Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-27462: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-05T16:15Z
Repository: https://github.com/WWBN/AVideo
Language: PHP
Files changed: objects/functions.php
Commit date: 2022-03-13 11:00:47 -0300
Commit message: XSS vulnerability fix , thanks Max Boll 
Diff: diff --git a/objects/functions.php b/objects/functions.php
index dea9f3cb57..5718eed9d5 100644
--- a/objects/functions.php
+++ b/objects/functions.php
@@ -5781,25 +5781,26 @@ function getHostOnlyFromURL($url) {
  * 8-4-4-4-12
  * @return string
  */
 function getDeviceID($useRandomString = true) {
     $ip = md5(getRealIpAddr());
+    $pattern = "/[0-9a-z_.-]/i";
     if (empty($_SERVER['HTTP_USER_AGENT'])) {
         $device = "unknowDevice-{$ip}";
         $device .= '-' . intval(User::getId());
-        return $device;
+        return preg_replace($pattern, '-', $device);
     }
 
     if (empty($useRandomString)) {
         $device = 'ypt-' . get_browser_name() . '-' . getOS() . '-' . $ip . '-' . md5($_SERVER['HTTP_USER_AGENT']);
         $device = str_replace(
                 ['[', ']', ' '],
                 ['', '', '_'],
                 $device
         );
         $device .= '-' . intval(User::getId());
-        return $device;
+        return preg_replace($pattern, '', $device);
     }
 
     $cookieName = "yptDeviceID";
     if (empty($_COOKIE[$cookieName])) {
         if (empty($_GET[$cookieName])) {
@@ -5814,13 +5815,12 @@ function getDeviceID($useRandomString = true) {
         }
         if (!_setcookie($cookieName, $_GET[$cookieName], strtotime("+ 1 year"))) {
             return "getDeviceIDError";
         }
         $_COOKIE[$cookieName] = $_GET[$cookieName];
-        return $_GET[$cookieName];
     }
-    return $_COOKIE[$cookieName];
+    return preg_replace($pattern, '', $_COOKIE[$cookieName]);
 }
 
 function deviceIdToObject($deviceID) {
     $parts = explode('-', $deviceID);
     $obj = new stdClass();

Vulnerable code:         return $device;
        return $device;
        return $_GET[$cookieName];
    return $_COOKIE[$cookieName];
Fixed code:     $pattern = "/[0-9a-z_.-]/i";
        return preg_replace($pattern, '-', $device);
        return preg_replace($pattern, '', $device);
    return preg_replace($pattern, '', $_COOKIE[$cookieName]);
CVE-2022-27463: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-04-05T16:15Z
Repository: https://github.com/WWBN/AVideo
Language: PHP
Files changed: objects/login.json.php
Commit date: 2022-03-14 14:54:12 -0300
Commit message: Open Redirect fix, thanks Max Boll

Diff: diff --git a/objects/login.json.php b/objects/login.json.php
index 25461f09a8..e184cd8ad4 100644
--- a/objects/login.json.php
+++ b/objects/login.json.php
@@ -28,11 +28,11 @@ require_once $global['systemRootPath'] . 'objects/user.php';
 require_once $global['systemRootPath'] . 'objects/category.php';
 
 Category::clearCacheCount();
 TimeLogEnd($timeLog, __LINE__);
 
-if (!preg_match("|^" . $global['webSiteRootURL'] . "|", $_POST['redirectUri'])) {
+if(!isSameDomain($global['webSiteRootURL'], $_POST['redirectUri'])){
     $_POST['redirectUri'] = $global['webSiteRootURL'];
 }
 _error_log("Start Login Request redirectUri=" . $_POST['redirectUri']);
 
 use Hybridauth\Hybridauth;

Vulnerable code: if (!preg_match("|^" . $global['webSiteRootURL'] . "|", $_POST['redirectUri'])) {
Fixed code: if(!isSameDomain($global['webSiteRootURL'], $_POST['redirectUri'])){
CVE-2023-32073: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-05-12T14:15Z
Repository: https://github.com/WWBN/AVideo
Language: PHP
Files changed: plugin/CloneSite/cloneClient.json.php
Commit date: 2023-05-06 17:14:09 -0300
Commit message: Authenticated Remote Code Execution fix

Diff: diff --git a/plugin/CloneSite/cloneClient.json.php b/plugin/CloneSite/cloneClient.json.php
index bbcfac96ea..dba8876f86 100644
--- a/plugin/CloneSite/cloneClient.json.php
+++ b/plugin/CloneSite/cloneClient.json.php
@@ -92,10 +92,11 @@ $log->add("Clone: Good start! the server has answered");
 
 
 $json->sqlFile = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->sqlFile));
 $json->videoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->videoFiles));
 $json->photoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->photoFiles));
+$objClone->cloneSiteURL = escapeshellarg($objClone->cloneSiteURL);
 
 // get dump file
 $cmd = "wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$json->sqlFile}";
 $log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file");
 exec($cmd . " 2>&1", $output, $return_val);

Fixed code: $objClone->cloneSiteURL = escapeshellarg($objClone->cloneSiteURL);
CVE-2023-3020: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-05-31T17:15Z
Repository: https://github.com/mkucej/i-librarian-free
Language: PHP
Files changed: app/views/items.php
Commit date: 2023-05-31 08:10:22 -0500
Commit message: reflected XSS vulnerability fix

Diff: diff --git a/app/views/items.php b/app/views/items.php
index 350de26..a745f21 100644
--- a/app/views/items.php
+++ b/app/views/items.php
@@ -384,17 +384,19 @@ class ItemsView extends TextView {
                 if ($get['search_query'][$i] === '') {
 
                     continue;
                 }
 
+                $get_search_query = $this->sanitation->html($get['search_query'][$i]);
+
                 /** @var Bootstrap\Button $el */
                 $el = $this->di->get('Button');
 
                 $el->context("dark");
                 $el->componentSize("small");
                 $el->addClass("d-inline-block mr-1 mb-2 rounded-0");
-                $el->html("<b>{$this->type_to_readable[$type]}</b> &mdash; {$get['search_query'][$i]}");
+                $el->html("<b>{$this->type_to_readable[$type]}</b> &mdash; {$get_search_query}");
                 $tags_html .= $el->render();
 
                 $el = null;
             }
         }

Vulnerable code:                 $el->html("<b>{$this->type_to_readable[$type]}</b> &mdash; {$get['search_query'][$i]}");
Fixed code:                 $get_search_query = $this->sanitation->html($get['search_query'][$i]);

                $el->html("<b>{$this->type_to_readable[$type]}</b> &mdash; {$get_search_query}");
CVE-2023-3021: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-05-31T17:15Z
Repository: https://github.com/mkucej/i-librarian-free
Language: PHP
Files changed: app/views/dashboard.php
Commit date: 2023-05-31 08:00:21 -0500
Commit message: stored XSS vulnerability fix

Diff: diff --git a/app/views/dashboard.php b/app/views/dashboard.php
index 0f3867f..0f58848 100644
--- a/app/views/dashboard.php
+++ b/app/views/dashboard.php
@@ -607,10 +607,11 @@ HTML;
 
         foreach ($active_sessions as $active_session) {
 
             $created = $temporal->toUserTime($active_session['created']);
             $updated = $temporal->toUserTime($active_session['last_accessed']);
+            $user_agent = $this->sanitation->html($active_session['user_agent']);
 
             $sessions_card .=
 <<<HTML
 <table class="ml-4 mb-2 text-muted">
     <tbody>
@@ -625,11 +626,11 @@ HTML;
         <tr>
             <td class="align-top pr-3">
                 <small><b class="text-uppercase">{$this->lang->t9n('Software')}</b></small>
             </td>
             <td>
-                {$active_session['user_agent']}
+                <small>{$user_agent}</small>
             </td>
         </tr>
         <tr>
             <td class="align-top pr-3">
                 <small><b class="text-uppercase">{$this->lang->t9n('Started')}</b></small>

Vulnerable code:                 {$active_session['user_agent']}
Fixed code:             $user_agent = $this->sanitation->html($active_session['user_agent']);
                <small>{$user_agent}</small>
CVE-2021-32819: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 8.8
Published: 2021-05-14T19:15Z
Repository: https://github.com/squirrellyjs/squirrelly
Language: TypeScript
Files changed: src/file-handlers.ts
Commit date: 2023-05-10 20:11:19 +0900
Commit message: Don't merge data.settings into the config option

Diff: diff --git a/src/file-handlers.ts b/src/file-handlers.ts
index 313b6cf..5c85a6d 100644
--- a/src/file-handlers.ts
+++ b/src/file-handlers.ts
@@ -16,13 +16,10 @@ export type CallbackFn = (err: Error | null, str?: string) => void
 interface FileOptions extends SqrlConfig {
   filename: string
 }
 
 interface DataObj {
-  settings?: {
-    [key: string]: any
-  }
   [key: string]: any
 }
 
 /* END TYPES */
 
@@ -112,20 +109,10 @@ function includeFile (path: string, options: SqrlConfig) {
 function renderFile (filename: string, data: DataObj, cb?: CallbackFn) {
   data = data || {}
   var Config: FileOptions = getConfig((data as PartialConfig)) as FileOptions
   // TODO: make sure above doesn't error. We do set filename down below
 
-  if (data.settings) {
-    // Pull a few things from known locations
-    if (data.settings.views) {
-      Config.views = data.settings.views
-    }
-    if (data.settings['view cache']) {
-      Config.cache = true
-    }
-  }
-
   Config.filename = filename // Make sure filename is right
 
   return tryHandleCache(Config, data, cb as CallbackFn)
 }
 

Vulnerable code:   settings?: {
    [key: string]: any
  }
  if (data.settings) {
    // Pull a few things from known locations
    if (data.settings.views) {
      Config.views = data.settings.views
    }
    if (data.settings['view cache']) {
      Config.cache = true
    }
  }
CVE-2021-32819: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 8.8
Published: 2021-05-14T19:15Z
Repository: https://github.com/squirrellyjs/squirrelly
Language: TypeScript
Files changed: src/file-handlers.ts
Commit date: 2023-05-10 20:06:29 +0900
Commit message: don't pass view options

Diff: diff --git a/src/file-handlers.ts b/src/file-handlers.ts
index cc16972..313b6cf 100644
--- a/src/file-handlers.ts
+++ b/src/file-handlers.ts
@@ -2,11 +2,11 @@
 
 import SqrlErr from './err'
 import compile from './compile'
 import { getConfig } from './config'
 import { getPath, readFile, loadFile } from './file-utils'
-import { promiseImpl, copyProps } from './utils'
+import { promiseImpl } from './utils'
 
 /* TYPES */
 
 import { SqrlConfig, PartialConfig } from './config'
 import { TemplateFunction } from './compile'
@@ -32,11 +32,10 @@ interface DataObj {
  *
  * If `options.cache` is true, this function reads the file from
  * `options.filename` so it must be set prior to calling this function.
  *
  * @param {Options} options   compilation options
- * @param {String} [template] template source
  * @return {(TemplateFunction|ClientFunction)}
  * Depending on the value of `options.client`, either type might be returned.
  * @static
  */
 
@@ -121,17 +120,10 @@ function renderFile (filename: string, data: DataObj, cb?: CallbackFn) {
       Config.views = data.settings.views
     }
     if (data.settings['view cache']) {
       Config.cache = true
     }
-    // Undocumented after Express 2, but still usable, esp. for
-    // items that are unsafe to be passed along with data, like `root`
-    var viewOpts = data.settings['view options']
-
-    if (viewOpts) {
-      copyProps(Config, viewOpts)
-    }
   }
 
   Config.filename = filename // Make sure filename is right
 
   return tryHandleCache(Config, data, cb as CallbackFn)

Vulnerable code: import { promiseImpl, copyProps } from './utils'
 * @param {String} [template] template source
    // Undocumented after Express 2, but still usable, esp. for
    // items that are unsafe to be passed along with data, like `root`
    var viewOpts = data.settings['view options']

    if (viewOpts) {
      copyProps(Config, viewOpts)
    }
Fixed code: import { promiseImpl } from './utils'
CVE-2013-2209: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-07-31T13:20Z
Repository: https://github.com/reviewboard/reviewboard
Language: JavaScript
Files changed: reviewboard/htdocs/media/rb/js/reviews.js
Commit date: 2013-06-22 00:04:20 -0700
Commit message: Fix an XSS vulnerability in the reviews dropdown.

The reviews dropdown had a bad vulnerability where it would assume the
user's full name is valid HTML. This allowed the user to craft a script
tag that would be executed every time the name appeared in the dropdown.

This vulnerability exists in 1.6.x, 1.7.x, and the in-development 1.8.
There are no known attacks in the wild.

This was reported by Craig Young at Tripwire.

Diff: diff --git a/reviewboard/htdocs/media/rb/js/reviews.js b/reviewboard/htdocs/media/rb/js/reviews.js
index 6340744d..035872ff 100644
--- a/reviewboard/htdocs/media/rb/js/reviews.js
+++ b/reviewboard/htdocs/media/rb/js/reviews.js
@@ -350,14 +350,16 @@ function setDraftField(field, value) {
 $.fn.reviewsAutoComplete = function(options) {
     return this.each(function() {
         $(this)
             .autocomplete({
                 formatItem: function(data) {
-                    var s = data[options.nameKey];
+                    var s = data[options.nameKey],
+                        desc;
 
                     if (options.descKey) {
-                        s += " <span>(" + data[options.descKey] + ")</span>";
+                        desc = $('<div/>').text(data[options.descKey]).html();
+                        s += " <span>(" + desc + ")</span>";
                     }
 
                     return s;
                 },
                 matchCase: false,

Vulnerable code:                     var s = data[options.nameKey];
                        s += " <span>(" + data[options.descKey] + ")</span>";
Fixed code:                     var s = data[options.nameKey],
                        desc;
                        desc = $('<div/>').text(data[options.descKey]).html();
                        s += " <span>(" + desc + ")</span>";
CVE-2022-23645: Out-of-bounds Read (CWE-125)
value: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-02-18T21:15Z
Repository: https://github.com/stefanberger/swtpm
Language: C
Files changed: src/swtpm/swtpm_nvstore.c
Commit date: 2022-02-16 15:53:56 -0500
Commit message: swtpm: Check header size indicator against expected size (CID 375869)

This fix addresses Coverity issue CID 375869.

Check the header size indicated in the header of the state against the
expected size and return an error code in case the header size indicator
is different. There was only one header size so far since blobheader was
introduced, so we don't need to deal with different sizes.

Without this fix a specially craft header could have cause out-of-bounds
accesses on the byte array containing the swtpm's state.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>

Diff: diff --git a/src/swtpm/swtpm_nvstore.c b/src/swtpm/swtpm_nvstore.c
index 4370883..144d897 100644
--- a/src/swtpm/swtpm_nvstore.c
+++ b/src/swtpm/swtpm_nvstore.c
@@ -1073,10 +1073,11 @@ static TPM_RESULT
 SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
                         uint32_t *dataoffset, uint16_t *hdrflags,
                         uint8_t *hdrversion, bool quiet)
 {
     blobheader *bh = (blobheader *)data;
+    uint16_t hdrsize;
 
     if (length < sizeof(bh)) {
         if (!quiet)
             logprintf(STDERR_FILENO,
                       "not enough bytes for header: %u\n", length);
@@ -1098,12 +1099,20 @@ SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
                       "only support version %d\n", bh->min_version,
                       BLOB_HEADER_VERSION);
         return TPM_BAD_VERSION;
     }
 
+    hdrsize = ntohs(bh->hdrsize);
+    if (hdrsize != sizeof(blobheader)) {
+        logprintf(STDERR_FILENO,
+                  "bad header size: %u != %zu\n",
+                  hdrsize, sizeof(blobheader));
+        return TPM_BAD_DATASIZE;
+    }
+
     *hdrversion = bh->version;
-    *dataoffset = ntohs(bh->hdrsize);
+    *dataoffset = hdrsize;
     *hdrflags = ntohs(bh->flags);
 
     return TPM_SUCCESS;
 }
 

Vulnerable code:     *dataoffset = ntohs(bh->hdrsize);
Fixed code:     uint16_t hdrsize;
    hdrsize = ntohs(bh->hdrsize);
    if (hdrsize != sizeof(blobheader)) {
        logprintf(STDERR_FILENO,
                  "bad header size: %u != %zu\n",
                  hdrsize, sizeof(blobheader));
        return TPM_BAD_DATASIZE;
    }

    *dataoffset = hdrsize;
CVE-2020-27985: Missing Authentication for Critical Function (CWE-306)
value: Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home/<user>/SecurityOnion/setup/so-setup.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 7.8
Published: 2020-11-23T14:15Z
Repository: https://github.com/Security-Onion-Solutions/securityonion
Language: Other
Files changed: salt/common/tools/sbin/soup, setup/so-functions
Commit date: 2020-11-17 15:36:25 -0500
Commit message: [feat] Remove so-setup permission from sudoers file after iso setup

Closes #1701

Diff: diff --git a/salt/common/tools/sbin/soup b/salt/common/tools/sbin/soup
index 0453ea29..db806a44 100755
--- a/salt/common/tools/sbin/soup
+++ b/salt/common/tools/sbin/soup
@@ -189,10 +189,11 @@ pillar_changes() {
     echo "Checking to see if pillar changes are needed."
     
     [[ "$INSTALLEDVERSION" =~ rc.1 ]] && rc1_to_rc2
     [[ "$INSTALLEDVERSION" =~ rc.2 ]] && rc2_to_rc3
     [[ "$INSTALLEDVERSION" =~ rc.3 ]] && rc3_to_2.3.0
+	[[ "$INSTALLEDVERSION" =~ 2.3.2 ]] && up_2.3.2_to_2.3.10
 
 }
 
 rc1_to_rc2() {
 
@@ -290,10 +291,16 @@ space_check() {
 unmount_update() {
   cd /tmp
   umount /tmp/soagupdate
 }
 
+up_2.3.2_to_2.3.10() {
+	if grep -q "so-setup" /etc/sudoers; then
+		echo "[ INFO ] There is an entry for so-setup in the sudoers file, this can be safely deleted using \"visudo\"."
+	fi
+}
+
 update_centos_repo() {
   # Update the files in the repo
   echo "Syncing new updates to /nsm/repo"
   rsync -av $AGREPO/* /nsm/repo/
   echo "Creating repo"
diff --git a/setup/so-functions b/setup/so-functions
index bd2c0517..c21f8407 100755
--- a/setup/so-functions
+++ b/setup/so-functions
@@ -1017,10 +1017,14 @@ install_cleanup() {
 	[ -n "$TESTING" ] && return
 
 	# If Mysql is running stop it
 	/usr/sbin/so-mysql-stop
 
+	if [[ $install_type == 'iso' ]]; then
+		info "Removing so-setup permission entry from sudoers file"
+		sed -i '/so-setup/d' /etc/sudoers
+	fi
 }
 
 import_registry_docker() {
 	if [ -f /nsm/docker-registry/docker/registry_image.tar ]; then
 	  logCmd "service docker start"

Fixed code: 	[[ "$INSTALLEDVERSION" =~ 2.3.2 ]] && up_2.3.2_to_2.3.10
up_2.3.2_to_2.3.10() {
	if grep -q "so-setup" /etc/sudoers; then
		echo "[ INFO ] There is an entry for so-setup in the sudoers file, this can be safely deleted using \"visudo\"."
	fi
}

	if [[ $install_type == 'iso' ]]; then
		info "Removing so-setup permission entry from sudoers file"
		sed -i '/so-setup/d' /etc/sudoers
	fi
CVE-2011-3592: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-12-26T02:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, js/sql.js
Commit date: 2011-09-02 13:00:33 -0400
Commit message: [security] Fixed XSS in Inline Edit on save action

Diff: diff --git a/ChangeLog b/ChangeLog
index 20e175148..137616921 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -29,10 +29,11 @@ phpMyAdmin - ChangeLog
 - bug #3374374 [interface] Fix footnote for inexact count while browsing
 - bug #3372807 [interface] Fix security warning link in setup
 - bug #3374347 [display] Backquotes in normal text on import page
 - bug #3358750 [core] With Suhosin, urls are too long in edit links
 - [security] Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13
+- [security] Fixed XSS in Inline Edit on save action
 
 3.4.3.2 (2011-07-23)
 - [security] Fixed XSS vulnerability, see PMASA-2011-9
 - [security] Fixed local file inclusion vulnerability, see PMASA-2011-10
 - [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11
diff --git a/js/sql.js b/js/sql.js
index dbba44136..842b6c6b9 100644
--- a/js/sql.js
+++ b/js/sql.js
@@ -1109,11 +1109,11 @@ function PMA_unInlineEditRow($del_hide, $chg_submit, $this_td, $input_siblings,
                         })
                         new_html = new_html.substring(0, new_html.length-1);
                     }
                 }
             }
-            $this_sibling.html(new_html);
+            $this_sibling.text(new_html);
         }
     })
 }
 
 /**

Vulnerable code:             $this_sibling.html(new_html);
Fixed code: - [security] Fixed XSS in Inline Edit on save action
            $this_sibling.text(new_html);
CVE-2012-1190: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-05-03T04:08Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: js/replication.js
Commit date: 2012-02-16 15:22:42 +0100
Commit message: Do not put database names as html

Diff: diff --git a/js/replication.js b/js/replication.js
index 1a7c785b03..3ea119a97f 100644
--- a/js/replication.js
+++ b/js/replication.js
@@ -3,31 +3,31 @@
  * for server_replication.php 
  *
  */
 
 var random_server_id = Math.floor(Math.random() * 10000000);
-var conf_prefix = "server-id=" + random_server_id + "<br />log-bin=mysql-bin<br />log-error=mysql-bin.err<br />";
+var conf_prefix = "server-id=" + random_server_id + "\nlog-bin=mysql-bin\nlog-error=mysql-bin.err\n";
 
 function update_config() {
     var conf_ignore = "binlog_ignore_db=";
     var conf_do = "binlog_do_db=";
     var database_list = $('#db_select option:selected:first').val();
     $('#db_select option:selected:not(:first)').each(function() {
         database_list += ',' + $(this).val();
     });
 
     if ($('#db_select option:selected').size() == 0) {
-        $('#rep').html(conf_prefix);
+        $('#rep').text(conf_prefix);
     } else if ($('#db_type option:selected').val() == 'all') {
-        $('#rep').html(conf_prefix + conf_ignore + database_list);
+        $('#rep').text(conf_prefix + conf_ignore + database_list);
     } else {
-        $('#rep').html(conf_prefix + conf_do + database_list);
+        $('#rep').text(conf_prefix + conf_do + database_list);
     }
 }
 
 $(document).ready(function() {
-    $('#rep').html(conf_prefix);
+    $('#rep').text(conf_prefix);
     $('#db_type').change(update_config);
     $('#db_select').change(update_config);
 
     $('#master_status_href').click(function() {
         $('#replication_master_section').toggle(); 

Vulnerable code: var conf_prefix = "server-id=" + random_server_id + "<br />log-bin=mysql-bin<br />log-error=mysql-bin.err<br />";
        $('#rep').html(conf_prefix);
        $('#rep').html(conf_prefix + conf_ignore + database_list);
        $('#rep').html(conf_prefix + conf_do + database_list);
    $('#rep').html(conf_prefix);
Fixed code: var conf_prefix = "server-id=" + random_server_id + "\nlog-bin=mysql-bin\nlog-error=mysql-bin.err\n";
        $('#rep').text(conf_prefix);
        $('#rep').text(conf_prefix + conf_ignore + database_list);
        $('#rep').text(conf_prefix + conf_do + database_list);
    $('#rep').text(conf_prefix);
CVE-2012-1902: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2012-04-06T19:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, show_config_errors.php
Commit date: 2012-03-28 12:39:39 -0400
Commit message: [security] Fixed local path disclosure vulnerability, see PMASA-2012-2

Diff: diff --git a/ChangeLog b/ChangeLog
index 40614885dd..d7b3789202 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
+3.4.10.2 (2012-03-28)
+- [security] Fixed local path disclosure vulnerability, see PMASA-2012-2
+
 3.4.10.1 (2012-02-18)
 - [security] XSS in replication setup, see PMASA-2012-1
 
 3.4.10.0 (2012-02-14)
 - bug #3460090 [interface] TextareaAutoSelect feature broken
diff --git a/show_config_errors.php b/show_config_errors.php
index 9024fec22d..7299a44249 100644
--- a/show_config_errors.php
+++ b/show_config_errors.php
@@ -12,8 +12,10 @@
 
 error_reporting(E_ALL);
 /**
  * Read config file.
  */
-require CONFIG_FILE;
+if (is_readable(CONFIG_FILE)) {
+    require CONFIG_FILE;
+}
 
 ?>

Vulnerable code: require CONFIG_FILE;
Fixed code: 3.4.10.2 (2012-03-28)
- [security] Fixed local path disclosure vulnerability, see PMASA-2012-2

if (is_readable(CONFIG_FILE)) {
    require CONFIG_FILE;
}
CVE-2012-5368: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-10-25T10:51Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: js/functions.js
Commit date: 2012-09-03 15:03:34 +0200
Commit message: Escape json reply received from server

Diff: diff --git a/js/functions.js b/js/functions.js
index ad2e39c8cd7..b9fad9e9ee1 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -130,13 +130,13 @@ function parseVersionString (str)
  */
 function PMA_current_version(data)
 {
     var current = parseVersionString(pmaversion);
     var latest = parseVersionString(data['version']);
-    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + data['version'];
+    var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + escapeHtml(data['version']);
     if (latest > current) {
-        var message = $.sprintf(PMA_messages['strNewerVersion'], data['version'], data['date']);
+        var message = $.sprintf(PMA_messages['strNewerVersion'], escapeHtml(data['version']), escapeHtml(data['date']));
         if (Math.floor(latest / 10000) == Math.floor(current / 10000)) {
             /* Security update */
             klass = 'error';
         } else {
             klass = 'notice';

Vulnerable code:     var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + data['version'];
        var message = $.sprintf(PMA_messages['strNewerVersion'], data['version'], data['date']);
Fixed code:     var version_information_message = PMA_messages['strLatestAvailable'] + ' ' + escapeHtml(data['version']);
        var message = $.sprintf(PMA_messages['strNewerVersion'], escapeHtml(data['version']), escapeHtml(data['date']));
CVE-2013-1937: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2013-04-16T14:04Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: tbl_gis_visualization.php
Commit date: 2013-04-01 22:29:21 +0200
Commit message: fix XSS reported by Janek Vind

Diff: diff --git a/tbl_gis_visualization.php b/tbl_gis_visualization.php
index 0811d01aebc..bd95b2e6c71 100644
--- a/tbl_gis_visualization.php
+++ b/tbl_gis_visualization.php
@@ -108,11 +108,11 @@
 <div id="div_view_options">
 <form method="post" action="tbl_gis_visualization.php">
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?>
 <fieldset>
     <legend><?php echo __('Display GIS Visualization'); ?></legend>
-    <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
+    <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">
         <?php echo $visualization; ?>
     </div>
     <div id="openlayersmap"></div>
     <input type="hidden" id="pmaThemeImage" value="<?php echo($GLOBALS['pmaThemeImage']); ?>" />
 
@@ -200,6 +200,6 @@ function drawOpenLayers() {
 /**
  * Displays the footer
  */
 require './libraries/footer.inc.php';
 
-?>
\ No newline at end of file
+?>

Vulnerable code:     <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
?>
Fixed code:     <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">
?>
CVE-2013-3238: Insufficient Information (NVD-CWE-noinfo)
value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2013-04-26T03:34Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/Tracker.class.php
Commit date: 2013-04-24 07:56:58 -0400
Commit message: Prevent null-byte injection in preg_replace()

Diff: diff --git a/libraries/Tracker.class.php b/libraries/Tracker.class.php
index 2f506238321..3d27f896a84 100644
--- a/libraries/Tracker.class.php
+++ b/libraries/Tracker.class.php
@@ -875,10 +875,13 @@ static public function handleQuery($query)
         // $dbname can be empty, for example when coming from Synchronize
         // and this is a query for the remote server
         if (empty($dbname)) {
             return;
         }
+        // Remove null bytes (preg_replace() is vulnerable in some
+        // PHP versions)
+        $dbname = str_replace("\0", "", $dbname);
 
         // If we found a valid statement
         if (isset($result['identifier'])) {
             $version = self::getVersion($dbname, $result['tablename'], $result['identifier']);
 

Fixed code:         // Remove null bytes (preg_replace() is vulnerable in some
        // PHP versions)
        $dbname = str_replace("\0", "", $dbname);
CVE-2013-3239: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2013-04-26T03:34Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: export.php
Commit date: 2013-04-24 07:59:06 -0400
Commit message: Security: remove dots in template to avoid a remote code execution vulnerability

Diff: diff --git a/export.php b/export.php
index 7036af92772..10567d1d1ad 100644
--- a/export.php
+++ b/export.php
@@ -270,10 +270,12 @@ function PMA_exportOutputHandler($line)
         if (isset($remember_template)) {
             $GLOBALS['PMA_Config']->setUserValue('pma_table_filename_template',
                 'Export/file_template_table', $filename_template);
         }
     }
+    // remove dots in template to avoid a remote code execution vulnerability
+    $filename_template = str_replace('.', '', $filename_template);
     $filename = PMA_expandUserString($filename_template);
     $filename = PMA_sanitize_filename($filename);
 
     // Grab basic dump extension and mime type
     // Check if the user already added extension; get the substring where the extension would be if it was included

Fixed code:     // remove dots in template to avoid a remote code execution vulnerability
    $filename_template = str_replace('.', '', $filename_template);
CVE-2013-3742: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-07-04T14:33Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: view_create.php
Commit date: 2013-05-29 21:13:32 +0200
Commit message: escape query in error message

Diff: diff --git a/view_create.php b/view_create.php
index d8781295d88..cd2ec3b616e 100644
--- a/view_create.php
+++ b/view_create.php
@@ -112,11 +112,12 @@
         } else {
             $response = PMA_Response::getInstance();
             $response->addJSON(
                 'message',
                 PMA_Message::error(
-                    "<i>$sql_query</i><br /><br />" . PMA_DBI_getError()
+                    "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
+                    . PMA_DBI_getError()
                 )
             );
             $response->isSuccess(false);
             exit;
         }

Vulnerable code:                     "<i>$sql_query</i><br /><br />" . PMA_DBI_getError()
Fixed code:                     "<i>" . htmlspecialchars($sql_query) . "</i><br /><br />"
                    . PMA_DBI_getError()
CVE-2013-4729: Permissions, Privileges, and Access Controls (CWE-264)
value: import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2013-07-04T14:33Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog, import.php
Commit date: 2013-06-28 13:09:13 -0400
Commit message: [security] Global variables scope injection vulnerability (see PMASA-2013-7)

Diff: diff --git a/ChangeLog b/ChangeLog
index 8b29aabbd9f3..b1430c4908df 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,11 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.0.4.1 ()
+- [security] Global variables scope injection vulnerability (see PMASA-2013-7)
+
 4.0.4.0 (2013-06-17)
 - bug #3959 Using DefaultTabDatabase in NavigationTree for Database Click
 - bug #3961 Avoid Suhosin warning when in simulation mode
 - bug #3897 Row Statistics and Space usage bugs
 - bug #3966 Only display "table has no unique column" message when applicable
diff --git a/import.php b/import.php
index 9d193ae63d51..6075d5d94fc4 100644
--- a/import.php
+++ b/import.php
@@ -120,10 +120,28 @@
 /**
  * Sets globals from $_POST patterns, for import plugins
  * We only need to load the selected plugin
  */
 
+if (! in_array(
+    $format, 
+    array(
+        'csv',
+        'ldi',
+        'mediawiki',
+        'ods',
+        'shp',
+        'sql',
+        'xml'
+    )
+)
+) {
+    // this should not happen for a normal user
+    // but only during an attack
+    PMA_fatalError('Incorrect format parameter');
+}
+
 $post_patterns = array(
     '/^force_file_/',
     '/^'. $format . '_/'
 );
 foreach (array_keys($_POST) as $post_key) {

Fixed code: 4.0.4.1 ()
- [security] Global variables scope injection vulnerability (see PMASA-2013-7)

if (! in_array(
    $format, 
    array(
        'csv',
        'ldi',
        'mediawiki',
        'ods',
        'shp',
        'sql',
        'xml'
    )
)
) {
    // this should not happen for a normal user
    // but only during an attack
    PMA_fatalError('Incorrect format parameter');
}
CVE-2013-5029: Improper Input Validation (CWE-20)
value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-08-19T23:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: js/cross_framing_protection.js, libraries/Header.class.php
Commit date: 2013-07-29 14:55:29 +0200
Commit message: Improved protection against cross framing

We now include CSS to hide the page and display it conditionally after
checking we're in top frame. This adds extra protection for clients who
do not support X-Frame-Options.

See also http://en.wikipedia.org/wiki/Framekiller and
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

Diff: diff --git a/js/cross_framing_protection.js b/js/cross_framing_protection.js
index 6fb780350fca..1e1caf0fd4ff 100644
--- a/js/cross_framing_protection.js
+++ b/js/cross_framing_protection.js
@@ -1,14 +1,9 @@
 /* vim: set expandtab sw=4 ts=4 sts=4: */
 /**
- * Conditionally included if third-party framing is not allowed
- *
+ * Conditionally included if framing is not allowed
  */
-
-try {
-    if (top != self) {
-        top.location.href = self.location.href;
-    }
-} catch(e) {
-    alert("Redirecting... (error: " + e);
-    top.location.href = self.location.href;
+if(self == top) {
+    document.documentElement.style.display = 'block' ;
+} else {
+    top.location = self.location ;
 }
diff --git a/libraries/Header.class.php b/libraries/Header.class.php
index 810d556904cc..8e4ba3393ddf 100644
--- a/libraries/Header.class.php
+++ b/libraries/Header.class.php
@@ -529,10 +529,11 @@ private function _getHtmlStart()
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
+        $retval .= '<style>html{display: none;}</style>';
         return $retval;
     }
 
     /**
      * Returns the LINK tags for the favicon and the stylesheets

Vulnerable code:  * Conditionally included if third-party framing is not allowed
 *

try {
    if (top != self) {
        top.location.href = self.location.href;
    }
} catch(e) {
    alert("Redirecting... (error: " + e);
    top.location.href = self.location.href;
Fixed code:  * Conditionally included if framing is not allowed
if(self == top) {
    document.documentElement.style.display = 'block' ;
} else {
    top.location = self.location ;
        $retval .= '<style>html{display: none;}</style>';
CVE-2013-5029: Improper Input Validation (CWE-20)
value: phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-08-19T23:55Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: Other
Files changed: ChangeLog
Commit date: 2013-07-29 16:31:44 -0400
Commit message: ChangeLog entry for Improved protection against cross framing

Diff: diff --git a/ChangeLog b/ChangeLog
index 9b356e76ae27..09098b22f5bd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,10 +15,12 @@ phpMyAdmin - ChangeLog
   interface to enable generating CREATE DATABASE and USE (false by default)
 - bug #4012 Crash on CSV file import
 - bug #4009 Statistic Monitor shows only last 3 digits in graph
 - bug #3998 Non-permanent SQL history not working
 - bug #3578 Transformations for text/plain on a BLOB column
+- [security] Improved protection against cross framing, see PMASA-2013-10
++ Reinstated configuration directive: AllowThirdPartyFraming
 
 4.0.4.2 (2013-07-28)
 - [security] Fix stored XSS in Server status monitor, see PMASA-2013-9
 - [security] Fix stored XSS in navigation panel logo link, see PMASA-2013-9
 - [security] Fix self-XSS in setup, trusted proxies validation, see PMASA-2013-9

Fixed code: - [security] Improved protection against cross framing, see PMASA-2013-10
+ Reinstated configuration directive: AllowThirdPartyFraming