deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-qgrr-f26j-87vf
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.23.0, < 2.24.3
Patched in: 2.24.3

Summary: MantisBT XXS where a Custom Field with a crafted Regular Expression property is used

Details:
An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of arbitrary JavaScript.
GitHub Security Advisory: GHSA-4rrc-5vp6-m3f6
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, <= 2.24.1
Patched in: 2.24.2

Summary: MantisBT XSS issue on the view_all_bug_page.php 

Details:
An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field, leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).
GitHub Security Advisory: GHSA-p495-jrpq-p66g
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.21.3
Patched in: 2.21.3

Summary: MantisBT XSS when uploading an attachment

Details:
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
GitHub Security Advisory: GHSA-v23g-wjvq-2fpf
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.0.0, < 2.22.1
Patched in: 2.22.1

Summary: MantisBT Remote Code Execution

Details:
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
GitHub Security Advisory: GHSA-v23g-wjvq-2fpf
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.3.20
Patched in: 1.3.20

Summary: MantisBT Remote Code Execution

Details:
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.
GitHub Security Advisory: GHSA-gg4j-279j-22ph
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.21.2
Patched in: 2.21.2

Summary: MantisBT allows cross-site scripting (XSS) via crafted filename

Details:
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
GitHub Security Advisory: GHSA-3qv7-98vm-xx2v
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, <= 2.17.0
Patched in: 2.17.1

Summary: MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO

Details:
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.
GitHub Security Advisory: GHSA-xjmx-cprh-646r
Package: mantisbt/mantisbt (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.24.3
Patched in: 2.24.3

Summary: MantisBT unauthorized users able to access private files

Details:
An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.
GitHub Security Advisory: GHSA-jm72-67rm-763j
Package: mantisbt/mantisbt (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 2.24.4
Patched in: 2.24.5

Summary: MantisBT Insufficient Session Expiration cookie string not reset after logout

Details:
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
GitHub Security Advisory: GHSA-6vx9-9r2g-8373
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 6.0.0-alpha, < 6.0.2
Patched in: 6.0.2

Summary: Mautic has an Open Redirect vulnerability on user unlock path.

Details:
### Summary
This advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits.

Open Redirection via `returnUrl` Parameter: An Open Redirection vulnerability exists in the `/s/action/unlock/user.user/0` endpoint. The `returnUrl` parameter, intended for post-action redirection, is not properly validated. This allows an attacker to craft a URL that, when clicked by a user, redirects them to an arbitrary external website controlled by the attacker.

### Mitigation
Update Mautic to a version that properly validates or sanitizes the `returnUrl` parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains.
GitHub Security Advisory: GHSA-6vx9-9r2g-8373
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 5.0.0-alpha, < 5.2.6
Patched in: 5.2.6

Summary: Mautic has an Open Redirect vulnerability on user unlock path.

Details:
### Summary
This advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits.

Open Redirection via `returnUrl` Parameter: An Open Redirection vulnerability exists in the `/s/action/unlock/user.user/0` endpoint. The `returnUrl` parameter, intended for post-action redirection, is not properly validated. This allows an attacker to craft a URL that, when clicked by a user, redirects them to an arbitrary external website controlled by the attacker.

### Mitigation
Update Mautic to a version that properly validates or sanitizes the `returnUrl` parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains.
GitHub Security Advisory: GHSA-6vx9-9r2g-8373
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 1.0.0, < 4.4.16
Patched in: 4.4.16

Summary: Mautic has an Open Redirect vulnerability on user unlock path.

Details:
### Summary
This advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits.

Open Redirection via `returnUrl` Parameter: An Open Redirection vulnerability exists in the `/s/action/unlock/user.user/0` endpoint. The `returnUrl` parameter, intended for post-action redirection, is not properly validated. This allows an attacker to craft a URL that, when clicked by a user, redirects them to an arbitrary external website controlled by the attacker.

### Mitigation
Update Mautic to a version that properly validates or sanitizes the `returnUrl` parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains.
GitHub Security Advisory: GHSA-vph5-ghq3-q782
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control, CWE-862: Missing Authorization
Vulnerable versions: >= 6.0.0-alpha, < 6.0.2
Patched in: 6.0.2

Summary: Mautic segment cloning doesn't have a proper permission check

Details:
### Summary
This advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.

Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the `cloneAction` of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.

### Mitigation
Update Mautic to a version that implements proper authorization checks for the `cloneAction` within the `ListController.php`. Ensure that users attempting to clone segments possess the appropriate creation permissions.

### Workarounds
None

If you have any questions or comments about this advisory:
Email us at security@mautic.org
GitHub Security Advisory: GHSA-vph5-ghq3-q782
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control, CWE-862: Missing Authorization
Vulnerable versions: >= 5.0.0-alpha, < 5.2.6
Patched in: 5.2.6

Summary: Mautic segment cloning doesn't have a proper permission check

Details:
### Summary
This advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.

Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the `cloneAction` of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.

### Mitigation
Update Mautic to a version that implements proper authorization checks for the `cloneAction` within the `ListController.php`. Ensure that users attempting to clone segments possess the appropriate creation permissions.

### Workarounds
None

If you have any questions or comments about this advisory:
Email us at security@mautic.org
GitHub Security Advisory: GHSA-424x-cxvh-wq9p
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-203: Observable Discrepancy, CWE-204: Observable Response Discrepancy
Vulnerable versions: >= 6.0.0-alpha, < 6.0.2
Patched in: 6.0.2

Summary: Mautic allows user name enumeration due to response time difference on password reset form

Details:
### Summary

This advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames.

User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack.

### Mitigation
Please update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

### Workarounds
None

If you have any questions or comments about this advisory:
Email us at security@mautic.org
GitHub Security Advisory: GHSA-424x-cxvh-wq9p
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-203: Observable Discrepancy, CWE-204: Observable Response Discrepancy
Vulnerable versions: >= 5.0.0-alpha, < 5.2.6
Patched in: 5.2.6

Summary: Mautic allows user name enumeration due to response time difference on password reset form

Details:
### Summary

This advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames.

User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack.

### Mitigation
Please update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

### Workarounds
None

If you have any questions or comments about this advisory:
Email us at security@mautic.org
GitHub Security Advisory: GHSA-424x-cxvh-wq9p
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-203: Observable Discrepancy, CWE-204: Observable Response Discrepancy
Vulnerable versions: >= 1.0.0, < 4.4.16
Patched in: 4.4.16

Summary: Mautic allows user name enumeration due to response time difference on password reset form

Details:
### Summary

This advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames.

User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" functionality. Differences in response times for existing and non-existing users, combined with a lack of request limiting, allow an attacker to determine the existence of usernames through a timing-based attack.

### Mitigation
Please update to a version that addresses this timing vulnerability, where password reset responses are normalized to respond at the same time regardless of user existence.

### Workarounds
None

If you have any questions or comments about this advisory:
Email us at security@mautic.org
GitHub Security Advisory: GHSA-h2wg-v8wg-jhxh
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
Vulnerable versions: >= 6.0.0-alpha, < 6.0.2
Patched in: 6.0.2

Summary: Mautic does not shield .env files from web traffic

Details:
### Summary 
This advisory addresses a security vulnerability in Mautic where sensitive `.env` configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API keys, and other critical system configurations.

Sensitive Information Disclosure via `.env` File Exposure: The `.env` file, which typically contains environment variables and sensitive application configurations, is directly accessible via a web browser due to missing web server configurations that restrict access to such files. This allows an unauthenticated attacker to view the contents of this file by simply navigating to its URL.

### Mitigation
Update Mautic to the latest Mautic version.
By default, Mautic does not use `.env` files for production data.

**For Apache users:** Ensure your web server is configured to respect `.htaccess` files.

**For Nginx users:** As Nginx does not inherently support `.htaccess` files, you must manually add a configuration block to your Nginx server configuration to deny access to `.env` files. Add the following to your Nginx configuration for the Mautic site:

```nginx
location ~ /\.env {
    deny all;
}
```

After modifying your Nginx configuration, remember to reload or restart your Nginx service for the changes to take effect.
GitHub Security Advisory: GHSA-h2wg-v8wg-jhxh
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
Vulnerable versions: >= 5.0.0-alpha, < 5.2.6
Patched in: 5.2.6

Summary: Mautic does not shield .env files from web traffic

Details:
### Summary 
This advisory addresses a security vulnerability in Mautic where sensitive `.env` configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API keys, and other critical system configurations.

Sensitive Information Disclosure via `.env` File Exposure: The `.env` file, which typically contains environment variables and sensitive application configurations, is directly accessible via a web browser due to missing web server configurations that restrict access to such files. This allows an unauthenticated attacker to view the contents of this file by simply navigating to its URL.

### Mitigation
Update Mautic to the latest Mautic version.
By default, Mautic does not use `.env` files for production data.

**For Apache users:** Ensure your web server is configured to respect `.htaccess` files.

**For Nginx users:** As Nginx does not inherently support `.htaccess` files, you must manually add a configuration block to your Nginx server configuration to deny access to `.env` files. Add the following to your Nginx configuration for the Mautic site:

```nginx
location ~ /\.env {
    deny all;
}
```

After modifying your Nginx configuration, remember to reload or restart your Nginx service for the changes to take effect.
GitHub Security Advisory: GHSA-h2wg-v8wg-jhxh
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-312: Cleartext Storage of Sensitive Information, CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
Vulnerable versions: >= 4.4.0, < 4.4.16
Patched in: 4.4.16

Summary: Mautic does not shield .env files from web traffic

Details:
### Summary 
This advisory addresses a security vulnerability in Mautic where sensitive `.env` configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API keys, and other critical system configurations.

Sensitive Information Disclosure via `.env` File Exposure: The `.env` file, which typically contains environment variables and sensitive application configurations, is directly accessible via a web browser due to missing web server configurations that restrict access to such files. This allows an unauthenticated attacker to view the contents of this file by simply navigating to its URL.

### Mitigation
Update Mautic to the latest Mautic version.
By default, Mautic does not use `.env` files for production data.

**For Apache users:** Ensure your web server is configured to respect `.htaccess` files.

**For Nginx users:** As Nginx does not inherently support `.htaccess` files, you must manually add a configuration block to your Nginx server configuration to deny access to `.env` files. Add the following to your Nginx configuration for the Mautic site:

```nginx
location ~ /\.env {
    deny all;
}
```

After modifying your Nginx configuration, remember to reload or restart your Nginx service for the changes to take effect.
GitHub Security Advisory: GHSA-cqx4-9vqf-q3m8
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-284: Improper Access Control, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: >= 6.0.0-alpha, < 6.0.2
Patched in: 6.0.2

Summary: Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

Details:
### Summary
This advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information.

Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., `/page/preview/1`, `/page/preview/2`), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable.

### Mitigation
Mautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later.
GitHub Security Advisory: GHSA-cqx4-9vqf-q3m8
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-284: Improper Access Control, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: >= 5.0.0-alpha, < 5.2.6
Patched in: 5.2.6

Summary: Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

Details:
### Summary
This advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information.

Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., `/page/preview/1`, `/page/preview/2`), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable.

### Mitigation
Mautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later.
GitHub Security Advisory: GHSA-cqx4-9vqf-q3m8
Package: mautic/core (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-284: Improper Access Control, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: >= 4.0.0, < 4.4.16
Patched in: 4.4.16

Summary: Mautic's Predictable Page Indexing Might Lead to Sensitive Data Exposure

Details:
### Summary
This advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information.

Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., `/page/preview/1`, `/page/preview/2`), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable.

### Mitigation
Mautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later.
GitHub Security Advisory: GHSA-3432-fmrf-7vmh
Package: chrome-php/chrome (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.14.0
Patched in: 1.14.0

Summary: Chrome PHP is missing encoding in `CssSelector`

Details:
### Impact

CSS Selector expressions are not properly encoded, which can lead to XSS (cross-site scripting) vulnerabilities.

### Patches

This is patched in v1.14.0.

### Workarounds

Users can apply encoding manually to their selectors, if they are unable to upgrade.