Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-2611: Incorrect Authorization (CWE-863)
value: Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2018-05-08T18:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-09 09:49:57 -0500
Commit message: Merge pull request #99 from jenkinsci-cert/SECURITY-389

[SECURITY-389] Check ADMINISTER on /fingerprintCleanup and /workspaceCleanup
CVE-2017-2613: Cross-Site Request Forgery (CSRF) (CWE-352)
value: jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 5.4
Published: 2018-05-15T22:29Z
Repository: https://github.com/jenkinsci/jenkins
Language: Unknown
Commit date: 2017-01-23 14:54:07 -0500
Commit message: Merge pull request #107 from jenkinsci-cert/SECURITY-406

[SECURITY-406] Prevent user creation via GET /user/whatever
CVE-2020-11091: Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)
value: In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it's pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them. By sending rogue router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year's RCE in apt (CVE-2019-3462), you can now escalate to the host. Weave Net version 2.6.3 disables the accept_ra option on the veth devices that it creates.
CWE description: The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
CVSS v3 base score: 5.8
Published: 2020-06-03T23:15Z
Repository: https://github.com/weaveworks/weave
Language: Unknown
Commit date: 2020-05-22 11:00:50 +0100
Commit message: Merge pull request #3801 from weaveworks/disable-accept-ra

Disable accept_ra on Weave Net interfaces
CVE-2022-1909: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-05-27T09:15Z
Repository: https://github.com/causefx/organizr
Language: PHP
Files changed: api/classes/organizr.class.php
Commit date: 2022-05-26 13:09:07 -0700
Commit message: sanitize tab image and group image

Diff: diff --git a/api/classes/organizr.class.php b/api/classes/organizr.class.php
index c0143590b..d9ba9d791 100644
--- a/api/classes/organizr.class.php
+++ b/api/classes/organizr.class.php
@@ -5147,10 +5147,12 @@ class Organizr
 			return false;
 		}
 		if (!array_key_exists('image', $array)) {
 			$this->setAPIResponse('error', 'Tab image was not supplied', 422);
 			return false;
+		} else {
+			$array['image'] = $this->sanitizeUserString($array['image']);
 		}
 		$response = [
 			array(
 				'function' => 'query',
 				'query' => array(
@@ -5195,10 +5197,13 @@ class Organizr
 		if (array_key_exists('default', $array)) {
 			if ($array['default']) {
 				$this->clearTabDefault();
 			}
 		}
+		if (array_key_exists('image', $array)) {
+			$array['image'] = $this->sanitizeUserString($array['image']);
+		}
 		if (array_key_exists('group_id', $array)) {
 			$groupCheck = (array_key_exists('group_id_max', $array)) ? $array['group_id_max'] : $tabInfo['group_id_max'];
 			if ($array['group_id'] < $groupCheck) {
 				$this->setAPIResponse('error', 'Tab name: ' . $tabInfo['name'] . ' cannot have a lower Group Id Max than Group Id Min', 409);
 				return false;
@@ -6780,10 +6785,11 @@ class Organizr
 		if (array_key_exists('image', $array)) {
 			if ($array['image'] == '') {
 				$this->setAPIResponse('error', 'Image was set but empty', 409);
 				return false;
 			}
+			$array['image'] = $this->sanitizeUserString($array['image']);
 		}
 		if (array_key_exists('default', $array)) {
 			if ($groupInfo['group_id'] == 0 || $groupInfo['group_id'] == 999) {
 				$this->setAPIResponse('error', 'Setting ' . $groupInfo['group'] . ' as default group is not allowed', 409);
 				return false;
@@ -6866,10 +6872,11 @@ class Organizr
 		if (array_key_exists('image', $array)) {
 			if ($array['image'] == '') {
 				$this->setAPIResponse('error', 'Group image cannot be empty', 422);
 				return false;
 			}
+			$array['image'] = $this->sanitizeUserString($array['image']);
 		} else {
 			$this->setAPIResponse('error', 'Group image was not supplied', 422);
 			return false;
 		}
 		$response = [

Fixed code: 		} else {
			$array['image'] = $this->sanitizeUserString($array['image']);
		if (array_key_exists('image', $array)) {
			$array['image'] = $this->sanitizeUserString($array['image']);
		}
			$array['image'] = $this->sanitizeUserString($array['image']);
			$array['image'] = $this->sanitizeUserString($array['image']);
CVE-2010-10002: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the argument AuthState leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is identified as d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-01T17:15Z
Repository: https://github.com/simplesamlphp/simplesamlphp-module-openid
Language: PHP
Files changed: templates/consumer.php
Commit date: 2010-07-29 10:42:16 +0000
Commit message: openid: Fix cross-site scripting.

Can be exploited by a malicious openid provider to execute scripts
on the host using openid.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2444 44740490-163a-0410-bde0-09ae8108e29a

Diff: diff --git a/templates/consumer.php b/templates/consumer.php
index 8a709ce..4849347 100644
--- a/templates/consumer.php
+++ b/templates/consumer.php
@@ -48,11 +48,11 @@ div.error {
 			<legend>OpenID Login</legend>
 
 			Identity&nbsp;URL:
 			<input type="hidden" name="action" value="verify" />
 			<input id="openid-identifier" class="openid-identifier" type="text" name="openid_url" value="http://" />
-			<input type="hidden" name="AuthState" value="<?php echo $this->data['AuthState']; ?>" />
+			<input type="hidden" name="AuthState" value="<?php echo htmlspecialchars($this->data['AuthState']); ?>" />
 			<input type="submit" value="Login with OpenID" />
 		</fieldset>
 	</form>
 
     <p style="margin-top: 2em">

Vulnerable code: 			<input type="hidden" name="AuthState" value="<?php echo $this->data['AuthState']; ?>" />
Fixed code: 			<input type="hidden" name="AuthState" value="<?php echo htmlspecialchars($this->data['AuthState']); ?>" />
CVE-2023-49802: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to version 2.0.1, cross-site scripting in the MantisBT LinkedCustomFields plugin allows Javascript execution, when a crafted Custom Field is linked via the plugin and displayed when reporting a new Issue or editing an existing one. This issue is fixed in version 2.0.1. As a workaround, one may utilize MantisBT's default Content Security Policy, which blocks script execution.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-12-11T22:15Z
Repository: https://github.com/mantisbt-plugins/LinkedCustomFields
Language: PHP
Files changed: LinkedCustomFields.API.php
Commit date: 2023-12-10 11:55:12 +0100
Commit message: Fix XSS in linked Custom Field's values 

Github Security Advisory GHSA-2f37-9xpx-5hhw

Fixes #10, PR #11 

Diff: diff --git a/LinkedCustomFields.API.php b/LinkedCustomFields.API.php
index bb4982f..1176f4c 100644
--- a/LinkedCustomFields.API.php
+++ b/LinkedCustomFields.API.php
@@ -103,21 +103,11 @@ class JavascriptUtils {
 	const LOG_INFO = 2;
 	const LOG_WARN = 3;
 	const LOG_ERROR = 4;
 
 	static function toJSArray( $p_array ) {
-
-		$t_field_values_js = '[ ';
-
-		foreach( $p_array as $t_custom_field_value ) {
-			$t_field_values_js .= '"'.string_attribute( $t_custom_field_value ).'" ,';
-		}
-
-		$t_field_values_js = rtrim( $t_field_values_js, ',' );
-		$t_field_values_js .= ']';
-
-		return $t_field_values_js;
+		return json_encode($p_array);
 	}
 
 	static function consoleLog( $p_message, $p_level = self::LOG_INFO ) {
 
 		$t_method = false;

Vulnerable code: 
		$t_field_values_js = '[ ';

		foreach( $p_array as $t_custom_field_value ) {
			$t_field_values_js .= '"'.string_attribute( $t_custom_field_value ).'" ,';
		}

		$t_field_values_js = rtrim( $t_field_values_js, ',' );
		$t_field_values_js .= ']';

		return $t_field_values_js;
Fixed code: 		return json_encode($p_array);
CVE-2020-13616: Improper Certificate Validation (CWE-295)
value: The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.9
Published: 2020-05-26T23:15Z
Repository: https://github.com/pichi-router/pichi
Language: Other
Files changed: CMakeLists.txt
Commit date: 2020-03-09 10:18:51 -0400
Commit message: Fix the insecure bug not verifying remote host name for TLS egress

- Verify nothing if 'insecure' field is true
- Verify only with the CA file if it's specified
- Otherwise, verify according to RFC 2818

Diff: diff --cc CMakeLists.txt
index 6b71d5f,9556733..9bff2ea
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@@ -19,12 -19,15 +19,15 @@@ find_package(MaxmindDB 1.3.0 REQUIRED
  find_package(Rapidjson 1.1.0 REQUIRED)
  find_package(Threads REQUIRED)
  if (ENABLE_TLS)
    find_package(OpenSSL REQUIRED)
    include_directories(${OPENSSL_INCLUDE_DIR})
 -  link_libraries(${OPENSSL_LIBRARIES})
 +  link_libraries(${OPENSSL_LIBRARIES} ${CMAKE_DL_LIBS})
+   if (WIN32 AND STATIC_LINK)
+     link_libraries(crypt32)
 -  endif (WIN32 AND STATIC_LINK)
 -endif (ENABLE_TLS)
++  endif ()
 +endif ()
  
  include(Configure)
  
  include_directories(
    ${CMAKE_SOURCE_DIR}/include

Fixed code:    if (WIN32 AND STATIC_LINK)
     link_libraries(crypt32)
+  endif ()
CVE-2020-25792: Improper Validation of Array Index (CWE-129)
value: An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair().
CWE description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVSS v3 base score: 7.5
Published: 2020-09-19T21:15Z
Repository: https://github.com/bodil/sized-chunks
Language: Unknown
Commit date: 2021-02-12 12:21:25 +0000
Commit message: Merge pull request #14 from vorner/inline-array-align

Fix alignment issues of InlineArray
CVE-2019-12272: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2019-05-23T15:30Z
Repository: https://github.com/openwrt/luci
Language: Lua
Files changed: modules/luci-mod-admin-full/luasrc/controller/admin/status.lua
Commit date: 2018-04-05 00:33:09 +0200
Commit message: luci-mod-admin-full: fix possible shell injection in bandwith status

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Diff: diff --git a/modules/luci-mod-admin-full/luasrc/controller/admin/status.lua b/modules/luci-mod-admin-full/luasrc/controller/admin/status.lua
index 22e1b7e17..4b03a1886 100644
--- a/modules/luci-mod-admin-full/luasrc/controller/admin/status.lua
+++ b/modules/luci-mod-admin-full/luasrc/controller/admin/status.lua
@@ -60,11 +60,11 @@ function action_iptables()
 end
 
 function action_bandwidth(iface)
 	luci.http.prepare_content("application/json")
 
-	local bwc = io.popen("luci-bwc -i %q 2>/dev/null" % iface)
+	local bwc = io.popen("luci-bwc -i '%s' 2>/dev/null" % iface:gsub("'", ""))
 	if bwc then
 		luci.http.write("[")
 
 		while true do
 			local ln = bwc:read("*l")
@@ -78,11 +78,11 @@ function action_bandwidth(iface)
 end
 
 function action_wireless(iface)
 	luci.http.prepare_content("application/json")
 
-	local bwc = io.popen("luci-bwc -r %q 2>/dev/null" % iface)
+	local bwc = io.popen("luci-bwc -r '%s' 2>/dev/null" % iface:gsub("'", ""))
 	if bwc then
 		luci.http.write("[")
 
 		while true do
 			local ln = bwc:read("*l")

Vulnerable code: 	local bwc = io.popen("luci-bwc -i %q 2>/dev/null" % iface)
	local bwc = io.popen("luci-bwc -r %q 2>/dev/null" % iface)
Fixed code: 	local bwc = io.popen("luci-bwc -i '%s' 2>/dev/null" % iface:gsub("'", ""))
	local bwc = io.popen("luci-bwc -r '%s' 2>/dev/null" % iface:gsub("'", ""))
CVE-2019-17367: Cross-Site Request Forgery (CSRF) (CWE-352)
value: OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2019-10-18T17:15Z
Repository: https://github.com/openwrt/luci
Language: Lua
Files changed: modules/luci-base/luasrc/dispatcher.lua
Commit date: 2019-10-09 09:55:44 +0200
Commit message: luci-base: fix CSRF prevention for arcombine targets

The dispatcher failed to propagate the child target post security
requirements to the arcombine() dispatch target so far - fix this
by recursively testing the post security requirements.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Diff: diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index e8106b741..f57114456 100644
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -147,11 +147,15 @@ function httpdispatch(request, prefix)
 	http.close()
 
 	--context._disable_memtrace()
 end
 
-local function require_post_security(target)
+local function require_post_security(target, args)
+	if type(target) == "table" and target.type == "arcombine" and type(target.targets) == "table" then
+		return require_post_security((type(args) == "table" and #args > 0) and target.targets[2] or target.targets[1], args)
+	end
+
 	if type(target) == "table" then
 		if type(target.post) == "table" then
 			local param_name, required_val, request_val
 
 			for param_name, required_val in pairs(target.post) do
@@ -468,11 +472,11 @@ function dispatch(request)
 		luci.http.header("Access-Control-Allow-Origin", http.getenv("HTTP_ORIGIN") or "*")
 		luci.http.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
 		return
 	end
 
-	if c and require_post_security(c.target) then
+	if c and require_post_security(c.target, args) then
 		if not test_post_security(c) then
 			return
 		end
 	end
 

Vulnerable code: local function require_post_security(target)
	if c and require_post_security(c.target) then
Fixed code: local function require_post_security(target, args)
	if type(target) == "table" and target.type == "arcombine" and type(target.targets) == "table" then
		return require_post_security((type(args) == "table" and #args > 0) and target.targets[2] or target.targets[1], args)
	end

	if c and require_post_security(c.target, args) then
CVE-2022-41435: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability allows attackers to execute arbitrary web scripts or HTML via crafted public key comments.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-11-03T12:15Z
Repository: https://github.com/openwrt/luci
Language: JavaScript
Files changed: modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
Commit date: 2022-09-21 14:47:41 +0200
Commit message: luci-mod-system: sshkeys.js: prevent XSS through pubkey comments

Ensure to not display public key comments verbatim in order to prevent
injection of markup.

Reported-by: Eric McDonald <ericmcdonald@protonmail.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Diff: diff --git a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
index a2f0bef9b4..8b12b2311e 100644
--- a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
+++ b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
@@ -110,11 +110,11 @@ function renderKeyItem(pubkey) {
 	return E('div', {
 		class: 'item',
 		click: isReadonlyView ? null : removeKey,
 		'data-key': pubkey.src
 	}, [
-		E('strong', pubkey.comment || _('Unnamed key')), E('br'),
+		E('strong', [ pubkey.comment || _('Unnamed key') ]), E('br'),
 		E('small', [
 			'%s, %s'.format(pubkey.type, pubkey.curve || _('%d Bit').format(pubkey.bits)),
 			pubkey.options ? E([], [
 				' / ', _('Options:'), ' ',
 				E('code', Object.keys(pubkey.options).sort().join(', '))

Vulnerable code: 		E('strong', pubkey.comment || _('Unnamed key')), E('br'),
Fixed code: 		E('strong', [ pubkey.comment || _('Unnamed key') ]), E('br'),
CVE-2023-24181: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-10T14:15Z
Repository: https://github.com/openwrt/luci
Language: Other
Files changed: applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm
Commit date: 2023-01-13 21:18:09 +0100
Commit message: luci-app-openvpn: fix potential XSS in pageswitch template

Ensure to escape URL instance parameter displayed in the heading.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Diff: diff --git a/applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm b/applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm
index 0792763085..c464ef4781 100644
--- a/applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm
+++ b/applications/luci-app-openvpn/luasrc/view/openvpn/pageswitch.htm
@@ -7,11 +7,11 @@
 <%+openvpn/ovpn_css%>
 
 <div class="cbi-section">
 	<h3>
 		<a href="<%=url('admin/vpn/openvpn')%>"><%:Overview%></a> &#187;
-		<%=luci.i18n.translatef("Instance \"%s\"", self.instance)%>
+		<%=luci.i18n.translatef("Instance \"%s\"", pcdata(self.instance))%>
 	</h3>
 	<% if self.mode == "basic" then %>
 		<a href="<%=url('admin/vpn/openvpn/advanced', self.instance)%>"><%:Switch to advanced configuration%> &#187;</a><p/>
 		<hr />
 	<% elseif self.mode == "advanced" then %>

Vulnerable code: 		<%=luci.i18n.translatef("Instance \"%s\"", self.instance)%>
Fixed code: 		<%=luci.i18n.translatef("Instance \"%s\"", pcdata(self.instance))%>
CVE-2023-24182: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-11T01:15Z
Repository: https://github.com/openwrt/luci
Language: JavaScript
Files changed: modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
Commit date: 2023-01-13 21:18:09 +0100
Commit message: luci-mod-system: fix potential stored XSS

Make sure to escape the key contents in the delete confirmation dialog.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Diff: diff --git a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
index df3e354e37..a1748ad990 100644
--- a/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
+++ b/modules/luci-mod-system/htdocs/luci-static/resources/view/system/sshkeys.js
@@ -202,11 +202,11 @@ function removeKey(ev) {
 			keys.push(key);
 	});
 
 	L.showModal(_('Delete key'), [
 		E('div', _('Do you really want to delete the following SSH key?')),
-		E('pre', delkey),
+		E('pre', [ delkey ]),
 		E('div', { class: 'right' }, [
 			E('div', { class: 'btn', click: L.hideModal }, _('Cancel')),
 			' ',
 			E('div', { class: 'btn danger', click: ui.createHandlerFn(this, saveKeys, keys) }, _('Delete key')),
 		])

Vulnerable code: 		E('pre', delkey),
Fixed code: 		E('pre', [ delkey ]),
CVE-2024-32657: Insufficient Information (NVD-CWE-noinfo)
value: Hydra is a Continuous Integration service for Nix based projects. Attackers can execute arbitrary code in the browser context of Hydra and execute authenticated HTTP requests. The abused feature allows Nix builds to specify files that Hydra serves to clients. One use of this functionality is serving NixOS `.iso` files. The issue is only with html files served by Hydra. The issue has been patched on https://hydra.nixos.org around 2024-04-21 14:30 UTC. The nixpkgs package were fixed in unstable and 23.11. Users with custom Hydra packages can apply the fix commit to their local installations. The vulnerability is only triggered when opening HTML build artifacts, so not opening them until the vulnerability is fixed works around the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-22T23:15Z
Repository: https://github.com/NixOS/hydra
Language: Perl
Files changed: src/lib/Hydra/Controller/Build.pm
Commit date: 2024-04-22 16:28:50 +0200
Commit message: web: serveFile: also serve a CSP putting served HTML in its own origin

Diff: diff --git a/src/lib/Hydra/Controller/Build.pm b/src/lib/Hydra/Controller/Build.pm
index f8587169..de2c204d 100644
--- a/src/lib/Hydra/Controller/Build.pm
+++ b/src/lib/Hydra/Controller/Build.pm
@@ -232,10 +232,13 @@ sub serveFile {
         my $target = $ls->{target};
         return serveFile($c, substr($target, 0, 1) eq "/" ? $target : dirname($path) . "/" . $target);
     }
 
     elsif ($ls->{type} eq "regular") {
+        # Have the hosted data considered its own origin to avoid being a giant
+        # XSS hole.
+        $c->response->header('Content-Security-Policy' => 'sandbox allow-scripts');
 
         $c->stash->{'plain'} = { data => grab(cmd => ["nix", "--experimental-features", "nix-command",
                                                       "store", "cat", "--store", getStoreUri(), "$path"]) };
 
         # Detect MIME type.

Fixed code:         # Have the hosted data considered its own origin to avoid being a giant
        # XSS hole.
        $c->response->header('Content-Security-Policy' => 'sandbox allow-scripts');
CVE-2022-4421: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-12T14:15Z
Repository: https://github.com/rathena/FluxCP
Language: PHP
Files changed: themes/default/servicedesk/view.php
Commit date: 2022-02-11 20:29:54 +0700
Commit message: [Security]

* Fixed an issue where XSS was possible in the service desk image url inclusion.

Diff: diff --git a/themes/default/servicedesk/view.php b/themes/default/servicedesk/view.php
index f3e06e3..25ef0ae 100644
--- a/themes/default/servicedesk/view.php
+++ b/themes/default/servicedesk/view.php
@@ -44,11 +44,11 @@ $this->loginRequired();
 		</tr>
 		<?php endif ?>
 		<?php if($trow->sslink!='0'): ?>
 		<tr>
 			<th>Screenshots</th>
-			<td colspan="3"><a href="<?php echo $trow->sslink ?>" target="_blank"><img src="<?php echo $trow->sslink ?>" width="100px" height="100"></a></td></tr>
+			<td colspan="3"><a href="<?php echo htmlspecialchars($trow->sslink) ?>" target="_blank"><img src="<?php echo htmlspecialchars($trow->sslink) ?>" width="100px" height="100"></a></td></tr>
 		</tr>
 		<?php endif ?>
 		<?php if($trow->videolink!='0'): ?>
 		<tr>
 			<th>Video Capture</th>

Vulnerable code: 			<td colspan="3"><a href="<?php echo $trow->sslink ?>" target="_blank"><img src="<?php echo $trow->sslink ?>" width="100px" height="100"></a></td></tr>
Fixed code: 			<td colspan="3"><a href="<?php echo htmlspecialchars($trow->sslink) ?>" target="_blank"><img src="<?php echo htmlspecialchars($trow->sslink) ?>" width="100px" height="100"></a></td></tr>
CVE-2015-10041: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Dovgalyuk AIBattle. Affected is the function sendComments of the file site/procedures.php. The manipulation of the argument text leads to sql injection. The name of the patch is e3aa4d0900167641d41cbccf53909229f00381c9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218304. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-13T20:15Z
Repository: https://github.com/Dovgalyuk/AIBattle-disabled-
Language: PHP
Files changed: site/procedures.php
Commit date: 2015-08-11 10:53:31 +0300
Commit message: Fix SQL injection in comments

Diff: diff --git a/site/procedures.php b/site/procedures.php
index b60813c..9b8238a 100644
--- a/site/procedures.php
+++ b/site/procedures.php
@@ -1809,10 +1809,11 @@
 		$link = getDBConnection();
 		if (mysqli_select_db($link, getDBName()))
 		{
 			$newsId 		= intval($newsId);
 			$currentUserId 	= intval(getActiveUserID());
+			$text = mysqli_real_escape_string($link, $text);
 			if ($currentUserId != -1)
 			{
 				$query = mysqli_query($link, "INSERT INTO newsComments SET news = $newsId, user = $currentUserId, text = '$text', date = NOW()");
 			}
 		}

Fixed code: 			$text = mysqli_real_escape_string($link, $text);
CVE-2015-10042: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in Dovgalyuk AIBattle. Affected by this vulnerability is the function registerUser of the file site/procedures.php. The manipulation of the argument postLogin leads to sql injection. The identifier of the patch is 448e9880aac18ae7832f8d065e03e46ce0f1d3e3. It is recommended to apply a patch to fix this issue. The identifier VDB-218305 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-13T21:15Z
Repository: https://github.com/Dovgalyuk/AIBattle-disabled-
Language: PHP
Files changed: site/procedures.php
Commit date: 2015-08-10 18:32:05 +0300
Commit message: Fix login SQL injection

Diff: diff --git a/site/procedures.php b/site/procedures.php
index 4073682..b60813c 100644
--- a/site/procedures.php
+++ b/site/procedures.php
@@ -491,11 +491,11 @@
             $err = array();
 
             $login = strip_tags($postLogin);
             if ($login != $postLogin)
                 $err[] = "Логин содержит некорректные символы";
-            $login = mysqli_real_escape_string($link, $login);
+            $postLogin = mysqli_real_escape_string($link, $postLogin);
             if (strlen($postLogin) < 3 or strlen($postLogin > 30))
                 $err[] = "Логин должен быть не меньше 3-х символов и не больше 30";
 
             $query = mysqli_query($link, "SELECT COUNT(id) FROM users WHERE login='{$login}'");
 

Vulnerable code:             $login = mysqli_real_escape_string($link, $login);
Fixed code:             $postLogin = mysqli_real_escape_string($link, $postLogin);
CVE-2015-4411: Uncontrolled Resource Consumption (CWE-400)
value: The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2020-02-20T17:15Z
Repository: https://github.com/mongodb/bson-ruby
Language: Ruby
Files changed: lib/bson/object_id.rb
Commit date: 2015-06-04 00:19:42 -0400
Commit message: Use \A \z for checking regex on legal

Diff: diff --git a/lib/bson/object_id.rb b/lib/bson/object_id.rb
index d393144..b8503f3 100644
--- a/lib/bson/object_id.rb
+++ b/lib/bson/object_id.rb
@@ -280,11 +280,11 @@ module BSON
       #
       # @return [ true, false ] If the string is legal.
       #
       # @since 2.0.0
       def legal?(string)
-        string.to_s =~ /^[0-9a-f]{24}$/i ? true : false
+        string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
       end
 
       # Executes the provided block only if the size of the provided object is
       # 12. Used in legacy id repairs.
       #

Vulnerable code:         string.to_s =~ /^[0-9a-f]{24}$/i ? true : false
Fixed code:         string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
CVE-2015-4412: Uncontrolled Resource Consumption (CWE-400)
value: BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 9.8
Published: 2018-02-05T16:29Z
Repository: https://github.com/mongodb/bson-ruby
Language: Ruby
Files changed: lib/bson/object_id.rb
Commit date: 2015-06-04 00:19:42 -0400
Commit message: Use \A \z for checking regex on legal

Diff: diff --git a/lib/bson/object_id.rb b/lib/bson/object_id.rb
index d393144..b8503f3 100644
--- a/lib/bson/object_id.rb
+++ b/lib/bson/object_id.rb
@@ -280,11 +280,11 @@ module BSON
       #
       # @return [ true, false ] If the string is legal.
       #
       # @since 2.0.0
       def legal?(string)
-        string.to_s =~ /^[0-9a-f]{24}$/i ? true : false
+        string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
       end
 
       # Executes the provided block only if the size of the provided object is
       # 12. Used in legacy id repairs.
       #

Vulnerable code:         string.to_s =~ /^[0-9a-f]{24}$/i ? true : false
Fixed code:         string.to_s =~ /\A[0-9a-f]{24}\z/i ? true : false
CVE-2021-4272: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 0fb30f9640bd5fa0cae58922eac6c00bb1a94391. It is recommended to apply a patch to fix this issue. The identifier VDB-216477 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/studygolang/studygolang
Language: JavaScript
Files changed: static/js/topics.js
Commit date: 2021-03-11 23:15:46 +0800
Commit message: 临时处理 xss

Diff: diff --git a/static/js/topics.js b/static/js/topics.js
index 0f675d5..97d356f 100644
--- a/static/js/topics.js
+++ b/static/js/topics.js
@@ -21,10 +21,28 @@
 
 		selector.each(function() {
 			var markdownString = $(this).text();
 
 			var contentHtml = marked(markdownString);
+
+			// JS 处理，避免 XSS。最终还是改为服务端渲染更好
+			if (contentHtml.indexOf('<script') != -1) {
+				contentHtml = contentHtml.replace(/<script/g, '&lt;script');
+			}
+			if (contentHtml.indexOf('<form') != -1) {
+				contentHtml = contentHtml.replace(/<form/g, '&lt;form');
+			}
+			if (contentHtml.indexOf('<input') != -1) {
+				contentHtml = contentHtml.replace(/<input/g, '&lt;input');
+			}
+			if (contentHtml.indexOf('<select') != -1) {
+				contentHtml = contentHtml.replace(/<select/g, '&lt;select');
+			}
+			if (contentHtml.indexOf('<textarea') != -1) {
+				contentHtml = contentHtml.replace(/<textarea/g, '&lt;textarea');
+			}
+
 			contentHtml = SG.replaceCodeChar(contentHtml);
 			
 			$(this).html(contentHtml);
 
 			// emoji 表情解析

Fixed code: 
			// JS 处理，避免 XSS。最终还是改为服务端渲染更好
			if (contentHtml.indexOf('<script') != -1) {
				contentHtml = contentHtml.replace(/<script/g, '&lt;script');
			}
			if (contentHtml.indexOf('<form') != -1) {
				contentHtml = contentHtml.replace(/<form/g, '&lt;form');
			}
			if (contentHtml.indexOf('<input') != -1) {
				contentHtml = contentHtml.replace(/<input/g, '&lt;input');
			}
			if (contentHtml.indexOf('<select') != -1) {
				contentHtml = contentHtml.replace(/<select/g, '&lt;select');
			}
			if (contentHtml.indexOf('<textarea') != -1) {
				contentHtml = contentHtml.replace(/<textarea/g, '&lt;textarea');
			}
CVE-2021-4273: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/studygolang/studygolang
Language: Unknown
Commit date: 2021-02-20 22:49:27 +0800
Commit message: Merge pull request #158 from RifeWang/master

fix: 搜索异常时导致页面渲染异常, 搜索框 XSS 漏洞
CVE-2019-10808: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 8.8
Published: 2020-03-11T23:15Z
Repository: https://github.com/xcritical-software/utilitify
Language: Unknown
Commit date: 2020-03-10 15:21:48 +0300
Commit message: Merge pull request #22 from xcritical-software/fix/merge_prototype_pollution

fix(mergeDeep): do not merge __proto__ property
CVE-2017-16877: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2017-11-17T17:29Z
Repository: https://github.com/vercel/next.js
Language: Unknown
Commit date: 2017-06-01 06:16:58 +0530
Commit message: Merge branch 'fix-dir-traversal-error'
CVE-2019-9199: NULL Pointer Dereference (CWE-476)
value: PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 8.8
Published: 2019-02-26T23:29Z
Repository: https://github.com/jjanku/podofo
Language: C++
Files changed: tools/podofoimpose/pdftranslator.cpp
Commit date: 2019-03-09 18:29:29 +0000
Commit message: Fixed CVE-2019-9199, issue #40 (raises PdfError with PageNotFound code on error)

The error is the page 0 (0-based) not being found, before this fix that led to
a null pointer dereference (method call on a null pointer, undefined behavior),
now just a PdfError exception is raised.


Diff: diff --git a/tools/podofoimpose/pdftranslator.cpp b/tools/podofoimpose/pdftranslator.cpp
index 835d18f..cce4843 100644
--- a/tools/podofoimpose/pdftranslator.cpp
+++ b/tools/podofoimpose/pdftranslator.cpp
@@ -146,11 +146,16 @@ namespace PoDoFo
 
 			pcount = sourceDoc->GetPageCount();
 // 	std::cerr << "Document has "<< pcount << " page(s) " << endl;
 			if ( pcount > 0 ) // only here to avoid possible segfault, but PDF without page is not conform IIRC
 			{
-				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );
+                PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
+                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
+                {
+                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
+                }
+                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
 				// keep in mind it’s just a hint since PDF can have different page sizes in a same doc
 				sourceWidth =  rect.GetWidth() - rect.GetLeft();
 				sourceHeight =  rect.GetHeight() - rect.GetBottom() ;
 			}
 		}

Vulnerable code: 				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );
Fixed code:                 PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
                {
                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
                }
                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
CVE-2014-8399: Insufficient Information (NVD-CWE-noinfo)
value: The default configuration in systemd-shim 8 enables the Abandon debugging clause, which allows local users to cause a denial of service via unspecified vectors.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-10-31T14:55Z
Repository: https://github.com/desrt/systemd-shim
Language: Other
Files changed: data/org.freedesktop.systemd1.conf
Commit date: 2014-10-21 17:30:37 -0400
Commit message: security policy: remove clause for Abandon call

I committed this after copying it out of a work-in-progress branch that
was being worked on by Serge.  I didn't realise that it was most likely
only ever intended to be for debugging purposes.

According to Martin and Stéphane this is not needed and is a potential
security problem.  Let's close that hole.

Diff: diff --git a/data/org.freedesktop.systemd1.conf b/data/org.freedesktop.systemd1.conf
index a17aea0..a07a8e1 100644
--- a/data/org.freedesktop.systemd1.conf
+++ b/data/org.freedesktop.systemd1.conf
@@ -84,13 +84,9 @@
 
                 <allow send_destination="org.freedesktop.systemd1"
                        send_interface="org.freedesktop.systemd1.Manager"
                        send_member="Dump"/>
 
-                <allow send_destination="org.freedesktop.systemd1"
-                       send_interface="org.freedesktop.systemd1.Scope"
-                       send_member="Abandon"/>
-
                 <allow receive_sender="org.freedesktop.systemd1"/>
         </policy>
 
 </busconfig>

Vulnerable code:                 <allow send_destination="org.freedesktop.systemd1"
                       send_interface="org.freedesktop.systemd1.Scope"
                       send_member="Abandon"/>
CVE-2014-4172: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-01-24T19:15Z
Repository: https://github.com/Jasig/dotnet-cas-client
Language: C#
Files changed: DotNetCasClient/Utils/UrlUtil.cs
Commit date: 2014-06-16 14:45:30 -0400
Commit message: NETC-60 URL encode ticket parameter value.

Diff: diff --git a/DotNetCasClient/Utils/UrlUtil.cs b/DotNetCasClient/Utils/UrlUtil.cs
index 6f95c6b..bc3c470 100644
--- a/DotNetCasClient/Utils/UrlUtil.cs
+++ b/DotNetCasClient/Utils/UrlUtil.cs
@@ -137,11 +137,11 @@ namespace DotNetCasClient.Utils
 
             CasAuthentication.Initialize();
 
             EnhancedUriBuilder ub = new EnhancedUriBuilder(EnhancedUriBuilder.Combine(CasAuthentication.CasServerUrlPrefix, CasAuthentication.TicketValidator.UrlSuffix));
             ub.QueryItems.Add(CasAuthentication.TicketValidator.ServiceParameterName, HttpUtility.UrlEncode(ConstructServiceUrl(gateway)));
-            ub.QueryItems.Add(CasAuthentication.TicketValidator.ArtifactParameterName, serviceTicket);
+            ub.QueryItems.Add(CasAuthentication.TicketValidator.ArtifactParameterName, HttpUtility.UrlEncode(serviceTicket));
 
             if (renew)
             {
                 ub.QueryItems.Set("renew", "true");
             }

Vulnerable code:             ub.QueryItems.Add(CasAuthentication.TicketValidator.ArtifactParameterName, serviceTicket);
Fixed code:             ub.QueryItems.Add(CasAuthentication.TicketValidator.ArtifactParameterName, HttpUtility.UrlEncode(serviceTicket));