Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-2629: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 7.8
Published: 2023-05-10T16:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: PHP
Files changed: src/CustomerList/Exporter/AbstractExporter.php
Commit date: 2023-04-21 12:26:55 +0200
Commit message: Escaped csv formulas (#453)


Diff: diff --git a/src/CustomerList/Exporter/AbstractExporter.php b/src/CustomerList/Exporter/AbstractExporter.php
index 14eb3e0f..32bff500 100644
--- a/src/CustomerList/Exporter/AbstractExporter.php
+++ b/src/CustomerList/Exporter/AbstractExporter.php
@@ -16,10 +16,11 @@
 namespace CustomerManagementFrameworkBundle\CustomerList\Exporter;
 
 use CustomerManagementFrameworkBundle\Model\CustomerInterface;
 use Pimcore\Model\DataObject\ClassDefinition;
 use Pimcore\Model\DataObject\Listing\Concrete;
+use Pimcore\Model\Element\Service;
 
 abstract class AbstractExporter implements ExporterInterface
 {
     /**
      * @var string
@@ -147,10 +148,12 @@ abstract class AbstractExporter implements ExporterInterface
                         $allSegmentIds[] = $segment->getId();
                     }
                 }
             }
 
+            $row[self::COLUMNS] = Service::escapeCsvRecord($row[self::COLUMNS]);
+            $row[self::SEGMENT_IDS] = Service::escapeCsvRecord($row[self::SEGMENT_IDS]);
             $rows[] = $row;
         }
 
         return [
             self::ROWS => $rows,

Fixed code: use Pimcore\Model\Element\Service;
            $row[self::COLUMNS] = Service::escapeCsvRecord($row[self::COLUMNS]);
            $row[self::SEGMENT_IDS] = Service::escapeCsvRecord($row[self::SEGMENT_IDS]);
CVE-2023-2881: Insufficiently Protected Credentials (CWE-522)
value: Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 4.9
Published: 2023-05-25T09:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: PHP
Files changed: src/CustomerView/DefaultCustomerView.php
Commit date: 2023-05-16 08:51:16 +0200
Commit message: Remove password field from detals view (#469)

* Remove password field from customer details

* Apply php-cs-fixer changes

* Update src/CustomerView/DefaultCustomerView.php

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>

---------

Co-authored-by: aryaantony92 <aryaantony92@users.noreply.github.com>
Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>
Diff: diff --git a/src/CustomerView/DefaultCustomerView.php b/src/CustomerView/DefaultCustomerView.php
index 4e95d3ca..8f3bdd88 100644
--- a/src/CustomerView/DefaultCustomerView.php
+++ b/src/CustomerView/DefaultCustomerView.php
@@ -108,11 +108,11 @@ class DefaultCustomerView implements CustomerViewInterface
 
         $result = [];
         $vf = $this->viewFormatter;
 
         foreach ($definition->getFieldDefinitions() as $fd) {
-            if ($fd->getInvisible()) {
+            if ($fd->getInvisible() || $fd->getFieldtype() === 'password') {
                 continue;
             }
 
             $getter = 'get'.ucfirst($fd->getName());
             $value = $vf->formatValueByFieldDefinition($fd, $customer->$getter());

Vulnerable code:             if ($fd->getInvisible()) {
Fixed code:             if ($fd->getInvisible() || $fd->getFieldtype() === 'password') {
CVE-2023-32075: Insufficient Information (NVD-CWE-noinfo)
value: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number. This vulnerability is capable of the unlogic in the counter value in the Conditions tab. Users should update to version 3.3.9 to receive a patch or, as a workaround, or apply the patch manually.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.3
Published: 2023-05-11T17:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: JavaScript
Files changed: src/Resources/public/js/config/conditions.js
Commit date: 2023-05-08 14:15:32 +0200
Commit message: Restrict negative value (#466)


Diff: diff --git a/src/Resources/public/js/config/conditions.js b/src/Resources/public/js/config/conditions.js
index 41afc7ab..61434d2a 100644
--- a/src/Resources/public/js/config/conditions.js
+++ b/src/Resources/public/js/config/conditions.js
@@ -219,11 +219,12 @@ pimcore.plugin.cmf.rule.conditions.CountActivities = Class.create(pimcore.plugin
                     },
                     {
                         xtype: "numberfield",
                         name: "count",
                         width: 90,
-                        value: this.options.count
+                        value: this.options.count,
+                        minValue: 0
                     }
                 ]
             }
 
 
@@ -450,11 +451,12 @@ pimcore.plugin.cmf.rule.conditions.CountTrackedSegment = Class.create(pimcore.pl
         });
         this.countField = Ext.create('Ext.form.field.Number', {
             //xtype: "numberfield",
             name: "count",
             width: 90,
-            value: this.options.count
+            value: this.options.count,
+            minValue: 0
         });
 
         return [
             {
                 xtype: "fieldcontainer",
@@ -529,11 +531,12 @@ pimcore.plugin.cmf.rule.conditions.CountTargetGroupWeight = Class.create(pimcore
                     },
                     {
                         xtype: "numberfield",
                         name: "count",
                         width: 90,
-                        value: this.options.count
+                        value: this.options.count,
+                        minValue: 0
                     }
                 ]
             },
             {
                 xtype: "fieldcontainer",

Vulnerable code:                         value: this.options.count
            value: this.options.count
                        value: this.options.count
Fixed code:                         value: this.options.count,
                        minValue: 0
            value: this.options.count,
            minValue: 0
                        value: this.options.count,
                        minValue: 0
CVE-2023-4145: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-03T17:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: PHP
Files changed: composer.json, src/View/Formatter/DefaultViewFormatter.php
Commit date: 2023-07-26 11:55:42 +0200
Commit message: Fix Xss in the segment name (#490)

* Fix Xss in the segment name

* Apply php-cs-fixer changes

* Fix PHP stan

---------

Co-authored-by: aryaantony92 <aryaantony92@users.noreply.github.com>
Diff: diff --git a/composer.json b/composer.json
index ad7daab0..d1ed9c69 100644
--- a/composer.json
+++ b/composer.json
@@ -22,11 +22,11 @@
     "guzzlehttp/guzzle": "^7.2",
     "knplabs/knp-components": "^3",
     "pear/archive_tar": "^1.4.3",
     "pimcore/number-sequence-generator": "^1.0.5",
     "pimcore/object-merger": "^3.0",
-    "pimcore/pimcore": "^10.5",
+    "pimcore/pimcore": "^10.5.21",
     "pimcore/search-query-parser": "^1.3",
     "symfony/asset": "^5.3",
     "symfony/config": "^5.3",
     "symfony/console": "^5.3",
     "symfony/dependency-injection": "^5.3.3",
diff --git a/src/View/Formatter/DefaultViewFormatter.php b/src/View/Formatter/DefaultViewFormatter.php
index 70fab54c..355f3075 100644
--- a/src/View/Formatter/DefaultViewFormatter.php
+++ b/src/View/Formatter/DefaultViewFormatter.php
@@ -17,10 +17,11 @@ namespace CustomerManagementFrameworkBundle\View\Formatter;
 
 use Carbon\Carbon;
 use CustomerManagementFrameworkBundle\Model\CustomerSegmentInterface;
 use Pimcore\Model\DataObject\ClassDefinition;
 use Pimcore\Model\DataObject\ClassDefinition\Data;
+use Pimcore\Security\SecurityHelper;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
 class DefaultViewFormatter implements ViewFormatterInterface
 {
     /**
@@ -174,11 +175,11 @@ class DefaultViewFormatter implements ViewFormatterInterface
      *
      * @return string
      */
     protected function formatSegmentValue(CustomerSegmentInterface $segment)
     {
-        return sprintf('<span class="label label-default">%s</span>', $segment->getName());
+        return sprintf('<span class="label label-default">%s</span>', SecurityHelper::convertHtmlSpecialChars($segment->getName()));
     }
 
     protected function getLanguageFromLocale($locale)
     {
         return explode('_', $locale)[0];

Vulnerable code:     "pimcore/pimcore": "^10.5",
        return sprintf('<span class="label label-default">%s</span>', $segment->getName());
Fixed code:     "pimcore/pimcore": "^10.5.21",
use Pimcore\Security\SecurityHelper;
        return sprintf('<span class="label label-default">%s</span>', SecurityHelper::convertHtmlSpecialChars($segment->getName()));
CVE-2024-21666: Improper Access Control (CWE-284)
value: The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when reaching the `/admin/customermanagementframework/duplicates/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. Unauthorized user(s) can access PII data from customers. This vulnerability has been patched in version 4.0.6.

CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 6.5
Published: 2024-01-11T01:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: PHP
Files changed: src/Controller/Admin/DuplicatesController.php
Commit date: 2024-01-08 12:39:34 +0100
Commit message: Fix: improper access (#523)


Diff: diff --git a/src/Controller/Admin/DuplicatesController.php b/src/Controller/Admin/DuplicatesController.php
index 73f53a973..55b1b2a2b 100644
--- a/src/Controller/Admin/DuplicatesController.php
+++ b/src/Controller/Admin/DuplicatesController.php
@@ -21,10 +21,11 @@ use CustomerManagementFrameworkBundle\DuplicatesIndex\DuplicatesIndexInterface;
 use Pimcore\Model\DataObject\AbstractObject;
 use Pimcore\Model\DataObject\Service;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\Routing\Annotation\Route;
 
 /**
  * @Route("/duplicates")
  */
@@ -33,10 +34,16 @@ class DuplicatesController extends Admin
     public function init()
     {
         AbstractObject::setHideUnpublished(true);
     }
 
+    public function onKernelControllerEvent(ControllerEvent $event): void
+    {
+        parent::onKernelControllerEvent($event);
+        $this->checkPermission('plugin_cmf_perm_customerview');
+    }
+
     /**
      * @Route("/list")
      *
      * @throws \Exception
      */

Fixed code: use Symfony\Component\HttpKernel\Event\ControllerEvent;
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        parent::onKernelControllerEvent($event);
        $this->checkPermission('plugin_cmf_perm_customerview');
    }
CVE-2024-21667: Improper Access Control (CWE-284)
value: pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Permissions are not enforced when reaching the `/admin/customermanagementframework/gdpr-data/search-data-objects` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. An unauthorized user can access PII data from customers. This vulnerability has been patched in version 4.0.6.

CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 6.5
Published: 2024-01-11T01:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: PHP
Files changed: src/Controller/Admin/GDPRDataController.php
Commit date: 2024-01-09 15:49:22 +0100
Commit message: [Bug]: Fix GDPR search-data-objects permission (#525)

* Update GDPRDataController.php

* fix typo

* Apply php-cs-fixer changes

---------

Co-authored-by: kingjia90 <kingjia90@users.noreply.github.com>

Diff: diff --git a/src/Controller/Admin/GDPRDataController.php b/src/Controller/Admin/GDPRDataController.php
index f97e11fbf..c97bc12e9 100644
--- a/src/Controller/Admin/GDPRDataController.php
+++ b/src/Controller/Admin/GDPRDataController.php
@@ -14,26 +14,33 @@
  */
 
 namespace CustomerManagementFrameworkBundle\Controller\Admin;
 
 use CustomerManagementFrameworkBundle\GDPR\DataProvider\Customers;
+use Pimcore\Controller\KernelControllerEventInterface;
 use Pimcore\Controller\Traits\JsonHelperTrait;
 use Pimcore\Controller\UserAwareController;
 use Pimcore\Model\DataObject\AbstractObject;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\Routing\Annotation\Route;
 
 /**
  * Class DataObjectController
  *
  * @Route("/gdpr-data")
  */
-class GDPRDataController extends UserAwareController
+class GDPRDataController extends UserAwareController implements KernelControllerEventInterface
 {
     use JsonHelperTrait;
 
+    public function onKernelControllerEvent(ControllerEvent $event): void
+    {
+        $this->checkPermission('gdpr_data_extractor');
+    }
+
     /**
      * @Route("/search-data-objects", name="_pimcore_customermanagementframework_gdprdata_searchdataobjects", methods={"GET"})
      */
     public function searchDataObjectsAction(Request $request, Customers $service): JsonResponse
     {

Vulnerable code: class GDPRDataController extends UserAwareController
Fixed code: use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class GDPRDataController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('gdpr_data_extractor');
    }
CVE-2018-10366: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-04-25T09:29Z
Repository: https://github.com/rainlab/user-plugin
Language: Other
Files changed: components/account/update.htm
Commit date: 2018-04-04 13:56:08 +1000
Commit message: KISS and form_value() doesn't use escaping

Diff: diff --git a/components/account/update.htm b/components/account/update.htm
index a294dd0..7d980da 100644
--- a/components/account/update.htm
+++ b/components/account/update.htm
@@ -1,15 +1,15 @@
-{{ form_ajax('onUpdate', { model: user }) }}
+{{ form_ajax('onUpdate') }}
 
     <div class="form-group">
         <label for="accountName">Full Name</label>
-        <input name="name" type="text" class="form-control" id="accountName" value="{{ form_value('name') }}">
+        <input name="name" type="text" class="form-control" id="accountName" value="{{ user.name }}">
     </div>
 
     <div class="form-group">
         <label for="accountEmail">Email</label>
-        <input name="email" type="email" class="form-control" id="accountEmail" value="{{ form_value('email') }}">
+        <input name="email" type="email" class="form-control" id="accountEmail" value="{{ user.email }}">
     </div>
 
     <div class="form-group">
         <label for="accountPassword">New Password</label>
         <input name="password" type="password" class="form-control" id="accountPassword">
@@ -20,6 +20,6 @@
         <input name="password_confirmation" type="password" class="form-control" id="accountPasswordConfirm">
     </div>
 
     <button type="submit" class="btn btn-default">Save</button>
 
-{{ form_close() }}
\ No newline at end of file
+{{ form_close() }}

Vulnerable code: {{ form_ajax('onUpdate', { model: user }) }}
        <input name="name" type="text" class="form-control" id="accountName" value="{{ form_value('name') }}">
        <input name="email" type="email" class="form-control" id="accountEmail" value="{{ form_value('email') }}">
{{ form_close() }}
Fixed code: {{ form_ajax('onUpdate') }}
        <input name="name" type="text" class="form-control" id="accountName" value="{{ user.name }}">
        <input name="email" type="email" class="form-control" id="accountEmail" value="{{ user.email }}">
{{ form_close() }}
CVE-2022-4456: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 15adb8e1ea1f1c3e3d152fc266071f621ef0c621. It is recommended to apply a patch to fix this issue. VDB-215446 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-13T18:15Z
Repository: https://github.com/falling-fruit/falling-fruit
Language: Unknown
Commit date: 2022-03-08 00:09:07 +0100
Commit message: Merge branch 'fix-xss-vulnerabilities'
CVE-2018-1000659: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulnerability in file upload functionality that can result in remote code execution as authenticated user. This attack appear to be exploitable via An authenticated user can upload a specially crafted zip file to get remote code execution. This vulnerability appears to have been fixed in after commit 72a02ebaaf95a80e26127ee7ee2b123cccce05a7 / version 3.14.4.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2018-09-06T17:29Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/third_party/pclzip/pclzip.lib.php
Commit date: 2018-08-15 13:25:47 +0200
Commit message: [security] fixed issue #13959: RCE via resource file upload as authenticated user


Diff: diff --git a/application/third_party/pclzip/pclzip.lib.php b/application/third_party/pclzip/pclzip.lib.php
index 2ac786dd251..8c7cbc79395 100644
--- a/application/third_party/pclzip/pclzip.lib.php
+++ b/application/third_party/pclzip/pclzip.lib.php
@@ -3667,10 +3667,13 @@
         $p_entry['filename'] = substr($p_entry['filename'], $p_remove_path_size);
 
       }
     }
 
+    // Added by LS Team to check for invalid paths
+    $p_entry['filename'] = get_absolute_path($p_entry['filename']);    
+
     // ----- Add the path
     if ($p_path != '') {
       $p_entry['filename'] = $p_path."/".$p_entry['filename'];
     }
 

Fixed code:     // Added by LS Team to check for invalid paths
    $p_entry['filename'] = get_absolute_path($p_entry['filename']);
CVE-2019-14512: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-03-16T15:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/views/admin/labels/labelview_view.php
Commit date: 2019-08-02 08:53:55 +0200
Commit message: Fixed issue [security]: #15094 XSS in label title
Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/
Dev: encode label name

Diff: diff --git a/application/views/admin/labels/labelview_view.php b/application/views/admin/labels/labelview_view.php
index e10687bd751..3a466db7034 100644
--- a/application/views/admin/labels/labelview_view.php
+++ b/application/views/admin/labels/labelview_view.php
@@ -8,11 +8,11 @@
 
 <div class="col-sm-12 labels">
     <div class="pagetitle h3">
         <?php eT("Labels") ?>
         <?php if(isset($model->label_name)): ?> 
-            - <?=$model->label_name;?>
+            - <?php echo CHtml::encode($model->label_name); ?>
         <?php endif; ?>
     </div>
     <div class="container">
         <div class="row">
 

Vulnerable code:             - <?=$model->label_name;?>
Fixed code:             - <?php echo CHtml::encode($model->label_name); ?>
CVE-2019-14512: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-03-16T15:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/extensions/PanelBoxWidget/views/box.php
Commit date: 2019-08-02 09:21:02 +0200
Commit message: Fixed issue [security]: #15094 XSS in Boxes (thanks to Michele Cisternino)
Reported by Michele Cisternino https://www.linkedin.com/in/michelecisternino/
Dev: encode always encode …

Diff: diff --git a/application/extensions/PanelBoxWidget/views/box.php b/application/extensions/PanelBoxWidget/views/box.php
index 1321e31cddf..e6ee6e7a152 100644
--- a/application/extensions/PanelBoxWidget/views/box.php
+++ b/application/extensions/PanelBoxWidget/views/box.php
@@ -1,9 +1,9 @@
 <div class="<?php echo $sizeClass; ?> ls-flex-column ls-panelboxes-panelbox text-primary" >
-    <div class="panel panel-primary panel-clickable ls-panelboxes-panelbox-inner selector__<?=str_replace(' ', '_', strtolower($title))?>"
+    <div class="panel panel-primary panel-clickable ls-panelboxes-panelbox-inner selector__<?php echo CHtml::encode(str_replace(' ', '_', strtolower(strip_tags($title)))) ?>"
         id="panel-<?php echo $position; ?>"
-        data-url="<?php echo $url; ?>"
+        data-url="<?php echo CHtml::encode($url); ?>"
         <?php if ($external): ?>
             data-target="_blank"
         <?php endif; ?>
     >
         <div class="panel-heading">

Vulnerable code:     <div class="panel panel-primary panel-clickable ls-panelboxes-panelbox-inner selector__<?=str_replace(' ', '_', strtolower($title))?>"
        data-url="<?php echo $url; ?>"
Fixed code:     <div class="panel panel-primary panel-clickable ls-panelboxes-panelbox-inner selector__<?php echo CHtml::encode(str_replace(' ', '_', strtolower(strip_tags($title)))) ?>"
        data-url="<?php echo CHtml::encode($url); ?>"
CVE-2019-16172: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-09-09T19:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/controllers/admin/SurveysGroupsController.php
Commit date: 2019-09-01 16:27:10 +0200
Commit message: Fixed issue: [security] #15204: Stored XSS vulnerabilities - Thanks to J. Greil from the SEC Consult Vulnerability Lab (https://www.sec-consult.com)
Dev: encode group name in alert deleted

Diff: diff --git a/application/controllers/admin/SurveysGroupsController.php b/application/controllers/admin/SurveysGroupsController.php
index 31d971fe9a8..2b97190ab5d 100644
--- a/application/controllers/admin/SurveysGroupsController.php
+++ b/application/controllers/admin/SurveysGroupsController.php
@@ -128,11 +128,11 @@ class SurveysGroupsController extends Survey_Common_Action
         } else {
             $oGroupToDelete->delete();
 
             // if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser
             if (!isset($_GET['ajax'])) {
-                Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), $sGroupTitle), 'success');
+                Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), CHtml::encode($sGroupTitle)), 'success');
                 $this->getController()->redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin/survey/sa/listsurveys '));
             }
         }
     }
 

Vulnerable code:                 Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), $sGroupTitle), 'success');
Fixed code:                 Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), CHtml::encode($sGroupTitle)), 'success');
CVE-2019-9960: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2019-03-24T01:29Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/controllers/admin/export.php
Commit date: 2019-03-14 15:29:56 +0100
Commit message: [security] Fixed issue #14617: relative path allowed in lsa multiple download 


Diff: diff --git a/application/controllers/admin/export.php b/application/controllers/admin/export.php
index 04d984ef4c5..5d5ae67719e 100644
--- a/application/controllers/admin/export.php
+++ b/application/controllers/admin/export.php
@@ -917,10 +917,11 @@ class export extends Survey_Common_Action
      * @param string $sZip name of zip file to download (will be downloaded as "surveys_archive.zip")
      */
     public function downloadZip($sZip)
     {
         $sTempDir     = Yii::app()->getConfig("tempdir");
+        $sZip         = get_absolute_path($sZip);
         $aZIPFileName = $sTempDir.DIRECTORY_SEPARATOR.$sZip;
 
         if (is_file($aZIPFileName)) {
             $fn = "surveys_archive.zip";
 

Fixed code:         $sZip         = get_absolute_path($sZip);
CVE-2020-22607: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-28T19:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/controllers/admin/PermissiontemplatesController.php
Commit date: 2020-04-02 10:30:51 +0200
Commit message: Fixed issue [security] #16068: Stored Cross Site Scripting Vulnerability in permission rules. (Thanks to Matthew Aberegg)

Diff: diff --git a/application/controllers/admin/PermissiontemplatesController.php b/application/controllers/admin/PermissiontemplatesController.php
index c61e36a3ff8..47b6ed1b1f4 100644
--- a/application/controllers/admin/PermissiontemplatesController.php
+++ b/application/controllers/admin/PermissiontemplatesController.php
@@ -81,10 +81,14 @@ class PermissiontemplatesController extends Survey_Common_Action
     public function applyedit()
     {
         $aPermissiontemplate = Yii::app()->request->getPost('Permissiontemplates');
         $model = $this->loadModel($aPermissiontemplate['ptid']);
 
+        // XSS filter
+        $aPermissiontemplate['name'] = CHtml::encode($aPermissiontemplate['name']);
+        $aPermissiontemplate['description'] = CHtml::encode($aPermissiontemplate['description']);
+
         $newAttributes = array_merge($model->attributes, $aPermissiontemplate);
         $model->attributes = $newAttributes;
 
         if ($model->save()) {
             $success = true;

Fixed code:         // XSS filter
        $aPermissiontemplate['name'] = CHtml::encode($aPermissiontemplate['name']);
        $aPermissiontemplate['description'] = CHtml::encode($aPermissiontemplate['description']);
CVE-2020-25798: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissions to inject arbitrary web script or HTML via parameter ParticipantAttributeNamesDropdown of the Attributes on the central participant database page. When the survey attribute being edited or viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-11-17T15:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/views/admin/participants/modal_subviews/_editAttribute.php
Commit date: 2019-12-19 16:23:08 +0100
Commit message: Fixed issue #15672: LimeSurvey 3.21.1 Cross Site Scripting

Diff: diff --git a/application/views/admin/participants/modal_subviews/_editAttribute.php b/application/views/admin/participants/modal_subviews/_editAttribute.php
index 0707684e851..562fc107efd 100644
--- a/application/views/admin/participants/modal_subviews/_editAttribute.php
+++ b/application/views/admin/participants/modal_subviews/_editAttribute.php
@@ -57,11 +57,15 @@
         <div id='ParticipantAttributeNamesDropdownEditList'>
             <?php 
                 foreach($model->getAttributesValues($model->attribute_id) as $attribute_value){
                     echo "<div class='control-group'>";
                     echo "<div class='dropDownContainer col-xs-8 col-offset-xs-2'>";
-                    echo "<input class='form-control' name='ParticipantAttributeNamesDropdown[]' value='".$attribute_value['value']."' />";
+                    echo TbHtml::textField('ParticipantAttributeNamesDropdown[]', $attribute_value['value'], [
+                        'class' => 'form-control',
+                        'id' => ''
+                    ]);
+                    // echo "<input class='form-control' name='ParticipantAttributeNamesDropdown[]' value='".$attribute_value['value']."' />";
                     echo "</div>";
                     echo '<div class="col-xs-1">
                             <button class="btn btn-default form-group action_delDropdownField">
                                 <i class="fa fa-trash text-danger"></i>
                             </button>

Vulnerable code:                     echo "<input class='form-control' name='ParticipantAttributeNamesDropdown[]' value='".$attribute_value['value']."' />";
Fixed code:                     echo TbHtml::textField('ParticipantAttributeNamesDropdown[]', $attribute_value['value'], [
                        'class' => 'form-control',
                        'id' => ''
                    ]);
                    // echo "<input class='form-control' name='ParticipantAttributeNamesDropdown[]' value='".$attribute_value['value']."' />";
CVE-2021-42112: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-10-08T21:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: JavaScript
Files changed: assets/scripts/modaldialog.js, assets/scripts/uploader.js
Commit date: 2021-09-21 09:43:39 +0200
Commit message: Fixed issue #17562: XSS injection in the 'File upload' question type in LimeSurvey version 3.x-LTS (#2044)


Diff: diff --git a/assets/scripts/modaldialog.js b/assets/scripts/modaldialog.js
index 1043126779e..f5552ef12ea 100644
--- a/assets/scripts/modaldialog.js
+++ b/assets/scripts/modaldialog.js
@@ -101,11 +101,14 @@ function displayUploadedFiles(jsonstring, filecount, fieldname, show_title, show
         return;
     }
 
     if (jsonstring !== '')
     {
-        jsonobj = eval('(' + jsonstring + ')');
+        var jsonobj = '';
+        try{
+            jsonobj = JSON.parse(jsonstring);
+        } catch(e) {}
         display = '<table width="100%" class="question uploadedfiles"><thead><tr><td width="20%">&nbsp;</td>';
         if (show_title != 0)
             display += '<th>'+uploadLang.headTitle+'</th>';
         if (show_comment != 0)
             display += '<th>'+uploadLang.headComment+'</th>';
diff --git a/assets/scripts/uploader.js b/assets/scripts/uploader.js
index 94b0c6bc341..fa3253dc543 100644
--- a/assets/scripts/uploader.js
+++ b/assets/scripts/uploader.js
@@ -36,11 +36,14 @@ function doFileUpload()
     var image_extensions = new Array("gif", "jpeg", "jpg", "png", "swf", "psd", "bmp", "tiff", "jp2", "iff", "bmp", "xbm", "ico");
 
     if (filecount > 0)
     {
         var jsontext = window.parent.window.$('#' + fieldname).val();
-        var json = eval('(' + jsontext + ')');
+        var json = '';
+        try{
+            json = JSON.parse(jsontext);
+        } catch(e) {}
         if ($('#field' + fieldname + '_listfiles').length == 0)
         {
             $("<ul id='field" + fieldname + "_listfiles' class='files-list' />").insertAfter("#uploadstatus");
         }
         var i;

Vulnerable code:         jsonobj = eval('(' + jsonstring + ')');
        var json = eval('(' + jsontext + ')');
Fixed code:         var jsonobj = '';
        try{
            jsonobj = JSON.parse(jsonstring);
        } catch(e) {}
        var json = '';
        try{
            json = JSON.parse(jsontext);
        } catch(e) {}
CVE-2018-25050: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T10:15Z
Repository: https://github.com/harvesthq/chosen
Language: Unknown
Commit date: 2018-06-08 14:21:58 -0400
Commit message: Merge pull request #2997 from harvesthq/fix-group-label-xss-vulnerability

Escape the `group_label` when rendering it
CVE-2017-15213: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or email_address field to themes/CleanFS/templates/common.editallusers.tpl.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-11T01:32Z
Repository: https://github.com/Flyspray/flyspray
Language: Other
Files changed: themes/CleanFS/templates/common.editallusers.tpl
Commit date: 2017-09-11 22:46:38 +0200
Commit message: Update common.editallusers.tpl
Diff: diff --git a/themes/CleanFS/templates/common.editallusers.tpl b/themes/CleanFS/templates/common.editallusers.tpl
index 621d0cdb..c43872ec 100644
--- a/themes/CleanFS/templates/common.editallusers.tpl
+++ b/themes/CleanFS/templates/common.editallusers.tpl
@@ -43,13 +43,13 @@ if ($do == 'admin'): ?>
 			echo '<tr class="account_enabled" onclick="toggleCheckbox('.$usr['user_id'].')">';
 		} else {
 			echo '<tr class="account_disabled" onclick="toggleCheckbox('.$usr['user_id'].')">';
 		} ?>
 		<td><input id="<?php echo $usr['user_id'] ?>" onclick="event.stopPropagation()" type="checkbox" name="checkedUsers[]" value="<?php echo $usr['user_id']; ?>"></td>
-		<td><a href="<?php echo CreateURL('edituser', $usr['user_id'] ); ?>"><?php echo $usr['real_name']; ?></a></td>
+		<td><a href="<?php echo CreateURL('edituser', $usr['user_id'] ); ?>"><?php echo Filters::noXSS($usr['real_name']); ?></a></td>
 		<td><?php echo $usr['user_name']; ?></td>
-		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==2) ? ' class="inactive"':''; ?>><?php echo $usr['email_address']; ?></td>
+		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==2) ? ' class="inactive"':''; ?>><?php echo Filters::noXSS($usr['email_address']); ?></td>
 		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==1) ? ' class="inactive"':''; ?>><?php echo Filters::noXSS($usr['jabber_id']); ?></td>
                 <td><?php echo formatDate($usr['register_date']); ?></td>
                 <td><?php echo Filters::noXSS($usr['lang_code']); ?></td>
                 <td><?php echo Filters::noXSS($usr['time_zone']); ?></td>
                 <td><?php echo Filters::noXSS($usr['dateformat']); ?></td>

Vulnerable code: 		<td><a href="<?php echo CreateURL('edituser', $usr['user_id'] ); ?>"><?php echo $usr['real_name']; ?></a></td>
		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==2) ? ' class="inactive"':''; ?>><?php echo $usr['email_address']; ?></td>
Fixed code: 		<td><a href="<?php echo CreateURL('edituser', $usr['user_id'] ); ?>"><?php echo Filters::noXSS($usr['real_name']); ?></a></td>
		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==2) ? ' class="inactive"':''; ?>><?php echo Filters::noXSS($usr['email_address']); ?></td>
CVE-2017-15214: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter to plugins/dokuwiki/lib/plugins/changelinks/syntax.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-11T01:32Z
Repository: https://github.com/Flyspray/flyspray
Language: PHP
Files changed: plugins/dokuwiki/lib/plugins/changelinks/syntax.php
Commit date: 2017-09-13 00:25:27 +0200
Commit message: quickfix for dokuwiki links
Diff: diff --git a/plugins/dokuwiki/lib/plugins/changelinks/syntax.php b/plugins/dokuwiki/lib/plugins/changelinks/syntax.php
index 7a733b37..263e0661 100644
--- a/plugins/dokuwiki/lib/plugins/changelinks/syntax.php
+++ b/plugins/dokuwiki/lib/plugins/changelinks/syntax.php
@@ -128,12 +128,19 @@ class syntax_plugin_changelinks extends DokuWiki_Syntax_Plugin {
             $link['pre']    = '';
             $link['suf']    = '';
             $link['more']   = '';
             $link['class']  = 'internallink';
             $link['url']    = DOKU_INTERNAL_LINK . $id;
-            $link['name']   = ($name) ? $name : $id;
-            $link['title']  = ($name) ? $name : $id;
+         
+            if(is_array($name)){
+               $link['name']   = (isset($name['title'])) ? hsc($name['title']) : hsc($id);
+               $link['title'] = $id;
+            } else{
+               $link['name']   = ($name) ? hsc($name) : hsc($id);
+               $link['title'] = ($name) ? $name : $id;
+            }
+
             //add search string
             if($search){
                 ($conf['userewrite']) ? $link['url'].='?s=' : $link['url'].='&amp;s=';
                 $link['url'] .= urlencode($search);
             }
@@ -145,6 +152,6 @@ class syntax_plugin_changelinks extends DokuWiki_Syntax_Plugin {
     }
      
 }
  
 //Setup VIM: ex: et ts=4 enc=utf-8 :
-?>
\ No newline at end of file
+?>

Vulnerable code:             $link['name']   = ($name) ? $name : $id;
            $link['title']  = ($name) ? $name : $id;
?>
Fixed code:          
            if(is_array($name)){
               $link['name']   = (isset($name['title'])) ? hsc($name['title']) : hsc($id);
               $link['title'] = $id;
            } else{
               $link['name']   = ($name) ? hsc($name) : hsc($id);
               $link['title'] = ($name) ? $name : $id;
            }

?>
CVE-2017-6418: Out-of-bounds Read (CWE-125)
value: libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-08-07T03:29Z
Repository: https://github.com/vrtadmin/clamav-devel
Language: C
Files changed: libclamav/message.c
Commit date: 2017-03-02 14:41:20 -0500
Commit message: bb11797 - fix invalid read in fuzzed mail file.

Diff: diff --git a/libclamav/message.c b/libclamav/message.c
index b5cf0ddc7..36bbf417d 100644
--- a/libclamav/message.c
+++ b/libclamav/message.c
@@ -443,12 +443,16 @@ messageAddArgument(message *m, const char *arg)
 		if(strncmp(p, "filename", 8) == 0) {
 			/*
 			 * FIXME: Bounce message handling is corrupting the in
 			 * core copies of headers
 			 */
-			cli_dbgmsg("Possible data corruption fixed\n");
-			p[8] = '=';
+                        if (strlen(p) > 8) {
+                            cli_dbgmsg("Possible data corruption fixed\n");
+                            p[8] = '=';
+                        } else {
+                            cli_dbgmsg("Possible data corruption not fixed\n");
+                        }
 		} else {
 			if(*p)
 				cli_dbgmsg("messageAddArgument, '%s' contains no '='\n", p);
 			free(m->mimeArguments[offset]);
 			m->mimeArguments[offset] = NULL;
@@ -680,11 +684,11 @@ messageFindArgument(const message *m, const char *variable)
 				ptr++;
 			if(*ptr != '=') {
 				cli_dbgmsg("messageFindArgument: no '=' sign found in MIME header '%s' (%s)\n", variable, messageGetArgument(m, i));
 				return NULL;
 			}
-			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
+			if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
 				/* Remove any quote characters */
 				char *ret = cli_strdup(++ptr);
 				char *p;
 
 				if(ret == NULL)

Vulnerable code: 			cli_dbgmsg("Possible data corruption fixed\n");
			p[8] = '=';
			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
Fixed code:                         if (strlen(p) > 8) {
                            cli_dbgmsg("Possible data corruption fixed\n");
                            p[8] = '=';
                        } else {
                            cli_dbgmsg("Possible data corruption not fixed\n");
                        }
			if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {