?php echo esc_url( remove_query_arg( 'updated' ) ); ?>" method="post">
 
 	<table class="form-table">
 	<tbody>
 		<?php if ( empty( $errors ) ): ?>
 		<tr>

Vulnerable code: 			wp_redirect(add_query_arg('updated', '', wp_get_referer()));
	<form action="<?php echo clean_url( remove_query_arg( 'updated' ) ); ?>" method="post">
Fixed code: 			wp_redirect(esc_url_raw(add_query_arg('updated', '', wp_get_referer())));
	<form action="<?php echo esc_url( remove_query_arg( 'updated' ) ); ?>" method="post">
CVE-2019-5484: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2019-09-13T18:15Z
Repository: https://github.com/bower/bower
Language: JSON
Files changed: lib/util/extract.js, package.json
Commit date: 2019-01-23 22:14:48 +0100
Commit message: Fix .tar.gz extract vulnerability

Diff: diff --git a/lib/util/extract.js b/lib/util/extract.js
index 7ba285c..ac04f06 100644
--- a/lib/util/extract.js
+++ b/lib/util/extract.js
@@ -128,12 +128,12 @@ function extractGz(archive, dst) {
         });
 
     return deferred.promise;
 }
 
-function isSymlink(entry) {
-    return entry.type === 'SymbolicLink';
+function isSymlink(_, entry) {
+    return entry.type === 'symlink';
 }
 
 function filterSymlinks(entry) {
     return entry.type !== 'SymbolicLink';
 }
diff --git a/package.json b/package.json
index 4dd1bed..57820e5 100644
--- a/package.json
+++ b/package.json
@@ -92,11 +92,11 @@
   },
   "scripts": {
     "test": "grunt test",
     "ci": "grunt travis",
     "coveralls": "coveralls",
-    "prepublish": "in-publish && echo 'You need to use \"grunt publish\" to publish bower' && false || not-in-publish",
+    "prepublishOnly": "in-publish && echo 'You need to use \"grunt publish\" to publish bower' && false || not-in-publish",
     "format": "prettier --write --single-quote --tab-width 4 '**/*.js'",
     "precommit": "lint-staged"
   },
   "lint-staged": {
     "*.js": [

Vulnerable code: function isSymlink(entry) {
    return entry.type === 'SymbolicLink';
    "prepublish": "in-publish && echo 'You need to use \"grunt publish\" to publish bower' && false || not-in-publish",
Fixed code: function isSymlink(_, entry) {
    return entry.type === 'symlink';
    "prepublishOnly": "in-publish && echo 'You need to use \"grunt publish\" to publish bower' && false || not-in-publish",
CVE-2020-36619: Use of Externally-Controlled Format String (CWE-134)
value: A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 9.8
Published: 2022-12-19T14:15Z
Repository: https://github.com/EliasOenal/multimon-ng
Language: C
Files changed: demod_flex.c
Commit date: 2020-05-31 18:24:00 -0400
Commit message: Remove uncontrolled format string vulnerability

Diff: diff --git a/demod_flex.c b/demod_flex.c
index 65a2520..2f3dbe8 100644
--- a/demod_flex.c
+++ b/demod_flex.c
@@ -556,10 +556,21 @@ unsigned int add_ch(unsigned char ch, unsigned char* buf, unsigned int idx) {
     if (ch == 0x0d && idx < (MAX_ALN - 2)) {  // '\r'
         buf[idx] = '\\';
         buf[idx + 1] = 'r';
         return 2;
     }
+    // unixinput.c::_verbprintf uses this output as a format string
+    // which introduces an uncontrolled format string vulnerability
+    // and also, generally, risks stack corruption
+    if (ch == '%') {
+        if (idx < (MAX_ALN - 2)) {
+            buf[idx] = '%';
+            buf[idx + 1] = '%';
+            return 2;
+        }
+        return 0;
+    }
     // only store ASCII printable
     if (ch >= 32 && ch <= 126) {
         buf[idx] = ch;
         return 1;
     }

Fixed code:     // unixinput.c::_verbprintf uses this output as a format string
    // which introduces an uncontrolled format string vulnerability
    // and also, generally, risks stack corruption
    if (ch == '%') {
        if (idx < (MAX_ALN - 2)) {
            buf[idx] = '%';
            buf[idx + 1] = '%';
            return 2;
        }
        return 0;
    }
CVE-2017-18594: Double Free (CWE-415)
value: nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.5
Published: 2019-08-29T00:15Z
Repository: https://github.com/nmap/nmap
Language: C++
Files changed: nse_libssh2.cc
Commit date: 2018-11-29 17:42:09 +0000
Commit message: Avoid a crash (double-free) when SSH connection fails

Diff: diff --git a/nse_libssh2.cc b/nse_libssh2.cc
index 6a18c0c85..983f83dbd 100644
--- a/nse_libssh2.cc
+++ b/nse_libssh2.cc
@@ -10,11 +10,10 @@
 extern "C" {
 #include "libssh2.h"
 }
 #include "nse_lua.h"
 
-#include "nse_debug.h"
 #include "nse_nsock.h"
 #include "nse_utility.h"
 
 #include <fcntl.h>
 #include <assert.h>
@@ -293,10 +292,11 @@ static int do_session_handshake (lua_State *L, int status, lua_KContext ctx) {
         lua_callk(L, 1, 0, 0, do_session_handshake);
     }
 
     if (rc) {
         libssh2_session_free(sshu->session);
+        sshu->session = NULL;
         return luaL_error(L, "Unable to complete libssh2 handshake.");
     }
 
     // lua_pushvalue(L, 3);
     lua_settop(L, 3);
@@ -476,11 +476,11 @@ static int userauth_list (lua_State *L, int status, lua_KContext ctx) {
 
     return 1;
 }
 
 /*
-* Returns list of supported authenication methods
+* Returns list of supported authentication methods
 */
 static int l_userauth_list (lua_State *L) {
     return userauth_list(L, 0, 0);
 }
 

Vulnerable code: #include "nse_debug.h"
* Returns list of supported authenication methods
Fixed code:         sshu->session = NULL;
* Returns list of supported authentication methods
CVE-2021-3666: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-09-13T18:15Z
Repository: https://github.com/fiznool/body-parser-xml
Language: Unknown
Commit date: 2021-05-19 11:06:13 +0100
Commit message: Fix prototype pollution vulnerability
CVE-2021-25971: Improper Handling of Exceptional Conditions (CWE-755)
value: In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 4.3
Published: 2021-10-20T12:15Z
Repository: https://github.com/owen2345/camaleon-cms
Language: Ruby
Files changed: app/uploaders/camaleon_cms_local_uploader.rb
Commit date: 2021-10-12 00:00:07 -0500
Commit message: Fix error when uploading an SVG with no size

Diff: diff --git a/app/uploaders/camaleon_cms_local_uploader.rb b/app/uploaders/camaleon_cms_local_uploader.rb
index ae966dc4..cc865b13 100644
--- a/app/uploaders/camaleon_cms_local_uploader.rb
+++ b/app/uploaders/camaleon_cms_local_uploader.rb
@@ -50,11 +50,11 @@ class CamaleonCmsLocalUploader < CamaleonCmsUploader
     res['key'] = File.join(res['folder_path'], res['name'])
     res["thumb"] = (is_private_uploader? ? '/admin/media/download_private_file?file=' + version_path(key).slice(1..-1) : version_path(res['url'])) if res['file_type'] == 'image' && File.extname(file_path).downcase != '.gif'
     if res['file_type'] == 'image'
       res["thumb"].sub! '.svg', '.jpg'
       im = MiniMagick::Image.open(file_path)
-      res['dimension'] = "#{im[:width]}x#{im[:height]}"
+      res['dimension'] = "#{im[:width]}x#{im[:height]}" rescue "0x0" # Malformed SVGs raise an exception here.
     end
     res
   end
 
   # save a file into local folder

Vulnerable code:       res['dimension'] = "#{im[:width]}x#{im[:height]}"
Fixed code:       res['dimension'] = "#{im[:width]}x#{im[:height]}" rescue "0x0" # Malformed SVGs raise an exception here.
CVE-2023-40013: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: SVG Loader is a javascript library that fetches SVGs using XMLHttpRequests and injects the SVG code in the tag's place. According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in Cross-site Scripting (XSS). When trying to sanitize the svg the lib removes event attributes such as `onmouseover`, `onclick` but the list of events is not exhaustive.  Any website which uses external-svg-loader and allows its users to provide svg src, upload svg files would be susceptible to stored XSS attack. This issue has been addressed in commit `d3562fc08` which is included in releases from 1.6.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-14T21:15Z
Repository: https://github.com/shubhamjain/svg-loader
Language: Unknown
Commit date: 2023-08-12 09:56:16 +0530
Commit message: Merge pull request from GHSA-xc2r-jf2x-gjr8

Fix XSS vulnerability
CVE-2018-1000073: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2018-03-13T15:29Z
Repository: https://github.com/rubygems/rubygems
Language: Ruby
Files changed: lib/rubygems/package.rb
Commit date: 2018-02-15 22:19:04 -0800
Commit message: Non-working patch for deducing symlinked base-dirs

Diff: diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
index dede959981..cb9c74a0fc 100644
--- a/lib/rubygems/package.rb
+++ b/lib/rubygems/package.rb
@@ -419,10 +419,12 @@ def install_location filename, destination_dir # :nodoc:
     destination_dir = File.realpath destination_dir if
       File.respond_to? :realpath
     destination_dir = File.expand_path destination_dir
 
     destination = File.join destination_dir, filename
+    destination = File.realpath destination if
+      File.respond_to? :realpath
     destination = File.expand_path destination
 
     raise Gem::Package::PathError.new(destination, destination_dir) unless
       destination.start_with? destination_dir + '/'
 

Fixed code:     destination = File.realpath destination if
      File.respond_to? :realpath
CVE-2018-1000078: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-13T15:29Z
Repository: https://github.com/rubygems/rubygems
Language: Ruby
Files changed: lib/rubygems/server.rb
Commit date: 2018-02-15 22:19:02 -0800
Commit message: Fix 289313

Diff: diff --git a/lib/rubygems/server.rb b/lib/rubygems/server.rb
index 93b3af36f8..31a6d0234e 100644
--- a/lib/rubygems/server.rb
+++ b/lib/rubygems/server.rb
@@ -630,11 +630,11 @@ def root(req, res)
         "doc_path"            => doc_root(spec.full_name),
         "executables"         => executables,
         "only_one_executable" => (executables && executables.size == 1),
         "full_name"           => spec.full_name,
         "has_deps"            => !deps.empty?,
-        "homepage"            => spec.homepage,
+        "homepage"            => (URI.parse(spec.homepage).is_a?(URI::HTTP) || URI.parse(spec.homepage).is_a?(URI::HTTPS)) ? spec.homepage : ".",
         "name"                => spec.name,
         "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,
         "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,
         "summary"             => spec.summary,
         "version"             => spec.version.to_s,

Vulnerable code:         "homepage"            => spec.homepage,
Fixed code:         "homepage"            => (URI.parse(spec.homepage).is_a?(URI::HTTP) || URI.parse(spec.homepage).is_a?(URI::HTTPS)) ? spec.homepage : ".",
CVE-2018-1000079: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2018-03-13T15:29Z
Repository: https://github.com/rubygems/rubygems
Language: Ruby
Files changed: lib/rubygems/package.rb
Commit date: 2018-02-15 22:19:02 -0800
Commit message: Add bug fix for #270068

Diff: diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
index 3ac5662b68..9d78544f92 100644
--- a/lib/rubygems/package.rb
+++ b/lib/rubygems/package.rb
@@ -422,11 +422,11 @@ def install_location filename, destination_dir # :nodoc:
 
     destination = File.join destination_dir, filename
     destination = File.expand_path destination
 
     raise Gem::Package::PathError.new(destination, destination_dir) unless
-      destination.start_with? destination_dir
+      destination.start_with? destination_dir + '/'
 
     destination.untaint
     destination
   end
 

Vulnerable code:       destination.start_with? destination_dir
Fixed code:       destination.start_with? destination_dir + '/'
CVE-2023-44467: Insufficient Information (NVD-CWE-noinfo)
value: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-10-09T20:15Z
Repository: https://github.com/langchain-ai/langchain
Language: Python
Files changed: libs/experimental/langchain_experimental/pal_chain/base.py
Commit date: 2023-09-29 16:16:00 -0400
Commit message: fix code injection vuln (#11233)

- **Description:** Fix a code injection vuln by adding one more keyword
into the filtering list
  - **Issue:** N/A
  - **Dependencies:** N/A
  - **Tag maintainer:** 
  - **Twitter handle:**

Co-authored-by: Eugene Yurtsev <eyurtsev@gmail.com>
Diff: diff --git a/libs/experimental/langchain_experimental/pal_chain/base.py b/libs/experimental/langchain_experimental/pal_chain/base.py
index 275f9e93..32ab235e 100644
--- a/libs/experimental/langchain_experimental/pal_chain/base.py
+++ b/libs/experimental/langchain_experimental/pal_chain/base.py
@@ -18,11 +18,11 @@ from langchain.utilities import PythonREPL
 
 from langchain_experimental.pal_chain.colored_object_prompt import COLORED_OBJECT_PROMPT
 from langchain_experimental.pal_chain.math_prompt import MATH_PROMPT
 from langchain_experimental.pydantic_v1 import Extra, Field
 
-COMMAND_EXECUTION_FUNCTIONS = ["system", "exec", "execfile", "eval"]
+COMMAND_EXECUTION_FUNCTIONS = ["system", "exec", "execfile", "eval", "__import__"]
 
 
 class PALValidation:
     SOLUTION_EXPRESSION_TYPE_FUNCTION = ast.FunctionDef
     SOLUTION_EXPRESSION_TYPE_VARIABLE = ast.Name

Vulnerable code: COMMAND_EXECUTION_FUNCTIONS = ["system", "exec", "execfile", "eval"]
Fixed code: COMMAND_EXECUTION_FUNCTIONS = ["system", "exec", "execfile", "eval", "__import__"]
CVE-2022-3968: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_save.php. The manipulation of the argument tag leads to cross site scripting. The attack can be launched remotely. The name of the patch is 5bf7a79826e0ea09bcc8a21f69a0c74107761a02. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213547.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-11-13T08:15Z
Repository: https://github.com/emlog/emlog
Language: PHP
Files changed: admin/article_save.php
Commit date: 2022-11-09 00:53:38 +0800
Commit message: fix:tag xss

Diff: diff --git a/admin/article_save.php b/admin/article_save.php
index afa0214..74a2a27 100755
--- a/admin/article_save.php
+++ b/admin/article_save.php
@@ -16,11 +16,11 @@ $Log_Model = new Log_Model();
 $Tag_Model = new Tag_Model();
 
 $title = isset($_POST['title']) ? addslashes(trim($_POST['title'])) : '';
 $postDate = isset($_POST['postdate']) ? strtotime(trim($_POST['postdate'])) : '';
 $sort = isset($_POST['sort']) ? (int)$_POST['sort'] : -1;
-$tagstring = isset($_POST['tag']) ? addslashes(trim($_POST['tag'])) : '';
+$tagstring = isset($_POST['tag']) ? strip_tags(addslashes(trim($_POST['tag']))) : '';
 $content = isset($_POST['logcontent']) ? addslashes(trim($_POST['logcontent'])) : '';
 $excerpt = isset($_POST['logexcerpt']) ? addslashes(trim($_POST['logexcerpt'])) : '';
 $author = isset($_POST['author']) && User::haveEditPermission() ? (int)trim($_POST['author']) : UID;
 $blogid = isset($_POST['as_logid']) ? (int)trim($_POST['as_logid']) : -1;//如被自动保存为草稿则有blog id号
 $alias = isset($_POST['alias']) ? addslashes(trim($_POST['alias'])) : '';

Vulnerable code: $tagstring = isset($_POST['tag']) ? addslashes(trim($_POST['tag'])) : '';
Fixed code: $tagstring = isset($_POST['tag']) ? strip_tags(addslashes(trim($_POST['tag']))) : '';
CVE-2014-125029: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in ttskch PaginationServiceProvider up to 0.x. It has been declared as critical. This vulnerability affects unknown code of the file demo/index.php of the component demo. The manipulation of the argument sort/id leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 619de478efce17ece1a3b913ab16e40651e1ea7b. It is recommended to upgrade the affected component. VDB-217150 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T22:15Z
Repository: https://github.com/ttskch/PaginationServiceProvider
Language: PHP
Files changed: demo/index.php
Commit date: 2014-11-04 17:22:58 +0900
Commit message: avoid sql injection on demo code

Diff: diff --git a/demo/index.php b/demo/index.php
index e9988ec..c23fb65 100644
--- a/demo/index.php
+++ b/demo/index.php
@@ -33,14 +33,14 @@ $app->register(new DoctrineServiceProvider(), [
 
 $app->get('/', function (Request $request) use ($app) {
 
     $page = $request->get('page', 1);
     $limit = $request->get('limit', 10);
-    $sort = $request->get('sort', 'id');
-    $direction = $request->get('direction', 'asc');
+    $sort = $app['db']->quoteIdentifier($request->get('sort', 'id'));
+    $direction = $request->get('direction') === 'desc' ? 'DESC' : 'ASC';
 
-    $sql = "select * from sample order by \"{$sort}\" {$direction}";
+    $sql = "select * from sample order by {$sort} {$direction}";
     $array = $app['db']->fetchAll($sql);
 
     $pagination = $app['knp_paginator']->paginate($array, $page, $limit);
 
     return $app['twig']->render('index.html.twig', array(

Vulnerable code:     $sort = $request->get('sort', 'id');
    $direction = $request->get('direction', 'asc');
    $sql = "select * from sample order by \"{$sort}\" {$direction}";
Fixed code:     $sort = $app['db']->quoteIdentifier($request->get('sort', 'id'));
    $direction = $request->get('direction') === 'desc' ? 'DESC' : 'ASC';
    $sql = "select * from sample order by {$sort} {$direction}";
CVE-2021-41087: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2021-09-21T21:15Z
Repository: https://github.com/in-toto/in-toto-golang
Language: Unknown
Commit date: 2021-09-21 16:50:06 -0400
Commit message: Merge pull request from GHSA-vrxp-mg9f-hwf3

Fix handling of wildcards and relative paths
CVE-2022-0955: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-03-24T15:15Z
Repository: https://github.com/pimcore/data-hub
Language: PHP
Files changed: src/Controller/ConfigController.php
Commit date: 2022-03-16 14:28:21 +0100
Commit message: follow up to https://github.com/pimcore/data-hub/pull/462

Diff: diff --git a/src/Controller/ConfigController.php b/src/Controller/ConfigController.php
index 286ba4e..1d24811 100644
--- a/src/Controller/ConfigController.php
+++ b/src/Controller/ConfigController.php
@@ -48,11 +48,11 @@ class ConfigController extends \Pimcore\Bundle\AdminBundle\Controller\AdminContr
         $type = $configuration->getType() ?: 'graphql';
         $name = $configuration->getName();
 
         return [
             'id' => $name,
-            'text' => $name,
+            'text' => htmlspecialchars($name),
             'type' => 'config',
             'iconCls' => 'plugin_pimcore_datahub_icon_' . $type,
             'expandable' => false,
             'leaf' => true,
             'adapter' => $type,

Vulnerable code:             'text' => $name,
Fixed code:             'text' => htmlspecialchars($name),
CVE-2018-20837: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2019-05-09T22:29Z
Repository: https://github.com/Typesetter/Typesetter
Language: PHP
Files changed: include/admin/Menu/Ajax.php
Commit date: 2018-05-23 21:55:50 +0200
Commit message: prevent code injection (XSS)

fix for reflected XSS vulnerability spotted by Mithat Gögebakan,
www.netsparker.com

Diff: diff --git a/include/admin/Menu/Ajax.php b/include/admin/Menu/Ajax.php
index 9deb8968..5e4b688c 100644
--- a/include/admin/Menu/Ajax.php
+++ b/include/admin/Menu/Ajax.php
@@ -153,14 +153,17 @@ class Ajax extends \gp\admin\Menu{
 
 		echo '<table class="bordered full_width">';
 		echo '<tr><th colspan="2">'.$langmessage['options'].'</th></tr>';
 
 		//title
+		$new_title = htmlspecialchars($_REQUEST['title']);
+		// prevent code injections
+		$new_title = str_replace(array('=', '/', '{', '}', ':', ',', ';'), '', $new_title);
 		echo '<tr><td>';
 		echo $langmessage['label'];
 		echo '</td><td>';
-		echo '<input type="text" name="title" maxlength="100" size="50" value="'.htmlspecialchars($_REQUEST['title']).'" class="gpinput full_width" required/>';
+		echo '<input type="text" name="title" maxlength="100" size="50" value="'. $new_title .'" class="gpinput full_width" required/>';
 		echo '</td></tr>';
 
 		//copy
 		echo '<tbody id="gp_new_copy">';
 		echo '<tr><td>';

Vulnerable code: 		echo '<input type="text" name="title" maxlength="100" size="50" value="'.htmlspecialchars($_REQUEST['title']).'" class="gpinput full_width" required/>';
Fixed code: 		$new_title = htmlspecialchars($_REQUEST['title']);
		// prevent code injections
		$new_title = str_replace(array('=', '/', '{', '}', ':', ',', ';'), '', $new_title);
		echo '<input type="text" name="title" maxlength="100" size="50" value="'. $new_title .'" class="gpinput full_width" required/>';
CVE-2014-125054: Improper Access Control (CWE-284)
value: A vulnerability classified as critical was found in koroket RedditOnRails. This vulnerability affects unknown code of the component Vote Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The patch is identified as 7f3c7407d95d532fcc342b00d68d0ea09ca71030. It is recommended to apply a patch to fix this issue. VDB-217594 is the identifier assigned to this vulnerability.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 4.3
Published: 2023-01-07T09:15Z
Repository: https://github.com/koroket/RedditOnRails
Language: Ruby
Files changed: app/controllers/comments_controller.rb, app/controllers/posts_controller.rb
Commit date: 2014-12-19 17:11:20 -0800
Commit message: Solved duplicate votes issue; Discovered karma exploitation
Exploit - Currently even if you already upvoted you can click the upvote button again, which doesn't add a new vote to the post/comment but *does* add more to the user's karma since there's no check for existing vote value to only add karma for actual changes to votes

Diff: diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb
index 9b63c88..2413730 100644
--- a/app/controllers/comments_controller.rb
+++ b/app/controllers/comments_controller.rb
@@ -92,8 +92,8 @@ class CommentsController < ApplicationController
     def comment_params
       params.require(:comment).permit(:content)
     end
 
     def current_user_existing_vote
-      @vote = current_user.votes.find_by(comment_id: params[:id])
+      @vote = current_user.votes.find_by(votable_id: params[:id])
     end
 end
diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb
index ac266ac..954a0b3 100644
--- a/app/controllers/posts_controller.rb
+++ b/app/controllers/posts_controller.rb
@@ -109,8 +109,9 @@ class PostsController < ApplicationController
       @post = current_user.posts.find_by(id: params[:id])
       redirect_to root_url if @post.nil?
     end
 
     def current_user_existing_vote
-      @vote = current_user.votes.find_by(post_id: params[:id])
+      # @vote = current_user.votes.find_by(post_id: params[:id])
+      @vote = current_user.votes.find_by(votable_id: params[:id])
     end
 end

Vulnerable code:       @vote = current_user.votes.find_by(comment_id: params[:id])
      @vote = current_user.votes.find_by(post_id: params[:id])
Fixed code:       @vote = current_user.votes.find_by(votable_id: params[:id])
      # @vote = current_user.votes.find_by(post_id: params[:id])
      @vote = current_user.votes.find_by(votable_id: params[:id])
CVE-2020-36762: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENT_BODY leads to os command injection. Upgrading to version 2.0.28 is able to address this issue. The name of the patch is dcaad2540f7d50c512ff2e031d3778dd9337db2b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-234248.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-07-18T15:15Z
Repository: https://github.com/ONSdigital/ras-collection-instrument
Language: YAML
Files changed: .github/workflows/comment.yml, _infra/helm/collection-instrument/Chart.yaml
Commit date: 2020-12-07 14:41:41 +0000
Commit message: Fix bash injection vulnerability (#199)

* Fix bash injection vulnerability

* [ci skip] auto patch increment
skip-checks: true

Co-authored-by: ras-rm-bot <65395820+ras-rm-bot@users.noreply.github.com>
Diff: diff --git a/.github/workflows/comment.yml b/.github/workflows/comment.yml
index 39521a2..c6a6ece 100644
--- a/.github/workflows/comment.yml
+++ b/.github/workflows/comment.yml
@@ -14,12 +14,14 @@ jobs:
   comment:
     runs-on: ubuntu-latest
     if: contains(github.event.comment.body, '/deploy')
     steps:
       - name: set namespace
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
         run: |
-          echo NAMESPACE=$(echo ${{ github.event.comment.body }} | cut -d' ' -f2) >> $GITHUB_ENV
+          echo NAMESPACE=$(echo $COMMENT_BODY | cut -d' ' -f2) >> $GITHUB_ENV
 
       - uses: GoogleCloudPlatform/github-actions/setup-gcloud@master
         with:
           version: '270.0.0'
           service_account_key: ${{ secrets.GCR_KEY }}
diff --git a/_infra/helm/collection-instrument/Chart.yaml b/_infra/helm/collection-instrument/Chart.yaml
index 4157661..a0f7ebd 100644
--- a/_infra/helm/collection-instrument/Chart.yaml
+++ b/_infra/helm/collection-instrument/Chart.yaml
@@ -16,6 +16,6 @@ type: application
 # to the chart and its templates, including the app version.
 version: 1.1.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 2.0.27
+appVersion: 2.0.28

Vulnerable code:           echo NAMESPACE=$(echo ${{ github.event.comment.body }} | cut -d' ' -f2) >> $GITHUB_ENV
appVersion: 2.0.27
Fixed code:         env:
          COMMENT_BODY: ${{ github.event.comment.body }}
          echo NAMESPACE=$(echo $COMMENT_BODY | cut -d' ' -f2) >> $GITHUB_ENV
appVersion: 2.0.28
CVE-2013-2559: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-03-27T16:55Z
Repository: https://github.com/symphonycms/symphony-2
Language: PHP
Files changed: symphony/lib/toolkit/class.authormanager.php
Commit date: 2013-03-20 23:02:43 +1000
Commit message: Fix potential autheticated SQL injection attack on the Authors page

Diff: diff --git a/symphony/lib/toolkit/class.authormanager.php b/symphony/lib/toolkit/class.authormanager.php
index 37a8e6c4..d07df76c 100755
--- a/symphony/lib/toolkit/class.authormanager.php
+++ b/symphony/lib/toolkit/class.authormanager.php
@@ -88,10 +88,12 @@
 		 *  Any custom JOIN's
 		 * @return array
 		 *  An array of Author objects. If no Authors are found, an empty array is returned.
 		 */
 		public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = null, $start = null, $where = null, $joins = null) {
+			$sortby = is_null($sortby) ? 'id' : Symphony::Database()->cleanValue($sortby);
+			$sortdirection = $sortdirection === 'ASC' ? 'ASC' : 'DESC';
 
 			$records = Symphony::Database()->fetch(sprintf("
 					SELECT a.*
 					FROM `tbl_authors` AS `a`
 					%s
@@ -99,11 +101,11 @@
 					ORDER BY %s %s
 					%s %s
 				",
 				$joins,
 				($where) ? $where : 1,
-				'a.'.$sortby, $sortdirection,
+				'a.'. $sortby, $sortdirection,
 				($limit) ? "LIMIT " . $limit : '',
 				($start && $limit) ? ', ' . $start : ''
 			));
 
 			if(!is_array($records) || empty($records)) return array();

Vulnerable code: 				'a.'.$sortby, $sortdirection,
Fixed code: 			$sortby = is_null($sortby) ? 'id' : Symphony::Database()->cleanValue($sortby);
			$sortdirection = $sortdirection === 'ASC' ? 'ASC' : 'DESC';
				'a.'. $sortby, $sortdirection,
CVE-2019-18667: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-11-02T16:15Z
Repository: https://github.com/pfsense/FreeBSD-ports
Language: Other
Files changed: net/pfSense-pkg-freeradius3/Makefile, net/pfSense-pkg-freeradius3/files/usr/local/www/freeradius_view_config.php
Commit date: 2019-10-31 08:28:28 -0400
Commit message: Encode FreeRADIUS config file display output. Fixes #9866

Diff: diff --git a/net/pfSense-pkg-freeradius3/Makefile b/net/pfSense-pkg-freeradius3/Makefile
index 7d5c3a9de36e..66777a8902e6 100644
--- a/net/pfSense-pkg-freeradius3/Makefile
+++ b/net/pfSense-pkg-freeradius3/Makefile
@@ -1,10 +1,10 @@
 # $FreeBSD$
 
 PORTNAME=	pfSense-pkg-freeradius3
 PORTVERSION=	0.15.7
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	net
 MASTER_SITES=	# empty
 DISTFILES=	# empty
 EXTRACT_ONLY=	# empty
 
diff --git a/net/pfSense-pkg-freeradius3/files/usr/local/www/freeradius_view_config.php b/net/pfSense-pkg-freeradius3/files/usr/local/www/freeradius_view_config.php
index 625415d7884c..a88f3be7cd50 100644
--- a/net/pfSense-pkg-freeradius3/files/usr/local/www/freeradius_view_config.php
+++ b/net/pfSense-pkg-freeradius3/files/usr/local/www/freeradius_view_config.php
@@ -38,11 +38,11 @@ function get_file($file) {
 	$files['virtual-server-default'] = FREERADIUS_RADDB . "/sites-enabled/default";
 	$files['ldap'] = FREERADIUS_MODSENABLED . "/ldap";
 
 	if ($files[$file] != "" && file_exists($files[$file])) {
 		print '<pre>';
-		print $files[$file] . "\n" . file_get_contents($files[$file]);
+		print $files[$file] . "\n" . htmlspecialchars(file_get_contents($files[$file]));
 		print '</pre>';
 	}
 }
 
 if ($_REQUEST['file'] != "") {

Vulnerable code: PORTREVISION=	2
		print $files[$file] . "\n" . file_get_contents($files[$file]);
Fixed code: PORTREVISION=	3
		print $files[$file] . "\n" . htmlspecialchars(file_get_contents($files[$file]));