Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-5734: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/controllers/table/TableSearchController.php
Commit date: 2016-06-20 12:03:44 +0200
Commit message: Always use delimiter not present in search expression

This avoids need to figure out correct escaping in case delimiter is
present in the expression.

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/libraries/controllers/table/TableSearchController.php b/libraries/controllers/table/TableSearchController.php
index 666dea8409293..a89a654b22f84 100644
--- a/libraries/controllers/table/TableSearchController.php
+++ b/libraries/controllers/table/TableSearchController.php
@@ -724,13 +724,26 @@ private function _getRegexReplaceRows(
             . " ORDER BY " . Util::backquote($column) . " ASC";
 
         $result = $this->dbi->fetchResult($sql_query, 0);
 
         if (is_array($result)) {
+            /* Iterate over possible delimiters to get one */
+            $delimiters = array('/', '@', '#', '~', '!', '$', '%', '^', '&', '_');
+            $found = false;
+            for ($i = 0; $i < count($delimiters); $i++) {
+                if (strpos($find, $delimiters[$i]) === false) {
+                    $found = true;
+                    break;
+                }
+            }
+            if (! $found) {
+                return false;
+            }
+            $find = $delimiters[$i] . $find . $delimiters[$i];
             foreach ($result as $index=>$row) {
                 $result[$index][1] = preg_replace(
-                    "/" . $find . "/",
+                    $find,
                     $replaceWith,
                     $row[0]
                 );
             }
         }

Vulnerable code:                     "/" . $find . "/",
Fixed code:             /* Iterate over possible delimiters to get one */
            $delimiters = array('/', '@', '#', '~', '!', '$', '%', '^', '&', '_');
            $found = false;
            for ($i = 0; $i < count($delimiters); $i++) {
                if (strpos($find, $delimiters[$i]) === false) {
                    $found = true;
                    break;
                }
            }
            if (! $found) {
                return false;
            }
            $find = $delimiters[$i] . $find . $delimiters[$i];
                    $find,
CVE-2016-5739: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/Header.php
Commit date: 2016-06-20 10:47:30 +0200
Commit message: Update referrer <meta> to match current standards

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/libraries/Header.php b/libraries/Header.php
index c20dfeb35ce69..93d05ca4bf831 100644
--- a/libraries/Header.php
+++ b/libraries/Header.php
@@ -637,11 +637,11 @@ private function _getHtmlStart()
      * @return string the META tags
      */
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
-        $retval .= '<meta name="referrer" content="none" />';
+        $retval .= '<meta name="referrer" content="no-referrer" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
             $retval .= '<style id="cfs-style">html{display: none;}</style>';
         }

Vulnerable code:         $retval .= '<meta name="referrer" content="none" />';
Fixed code:         $retval .= '<meta name="referrer" content="no-referrer" />';
CVE-2016-5739: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2016-07-03T01:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/Header.php
Commit date: 2016-06-20 09:41:06 +0200
Commit message: Add referrer CSP and <meta> tag

This avoids leaking Referer header in modern browsers.

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/libraries/Header.php b/libraries/Header.php
index 488fdd80d58df..c20dfeb35ce69 100644
--- a/libraries/Header.php
+++ b/libraries/Header.php
@@ -548,10 +548,11 @@ public function sendHttpHeaders()
             . ";"
             . "style-src 'self' 'unsafe-inline' "
             . $captcha_url
             . $GLOBALS['cfg']['CSPAllow']
             . ";"
+            . "referrer no-referrer;"
             . "img-src 'self' data: "
             . $GLOBALS['cfg']['CSPAllow']
             . $map_tile_urls
             . $captcha_url
             . ";"
@@ -559,10 +560,11 @@ public function sendHttpHeaders()
         header(
             "X-Content-Security-Policy: default-src 'self' "
             . $captcha_url
             . $GLOBALS['cfg']['CSPAllow'] . ';'
             . "options inline-script eval-script;"
+            . "referrer no-referrer;"
             . "img-src 'self' data: "
             . $GLOBALS['cfg']['CSPAllow']
             . $map_tile_urls
             . $captcha_url
             . ";"
@@ -573,10 +575,11 @@ public function sendHttpHeaders()
             . $GLOBALS['cfg']['CSPAllow'] . ';'
             . "script-src 'self' "
             . $captcha_url
             . $GLOBALS['cfg']['CSPAllow']
             . " 'unsafe-inline' 'unsafe-eval';"
+            . "referrer no-referrer;"
             . "style-src 'self' 'unsafe-inline' "
             . $captcha_url
             . ';'
             . "img-src 'self' data: "
             . $GLOBALS['cfg']['CSPAllow']
@@ -634,10 +637,11 @@ private function _getHtmlStart()
      * @return string the META tags
      */
     private function _getMetaTags()
     {
         $retval  = '<meta charset="utf-8" />';
+        $retval .= '<meta name="referrer" content="none" />';
         $retval .= '<meta name="robots" content="noindex,nofollow" />';
         $retval .= '<meta http-equiv="X-UA-Compatible" content="IE=Edge">';
         if (! $GLOBALS['cfg']['AllowThirdPartyFraming']) {
             $retval .= '<style id="cfs-style">html{display: none;}</style>';
         }

Fixed code:             . "referrer no-referrer;"
            . "referrer no-referrer;"
            . "referrer no-referrer;"
        $retval .= '<meta name="referrer" content="none" />';
CVE-2024-32980: Insufficient Information (NVD-CWE-noinfo)
value: Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-08T15:15Z
Repository: https://github.com/fermyon/spin
Language: Unknown
Commit date: 2024-05-08 10:05:15 -0400
Commit message: Merge pull request from GHSA-f3h7-gpjj-wcvh

Stop using untrusted user input for determining outbound request permissions
CVE-2020-11529: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2020-04-04T19:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Grav.php
Commit date: 2020-03-18 17:32:46 -0600
Commit message: Fix for user reported CVE path-based open redirect

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index e01d94c8..75d91245 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,11 @@
 
 1. [](#new)
     * Moved `Parsedown` 1.6 and `ParsedownExtra` 0.7 into `Grav\Framework\Parsedown` to allow fixes
 1. [](#bugfix)
     * Fixed PHP 7.4 issue in ParsedownExtra [#2832](https://github.com/getgrav/grav/issues/2832)
+    * Fix for [user reported](https://twitter.com/OriginalSicksec) CVE path-based open redirect
 
 # v1.6.22
 ## 03/05/2020
 
 1. [](#new)
diff --git a/system/src/Grav/Common/Grav.php b/system/src/Grav/Common/Grav.php
index 2f9b3732..c7287dbd 100644
--- a/system/src/Grav/Common/Grav.php
+++ b/system/src/Grav/Common/Grav.php
@@ -314,11 +314,14 @@ class Grav extends Container
     public function redirect($route, $code = null)
     {
         /** @var Uri $uri */
         $uri = $this['uri'];
 
-        //Check for code in route
+        // Clean route for redirect
+        $route = preg_replace("#^\/[\\\/]+\/#", '/', $route);
+
+         // Check for code in route
         $regex = '/.*(\[(30[1-7])\])$/';
         preg_match($regex, $route, $matches);
         if ($matches) {
             $route = str_replace($matches[1], '', $matches[0]);
             $code = $matches[2];

Vulnerable code:         //Check for code in route
Fixed code:     * Fix for [user reported](https://twitter.com/OriginalSicksec) CVE path-based open redirect
        // Clean route for redirect
        $route = preg_replace("#^\/[\\\/]+\/#", '/', $route);

         // Check for code in route
CVE-2021-3904: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: grav is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-10-27T22:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Security.php
Commit date: 2021-10-25 20:37:59 +0300
Commit message: Fixed XSS detection with `&colon;`

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5bf8e14e0..45c4b5a1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,10 +6,11 @@
     * Added support to disable a form, making it readonly
 3. [](#bugfix)
     * Fixed a bug in `PermissionsReader` in PHP 7.3
     * Fixed `session_store_active` language option (#3464)
     * Fixed deprecated warnings on `ArrayAccess` in PHP 8.1
+    * Fixed XSS detection with `&colon;`
 
 # v1.7.23
 ## 09/29/2021
 
 1. [](#new)
diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php
index 55aa54593..fe259d8ba 100644
--- a/system/src/Grav/Common/Security.php
+++ b/system/src/Grav/Common/Security.php
@@ -201,11 +201,11 @@ class Security
 
         // Clean up entities
         $string = preg_replace('!(&#0+[0-9]+)!u', '$1;', $string);
 
         // Decode entities
-        $string = html_entity_decode($string, ENT_NOQUOTES, 'UTF-8');
+        $string = html_entity_decode($string, ENT_NOQUOTES | ENT_HTML5, 'UTF-8');
 
         // Strip whitespace characters
         $string = preg_replace('!\s!u', '', $string);
 
         // Set the patterns we'll test against

Vulnerable code:         $string = html_entity_decode($string, ENT_NOQUOTES, 'UTF-8');
Fixed code:     * Fixed XSS detection with `&colon;`
        $string = html_entity_decode($string, ENT_NOQUOTES | ENT_HTML5, 'UTF-8');
CVE-2022-0743: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.6
Published: 2022-02-28T23:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Security.php
Commit date: 2022-02-23 14:57:36 -0800
Commit message: Fixed entity sanitization for XSS detection

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index be63eea0e2..bb0adfc476 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,10 +6,11 @@
     * Fixed phpstan issues (All level 2, Framework level 5)
 2. [](#bugfix)
     * Fixed `'mbstring' extension is not loaded` error, use Polyfill instead [#3504](https://github.com/getgrav/grav/pull/3504)
     * Fixed new `Utils::pathinfo()` and `Utils::basename()` being too strict for legacy use [#3542](https://github.com/getgrav/grav/issues/3542)
     * Fixed non-standard video html atributes generated by `{{ media.html() }}` [#3540](https://github.com/getgrav/grav/issues/3540)
+    * Fixed entity sanitization for XSS detection
 
 # v1.7.30
 ## 02/07/2022
 
 1. [](#new)
diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php
index 017720ca89..01ea0f13c8 100644
--- a/system/src/Grav/Common/Security.php
+++ b/system/src/Grav/Common/Security.php
@@ -198,11 +198,11 @@ class Security
         $string = (string)preg_replace_callback('!(&#|\\\)[xX]([0-9a-fA-F]+);?!u', static function ($m) {
             return chr(hexdec($m[2]));
         }, $string);
 
         // Clean up entities
-        $string = preg_replace('!(&#0+[0-9]+)!u', '$1;', $string);
+        $string = preg_replace('!(&#[0-9]+)!u', '$1;', $string);
 
         // Decode entities
         $string = html_entity_decode($string, ENT_NOQUOTES | ENT_HTML5, 'UTF-8');
 
         // Strip whitespace characters

Vulnerable code:         $string = preg_replace('!(&#0+[0-9]+)!u', '$1;', $string);
Fixed code:     * Fixed entity sanitization for XSS detection
        $string = preg_replace('!(&#[0-9]+)!u', '$1;', $string);
CVE-2022-1173: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: stored xss in GitHub repository getgrav/grav prior to 1.7.33.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-26T16:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Security.php
Commit date: 2022-03-30 13:26:11 +0300
Commit message: Fixed XSS check not detecting onX events without quotes

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59f4a11290..0c993524c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,11 @@
 
 1. [](#improved)
     * When saving yaml and markdown, create also a cached version of the file and recompile it in opcache
 2. [](#bugfix)
     * Fixed missing changes in yaml & markdown files if saved multiple times during the same second because of a caching issue
+    * Fixed XSS check not detecting onX events without quotes
 
 # v1.7.32
 ## 03/28/2022
 
 1. [](#new)
diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php
index 11153a625c..982618544f 100644
--- a/system/src/Grav/Common/Security.php
+++ b/system/src/Grav/Common/Security.php
@@ -217,11 +217,12 @@ class Security
 
         // Decode entities
         $string = html_entity_decode($string, ENT_NOQUOTES | ENT_HTML5, 'UTF-8');
 
         // Strip whitespace characters
-        $string = preg_replace('!\s!u', '', $string);
+        $string = preg_replace('!\s!u', ' ', $string);
+        $stripped = preg_replace('!\s!u', '', $string);
 
         // Set the patterns we'll test against
         $patterns = [
             // Match any attribute starting with "on" or xmlns
             'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',
@@ -240,11 +241,11 @@ class Security
         ];
 
         // Iterate over rules and return label if fail
         foreach ($patterns as $name => $regex) {
             if (!empty($enabled_rules[$name])) {
-                if (preg_match($regex, $string) || preg_match($regex, $orig)) {
+                if (preg_match($regex, $string) || preg_match($regex, $stripped) || preg_match($regex, $orig)) {
                     return $name;
                 }
             }
         }
 

Vulnerable code:         $string = preg_replace('!\s!u', '', $string);
                if (preg_match($regex, $string) || preg_match($regex, $orig)) {
Fixed code:     * Fixed XSS check not detecting onX events without quotes
        $string = preg_replace('!\s!u', ' ', $string);
        $stripped = preg_replace('!\s!u', '', $string);
                if (preg_match($regex, $string) || preg_match($regex, $stripped) || preg_match($regex, $orig)) {
CVE-2024-27921: Insufficient Information (NVD-CWE-noinfo)
value: Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T22:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Utils.php
Commit date: 2024-03-04 13:39:50 -0700
Commit message: fixed path traversal by santize checking fiilename

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba936e2841..16ac059060 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,10 +4,11 @@
 1. [](#news)
    * Added new Image trait for `decoding` attribute [#3796](https://github.com/getgrav/grav/pull/3796)
 1. [](#bugfix)
    * Fixed some multibyte issues in Inflector class [#732](https://github.com/getgrav/grav/issues/732)
    * Fallback to page modified date if Page date provided is invalid and can't be parsed [getgrav/grav-plugin-admin#2394](https://github.com/getgrav/grav-plugin-admin/issues/2394)
+   * Fixed a path traversal vulnerability with file uploads [GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
 
 # v1.7.44
 ## 01/05/2024
 
 1. [](#new)
diff --git a/system/src/Grav/Common/Utils.php b/system/src/Grav/Common/Utils.php
index bc56f81a94..a518ec1990 100644
--- a/system/src/Grav/Common/Utils.php
+++ b/system/src/Grav/Common/Utils.php
@@ -987,10 +987,12 @@ abstract class Utils
             !$filename
             // Filename should not contain horizontal/vertical tabs, newlines, nils or back/forward slashes.
             || strtr($filename, "\t\v\n\r\0\\/", '_______') !== $filename
             // Filename should not start or end with dot or space.
             || trim($filename, '. ') !== $filename
+            // Filename should not contain path traversal
+            || str_replace('..', '', $filename) !== $filename
             // File extension should not be part of configured dangerous extensions
             || in_array($extension, $dangerous_extensions)
         );
     }
 

Fixed code:    * Fixed a path traversal vulnerability with file uploads [GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
            // Filename should not contain path traversal
            || str_replace('..', '', $filename) !== $filename
CVE-2024-27923: Insufficient Information (NVD-CWE-noinfo)
value: Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T02:52Z
Repository: https://github.com/getgrav/grav
Language: Markdown
Files changed: CHANGELOG.md, system/config/security.yaml
Commit date: 2023-08-22 11:57:13 +0100
Commit message: inlcude phar in dangerous extensions

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7fc0d214c..b8578a1148 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
+# v1.7.42.4
+## mm/dd/2023
+
+2. [](#improved)
+   * Include `phar` in the list of `security.uploads_dangerous_extensions`
+
 # v1.7.42.3
 ## 07/18/2023
 
 2. [](#improved)
    * Fixed a typo in `Utils::isDangerousFunction`
diff --git a/system/config/security.yaml b/system/config/security.yaml
index 2cc815fb5b..54c7fc5225 100644
--- a/system/config/security.yaml
+++ b/system/config/security.yaml
@@ -30,10 +30,11 @@ xss_dangerous_tags:
     - bgsound
     - title
     - base
 uploads_dangerous_extensions:
     - php
+    - phar
     - html
     - htm
     - js
     - exe
 sanitize_svg: true

Fixed code: # v1.7.42.4
## mm/dd/2023

2. [](#improved)
   * Include `phar` in the list of `security.uploads_dangerous_extensions`

    - phar
CVE-2024-34082: Insufficient Information (NVD-CWE-noinfo)
value: Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the web server by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. A low privileged user may also perform a full account takeover of other registered users including Administrators. Version 1.7.46 contains a patch.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-15T17:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: system/src/Grav/Common/Security.php
Commit date: 2024-05-06 12:48:45 +0100
Commit message: fixes #GHSA-f8v5-jmfh-pr69

Diff: diff --git a/system/src/Grav/Common/Security.php b/system/src/Grav/Common/Security.php
index 8b4783089c..6fabf4eec3 100644
--- a/system/src/Grav/Common/Security.php
+++ b/system/src/Grav/Common/Security.php
@@ -223,11 +223,11 @@ class Security
         $stripped = preg_replace('!\s!u', '', $string);
 
         // Set the patterns we'll test against
         $patterns = [
             // Match any attribute starting with "on" or xmlns
-            'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',
+            'on_events' => '#(<[^>]+[a-z\x00-\x20\"\'\/])(on[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu',
 
             // Match javascript:, livescript:, vbscript:, mocha:, feed: and data: protocols
             'invalid_protocols' => '#(' . implode('|', array_map('preg_quote', $invalid_protocols, ['#'])) . ')(:|\&\#58)\S.*?#iUu',
 
             // Match -moz-bindings
@@ -277,10 +277,11 @@ class Security
             'registerUndefinedFunctionCallback',
             'undefined_functions',
             'twig.getFunction',
             'core.setEscaper',
             'twig.safe_functions',
+            'read_file',
         ];
         $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
         return $string;
     }
 }

Vulnerable code:             'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',
Fixed code:             'on_events' => '#(<[^>]+[a-z\x00-\x20\"\'\/])(on[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu',
            'read_file',
CVE-2018-7634: Cross-Site Request Forgery (CSRF) (CWE-352)
value: An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2018-03-01T23:29Z
Repository: https://github.com/Enalean/tuleap
Language: Unknown
Commit date: 2018-03-01 14:40:05 +0100
Commit message: Merge 'gerrit #10714' into stable/master

* commit 'd6701289ae':
  request #11217 Account takeover due to a missing CSRF protection

Change-Id: Id29f45cfa402f0cb378b9f257d1e7adb4b0d40be
CVE-2021-41147: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2021-10-15T14:15Z
Repository: https://github.com/Enalean/tuleap
Language: PHP
Files changed: plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
Commit date: 2020-07-20 10:20:17 +0200
Commit message: request #15131: SQL injection in the planning edition panel

Change-Id: Ifa9971534640010198196f34544f97eb8c7cc9c9

Diff: diff --git a/plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php b/plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
index 14393b6d799..961eb2fce5c 100644
--- a/plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
+++ b/plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
@@ -1,8 +1,8 @@
 <?php
 /**
- * Copyright (c) Enalean, 2012. All Rights Reserved.
+ * Copyright (c) Enalean, 2012-Present. All Rights Reserved.
  *
  * This file is a part of Tuleap.
  *
  * Tuleap is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -33,10 +33,12 @@ class Cardwall_OnTop_ColumnMappingFieldValueDao extends DataAccessObject
 
     public function save($cardwall_tracker_id, $tracker_id, $field_id, $value_id, $column_id)
     {
         $cardwall_tracker_id = $this->da->escapeInt($cardwall_tracker_id);
         $tracker_id          = $this->da->escapeInt($tracker_id);
+        $value_id            = $this->da->escapeInt($value_id);
+        $column_id           = $this->da->escapeInt($column_id);
         if ($field_id === null) {
             $field_id = " NULL ";
         } else {
             $field_id = $this->da->escapeInt($field_id);
         }

Vulnerable code:  * Copyright (c) Enalean, 2012. All Rights Reserved.
Fixed code:  * Copyright (c) Enalean, 2012-Present. All Rights Reserved.
        $value_id            = $this->da->escapeInt($value_id);
        $column_id           = $this->da->escapeInt($column_id);
CVE-2022-31032: Other (NVD-CWE-Other)
value: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get access to information in those template projects because the permissions model is not properly enforced. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 4.3
Published: 2022-06-29T18:15Z
Repository: https://github.com/Enalean/tuleap
Language: Unknown
Commit date: 2022-06-06 14:20:26 +0200
Commit message: Merge commit 'refs/changes/79/25979/8' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD

* ssh://gerrit.tuleap.net:29418/tuleap:
  request #26816 Resources of private projects can be accessed by non project members

Diff: diff --cc site-content/fr_FR/LC_MESSAGES/tuleap-core.po
index 0785745fc219,779bd733fce2..0cff10dd346d
--- a/site-content/fr_FR/LC_MESSAGES/tuleap-core.po
+++ b/site-content/fr_FR/LC_MESSAGES/tuleap-core.po
@@@ -2655,16 -2655,19 +2655,16 @@@ msgstr "Processeurs
  
  msgid "Project"
  msgstr "Projet"
  
  #, php-format
- msgid "Project #%d is not active and is not a template"
- msgstr "Le project #%d n'est pas actif et n'est pas un modèle"
+ msgid "Project #%d is not active."
+ msgstr "Le project #%d n'est pas actif."
  
  msgid "Project (read only)"
  msgstr "Projet (lecture seule)"
  
 -msgid "Project Data Export"
 -msgstr "Export des données"
 -
  msgid "Project Latest News"
  msgstr "Dernières annonces du projet"
  
  msgid "Project Name"
  msgstr "Nom du projet"
diff --cc site-content/pt_BR/LC_MESSAGES/tuleap-core.po
index e02d52ea48a3,9daad004d5f4..ae9a4ba3496e
--- a/site-content/pt_BR/LC_MESSAGES/tuleap-core.po
+++ b/site-content/pt_BR/LC_MESSAGES/tuleap-core.po
@@@ -2591,16 -2591,19 +2591,16 @@@ msgstr "Processadores
  
  msgid "Project"
  msgstr "Projeto"
  
  #, php-format
- msgid "Project #%d is not active and is not a template"
- msgstr "O projeto #%d não está ativo e não é um modelo"
+ msgid "Project #%d is not active."
+ msgstr "O projeto #%d não está ativo."
  
  msgid "Project (read only)"
  msgstr "Projeto (somente leitura)"
  
 -msgid "Project Data Export"
 -msgstr "Exportação de Dados do Projeto"
 -
  msgid "Project Latest News"
  msgstr "Últimas Notícias do Projeto"
  
  msgid "Project Name"
  msgstr "Nome do Projeto"
CVE-2023-23938: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration. Administrative privilege is required, but an attacker with tracker administration rights could use this vulnerability to force a victim to execute uncontrolled code in the context of their browser. This issue has been addressed in Tuleap Community Edition version 14.5.99.4. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-04-20T17:15Z
Repository: https://github.com/Enalean/tuleap
Language: PHP
Files changed: plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_List_Bind_StaticValue.php
Commit date: 2023-02-01 15:26:07 +0100
Commit message: request #30734: XSS through the name of a color of select box values

Change-Id: Ia8dc1bf8cfb304975272064611b7b27264b884a3

Diff: diff --git a/plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_List_Bind_StaticValue.php b/plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_List_Bind_StaticValue.php
index 6116bacdf0e2..d1788061f51d 100644
--- a/plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_List_Bind_StaticValue.php
+++ b/plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_List_Bind_StaticValue.php
@@ -139,11 +139,11 @@ class Tracker_FormElement_Field_List_Bind_StaticValue extends Tracker_FormElemen
     {
         $decorators = $field->getDecorators();
         $id         = $this->getId();
 
         if (! empty($decorators) && isset($decorators[$id])) {
-            $purifier = Codendi_HTTPPurifier::instance();
+            $purifier = Codendi_HTMLPurifier::instance();
             return [
                 "data-color-value" => $purifier->purify($decorators[$id]->getCurrentColor()),
             ];
         }
 

Vulnerable code:             $purifier = Codendi_HTTPPurifier::instance();
Fixed code:             $purifier = Codendi_HTMLPurifier::instance();
CVE-2022-23065: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-05-02T13:15Z
Repository: https://github.com/vendure-ecommerce/vendure
Language: TypeScript
Files changed: packages/asset-server-plugin/src/plugin.ts
Commit date: 2022-04-14 21:20:23 +0200
Commit message: fix(asset-server-plugin): Fix svg XSS vulnerability

It was discovered that a malicious SVG file containing javascript could be executed when opening the
source file in a new tab. This is now mitigated by adding a Content Security Policy header
to responses from the AssetServerPlugin.

Diff: diff --git a/packages/asset-server-plugin/src/plugin.ts b/packages/asset-server-plugin/src/plugin.ts
index 526c30f30..4a563297f 100644
--- a/packages/asset-server-plugin/src/plugin.ts
+++ b/packages/asset-server-plugin/src/plugin.ts
@@ -210,10 +210,11 @@ export class AssetServerPlugin implements NestModule, OnApplicationBootstrap {
                 let mimeType = this.getMimeType(key);
                 if (!mimeType) {
                     mimeType = (await fromBuffer(file))?.mime || 'application/octet-stream';
                 }
                 res.contentType(mimeType);
+                res.setHeader('content-security-policy', `default-src 'self'`);
                 res.send(file);
             } catch (e) {
                 const err = new Error('File not found');
                 (err as any).status = 404;
                 return next(err);
@@ -249,10 +250,11 @@ export class AssetServerPlugin implements NestModule, OnApplicationBootstrap {
                                 imageBuffer,
                             );
                             Logger.debug(`Saved cached asset: ${cachedFileName}`, loggerCtx);
                         }
                         res.set('Content-Type', `image/${(await image.metadata()).format}`);
+                        res.setHeader('content-security-policy', `default-src 'self'`);
                         res.send(imageBuffer);
                         return;
                     } catch (e) {
                         Logger.error(e, 'AssetServerPlugin', e.stack);
                         res.status(500).send(e.message);

Fixed code:                 res.setHeader('content-security-policy', `default-src 'self'`);
                        res.setHeader('content-security-policy', `default-src 'self'`);
CVE-2010-10010: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in Stars Alliance PsychoStats up to 3.2.2a. This affects an unknown part of the file upload/admin/login.php. The manipulation of the argument ref leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.2.2b is able to address this issue. The identifier of the patch is 5d3b7311fd5085ec6ea1b1bfa9a05285964e07e4. It is recommended to upgrade the affected component. The identifier VDB-230265 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-01T05:15Z
Repository: https://github.com/StarsAlliance/PsychoStats
Language: PHP
Files changed: upload/admin/login.php
Commit date: 2010-08-09 21:45:23 +0200
Commit message: User JS2007 detected a "poisoned-URL" XSS-Defacement
Link: http://www.psychostats.com/forums/index.php?showtopic=20796&hl=

Diff: diff --git a/upload/admin/login.php b/upload/admin/login.php
index 8c622bc..a95c53a 100644
--- a/upload/admin/login.php
+++ b/upload/admin/login.php
@@ -25,10 +25,11 @@ define("PSYCHOSTATS_ADMIN_PAGE", true);
 define("PSYCHOSTATS_LOGIN_PAGE", true);
 include("../includes/common.php");
 include("./common.php");
 $cms->theme->assign('page', basename(__FILE__, '.php'));
 
+$_GET['ref'] = htmlspecialchars($_GET['ref']); //XSS Fix. Thanks to JS2007
 $validfields = array('submit','cancel','ref');
 $cms->theme->assign_request_vars($validfields, true);
 
 if ($cancel) {
 	gotopage("../index.php");

Fixed code: $_GET['ref'] = htmlspecialchars($_GET['ref']); //XSS Fix. Thanks to JS2007
CVE-2012-2671: Other (NVD-CWE-Other)
value: The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2012-06-17T03:41Z
Repository: https://github.com/rtomayko/rack-cache
Language: Unknown
Commit date: 2012-02-15 13:43:57 -0800
Commit message: Merge pull request #52 from rmm5t/strip_set_cookie

Rack::Cache caches Set-Cookie response headers yielding potential security holes in apps