Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hansmach1ne security fixes #583

Merged
merged 8 commits into from
Dec 6, 2022
Merged

Hansmach1ne security fixes #583

merged 8 commits into from
Dec 6, 2022

Commits on Sep 25, 2022

  1. Update CareersUI.php

    @hansmach1ne
    hansmach1ne committed Sep 25, 2022
    Configuration menu
    Copy the full SHA
    2e70547 View commit details
    Browse the repository at this point in the history

Commits on Oct 2, 2022

  1. SQL injection vulnerability fix in $entriesPerPage

    @hansmach1ne
    hansmach1ne committed Oct 2, 2022
    Configuration menu
    Copy the full SHA
    23472ed View commit details
    Browse the repository at this point in the history

  2. Sanitize parameters against XSS attacks 

    This commit fixes three XSS vulnerabilities.

1) 'indexFile' parameter
/ajax.php?f=getPipelineJobOrder&joborderID=1&page=0&entriesPerPage=1&sortBy=dateCreatedInt&sortDirection=desc&indexFile=15)"></a><script>alert`xss`</script>&isPopup=0

2) 'entriesPerPage' parameter
/ajax.php?f=getPipelineJobOrder&joborderID=2&page=0&entriesPerPage=15)"></a> <script>alert`xss`</script>&sortBy=dateCreatedInt&sortDirection=desc&indexFile=index.php&isPopup=0

3)'joborderID' parameter
/ajax.php?f=getPipelineJobOrder&joborderID=1)"></a> <script>alert`xss`</script>&page=0&entriesPerPage=1&sortBy=dateCreatedInt&sortDirection=desc&indexFile=index.php&isPopup=0
    @hansmach1ne
    hansmach1ne committed Oct 2, 2022
    Configuration menu
    Copy the full SHA
    68ac56c View commit details
    Browse the repository at this point in the history

  3. Fix for two XSS vulnerabilities in toolbar 

    This commit will fix two XSS vulnerabilities in toolbar module functionality.

1) GET parameter 'callback'.
/index.php?m=toolbar&callback=<script>alert`xss`</script>&a=authenticate

2) GET parameter 'email'
/index.php?m=toolbar&callback=<script>alert`xss`</script>&a=checkEmailIsInSystem&email=<script>alert(document.domain)</script>
    @hansmach1ne
    hansmach1ne committed Oct 2, 2022
    Configuration menu
    Copy the full SHA
    f7557a5 View commit details
    Browse the repository at this point in the history

  4. RCE vulnerability fix via insecure deserialization

    @hansmach1ne
    hansmach1ne committed Oct 2, 2022
    Configuration menu
    Copy the full SHA
    785a686 View commit details
    Browse the repository at this point in the history

Commits on Oct 3, 2022

  1. Merge branch 'opencats:master' into master

    @hansmach1ne
    hansmach1ne committed Oct 3, 2022
    Configuration menu
    Copy the full SHA
    076bfcf View commit details
    Browse the repository at this point in the history

  2. Fix SQL injection vulnerability in Tag deletion

    @hansmach1ne
    hansmach1ne committed Oct 3, 2022
    Configuration menu
    Copy the full SHA
    354cdc7 View commit details
    Browse the repository at this point in the history

  3. FIX SQL injection vulnerability in Imports module

    @hansmach1ne
    hansmach1ne committed Oct 3, 2022
    Configuration menu
    Copy the full SHA
    a5838b6 View commit details
    Browse the repository at this point in the history