Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-28868: Insufficient Information (NVD-CWE-noinfo)
value: Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external logins.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-20T20:15Z
Repository: https://github.com/umbraco/Umbraco-CMS
Language: C#
Files changed: src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs
Commit date: 2024-03-18 08:28:25 +0100
Commit message: Merge pull request from GHSA-552f-97wf-pmpq

Co-authored-by: jey <jey@umbraco.dk>
(cherry picked from commit b743f6a2df7c4e8bc72d6aaffd2ae1544ed2ad1a)

Diff: diff --git a/src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs b/src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs
index 96f0025efac..231f2b3b1a8 100644
--- a/src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs
+++ b/src/Umbraco.Infrastructure/Security/UmbracoUserManager.cs
@@ -132,12 +132,12 @@ public async Task<IdentityResult> ValidatePasswordAsync(string? password)
     }
 
     /// <inheritdoc />
     public override async Task<bool> CheckPasswordAsync(TUser user, string? password)
     {
-        // we cannot proceed if the user passed in does not have an identity
-        if (user.HasIdentity == false)
+        // we cannot proceed if the user passed in does not have an identity, or if no password is provided.
+        if (user.HasIdentity == false || password is null)
         {
             return false;
         }
 
         // use the default behavior
@@ -250,22 +250,22 @@ public override async Task<IdentityResult> AccessFailedAsync(TUser user)
     }
 
     public async Task<bool> ValidateCredentialsAsync(string username, string password)
     {
         TUser user = await FindByNameAsync(username);
-        
+
         if (user == null)
         {
             return false;
         }
 
         if (Store is not IUserPasswordStore<TUser> userPasswordStore)
         {
             throw new NotSupportedException("The current user store does not implement " +
                                             typeof(IUserPasswordStore<>));
         }
-        
+
         var result = await VerifyPasswordAsync(userPasswordStore, user, password);
 
         return result == PasswordVerificationResult.Success || result == PasswordVerificationResult.SuccessRehashNeeded;
     }
 

Vulnerable code:         // we cannot proceed if the user passed in does not have an identity
        if (user.HasIdentity == false)
        
        
Fixed code:         // we cannot proceed if the user passed in does not have an identity, or if no password is provided.
        if (user.HasIdentity == false || password is null)
CVE-2019-3826: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-26T18:29Z
Repository: https://github.com/prometheus/prometheus
Language: Other
Files changed: CHANGELOG.md, VERSION
Commit date: 2019-01-31 12:13:25 +0100
Commit message: *: cut 2.7.1 (#5164)

Signed-off-by: Goutham Veeramachaneni <gouthamve@gmail.com>
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7edb57a..88ac47b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
+## 2.7.1 / 2019-01-31
+
+This release has a fix for a Stored DOM XSS vulnerability that can be triggered when using the query history functionality. Thanks to Dor Tumarkin from Checkmarx for reporting it.
+
+* [BUGFIX/SECURITY] Fix a Stored DOM XSS vulnerability with query history. #5163
+* [BUGFIX] `prometheus_rule_group_last_duration_seconds` now reports seconds instead of nanoseconds. #5153
+* [BUGFIX] Make sure the targets are consistently sorted in the targets page. #5161
+
 ## 2.7.0 / 2019-01-28
 
 We're rolling back the Dockerfile changes introduced in 2.6.0. If you made changes to your docker deployment in 2.6.0, you will need to roll them back. This release also adds experimental support for disk size based retention. To accomodate that we are deprecating the flag `storage.tsdb.retention` in favour of `storage.tsdb.retention.time`. We print a warning if the flag is in use, but it will function without breaking until Prometheus 3.0.
 
 * [CHANGE] Rollback Dockerfile to version at 2.5.0. Rollback of the breaking change introduced in 2.6.0. #5122
diff --git a/VERSION b/VERSION
index 24ba9a38..860487ca 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.7.0
+2.7.1

Vulnerable code: 2.7.0
Fixed code: ## 2.7.1 / 2019-01-31

This release has a fix for a Stored DOM XSS vulnerability that can be triggered when using the query history functionality. Thanks to Dor Tumarkin from Checkmarx for reporting it.

* [BUGFIX/SECURITY] Fix a Stored DOM XSS vulnerability with query history. #5163
* [BUGFIX] `prometheus_rule_group_last_duration_seconds` now reports seconds instead of nanoseconds. #5153
* [BUGFIX] Make sure the targets are consistently sorted in the targets page. #5161

2.7.1
CVE-2017-5473: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary users, as demonstrated by admin/add_user.lua, admin/change_user_prefs.lua, admin/delete_user.lua, and admin/password_reset.lua.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2017-01-14T07:59Z
Repository: https://github.com/ntop/ntopng
Language: C++
Files changed: src/Lua.cpp
Commit date: 2017-01-12 06:45:41 -0800
Commit message: Check for presence of crsf in admin scripts

Diff: diff --git a/src/Lua.cpp b/src/Lua.cpp
index 1160a38e..ec001f76 100644
--- a/src/Lua.cpp
+++ b/src/Lua.cpp
@@ -5678,11 +5678,12 @@ int Lua::handle_script_request(struct mg_connection *conn,
 			       char *script_path) {
   char buf[64], key[64], ifname[MAX_INTERFACE_NAME_LEN];
   char *_cookies, user[64] = { '\0' }, outbuf[FILENAME_MAX];
   AddressTree ptree;
   int rc;
-
+  bool csrf_found = false;
+  
   if(!L) return(-1);
 
   luaL_openlibs(L); /* Load base libraries */
   lua_register_classes(L, true); /* Load custom classes */
 
@@ -5691,15 +5692,15 @@ int Lua::handle_script_request(struct mg_connection *conn,
 
   /* Put the GET params into the environment */
   lua_newtable(L);
   if(request_info->query_string != NULL) {
     char *query_string = strdup(request_info->query_string);
-
+    
     if(query_string) {
       char *where;
       char *tok;
-
+      
       // ntop->getTrace()->traceEvent(TRACE_WARNING, "[HTTP] %s", query_string);
 
       tok = strtok_r(query_string, "&", &where);
 
       while(tok != NULL) {
@@ -5757,10 +5758,12 @@ int Lua::handle_script_request(struct mg_connection *conn,
 		  free(equal);
 		  return(send_error(conn, 500 /* Internal server error */,
 				    msg, PAGE_ERROR, query_string, msg));
 		} else
 		  ntop->getRedis()->delKey(decoded_buf);
+
+		csrf_found = true;
 	      }
 
 	      lua_push_str_table_entry(L, tok, decoded_buf);
 	      free(decoded_buf);
 	    }
@@ -5775,10 +5778,17 @@ int Lua::handle_script_request(struct mg_connection *conn,
 
       free(query_string);
     } else
       ntop->getTrace()->traceEvent(TRACE_WARNING, "Not enough memory");
   }
+
+  if(strstr(request_info->uri, "/admin/") && (!csrf_found)) {
+    const char *msg = "Missing CSRF parameter";
+    
+    return(send_error(conn, 500 /* Internal server error */, msg, PAGE_ERROR, request_info->uri, msg));
+  }
+  
   lua_setglobal(L, "_GET"); /* Like in php */
 
   /* _SERVER */
   lua_newtable(L);
   lua_push_str_table_entry(L, "HTTP_REFERER", (char*)mg_get_header(conn, "Referer"));

Fixed code:   bool csrf_found = false;
  
    
      

		csrf_found = true;

  if(strstr(request_info->uri, "/admin/") && (!csrf_found)) {
    const char *msg = "Missing CSRF parameter";
    
    return(send_error(conn, 500 /* Internal server error */, msg, PAGE_ERROR, request_info->uri, msg));
  }
CVE-2017-7458: NULL Pointer Dereference (CWE-476)
value: The NetworkInterface::getHost function in NetworkInterface.cpp in ntopng before 3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty field that should have contained a hostname or IP address.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2017-06-26T23:29Z
Repository: https://github.com/ntop/ntopng
Language: C++
Files changed: src/Lua.cpp, src/NetworkInterface.cpp
Commit date: 2017-02-13 23:47:02 +0100
Commit message: Security fix: prevents empty host from being used

Diff: diff --git a/src/Lua.cpp b/src/Lua.cpp
index 33ef71e7..b12d79df 100644
--- a/src/Lua.cpp
+++ b/src/Lua.cpp
@@ -6016,11 +6016,12 @@ void Lua::setParamsTable(lua_State* vm, const char* table_name,
 
     while(tok != NULL) {
       char *_equal;
 
       if(strncmp(tok, "csrf", strlen("csrf")) /* Do not put csrf into the params table */
-	 && (_equal = strchr(tok, '='))) {
+	 && (_equal = strchr(tok, '='))
+	 && (strlen(_equal) > 1)) {
 	char *decoded_buf;
         int len;
 
         _equal[0] = '\0';
         _equal = &_equal[1];
diff --git a/src/NetworkInterface.cpp b/src/NetworkInterface.cpp
index c35b595b..7b92cd4d 100644
--- a/src/NetworkInterface.cpp
+++ b/src/NetworkInterface.cpp
@@ -2198,10 +2198,12 @@ bool NetworkInterface::restoreHost(char *host_ip, u_int16_t vlan_id) {
 Host* NetworkInterface::getHost(char *host_ip, u_int16_t vlan_id) {
   struct in_addr  a4;
   struct in6_addr a6;
   Host *h = NULL;
 
+  if(!host_ip) return(NULL);
+
   /* Check if address is invalid */
   if((inet_pton(AF_INET, (const char*)host_ip, &a4) == 0)
      && (inet_pton(AF_INET6, (const char*)host_ip, &a6) == 0)) {
     /* Looks like a symbolic name */
     struct host_find_info info;

Vulnerable code: 	 && (_equal = strchr(tok, '='))) {
Fixed code: 	 && (_equal = strchr(tok, '='))
	 && (strlen(_equal) > 1)) {
  if(!host_ip) return(NULL);
CVE-2018-12520: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) (CWE-335)
value: An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seeded at program startup. This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.
CWE description: The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
CVSS v3 base score: 8.1
Published: 2018-07-05T20:29Z
Repository: https://github.com/ntop/ntopng
Language: C++
Files changed: src/HTTPserver.cpp
Commit date: 2018-06-17 15:24:25 +0200
Commit message: Added code to randomize values returned by rand()

Diff: diff --git a/src/HTTPserver.cpp b/src/HTTPserver.cpp
index f954a4b94..68cffcfb5 100644
--- a/src/HTTPserver.cpp
+++ b/src/HTTPserver.cpp
@@ -862,11 +862,16 @@ HTTPserver::HTTPserver(const char *_docs_dir, const char *_scripts_dir) {
   char tmpBuf[8];
   bool use_ssl = false;
   bool use_http = true;
   struct stat statsBuf;
   int stat_rc;
+  struct timeval tv;
 
+  /* Randomize data */
+  gettimeofday(&tv, NULL);
+  srand(tv.tv_sec + tv.tv_usec);
+  
   static char *http_options[] = {
     (char*)"listening_ports", ports,
     (char*)"enable_directory_listing", (char*)"no",
     (char*)"document_root",  (char*)_docs_dir,
     /* (char*)"extra_mime_types", (char*)"" */ /* see mongoose.c */

Fixed code:   struct timeval tv;
  /* Randomize data */
  gettimeofday(&tv, NULL);
  srand(tv.tv_sec + tv.tv_usec);
CVE-2008-10003: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in iGamingModules flashgames 1.1.0. It has been classified as critical. Affected is an unknown function of the file game.php. The manipulation of the argument lid leads to sql injection. It is possible to launch the attack remotely. The name of the patch is 6e57683704885be32eea2ea614f80c9bb8f012c5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222288.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-03-05T02:15Z
Repository: https://github.com/iGamingModules/flashgames
Language: PHP
Files changed: game.php
Commit date: 2008-10-01 18:05:01 +0000
Commit message: adding patched game.php for SQLI vulnerability in lid parameter.

git-svn-id: https://subversion.assembla.com/svn/impresscmsaddons/modules/flashgames/trunk@5300 7a4d4d67-0c3a-0410-b24c-89d50c169223

Diff: diff --git a/game.php b/game.php
index 369f2f0..ebdab76 100644
--- a/game.php
+++ b/game.php
@@ -36,10 +36,16 @@ include_once(XOOPS_ROOT_PATH."/class/xoopstree.php");
 //include_once(XOOPS_ROOT_PATH."/class/xoopscomments.php");
 $mytree = new XoopsTree($xoopsDB->prefix("flashgames_cat"),"cid","pid");
 $xoopsOption['template_main'] = 'flashgames_game.html';
 
 $lid = $HTTP_GET_VARS['lid'];
+
+if (!is_numeric($lid) or $lid<=0) 
+{ exit;
+}
+
+
 if(!$full) {
     include(XOOPS_ROOT_PATH."/header.php");
 //    OpenTable();
 }
 //mainheader();

Fixed code: 
if (!is_numeric($lid) or $lid<=0) 
{ exit;
}
CVE-2024-24760: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
value: mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of a Docker container, even when the port is bound to 127.0.0.1. The vulnerability has been addressed by implementing additional iptables/nftables rules. These rules drop packets for Docker containers on ports 3306, 6379, 8983, and 12345, where the input interface is not `br-mailcow` and the output interface is `br-mailcow`.
CWE description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 7.3
Published: 2024-02-02T16:15Z
Repository: https://github.com/mailcow/mailcow-dockerized
Language: Unknown
Commit date: 2024-02-02 14:33:01 +0100
Commit message: Merge pull request #5696 from mailcow/fix/netfilter

[Netfilter] add mailcow isolation rule to MAILCOW chain
CVE-2020-27347: Out-of-bounds Write (CWE-787)
value: In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2020-11-06T03:15Z
Repository: https://github.com/tmux/tmux
Language: C
Files changed: input.c
Commit date: 2020-10-29 16:33:01 +0000
Commit message: Do not write after the end of the array and overwrite the stack when
colon-separated SGR sequences contain empty arguments. Reported by Sergey
Nizovtsev.

Diff: diff --git a/input.c b/input.c
index 42a60c92..c280c0d9 100644
--- a/input.c
+++ b/input.c
@@ -1974,12 +1974,17 @@ input_csi_dispatch_sgr_colon(struct input_ctx *ictx, u_int i)
 			p[n++] = strtonum(out, 0, INT_MAX, &errstr);
 			if (errstr != NULL || n == nitems(p)) {
 				free(copy);
 				return;
 			}
-		} else
+		} else {
 			n++;
+			if (n == nitems(p)) {
+				free(copy);
+				return;
+			}
+		}
 		log_debug("%s: %u = %d", __func__, n - 1, p[n - 1]);
 	}
 	free(copy);
 
 	if (n == 0)

Vulnerable code: 		} else
Fixed code: 		} else {
			if (n == nitems(p)) {
				free(copy);
				return;
			}
		}
CVE-2017-5591: Improper Input Validation (CWE-20)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/poezio/slixmpp
Language: Python
Files changed: slixmpp/plugins/xep_0280/carbons.py
Commit date: 2017-01-28 00:02:27 +0100
Commit message: Fix carbons

Diff: diff --git a/slixmpp/plugins/xep_0280/carbons.py b/slixmpp/plugins/xep_0280/carbons.py
index 261238b..aa71f7f 100644
--- a/slixmpp/plugins/xep_0280/carbons.py
+++ b/slixmpp/plugins/xep_0280/carbons.py
@@ -59,14 +59,16 @@ class XEP_0280(BasePlugin):
 
     def session_bind(self, jid):
         self.xmpp.plugin['xep_0030'].add_feature('urn:xmpp:carbons:2')
 
     def _handle_carbon_received(self, msg):
-        self.xmpp.event('carbon_received', msg)
+        if msg['from'].bare == self.xmpp.boundjid.bare:
+            self.xmpp.event('carbon_received', msg)
 
     def _handle_carbon_sent(self, msg):
-        self.xmpp.event('carbon_sent', msg)
+        if msg['from'].bare == self.xmpp.boundjid.bare:
+            self.xmpp.event('carbon_sent', msg)
 
     def enable(self, ifrom=None, timeout=None, callback=None,
                timeout_callback=None):
         iq = self.xmpp.Iq()
         iq['type'] = 'set'

Vulnerable code:         self.xmpp.event('carbon_received', msg)
        self.xmpp.event('carbon_sent', msg)
Fixed code:         if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_received', msg)
        if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_sent', msg)
CVE-2017-5591: Origin Validation Error (CWE-346)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/poezio/slixmpp
Language: Python
Files changed: slixmpp/plugins/xep_0280/carbons.py
Commit date: 2017-01-28 00:02:27 +0100
Commit message: Fix carbons

Diff: diff --git a/slixmpp/plugins/xep_0280/carbons.py b/slixmpp/plugins/xep_0280/carbons.py
index 261238b..aa71f7f 100644
--- a/slixmpp/plugins/xep_0280/carbons.py
+++ b/slixmpp/plugins/xep_0280/carbons.py
@@ -59,14 +59,16 @@ class XEP_0280(BasePlugin):
 
     def session_bind(self, jid):
         self.xmpp.plugin['xep_0030'].add_feature('urn:xmpp:carbons:2')
 
     def _handle_carbon_received(self, msg):
-        self.xmpp.event('carbon_received', msg)
+        if msg['from'].bare == self.xmpp.boundjid.bare:
+            self.xmpp.event('carbon_received', msg)
 
     def _handle_carbon_sent(self, msg):
-        self.xmpp.event('carbon_sent', msg)
+        if msg['from'].bare == self.xmpp.boundjid.bare:
+            self.xmpp.event('carbon_sent', msg)
 
     def enable(self, ifrom=None, timeout=None, callback=None,
                timeout_callback=None):
         iq = self.xmpp.Iq()
         iq['type'] = 'set'

Vulnerable code:         self.xmpp.event('carbon_received', msg)
        self.xmpp.event('carbon_sent', msg)
Fixed code:         if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_received', msg)
        if msg['from'].bare == self.xmpp.boundjid.bare:
            self.xmpp.event('carbon_sent', msg)
CVE-2023-25166: Inefficient Regular Expression Complexity (CWE-1333)
value: formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 6.5
Published: 2023-02-08T20:15Z
Repository: https://github.com/hapijs/formula
Language: JavaScript
Files changed: lib/index.js
Commit date: 2022-12-14 11:28:19 +0100
Commit message: chore: better number regex

Diff: diff --git a/lib/index.js b/lib/index.js
index 871ab1b..4b4d0a2 100755
--- a/lib/index.js
+++ b/lib/index.js
@@ -11,11 +11,11 @@ const internals = {
         '`': '`',
         '\'': '\'',
         '[': ']'
     },
 
-    numberRx: /^(?:[0-9]*\.?[0-9]*){1}$/,
+    numberRx: /^(?:[0-9]*(\.[0-9]*)?){1}$/,
     tokenRx: /^[\w\$\#\.\@\:\{\}]+$/,
 
     symbol: Symbol('formula'),
     settings: Symbol('settings')
 };

Vulnerable code:     numberRx: /^(?:[0-9]*\.?[0-9]*){1}$/,
Fixed code:     numberRx: /^(?:[0-9]*(\.[0-9]*)?){1}$/,
CVE-2017-12795: Improper Input Validation (CWE-20)
value: OpenMRS openmrs-module-htmlformentry 3.3.2 is affected by: (Improper Input Validation).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2019-05-10T15:29Z
Repository: https://github.com/openmrs/openmrs-module-htmlformentry
Language: Java
Files changed: omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
Commit date: 2017-09-06 12:33:33 -0400
Commit message: Added privilege check when previewing an uploaded html form

Diff: diff --git a/omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java b/omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
index a132a610..6aebfade 100644
--- a/omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
+++ b/omod/src/main/java/org/openmrs/module/htmlformentry/web/controller/HtmlFormFromFileController.java
@@ -42,10 +42,12 @@ public class HtmlFormFromFileController {
 	@RequestMapping("/module/htmlformentry/htmlFormFromFile.form")
 	public void handleRequest(Model model, @RequestParam(value = "filePath", required = false) String filePath,
 	                          @RequestParam(value = "patientId", required = false) Integer pId,
 	                          @RequestParam(value = "isFileUpload", required = false) boolean isFileUpload,
 	                          HttpServletRequest request) throws Exception {
+
+        Context.requirePrivilege("Manage Forms");
 		
 		if (log.isDebugEnabled())
 			log.debug("In reference data...");
 		
 		model.addAttribute("previewHtml", "");

Fixed code: 
        Context.requirePrivilege("Manage Forms");
CVE-2022-31109: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by default, and require users to opt-in to `X-Forwarded-*` header usage via a configured `Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject `X-Forwarded-*` headers at the web server level.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 6.1
Published: 2022-08-01T17:15Z
Repository: https://github.com/laminas/laminas-diactoros
Language: Unknown
Commit date: 2022-06-28 16:07:29 -0500
Commit message: Merge pull request from GHSA-8274-h5jp-97vr

Security/x forwarded header trust
CVE-2022-31109: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered environments using a load balancer, the library offers mitigation measures only in the v2 releases, as doing otherwise would break these use cases immediately. Users of v2 releases from 2.11.1 can provide an additional argument to `Laminas\Diactoros\ServerRequestFactory::fromGlobals()` in the form of a `Laminas\Diactoros\RequestFilter\RequestFilterInterface` instance, including the shipped `Laminas\Diactoros\RequestFilter\NoOpRequestFilter` implementation which ignores the `X-Forwarded-*` headers. Starting in version 3.0, the library will reverse behavior to use the `NoOpRequestFilter` by default, and require users to opt-in to `X-Forwarded-*` header usage via a configured `Laminas\Diactoros\RequestFilter\LegacyXForwardedHeaderFilter` instance. Users are advised to upgrade to version 2.11.1 or later to resolve this issue. Users unable to upgrade may configure web servers to reject `X-Forwarded-*` headers at the web server level.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-08-01T17:15Z
Repository: https://github.com/laminas/laminas-diactoros
Language: Unknown
Commit date: 2022-06-28 16:07:29 -0500
Commit message: Merge pull request from GHSA-8274-h5jp-97vr

Security/x forwarded header trust
CVE-2020-26231: Missing Authorization (CWE-862)
value: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 470 (v1.0.470) and v1.1.1.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.7
Published: 2020-11-23T21:15Z
Repository: https://github.com/octobercms/october
Language: PHP
Files changed: modules/system/twig/SecurityPolicy.php
Commit date: 2020-11-13 03:48:27 -0600
Commit message: Improve Twig security policy

Follow up to https://github.com/octobercms/october/compare/106daa2930de4cebb18732732d47d4056f01dd5b...7cb148c1677373ac30ccfd3069d18098e403e1ca. Thanks to @ka1n4t for the additional review.

Diff: diff --git a/modules/system/twig/SecurityPolicy.php b/modules/system/twig/SecurityPolicy.php
index bcbc7a1501..aacd39ba63 100644
--- a/modules/system/twig/SecurityPolicy.php
+++ b/modules/system/twig/SecurityPolicy.php
@@ -18,10 +18,12 @@ final class SecurityPolicy implements SecurityPolicyInterface
      * @var array List of forbidden methods.
      */
     protected $blockedMethods = [
         'addDynamicMethod',
         'addDynamicProperty',
+        'bindEvent',
+        'bindEventOnce',
     ];
 
     /**
      * Constructor
      */

Fixed code:         'bindEvent',
        'bindEventOnce',
CVE-2020-5295: Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CWE description: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CVSS v3 base score: 4.9
Published: 2020-06-03T22:15Z
Repository: https://github.com/octobercms/october
Language: PHP
Files changed: modules/cms/classes/Asset.php
Commit date: 2020-03-31 03:37:31 -0600
Commit message: Improve asset file path handling

Diff: diff --git a/modules/cms/classes/Asset.php b/modules/cms/classes/Asset.php
index c0920752ff..1073f8ed8c 100644
--- a/modules/cms/classes/Asset.php
+++ b/modules/cms/classes/Asset.php
@@ -283,11 +283,18 @@ class Asset extends Extendable
     {
         if ($fileName === null) {
             $fileName = $this->fileName;
         }
 
-        return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;
+        // Limit paths to those under the assets directory
+        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
+        $path = realpath($directory . $fileName);
+        if (!starts_with($path, $directory)) {
+            return false;
+        }
+
+        return $path;
     }
 
     /**
      * Returns a list of editable asset extensions.
      * The list can be overridden with the cms.editableAssetTypes configuration option.

Vulnerable code:         return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;
Fixed code:         // Limit paths to those under the assets directory
        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
        $path = realpath($directory . $fileName);
        if (!starts_with($path, $directory)) {
            return false;
        }

        return $path;
CVE-2020-5296: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CWE description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 4.9
Published: 2020-06-03T22:15Z
Repository: https://github.com/octobercms/october
Language: PHP
Files changed: modules/cms/classes/Asset.php
Commit date: 2020-03-31 03:37:31 -0600
Commit message: Improve asset file path handling

Diff: diff --git a/modules/cms/classes/Asset.php b/modules/cms/classes/Asset.php
index c0920752ff..1073f8ed8c 100644
--- a/modules/cms/classes/Asset.php
+++ b/modules/cms/classes/Asset.php
@@ -283,11 +283,18 @@ class Asset extends Extendable
     {
         if ($fileName === null) {
             $fileName = $this->fileName;
         }
 
-        return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;
+        // Limit paths to those under the assets directory
+        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
+        $path = realpath($directory . $fileName);
+        if (!starts_with($path, $directory)) {
+            return false;
+        }
+
+        return $path;
     }
 
     /**
      * Returns a list of editable asset extensions.
      * The list can be overridden with the cms.editableAssetTypes configuration option.

Vulnerable code:         return $this->theme->getPath().'/'.$this->dirName.'/'.$fileName;
Fixed code:         // Limit paths to those under the assets directory
        $directory = $this->theme->getPath() . '/' . $this->dirName . '/';
        $path = realpath($directory . $fileName);
        if (!starts_with($path, $directory)) {
            return false;
        }

        return $path;
CVE-2020-5297: Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).
CWE description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 2.7
Published: 2020-06-03T22:15Z
Repository: https://github.com/octobercms/october
Language: PHP
Files changed: modules/cms/widgets/AssetList.php
Commit date: 2020-03-31 04:09:18 -0600
Commit message: Improve asset file path handling when moving assets

Diff: diff --git a/modules/cms/widgets/AssetList.php b/modules/cms/widgets/AssetList.php
index 0fcd63c730..3dda5d1b35 100644
--- a/modules/cms/widgets/AssetList.php
+++ b/modules/cms/widgets/AssetList.php
@@ -331,17 +331,24 @@ class AssetList extends WidgetBase
                 throw new ApplicationException(Lang::get('cms::lang.asset.invalid_path'));
             }
 
             $basename = basename($path);
             $originalFullPath = $this->getFullPath($path);
-            $newFullPath = rtrim($destinationFullPath, '/').'/'.$basename;
+            $newFullPath = realpath(rtrim($destinationFullPath, '/')) . '/' . $basename;
             $safeDir = $this->getAssetsPath();
 
             if ($originalFullPath == $newFullPath) {
                 continue;
             }
 
+            if (!starts_with($newFullPath, $safeDir)) {
+                throw new ApplicationException(Lang::get(
+                    'cms::lang.asset.error_moving_file',
+                    ['file' => $basename]
+                ));
+            }
+
             if (is_file($originalFullPath)) {
                 if (!@File::move($originalFullPath, $newFullPath)) {
                     throw new ApplicationException(Lang::get(
                         'cms::lang.asset.error_moving_file',
                         ['file' => $basename]

Vulnerable code:             $newFullPath = rtrim($destinationFullPath, '/').'/'.$basename;
Fixed code:             $newFullPath = realpath(rtrim($destinationFullPath, '/')) . '/' . $basename;
            if (!starts_with($newFullPath, $safeDir)) {
                throw new ApplicationException(Lang::get(
                    'cms::lang.asset.error_moving_file',
                    ['file' => $basename]
                ));
            }
CVE-2020-5298: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-06-03T22:15Z
Repository: https://github.com/octobercms/october
Language: Other
Files changed: modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm
Commit date: 2020-03-31 04:17:41 -0600
Commit message: escape import CSV column names

Diff: diff --git a/modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm b/modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm
index 8677699774..b221e54879 100644
--- a/modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm
+++ b/modules/backend/behaviors/importexportcontroller/partials/_import_file_columns.htm
@@ -20,11 +20,11 @@
                             <a
                                 href="javascript:;"
                                 class="column-label"
                                 onclick="$.oc.importBehavior.loadFileColumnSample(this)"
                             >
-                                <?= $column ?>
+                                <?= e($column) ?>
                             </a>
                         </span>
                     </div>
                     <div class="import-column-bindings">
                         <ul data-empty-text="<?= e(trans('backend::lang.import_export.drop_column_here')) ?>"></ul>

Vulnerable code:                                 <?= $column ?>
Fixed code:                                 <?= e($column) ?>
CVE-2023-44383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-11-29T20:15Z
Repository: https://github.com/octobercms/october
Language: PHP
Files changed: config/media.php
Commit date: 2023-10-03 10:27:57 +1100
Commit message: Sync upstream (3.5)

Diff: diff --git a/config/media.php b/config/media.php
index 1f92a73057..90b0d1423a 100644
--- a/config/media.php
+++ b/config/media.php
@@ -28,10 +28,22 @@ return [
     |
     */
 
     'auto_rename' => null,
 
+   /*
+    |--------------------------------------------------------------------------
+    | Clean Vector Files
+    |--------------------------------------------------------------------------
+    |
+    | When a vector file (SVG) file is uploaded, automatically process its
+    | contents to remove scripts and other potentially dangerous content.
+    |
+    */
+
+    'clean_vectors' => true,
+
     /*
     |--------------------------------------------------------------------------
     | Ignored Files and Patterns
     |--------------------------------------------------------------------------
     |

Fixed code:    /*
    |--------------------------------------------------------------------------
    | Clean Vector Files
    |--------------------------------------------------------------------------
    |
    | When a vector file (SVG) file is uploaded, automatically process its
    | contents to remove scripts and other potentially dangerous content.
    |
    */

    'clean_vectors' => true,
CVE-2017-20165: Inefficient Regular Expression Complexity (CWE-1333)
value: A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-09T10:15Z
Repository: https://github.com/debug-js/debug
Language: JavaScript
Files changed: src/node.js
Commit date: 2017-09-22 00:26:33 +0200
Commit message: remove ReDoS regexp in %o formatter (#504)


Diff: diff --git a/src/node.js b/src/node.js
index b85ec7e..2bc7571 100644
--- a/src/node.js
+++ b/src/node.js
@@ -81,11 +81,13 @@ function useColors() {
  */
 
 exports.formatters.o = function(v) {
   this.inspectOpts.colors = this.useColors;
   return util.inspect(v, this.inspectOpts)
-    .replace(/\s*\n\s*/g, ' ');
+    .split('\n').map(function(str) {
+      return str.trim()
+    }).join(' ');
 };
 
 /**
  * Map %o to `util.inspect()`, allowing multiple lines if needed.
  */

Vulnerable code:     .replace(/\s*\n\s*/g, ' ');
Fixed code:     .split('\n').map(function(str) {
      return str.trim()
    }).join(' ');
CVE-2022-2653: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: With this vulnerability an attacker can read many sensitive files like configuration files, or the /proc/self/environ file, that contains the environment variable used by the web server that includes database credentials. If the web server user is root, an attacker will be able to read any file in the system.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2022-08-04T10:15Z
Repository: https://github.com/plankanban/planka
Language: JavaScript
Files changed: server/api/controllers/attachments/download-thumbnail.js, server/config/routes.js
Commit date: 2022-08-04 00:37:30 +0200
Commit message: fix: Fix path traversal vulnerability

Diff: diff --git a/server/api/controllers/attachments/download-thumbnail.js b/server/api/controllers/attachments/download-thumbnail.js
index 9da37b7..9233be8 100644
--- a/server/api/controllers/attachments/download-thumbnail.js
+++ b/server/api/controllers/attachments/download-thumbnail.js
@@ -12,14 +12,10 @@ module.exports = {
     id: {
       type: 'string',
       regex: /^[0-9]+$/,
       required: true,
     },
-    filename: {
-      type: 'string',
-      required: true,
-    },
   },
 
   exits: {
     attachmentNotFound: {
       responseType: 'notFound',
@@ -52,18 +48,18 @@ module.exports = {
 
     const filePath = path.join(
       sails.config.custom.attachmentsPath,
       attachment.dirname,
       'thumbnails',
-      inputs.filename,
+      'cover-256.jpg',
     );
 
     if (!fs.existsSync(filePath)) {
       throw Errors.ATTACHMENT_NOT_FOUND;
     }
 
-    this.res.type(attachment.filename);
+    this.res.type('image/jpeg');
     this.res.set('Cache-Control', 'private, max-age=900'); // TODO: move to config
 
     return exits.success(fs.createReadStream(filePath));
   },
 };
diff --git a/server/config/routes.js b/server/config/routes.js
index 1bcd4db..3302c62 100644
--- a/server/config/routes.js
+++ b/server/config/routes.js
@@ -78,11 +78,11 @@ module.exports.routes = {
   'GET /attachments/:id/download/:filename': {
     action: 'attachments/download',
     skipAssets: false,
   },
 
-  'GET /attachments/:id/download/thumbnails/:filename': {
+  'GET /attachments/:id/download/thumbnails/cover-256.jpg': {
     action: 'attachments/download-thumbnail',
     skipAssets: false,
   },
 
   'GET /*': {

Vulnerable code:     filename: {
      type: 'string',
      required: true,
    },
      inputs.filename,
    this.res.type(attachment.filename);
  'GET /attachments/:id/download/thumbnails/:filename': {
Fixed code:       'cover-256.jpg',
    this.res.type('image/jpeg');
  'GET /attachments/:id/download/thumbnails/cover-256.jpg': {
CVE-2017-20179: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourController of the file app/controllers/tour_controller.rb. The manipulation leads to an unknown weakness. The attack may be initiated remotely. Upgrading to version 2.3.2 is able to address this issue. The patch is named 6ef04f8b5972d5f16f8b86f8b53f62fac68d5498. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221507.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-02-21T21:15Z
Repository: https://github.com/instedd/pollit
Language: Ruby
Files changed: app/controllers/tour_controller.rb
Commit date: 2017-03-02 14:41:22 -0300
Commit message: Fix possible remote execution code exploit in TourController

Diff: diff --git a/app/controllers/tour_controller.rb b/app/controllers/tour_controller.rb
index 6344370..57ea0c9 100644
--- a/app/controllers/tour_controller.rb
+++ b/app/controllers/tour_controller.rb
@@ -15,8 +15,8 @@
 # You should have received a copy of the GNU General Public License
 # along with Pollit.  If not, see <http://www.gnu.org/licenses/>.
 
 class TourController < ApplicationController
   def show
-    render (params[:page] ||= 'start')
+    render (params[:page].to_s ||= 'start')
   end
-end
\ No newline at end of file
+end

Vulnerable code:     render (params[:page] ||= 'start')
end
Fixed code:     render (params[:page].to_s ||= 'start')
end