starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-7521 (published 2017-04-20T18:59Z)

Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: dirk
author_date: 2016-02-02 21:03:24+01:00
msg: Moved check for https://github.com/ImageMagick/ImageMagick/issues/92.
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: psd.c
change_type: ModificationType.MODIFY
diff: @@ -487,6 +487,7 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
     length++;
     for (j=0; j < (ssize_t) length; j++)
     {
+      CheckNumberCompactPixels;
       switch (depth)
       {
         case 1:
@@ -525,7 +526,6 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
           break;
         }
       }
-      CheckNumberCompactPixels;
       compact_pixels++;
     }
   }

programming_language: Objective-C
CVE-2021-29568 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in `tf.raw_ops.ParameterizedTruncatedNormal`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/3f6fe4dfef6f57e768260b48166c27d148f3015f/tensorflow/core/kernels/parameterized_truncated_normal_op.cc#L630) does not validate input arguments before accessing the first element of `shape`. If `shape` argument is empty, then `shape_tensor.flat<T>()` is an empty array. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-05-04 19:14:24-07:00
msg: Fix breakage in parameterized_truncated_normal_op.cc

PiperOrigin-RevId: 372041718
Change-Id: Iff79e77a2bb27032423eefcb84211627b27dfe81
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: parameterized_truncated_normal_op.cc
change_type: ModificationType.MODIFY
diff: @@ -627,6 +627,9 @@ class ParameterizedTruncatedNormalOp : public OpKernel {
         ctx, TensorShapeUtils::IsVector(shape_tensor.shape()),
         errors::InvalidArgument("Input shape should be a vector, got shape: ",
                                 shape_tensor.shape().DebugString()));
+    OP_REQUIRES(ctx, shape_tensor.NumElements() > 0,
+                errors::InvalidArgument("Shape tensor must not be empty, got ",
+                                        shape_tensor.DebugString()));
     int32 num_batches = shape_tensor.flat<int32>()(0);
 
     int32 samples_per_batch = 1;

programming_language: C++
CVE-2020-26254 (published 2020-12-08T15:15Z)

omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the info.email field of OmniAuth\'s Auth Hash Schema for any kind of identification. The value of this field may be set to any value of the attacker\'s choice including email addresses of other users. Applications not using info.email for identification but are instead using the uid field are not impacted in the same manner. Note, these applications may still be negatively affected if the value of info.email is being used for other purposes. Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.7, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-290
cwe_name: Authentication Bypass by Spoofing
description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/nhosoya/omniauth-apple
commit_details: repo_url: https://github.com/nhosoya/omniauth-apple
author: nhosoya
author_date: 2020-12-02 14:12:51+09:00
msg: Use only verified email address to prevent fake email address

Co-authored-by: David Taylor <david@taylorhq.com>
repository: repo_url: https://github.com/nhosoya/omniauth-apple
repo_name: nhosoya/omniauth-apple
description:  OmniAuth strategy for Sign In with Apple
repo_language: Ruby
owner: nhosoya
file_changes: filename: apple.rb
change_type: ModificationType.MODIFY
diff: @@ -104,7 +104,7 @@ module OmniAuth
       end
 
       def email
-        user_info['email'] || id_info['email']
+        id_info['email']
       end
 
       def first_name

programming_language: Ruby
filename: apple_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -252,6 +252,21 @@ describe OmniAuth::Strategies::Apple do
       end
     end
 
+    context 'with a spoofed email in the user payload' do
+      before do
+        request.params['user'] = {
+          name: {
+            firstName: 'first',
+            lastName: 'last'
+          },
+          email: "spoofed@example.com"
+        }.to_json
+      end
+
+      it 'should return the true email' do
+        expect(subject.info[:email]).to eq('something@privatrerelay.appleid.com')
+      end
+    end
   end
 
   describe '#extra' do

programming_language: Ruby
CVE-2020-36649 (published 2023-01-11T15:15Z)

A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/mholt/PapaParse
commit_details: repo_url: https://github.com/mholt/PapaParse
author: Sergi Almacellas Abellana
author_date: 2020-04-02 15:12:02+02:00
msg: Avoid ReDOS on float dynamic typing (#779)

Fixes #777
repository: repo_url: https://github.com/mholt/PapaParse
repo_name: mholt/PapaParse
description: Fast and powerful CSV (delimited text) parser that gracefully handles large files and malformed input
repo_language: JavaScript
owner: mholt
file_changes: filename: papaparse.js
change_type: ModificationType.MODIFY
diff: @@ -1006,7 +1006,7 @@ License: MIT
 		// One goal is to minimize the use of regular expressions...
 		var MAX_FLOAT = Math.pow(2, 53);
 		var MIN_FLOAT = -MAX_FLOAT;
-		var FLOAT = /^\s*-?(\d*\.?\d+|\d+\.?\d*)(e[-+]?\d+)?\s*$/i;
+		var FLOAT = /^\s*-?(\d+\.?|\.\d+|\d+\.\d+)(e[-+]?\d+)?\s*$/;
 		var ISO_DATE = /(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d\.\d+([+-][0-2]\d:[0-5]\d|Z))|(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d:[0-5]\d([+-][0-2]\d:[0-5]\d|Z))|(\d{4}-[01]\d-[0-3]\dT[0-2]\d:[0-5]\d([+-][0-2]\d:[0-5]\d|Z))/;
 		var self = this;
 		var _stepCounter = 0;	// Number of times step was called (number of rows parsed)

programming_language: JavaScript
CVE-2012-2671 (published 2012-06-17T03:41Z)

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/rtomayko/rack-cache
commit_details: repo_url: https://github.com/rtomayko/rack-cache
author: Ryan Tomayko
author_date: 2012-02-15 13:43:57-08:00
msg: Merge pull request #52 from rmm5t/strip_set_cookie

Rack::Cache caches Set-Cookie response headers yielding potential security holes in apps
repository: repo_url: https://github.com/rtomayko/rack-cache
repo_name: rtomayko/rack-cache
description: Real HTTP Caching for Ruby Web Apps
repo_language: Ruby
owner: rtomayko
CVE-2014-125062 (published 2023-01-07T17:15Z)

A vulnerability classified as critical was found in ananich bitstorm. Affected by this vulnerability is an unknown functionality of the file announce.php. The manipulation of the argument event leads to sql injection. The identifier of the patch is ea8da92f94cdb78ee7831e1f7af6258473ab396a. It is recommended to apply a patch to fix this issue. The identifier VDB-217621 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ananich/bitstorm
commit_details: repo_url: https://github.com/ananich/bitstorm
author: Anthony Ananich
author_date: 2014-12-15 01:32:16+03:00
msg: FIX: SQL Injection
repository: repo_url: https://github.com/ananich/bitstorm
repo_name: ananich/bitstorm
description: Lightweight bittorrent tracker contained in a single PHP file
repo_language: PHP
owner: ananich
file_changes: filename: announce.php
change_type: ModificationType.MODIFY
diff: @@ -108,12 +108,12 @@ if (!isset($_GET['left'])) {
 $state = 'state';
 $attempt = 'attempt';
 if (isset($_GET['event'])){
-	$state = "'" . $_GET['event'] . "'";
+	$state = "'" . mysql_real_escape_string($_GET['event']) . "'";
 	$attempt = 'LAST_INSERT_ID(peer_torrent.id)';
 }
 
-mysql_query('INSERT INTO peer_torrent (peer_id, torrent_id, uploaded, downloaded, `left`, state, attempt, `last_updated`) '
-	. 'SELECT ' . $pk_peer . ', `torrent`.`id`, ' . intval($_GET['uploaded']) . ', ' . intval($_GET['downloaded']) . ', ' . intval($_GET['left']) . ', ' . $state .  ', ' . 0 . ', UTC_TIMESTAMP() '
+mysql_query('INSERT INTO peer_torrent (peer_id, torrent_id, uploaded, downloaded, `left`, attempt, `last_updated`) '
+	. 'SELECT ' . $pk_peer . ', `torrent`.`id`, ' . intval($_GET['uploaded']) . ', ' . intval($_GET['downloaded']) . ', ' . intval($_GET['left']) . ', ' . 0 . ', UTC_TIMESTAMP() '
 	. 'FROM `torrent` '
 	. "WHERE `torrent`.`hash` = '" . mysql_real_escape_string(bin2hex($_GET['info_hash'])) . "' "
 	. 'ON DUPLICATE KEY UPDATE `uploaded` = VALUES(`uploaded`), `downloaded` = VALUES(`downloaded`), `left` = VALUES(`left`), ' 

programming_language: PHP
CVE-2020-35149 (published 2020-12-11T19:15Z)

lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or clone operation.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/aheckmann/mquery
commit_details: repo_url: https://github.com/aheckmann/mquery
author: Valeri Karpov
author_date: 2020-12-10 15:24:30-05:00
msg: fix(utils): avoid copying special properties like `__proto__` when merging and cloning
repository: repo_url: https://github.com/aheckmann/mquery
repo_name: mongoosejs/mquery
description: Expressive MongoDB query builder
repo_language: JavaScript
owner: aheckmann
file_changes: filename: utils.js
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,8 @@
 var Buffer = require('safe-buffer').Buffer;
 var RegExpClone = require('regexp-clone');
 
+var specialProperties = ['__proto__', 'constructor', 'prototype'];
+
 /**
  * Clones objects
  *
@@ -69,6 +71,12 @@ exports.cloneObject = function cloneObject(obj, options) {
   var k;
 
   for (k in obj) {
+    // Not technically prototype pollution because this wouldn't merge properties
+    // onto `Object.prototype`, but avoid properties like __proto__ as a precaution.
+    if (specialProperties.indexOf(k) !== -1) {
+      continue;
+    }
+
     val = clone(obj[k], options);
 
     if (!minimize || ('undefined' !== typeof val)) {
@@ -133,6 +141,9 @@ exports.merge = function merge(to, from) {
 
   while (i--) {
     key = keys[i];
+    if (specialProperties.indexOf(key) !== -1) {
+      continue;
+    }
     if ('undefined' === typeof to[key]) {
       to[key] = from[key];
     } else {

programming_language: JavaScript
filename: utils.test.js
change_type: ModificationType.MODIFY
diff: @@ -140,5 +140,23 @@ describe('lib/utils', function() {
 
       done();
     });
+
+    it('skips __proto__', function() {
+      var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable"}}');
+      var res = utils.clone(payload);
+
+      assert.strictEqual({}.polluted, void 0);
+      assert.strictEqual(res.__proto__, Object.prototype);
+    });
+  });
+
+  describe('merge', function() {
+    it('avoids prototype pollution', function() {
+      var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable"}}');
+      var obj = {};
+      utils.merge(obj, payload);
+
+      assert.strictEqual({}.polluted, void 0);
+    });
   });
 });

programming_language: JavaScript
CVE-2019-13136 (published 2019-07-01T20:15Z)

ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-18 11:57:54-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1602
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: tiff.c
change_type: ModificationType.MODIFY
diff: @@ -258,6 +258,12 @@ static MagickOffsetType TIFFSeekCustomStream(const MagickOffsetType offset,
     }
     case SEEK_CUR:
     {
+      if (((offset > 0) && (profile->offset > (SSIZE_MAX-offset))) ||
+          ((offset < 0) && (profile->offset < (-SSIZE_MAX-offset))))
+        {
+          errno=EOVERFLOW;
+          return(-1);
+        }
       if ((profile->offset+offset) < 0)
         return(-1);
       profile->offset+=offset;

programming_language: C
CVE-2022-31549 (published 2022-07-11T01:15Z)

The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.3, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/olmax99/helm-flask-celery
commit_details: repo_url: https://github.com/olmax99/helm-flask-celery
author: olmax99
author_date: 2022-05-25 22:04:09+02:00
msg: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
repository: repo_url: https://github.com/olmax99/helm-flask-celery
repo_name: olmax99/helm-flask-celery
description: A Helm Flask base build setup for Kubernetes deployment using Helm
repo_language: Python
owner: olmax99
CVE-2023-1788 (published 2023-04-05T16:15Z)

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/firefly-iii/firefly-iii
commit_details: repo_url: https://github.com/firefly-iii/firefly-iii
author: James Cole
author_date: 2023-02-20 12:46:36+01:00
msg: Merge pull request #7062 from firefly-iii/JC5-patch-1

Update session.php
repository: repo_url: https://github.com/firefly-iii/firefly-iii
repo_name: firefly-iii/firefly-iii
description: Firefly III: a personal finances manager
repo_language: PHP
owner: firefly-iii
CVE-2023-4654 (published 2023-08-31T01:15Z)

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS v3 base score: 3.5, LOW (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-614
cwe_name: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
description: The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/instantsoft/icms2
commit_details: repo_url: https://github.com/instantsoft/icms2
author: fuzegit
author_date: 2023-08-16 00:47:41+03:00
msg: Add session regenerate after login & logout. Secure cookie if HTTPS.
close #1473
repository: repo_url: https://github.com/instantsoft/icms2
repo_name: instantsoft/icms2
description: Self-hosted Site Management System
repo_language: PHP
owner: instantsoft
file_changes: filename: config.php
change_type: ModificationType.MODIFY
diff: @@ -144,7 +144,7 @@ class cmsConfig extends cmsConfigs {
             $replace_upload_host_protocol = true;
         }
 
-        $this->set('document_root', rtrim(PATH, $this->root));
+        $this->set('document_root', preg_replace('#(.*)('.preg_quote($this->root).')$#u', '$1', PATH . DIRECTORY_SEPARATOR));
         $this->set('root_path', PATH . DIRECTORY_SEPARATOR);
         $this->set('system_path', $this->root_path . 'system/');
         $this->set('upload_path', $this->document_root . $this->upload_root);

programming_language: PHP
filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -265,6 +265,8 @@ class cmsUser {
 
         self::setUserSession($user, $user['ip']);
 
+        self::sessionRegenerate();
+
         return intval($user['id']);
     }
 
@@ -343,6 +345,8 @@ class cmsUser {
         self::getInstance()->id = $user['id'];
         self::getInstance()->is_logged = true;
 
+        self::sessionRegenerate();
+
         return true;
     }
 
@@ -384,6 +388,8 @@ class cmsUser {
 
         self::sessionUnset('user');
 
+        self::sessionRegenerate();
+
         return true;
     }
 
@@ -486,6 +492,19 @@ class cmsUser {
         }
     }
 
+    public static function sessionRegenerate() {
+
+        session_regenerate_id(false);
+
+        $id = session_id();
+
+        session_write_close();
+
+        session_id($id);
+
+        session_start();
+    }
+
     public static function sessionSet($key, $value) {
 
         if (strpos($key, ':') === false) {
@@ -568,7 +587,7 @@ class cmsUser {
                 'path'     => $path,
                 'domain'   => $domain,
                 'samesite' => 'Lax',
-                'secure'   => false,
+                'secure'   => cmsConfig::isSecureProtocol(),
                 'httponly' => $http_only
             ]);
         }

programming_language: PHP