marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
6f9613329e39c8cdce65046ebffc9866222f0a11
Open_Ultra_SAST/benchmarks/valid/train/CANDIDATES.md
T
Marius CiepluchandClaude Opus 5.5 2b65680d5d data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check 
Sourced apart from the 12 pilot repositories: 212 candidates (pool-fresh, pool-retry, OSV for PyPI,
npm, Maven and Packagist), 49 dropped because the benchmarks already name their repository, 413
catalog locations, 99 passing all three verifier checks in 28 repositories. Short of the 40-positive
target. catalog.py now reads .java and .php. Freeze waits on the maintainer's spot-check
(CANDIDATES.md, SOURCING.md).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-13 16:48:41 +02:00

44 KiB
Raw Blame History

Training-set candidates for the maintainer's spot-check

Generated 2026-10-13 by benchmarks/valid/train/sourcing.py candidates. Every location below passed all three model checks (vulnerable before the fix, fix addresses it, reachable from an in-repo entry point) and waits for a human accept or reject. Nothing here is a positive until accepted. Accept or reject a location with

.venv/bin/python -m benchmarks.valid.verify spot-check benchmarks/valid/train/verification.json <id> accept|reject --reviewer <you> --date YYYY-MM-DD

Sites passing: 99 in 28 repositories, 28 positive changes (fix commits); languages: java 21, javascript 5, php 31, python 21, typescript 21

The verifier's entry point is the model's claim, not a checked fact; it is the reason the site passed the reachability check.

andrea9293/mcp-documentation-server

  • advisory: GHSA-6f5r-5672-72j7 (access_control, CWE-306), origin osv, ecosystem npm, licence MIT
  • fix 37159d4e06b8ee50c3645b2496e3d3f6d32c47f9, parent (fix^1) 06d28086dd3fe120978bfa4a49a0a93c7bba8449
  • advisory title: @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
id path::function (pre-fix lines) language entry point (verifier) confidence
andrea9293-mcp-documentation-server-0913a4303cf82c9a src/web-server.ts::startWebServer (24-41) typescript startWebServer -> app.listen(PORT) binding all interfaces; HTTP routes GET /api/documents, POST /api/documents, DELETE /api/documents/:id, POST /api/search-all, GET /api/config 0.9

apache/atlas

  • advisory: GHSA-v73p-f52r-fmmr (output_encoding, CWE-80), origin osv, ecosystem maven, licence Apache-2.0
  • fix 800f979307d6ea0f0b6563ec890f6b728022e497, parent (fix^1) e67cc199e61afc92f242cccd05e97a61e0791bd2
  • advisory title: Apache Atlas UI: Authenticated User XSS
id path::function (pre-fix lines) language entry point (verifier) confidence
apache-atlas-3f751971e2a63d2e dashboardv2/public/js/views/search/SearchResultLayoutView.js::function (34-1474) javascript SearchResultLayoutView.getFixedDslColumn / getDaynamicColumns formatters rendering entity attributes via Backgrid Html cells; source is search API response entity attributes (e.g. name, typeName, cust 0.55
apache-atlas-42a370a3cdec7d12 dashboardv2/public/js/views/site/Header.js::function (27-347) javascript Header view onRender: that.$('.userName').html(Globals.userLogedIn.response.userName) renders the authenticated user's userName via .html() (DOM XSS sink); source is the logged-in user's userName from 0.75
apache-atlas-4c582bc549c555a1 dashboard/src/components/FilterQuery.tsx::clearQueryAttr (97-503) typescript React route /search/searchResult (FilterQuery component); source: URL query string via location.search / URLSearchParams, attacker-controlled filter params (type, tag, relationshipName, entityFilters, 0.55
apache-atlas-940ab56a7aadcda1 dashboardv2/public/js/views/search/RelationSearchResultLayoutView.js::function (33-820) javascript Backbone Marionette view RelationSearchResultLayoutView rendering relationship search results; data from relationship search API (getBasicRearchResult/fetch) flows into Backgrid Html cell formatters ( 0.55

apache/pdfbox

  • advisory: GHSA-jjwr-xmw6-gf78 (path, CWE-22), origin osv-extend, ecosystem maven, licence Apache-2.0
  • fix b028eafdf101b58e4ee95430c3be25e3e3aa29d7, parent (fix^1) daaead9069d562e166918d461191c89773e51f90
  • advisory title: Apache PDFBox has Path Traversal through PDComplexFileSpecification.getFilename() function
id path::function (pre-fix lines) language entry point (verifier) confidence
apache-pdfbox-3dc4e739d0307166 examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java::try (66-81) java ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() flows into extractFile(filePath, filename, embeddedFile) 0.9
apache-pdfbox-56ad35de6b5478ab examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java::extractFilesFromPage (84-104) java main(String[] args) CLI: args[0] PDF file path; embedded file names from PDComplexFileSpecification.getFilename() flow into extractFile 0.9
apache-pdfbox-7d8d6513c163f5fe examples/src/main/java/org/apache/pdfbox/examples/pdmodel/ExtractEmbeddedFiles.java::main (56-83) java ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() in PDF content reaches extractFile 0.9

codecov/codecov-python

  • advisory: GHSA-h3qr-fjhm-jphw (injection, CWE-88), origin osv-extend, ecosystem pip, licence Apache-2.0
  • fix 2a80aa434f74feb31242b6f213b75ce63ae97902, parent (fix^1) 73b1b138ec40912eee6fed02636be6011105706e
  • advisory title: Codecov does not sanitize gcov arguments
id path::function (pre-fix lines) language entry point (verifier) confidence
codecov-codecov-python-261567376b9ecd8e codecov/__init__.py::main (209-805) python codecov/__init__.py:main() CLI entry point; attacker-controlled source: --gcov-args / --gcov-exec / --gcov-root CLI arguments (argparse) flowing into cmd string passed to try_to_run (popen) 0.9

cyanheads/git-mcp-server

  • advisory: GHSA-3q26-f695-pp76 (injection, CWE-77), origin osv-extend, ecosystem npm, licence Apache-2.0
  • fix 0dbd6995ccdf76ab770b58013034365b2d06c4d9, parent (fix^1) f30169ec3a2520990e5467c19ef42ea7d6d9270e
  • advisory title: @cyanheads/git-mcp-server vulnerable to command injection in several tools
id path::function (pre-fix lines) language entry point (verifier) confidence
cyanheads-git-mcp-server-07d42f8af21c4e1d src/mcp-server/tools/gitClone/logic.ts::gitCloneLogic (69-278) typescript MCP tool git_clone (gitCloneLogic) invoked via MCP tools/call with attacker-controlled input.targetPath/repositoryUrl/branch reaching child_process.exec 0.85
cyanheads-git-mcp-server-3c306de22fb76061 src/mcp-server/tools/gitInit/logic.ts::gitInitLogic (63-227) typescript MCP tool git_init (gitInitLogic) invoked via tools/call with input.initialBranch 0.9

cyface/django-termsandconditions

  • advisory: GHSA-6rmf-cv6p-4h27 (untrusted_destination, CWE-601), origin osv-extend, ecosystem pip, licence BSD-3-Clause
  • fix 03396a1c2e0af95e12a45c5faef7e47a4b513e1a, parent (fix^1) c131a1b1daab533ece466f12d79a9ff903c9cacc
  • advisory title: Terms and Conditions Module vulnerable to Open Redirect
id path::function (pre-fix lines) language entry point (verifier) confidence
cyface-django-termsandconditions-1b3a86185cb651c3 termsandconditions/views.py::form_valid (154-185) python EmailTermsView at url /terms/email; GET parameter returnTo flows via get_initial into form initial, then form_valid sets self.success_url from form.cleaned_data['returnTo'] without validation, causing 0.85
cyface-django-termsandconditions-387ba4069e5df737 termsandconditions/views.py::post (76-124) python AcceptTermsView.post at URL /terms/accept, reading request.POST['returnTo'] 0.85
cyface-django-termsandconditions-8ee6351ba4d07811 termsandconditions/tests.py::test_accept_redirect_safe (245-259) python POST /terms/accept/ with returnTo parameter handled by termsandconditions/views.py returnTo function 0.85
cyface-django-termsandconditions-95885d31451074da termsandconditions/tests.py::test_accept_redirect_unsafe (260-270) python POST /terms/accept/ with returnTo parameter (termsandconditions/views.py returnTo function) 0.85
cyface-django-termsandconditions-d51b737f5af17360 termsandconditions/views.py::get_initial (67-75) python AcceptTermsView at url /terms/accept; GET parameter returnTo read via self.request.GET.get("returnTo", "/") in get_initial 0.85

datamodel-code-generator/datamodel-code-generator

  • advisory: GHSA-77xj-x4rm-935c (path, CWE-22), origin osv, ecosystem pip, licence MIT
  • fix 5e94b8f4203198798ec66b8e48217f70af69a0dc, parent (fix^1) 834731d56c0a90c182a0919f316069cf5ff0659a
  • advisory title: datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
id path::function (pre-fix lines) language entry point (verifier) confidence
datamodel-code-generator-datamodel-code-generator-bd146f812470891a src/datamodel_code_generator/parser/protobuf.py::_write_missing_weak_imports (383-395) python CLI: datamodel-code-generator --input-file-type protobuf --input <attacker-controlled .proto> (or --url); source: WEAK_IMPORT_PATTERN capture group from the proto text reaching _write_missing_weak_imp 0.9

docling-project/docling

  • advisory: GHSA-p3fw-7699-7926 (config_secrets, CWE-522), origin osv, ecosystem pip, licence MIT
  • fix 5e469137f275ffc443306a30d12a3a45bceb80fb, parent (fix^1) efaf9edd61363ef7239a49ba8e6b349ee219268f
  • advisory title: Docling: Configured HTTP headers sent to every remote image host named by a document
id path::function (pre-fix lines) language entry point (verifier) confidence
docling-project-docling-442cf60d08eedb5a docling/cli/main.py::convert (769-1181) python CLI command convert (docling/cli/main.py) with --html-image-headers and --html-image-fetch remote|all; attacker-controlled source is the untrusted HTML document's <img src> URL 0.85
docling-project-docling-6fdb354a87a33a5b docling/backend/html_backend.py::_render_with_browser (1004-1208) python HTMLBackend._render_with_browser via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled so 0.75
docling-project-docling-e161c7347b530396 docling/backend/html_backend.py::_route_request (1044-1054) python HTMLBackend._route_request via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source i 0.75

dtwang/line-desktop-mcp

  • advisory: GHSA-4hf8-5mjm-rfgq (access_control, CWE-306), origin osv, ecosystem npm, licence MIT
  • fix 680617894981ea93f8f6ceb51ecde7519754d501, parent (fix^1) 4023b0c85004507e28ae08999aac689293db63a5
  • advisory title: Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication
id path::function (pre-fix lines) language entry point (verifier) confidence
dtwang-line-desktop-mcp-11072dcfdfa41a45 src/server.js::parseArgs (575-607) javascript CLI --http-mode --port 3000 binds Express app to 0.0.0.0 and exposes POST /mcp Streamable HTTP endpoint without authentication 0.9
dtwang-line-desktop-mcp-b9429141072345c4 src/server.js::run (438-574) javascript Express app.all('/mcp') handler in LineDesktopMCPServer.run() invoked via CLI --http-mode --port; attacker-controlled source is the unauthenticated HTTP POST to /mcp (req.body initialize / mcp-session 0.9

flytohub/flyto-core

  • advisory: GHSA-c9hr-64h3-gxpc (untrusted_destination, CWE-918), origin osv, ecosystem pip, licence Apache-2.0
  • fix 0a0a528520ec18f5a21f1ddf858a71cc1edfb6e9, parent (fix^1) 2471c6e774102fcca21c61eb66cae057c0f0cecf
  • advisory title: Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
id path::function (pre-fix lines) language entry point (verifier) confidence
flytohub-flyto-core-9648472ee6b1bd21 src/core/modules/atomic/http/request.py::http_request (280-398) python execute_module http.request {url: attacker-controlled} -> http_request() -> session.request(method, url, allow_redirects=True) follows 302 into internal space 0.85
flytohub-flyto-core-c57a8e72e5f62c6f src/core/modules/atomic/http/get.py::http_get (85-125) python execute_module http.get with attacker-controlled url parameter (http_get in src/core/modules/atomic/http/get.py) 0.85

graphql/graphql-playground

  • advisory: GHSA-59r9-6jp6-jcm7 (output_encoding, CWE-79), origin osv-extend, ecosystem npm, licence MIT
  • fix b8a956006835992f12c46b90384a79ab82bcadad, parent (fix^1) 5073062f3834bb8652c0c0e3297ad83ddc8ad867
  • advisory title: XSS vulnerability in GraphQL Playground from untrusted schemas
id path::function (pre-fix lines) language entry point (verifier) confidence
graphql-graphql-playground-8a960cf0662c724e packages/graphql-playground-react/src/components/Playground/onHasCompletion.tsx::renderType (136-138) typescript GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; introspection type names reach renderType via onHasCompletion autocomplete, then injected through information.in 0.85
graphql-graphql-playground-8ab7cfafbc027403 packages/graphql-playground-react/src/components/Playground/SchemaFetcher.ts::getSchema (95-166) typescript SchemaFetcher.fetchSchema via endpoint query parameter (session.endpoint) loading a malicious schema 0.75
graphql-graphql-playground-94e027d23fc54155 packages/graphql-playground-react/src/components/Playground.tsx::UNSAFE_componentWillReceiveProps (215-253) typescript GraphQL Playground React app loaded via graphql-playground-html/middleware; endpoint query parameter (?endpoint=...) sets the schema endpoint, and the fetched introspection schema flows through props. 0.75
graphql-graphql-playground-afc7c3fd32fb660f packages/graphql-playground-react/src/components/Playground/onHasCompletion.tsx::onHasCompletion (15-135) typescript GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; onHasCompletion renders untrusted schema type names via innerHTML 0.85

hkuds/vibe-trading

  • advisory: GHSA-5rmq-chc7-m22f (path, CWE-22), origin osv, ecosystem pip, licence MIT
  • fix 9454d4a27a763b80e1d6eb5763b86c88e9e4e714, parent (fix^1) fd767f5c29c72cffe8e3f89c7ff006cb3041397f
  • advisory title: Vibe-Trading file-read tools expose arbitrary server-readable files
id path::function (pre-fix lines) language entry point (verifier) confidence
hkuds-vibe-trading-16a24d8276343ff1 agent/src/tools/path_utils.py::safe_user_path (52-81) python POST /sessions/{sid}/messages -> LLM tool registry -> ExtractShadowStrategyTool (journal_path) -> safe_user_path 0.85
hkuds-vibe-trading-866d7a8070276364 agent/src/tools/doc_reader_tool.py::read_document (259-291) python POST /sessions/{sid}/messages -> LLM tool registry -> DocReaderTool.execute -> read_document(file_path) with attacker-controlled file_path from chat message 0.85
hkuds-vibe-trading-c16e9e336b3428d7 agent/src/tools/backtest_tool.py::run_backtest (12-64) python BacktestTool.execute -> run_backtest(run_dir) via POST /sessions/{sid}/messages LLM tool invocation; run_dir is attacker-controlled via prompt injection 0.55
hkuds-vibe-trading-c504e5fd82839ef8 agent/src/tools/pattern_tool.py::run_pattern (305-342) python POST /sessions/{sid}/messages -> LLM tool registry -> PatternTool.execute -> run_pattern(run_dir) 0.55

home-assistant/frontend

  • advisory: GHSA-wx4m-69m9-gx3m (output_encoding, CWE-80), origin osv, ecosystem pip, licence Apache-2.0
  • fix b8c201b6d34414d30c622797366570185c219614, parent (fix^1) 4a6c23c93e0cf24c26721090ba168a853b91843f
  • advisory title: Home Assistant: XSS in Statistics Graph Card
id path::function (pre-fix lines) language entry point (verifier) confidence
home-assistant-frontend-588ec87d01bd562c src/panels/lovelace/cards/energy/common/energy-chart-options.ts::formatTooltip (226-299) typescript Lovelace Statistics Graph card (statistics-chart.ts) rendering ECharts tooltip via formatTooltip; source is entity name from getStatisticLabel/computeStateName (attacker-controlled via helper or integ 0.85
home-assistant-frontend-589375de71f6b2f2 src/panels/config/integrations/integration-panels/zwave_js/zwave_js-network-visualization.ts::customElement (33-388) typescript ZWave JS network visualization panel (zwave_js-network-visualization custom element) tooltip formatter rendering device names via ECharts tooltip 0.6
home-assistant-frontend-72bcad0f4ba8aa00 src/components/chart/state-history-chart-timeline.ts::render (66-171) typescript Statistics Graph card / state-history-chart-timeline.ts _renderTooltip (seriesName from entity name via getStatisticLabel/computeStateName) 0.75
home-assistant-frontend-d7404ee83aa6f810 src/components/chart/ha-chart-base.ts::_getSeries (955-996) typescript Statistics Graph card (statistics-chart.ts) rendering entity name via getStatisticLabel -> computeStateName into ECharts tooltip; attacker-controlled source is the entity name set via helper/integrati 0.85
home-assistant-frontend-f515548346e64ad5 src/panels/lovelace/cards/energy/hui-energy-devices-graph-card.ts::_renderTooltip (201-282) typescript Lovelace Statistics Graph card tooltip formatter (_renderTooltip) rendering entity name from getStatisticLabel/computeStateName; attacker-controlled source is the entity/statistic name set via helper 0.85

htmlunit/htmlunit

  • advisory: GHSA-3xrr-7m6p-p7xh (injection, CWE-94), origin osv, ecosystem maven, licence Apache-2.0
  • fix 641325bbc84702dc9800ec7037aec061ce21956b, parent (fix^1) d75f21270a20b94c4a49aa0a7dff3f9b7309ca78
  • advisory title: HtmlUnit Code Injection vulnerability
id path::function (pre-fix lines) language entry point (verifier) confidence
htmlunit-htmlunit-2d8f01031e36f7f1 src/main/java/com/gargoylesoftware/htmlunit/javascript/host/xml/XSLTProcessor.java::transform (121-209) java XSLTProcessor.transform (JS-exposed @JsxFunction transformToDocument/transformToFragment) invoked from attacker-controlled webpage JavaScript in HtmlUnit browser 0.75

inventree/inventree

  • advisory: GHSA-vx3h-qwqw-r2wq (untrusted_destination, CWE-918), origin osv-extend, ecosystem pip, licence MIT
  • fix 5759b60a48e7e178fb417a900ed543f29dc5dc86, parent (fix^1) 7bffa49f3cdd44dffdcf14e11e57db6295273b36
  • advisory title: Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP
id path::function (pre-fix lines) language entry point (verifier) confidence
inventree-inventree-3c189cf58ad5161c src/backend/InvenTree/InvenTree/serializers.py::validate_remote_image (890-914) python RemoteImageMixin.validate_remote_image via DRF serializer field 'remote_image' (URLField) on API endpoints using RemoteImageMixin; attacker-controlled source is the remote_image URL submitted in the r 0.75

jenkinsci/ansible-plugin

  • advisory: GHSA-38hw-368m-7jmg (config_secrets, CWE-311), origin osv, ecosystem maven, licence Apache-2.0
  • fix 4cbc48657c21a65a917b3b3049918480198c0cfb, parent (fix^1) 8191fd551ebf606556c730a08eb1d74426dc6257
  • advisory title: Jenkins Ansible Plugin stores and displays secrets in plain text
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-ansible-plugin-4904f1516a63debe src/main/java/org/jenkinsci/plugins/ansible/workflow/AnsiblePlaybookStep.java::convertExtraVars (376-397) java AnsiblePlaybookStep.AnsiblePlaybookExecution.run() invoked via the ansiblePlaybook pipeline step; extraVars parameter (step.extraVars) is attacker/user-controlled and passed to convertExtraVars 0.75

jenkinsci/dependency-track-plugin

  • advisory: GHSA-xfrw-pcmc-r2p3 (access_control, CWE-862), origin osv-extend, ecosystem maven, licence Apache-2.0
  • fix 70e7b82ad9a10499e628998a0bcb57c1481c66bc, parent (fix^1) 69317029c8a3eaadc7fe3f5a57de2c364279f612
  • advisory title: Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-dependency-track-plugin-673cc48b4f75ebf5 src/main/java/org/jenkinsci/plugins/DependencyTrack/DescriptorImpl.java::doCheckDependencyTrackFrontendUrl (205-219) java Jenkins Stapler HTTP endpoint doCheckDependencyTrackFrontendUrl (and doTestConnection) invoked via form validation request; attacker-controlled source is the @QueryParameter value / dependencyTrackApi 0.85
jenkinsci-dependency-track-plugin-90b566be2c3aebff src/main/java/org/jenkinsci/plugins/DependencyTrack/DescriptorImpl.java::doCheckDependencyTrackUrl (195-204) java Jenkins HTTP endpoint doCheckDependencyTrackUrl (and doTestConnection) reachable via Stapler form validation; attacker-controlled source: @QueryParameter value / dependencyTrackUrl and dependencyTrack 0.85
jenkinsci-dependency-track-plugin-9e8488d96f7c0424 src/main/java/org/jenkinsci/plugins/DependencyTrack/DescriptorImpl.java::doTestConnection (220-245) java Jenkins Stapler HTTP endpoint doTestConnection (descriptor form validation endpoint, e.g. /descriptorByName/.../testConnection) with attacker-controlled dependencyTrackUrl and dependencyTrackApiKey qu 0.85

jenkinsci/gitlab-logo-plugin

  • advisory: GHSA-22rj-q66g-2jg3 (config_secrets, CWE-522), origin osv-extend, ecosystem maven, licence MIT
  • fix 1a64595353df91b5fcf2d9336fa627e06ef1f8a9, parent (fix^1) f4c28e3db4974bfb03ba41838e68a1d99debd75b
  • advisory title: Jenkins GitLab Logo Plugin stores credentials unencrypted
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-gitlab-logo-plugin-f771ba20ac33c126 src/main/java/org/jenkinsci/plugins/gitlablogo/GitlabLogoProperty.java::configure (100-110) java Jenkins global configuration form submission handled by DescriptorImpl.configure(StaplerRequest, JSONObject) via Stapler; attacker-controlled source is the privateToken form field in the submitted JSO 0.85

jenkinsci/job-import-plugin

  • advisory: GHSA-4g29-r7vj-2rpv (access_control, CWE-862), origin osv-extend, ecosystem maven, licence MIT
  • fix 1b4119849571d4879977c529f9972d271ad6a630, parent (fix^1) 647b3d5a034708c7f8dd61194c476b4e2b8d9593
  • advisory title: Jenkins Job Import Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-job-import-plugin-07e0e7023a46cf4d src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java::doFillJenkinsSitesItems (336-342) java Jenkins Stapler HTTP endpoint doFillJenkinsSitesItems on JobImportActionDescriptor (fill field for Jenkins sites), reachable by any authenticated user with Overall/Read permission 0.85
jenkinsci-job-import-plugin-5509a356384e862e src/main/java/org/jenkins/ci/plugins/jobimport/JobImportAction.java::doFillCredentialIdItems (318-335) java Jenkins Stapler HTTP endpoint /jobImport/fillCredentialIdItems (doFillCredentialIdItems on JobImportActionDescriptor), reachable by any authenticated user with Overall/Read permission 0.85

jenkinsci/p4-plugin

  • advisory: GHSA-f9v6-p7hp-c3qx (access_control, CWE-862), origin osv, ecosystem maven, licence BSD-2-Clause
  • fix 2f2a31d8d36de7abab45820fab3a82f4c682b760, parent (fix^1) a168eb417f4b725612123be12ac014b01ab09999
  • advisory title: Missing permission checks in Jenkins P4 Plugin
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-p4-plugin-5022afedadfe8449 src/main/java/org/jenkinsci/plugins/p4/trigger/P4Hook.java::doChangeSubmit (105-125) java Stapler HTTP endpoint doChangeSubmit (P4Hook) reachable via Jenkins Stapler routing; attacker-controlled source: StaplerRequest parameters (_.p4port) and submitted form 0.9
jenkinsci-p4-plugin-65a59903d43924ee src/main/java/org/jenkinsci/plugins/p4/trigger/P4Hook.java::doChange (69-91) java P4Hook.doChange (HTTP endpoint /p4/change via StaplerRequest) 0.9
jenkinsci-p4-plugin-85c3775c29eb0c5c src/main/java/org/jenkinsci/plugins/p4/review/ReviewAction.java::doBuild (78-125) java HTTP endpoint doBuild/doBuildSubmit on ReviewAction (urlName 'review') via StaplerRequest parameters 0.85
jenkinsci-p4-plugin-a1c0ab5c3582fc3b src/main/java/org/jenkinsci/plugins/p4/review/ReviewAction.java::doBuildSubmit (70-77) java HTTP endpoint /review/buildSubmit (Stapler doBuildSubmit) reachable via Overall/Read authenticated user submitting form data 0.85
jenkinsci-p4-plugin-fdef12ac487474fb src/main/java/org/jenkinsci/plugins/p4/trigger/P4Hook.java::doEvent (49-68) java UnprotectedRootAction P4Hook at URL /p4, HTTP endpoint doEvent (and doChange) reachable without authentication; attacker-controlled source is the HTTP request body/JSON payload (req.getInputStream) 0.9

jenkinsci/tap-plugin

  • advisory: GHSA-24jc-w55j-5p83 (path, CWE-22), origin osv-extend, ecosystem maven, licence MIT
  • fix 8e2a3aa86ce57a98c69e6038e15ae8fe47d08124, parent (fix^1) a98a85c961ef983fb2935aa2987587acc2e11e8e
  • advisory title: Jenkins TAP Plugin allows Path Traversal
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-tap-plugin-b1954cc1fc64febe src/main/java/org/tap4j/plugin/TapResult.java::doDownloadAttachment (306-345) java doDownloadAttachment Stapler request handler (Jenkins Stapler route /downloadAttachment) reading request parameter "f" 0.85

jenkinsci/zap-pipeline-plugin

  • advisory: GHSA-4c87-9xq5-5c35 (output_encoding, CWE-79), origin osv-extend, ecosystem maven, licence MIT
  • fix bca4b087c66ead39398f54cdadc27c515e8ede31, parent (fix^1) 5fc703a3c383eb515909cf0b9dc452ccc38f07d9
  • advisory title: Content-Security-Policy protection for user content disabled by Jenkins ZAP Pipeline Plugin
id path::function (pre-fix lines) language entry point (verifier) confidence
jenkinsci-zap-pipeline-plugin-953ab12f1f2d06d9 src/main/java/com/vrondakis/zap/ZapAction.java::doDynamic (61-69) java ZapAction.doDynamic (Stapler route /job///zap/... via getUrlName() returning ZapArchive.DIRECTORY_NAME), serving DirectoryBrowserSupport content; attacker-controlled source is files in the w 0.85

line/armeria

  • advisory: GHSA-8fp4-rp6c-5gcv (path, CWE-22), origin osv-extend, ecosystem maven, licence Apache-2.0
  • fix e2697a575e9df6692b423e02d731f293c1313284, parent (fix^1) a1105519e920b00ee3bc848a5074d943925931ef
  • advisory title: Path Traversal in com.linecorp.armeria:armeria
id path::function (pre-fix lines) language entry point (verifier) confidence
line-armeria-143c39cfd2874e4c core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java::appendOneByte (359-389) java HTTP request path parsing in Armeria server (PathAndQuery.appendOneByte) reached via FileService under a path prefix, e.g. GET /files/..%2Fsecrets.txt 0.75
line-armeria-3196308da59204ff core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java::splitPathAndQuery (189-230) java HTTP request path handling in Armeria server (PathAndQuery.splitPathAndQuery invoked from request path parsing); attacker-controlled source is the request path containing %2F, e.g. /files/..%2Fsecrets 0.75
line-armeria-fff692dc76424e72 core/src/main/java/com/linecorp/armeria/internal/common/PathAndQuery.java::decodePercentsAndEncodeToUtf8 (231-358) java HTTP request path parsing in Armeria server (PathAndQuery.parse) invoked via FileService under a route such as /files, attacker-controlled source: request path containing %2F 0.85

modoboa/modoboa-dmarc

  • advisory: GHSA-vc42-mgr2-w34r (injection, CWE-91), origin osv-extend, ecosystem pip, licence MIT
  • fix 14c29e0ad9487bdbe4cc0bd1f8bc711285bf9933, parent (fix^1) 1b1472fc7ef168e19f981f8bb8827e9ed7888e46
  • advisory title: Modoboa is vulnerable to an XML External Entity Injection (XXE)
id path::function (pre-fix lines) language entry point (verifier) confidence
modoboa-modoboa-dmarc-7b9ba42b6d644e40 modoboa_dmarc/lib.py::import_report (76-119) python import_report_from_email(content) -> import_archive -> import_report; content originates from DMARC report emails sent to the rua address of a domain 0.85

posit-dev/py-shiny

  • advisory: GHSA-47c3-hpmg-7j6p (path, CWE-22), origin osv, ecosystem pip, licence MIT
  • fix 1d8ecb46cbc9621b7dc8812111d26692e086b376, parent (fix^1) 48b4faa0d651476afa84d6423d57503b60716902
  • advisory title: Shiny for Python has path traversal in bookmark restore
id path::function (pre-fix lines) language entry point (verifier) confidence
posit-dev-py-shiny-3537c0dd41a40d38 shiny/_app.py::_on_root_request_cb (397-418) python HTTP GET / handler _on_root_request_cb reading request.url.query (state_id) 0.9
posit-dev-py-shiny-78e995f1fddd0cb5 shiny/bookmark/_restore_state.py::_load_state_qs (183-221) python HTTP request query string _state_id_ parameter reaching _load_state_qs (bookmark restore path) 0.85
posit-dev-py-shiny-8fd07b2eca54563e shiny/bookmark/_restore_state.py::from_query_string (110-163) python HTTP request query string parsed by RestoreContext.from_query_string via the Shiny bookmark-restore path; attacker-controlled source is the _state_id_ query-string parameter 0.85

shopperlabs/shopper

  • advisory: GHSA-f946-9qp6-vgch (access_control, CWE-285), origin osv-extend, ecosystem composer, licence MIT
  • fix fcd0c5920588702df5b874f432b1042abd77a50b, parent (fix^1) ceaea6a078025d4a7634d2646d27dde3f13b6f58
  • advisory title: shopper/framework: Authorization bypass in multiple Livewire admin components
id path::function (pre-fix lines) language entry point (verifier) confidence
shopperlabs-shopper-02254beed509364c packages/admin/src/Livewire/Components/Products/Form/Inventory.php::store (195-207) php Livewire component packages/admin/src/Livewire/Components/Products/Form/Inventory.php store() method, invoked via Livewire request from the admin product inventory form; attacker-controlled source is 0.85
shopperlabs-shopper-047e62abed0b91fa packages/admin/src/Livewire/Components/Customers/Orders.php::table (36-123) php Livewire component Shopper\Admin\Livewire\Components\Customers\Orders (public $customer property, table()/render()); attacker-controlled source: Livewire client-side property tampering of the unlocked 0.6
shopperlabs-shopper-052f88a347caf2eb packages/admin/src/Livewire/Components/Orders/OrderNotes.php::leaveNotes (24-37) php Livewire component Shopper\Livewire\Components\Orders\OrderNotes::leaveNotes(), invoked via Livewire update request from the order detail admin panel; attacker-controlled source is the public $notes p 0.85
shopperlabs-shopper-064f0b5f8937aae5 packages/admin/src/Livewire/Pages/Settings/Team/Index.php::table (77-118) php Livewire admin component Settings/Team/Index (table recordActions DeleteAction) reachable by any authenticated panel user 0.75
shopperlabs-shopper-0fd6e8d87dd0ed82 packages/admin/src/Livewire/Pages/Order/Detail.php::markCompleteAction (114-133) php Livewire admin Order Detail component action markCompleteAction (Filament action callable by authenticated low-privilege panel user with read_orders) 0.85
shopperlabs-shopper-1112cc61420816ff packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php::save (199-210) php Livewire component Settings/Team/RolePermission::save() invoked via Livewire update request from the admin panel route (shopper settings team role page); attacker-controlled source is the authenticate 0.85
shopperlabs-shopper-13fdb238d0d8e573 packages/admin/src/Livewire/Components/Products/Form/Edit.php::store (213-231) php Livewire component Products\Form\Edit::store() invoked via Livewire update request from the admin product edit form; attacker-controlled source is the Livewire form state (data) submitted by an authen 0.85
shopperlabs-shopper-22487ec06a8cf50a packages/admin/src/Livewire/Pages/Order/Detail.php::capturePaymentAction (134-178) php Livewire admin component packages/admin/src/Livewire/Pages/Order/Detail.php::capturePaymentAction (Filament action 'capturePayment' invoked by an authenticated low-privilege panel user with read_order 0.85
shopperlabs-shopper-2405022067cc6870 packages/admin/src/Livewire/Pages/Order/Shipments.php::table (98-213) php Livewire admin component packages/admin/src/Livewire/Pages/Order/Shipments.php::table() record actions (markDelivered, edit) invoked via Livewire request by an authenticated low-privilege panel user w 0.85
shopperlabs-shopper-29811dac402a0d13 packages/admin/src/Livewire/Pages/Order/Detail.php::markPaidAction (88-113) php Livewire admin component Order/Detail markPaidAction (Filament action 'markPaid') invoked by an authenticated low-privilege panel user with read_orders permission 0.85
shopperlabs-shopper-2aeaefee52274ee8 packages/admin/src/Livewire/Pages/Order/Detail.php::archiveAction (179-207) php Livewire admin component Order/Detail archiveAction (Filament action 'archive') invoked via Livewire request to the admin order detail page; attacker-controlled source is the authenticated low-privile 0.85
shopperlabs-shopper-5481a94c34f42fbf packages/admin/src/Livewire/Components/Products/Form/Files.php::store (54-65) php Livewire component packages/admin/src/Livewire/Components/Products/Form/Files.php store() action, invoked via Livewire request to the product edit page; attacker-controlled source is the Livewire acti 0.85
shopperlabs-shopper-5a3dcf2a6b6b16c8 packages/admin/src/Livewire/Components/Products/Form/Shipping.php::store (56-67) php Livewire component Products\Form\Shipping::store() invoked via Livewire update request from the admin product shipping form; attacker-controlled source is the Livewire action call and form state ($thi 0.85
shopperlabs-shopper-5e6161ace0cb4b97 packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php::createPermissionAction (151-198) php Livewire component Settings/Team/RolePermission::createPermissionAction (admin panel route for role permissions), invoked by an authenticated low-privilege panel user with view_users permission 0.85
shopperlabs-shopper-61e951b6bcd03186 packages/admin/src/Livewire/Pages/Settings/Carriers.php::createCarrierAction (49-66) php Livewire component Shopper\Admin\Livewire\Pages\Settings\Carriers::createCarrierAction (admin panel route rendering the Carriers Livewire component); attacker-controlled source: authenticated low-priv 0.75
shopperlabs-shopper-7cc69fb293ec0e10 packages/admin/src/Livewire/Pages/Collection/Edit.php::store (134-143) php Livewire component packages/admin/src/Livewire/Pages/Collection/Edit.php store() action, invoked via Livewire update request from the admin collection edit page by an authenticated low-privilege panel 0.75
shopperlabs-shopper-8769d9915b8295a9 packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php::generatePermissionsAction (90-150) php Livewire admin component Settings/Team/RolePermission::generatePermissionsAction (Filament action 'generatePermissions'), invoked by an authenticated panel user with only view_users permission; source 0.85
shopperlabs-shopper-88497bd11908cf4a packages/admin/src/Livewire/Pages/Settings/Currencies.php::table (43-130) php Livewire component Shopper\Admin\Livewire\Pages\Settings\Currencies (route /settings/currencies) - table() ToggleColumn is_enabled, EditAction edit, and grouped bulk actions enable/disable; attacker-c 0.75
shopperlabs-shopper-8b7021ee40c51b56 packages/admin/src/Livewire/SlideOvers/AddVariant.php::form (71-203) php Livewire component AddVariant (packages/admin/src/Livewire/SlideOvers/AddVariant.php) form() barcode TextInput; attacker-controlled source is the barcode form field submitted via the Livewire save() a 0.6
shopperlabs-shopper-91023b586e4ab747 packages/admin/src/Livewire/Components/Settings/Legal/PolicyForm.php::store (60-72) php Livewire component Settings\Legal\PolicyForm::store() invoked via Livewire update request from the admin panel; attacker-controlled source is the authenticated low-privilege panel user's Livewire requ 0.75
shopperlabs-shopper-a413505de3d037f8 packages/admin/src/Livewire/Pages/Settings/PaymentMethods.php::createPaymentAction (49-66) php Livewire component Shopper\Admin\Livewire\Pages\Settings\PaymentMethods::createPaymentAction (admin panel route for payment methods settings); attacker-controlled source: authenticated low-privilege p 0.75
shopperlabs-shopper-a82b452965e2ffe5 packages/admin/src/Livewire/Components/Products/Form/Seo.php::store (52-63) php Livewire component packages/admin/src/Livewire/Components/Products/Form/Seo.php store() action, invoked via Livewire request to the product SEO form; attacker-controlled source is the Livewire compone 0.85
shopperlabs-shopper-ab37699016e7189c packages/admin/src/Livewire/SlideOvers/AddProduct.php::form (84-283) php Livewire component packages/admin/src/Livewire/SlideOvers/AddProduct.php::store() invoked via Livewire request to the AddProduct slide-over (form submit wire:target="store"); attacker-controlled sourc 0.6
shopperlabs-shopper-b37cd0c75b594760 packages/admin/src/Livewire/Pages/Product/Variant.php::updateStockAction (46-81) php Livewire component Shopper\Admin\Livewire\Pages\Product\Variant::updateStockAction (admin panel product variant page); attacker-controlled source: Livewire action call with form data (sku, barcode) fr 0.85
shopperlabs-shopper-cd45e0d6604bb846 packages/admin/src/Livewire/Pages/Order/Detail.php::cancelOrderAction (47-69) php Livewire admin component Shopper\Livewire\Pages\Order\Detail::cancelOrderAction invoked via Livewire action call on the order detail page (route shopper.orders.detail); attacker-controlled source is t 0.85
shopperlabs-shopper-d05ad8c2776691be packages/admin/src/Livewire/Components/Settings/Locations/InventoryForm.php::store (103-118) php Livewire component Settings/Locations/InventoryForm::store() invoked via Livewire update request from the admin panel route shopper.settings.locations; attacker-controlled source is the Livewire form 0.85
shopperlabs-shopper-d26bdca35566e799 packages/admin/src/Livewire/Pages/Settings/PaymentMethods.php::table (67-112) php Livewire component PaymentMethods (Settings/PaymentMethods) table actions: ToggleColumn is_enabled, EditAction edit, DeleteAction delete; invoked via Livewire update endpoint by any authenticated pane 0.85
shopperlabs-shopper-deb90b541bcac1aa packages/admin/src/Livewire/Pages/Order/Detail.php::startProcessingAction (70-87) php Livewire admin component Order/Detail::startProcessingAction (Filament action 'startProcessing') invoked by an authenticated low-privilege panel user with read_orders permission 0.85
shopperlabs-shopper-df2391064e3c3332 packages/admin/src/Livewire/Pages/Settings/Team/Index.php::createRoleAction (41-76) php Livewire component Shopper\Admin\Livewire\Pages\Settings\Team\Index (route: shopper.settings.team.index) - createRoleAction invoked by any authenticated panel user; source: Livewire action call from c 0.85
shopperlabs-shopper-f3cb66743db8d5f1 packages/admin/src/Livewire/Pages/Customers/Create.php::store (142-178) php Livewire component Customers\Create::store() invoked via admin panel route shopper.customers.create (Livewire POST to /admin/customers/create); attacker-controlled source is the Livewire form state ($ 0.85
shopperlabs-shopper-fddd0d6c3c4501aa packages/admin/src/Livewire/Pages/Settings/Carriers.php::table (67-112) php Livewire component packages/admin/src/Livewire/Pages/Settings/Carriers.php (table actions: ToggleColumn is_enabled, EditAction, DeleteAction) invoked via Livewire update requests by any authenticated 0.75

triggerdotdev/trigger.dev

  • advisory: GHSA-4672-hwv6-gq62 (access_control, CWE-639), origin osv, ecosystem npm, licence Apache-2.0
  • fix 6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0, parent (fix^1) cc748422d8188833948035281cc50ef4f7ab77e2
  • advisory title: Trigger.dev: Cross-environment deployment cancel
id path::function (pre-fix lines) language entry point (verifier) confidence
triggerdotdev-trigger.dev-0eb72665259b13c2 apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts::action (14-75) typescript POST /api/v1/schedules/:scheduleId/deactivate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts), authenticated via authenticateApiRequest using an environment-scoped secret 0.55
triggerdotdev-trigger.dev-124d417d0ae18fbe apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts::action (14-75) typescript POST /api/v1/schedules/:scheduleId/activate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API 0.55
triggerdotdev-trigger.dev-2240070f2c86924b apps/webapp/app/v3/services/initializeDeployment.server.ts::call (24-315) typescript POST /api/v1/deployments/:deploymentId/cancel (api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment(projectId, friendlyId); attacker-controlled source: de 0.75
triggerdotdev-trigger.dev-30dec4b7031de737 apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts::action (12-78) typescript POST /api/v1/deployments/:deploymentId/cancel (action in apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts); attacker-controlled source: API key in request headers via authenticateRequ 0.9
triggerdotdev-trigger.dev-5b0c0ef74fdf5bc3 apps/webapp/app/v3/services/deployment.server.ts::generateRegistryCredentials (280-333) typescript POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) with attacker-controlled secret API key (dev/preview env) and deploymentId param 0.85
triggerdotdev-trigger.dev-5f1cf28e3ac84980 apps/webapp/app/v3/services/deployment.server.ts::getDeployment (475-515) typescript POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment; attacker-controlled source: au 0.9
triggerdotdev-trigger.dev-eebfca9646e01b1c apps/webapp/app/v3/services/deployment.server.ts::cancelDeployment (193-270) typescript POST /api/v1/deployments/$deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment; attacker-controlled source: authenticated envir 0.9

whiskeysockets/baileys

  • advisory: GHSA-qvv5-jq5g-4cgg (config_secrets, CWE-346), origin osv, ecosystem npm, licence MIT
  • fix 3beb08eecfcb4e65722e674034bd84fb11a9de35, parent (fix^1) 28ca087cf1cbe3c05a5b704d67b3e2270d647b74
  • advisory title: Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
id path::function (pre-fix lines) language entry point (verifier) confidence
whiskeysockets-baileys-89cd6d4edf46d286 src/Utils/process-message.ts::processMessage (293-751) typescript processMessage(message, ctx) invoked from the Baileys socket message pipeline (e.g. sendMessage/ev 'messages.upsert' handling); attacker-controlled source is the incoming WAMessage.message.protocolMes 0.75
Reference in New Issue View Git Blame Copy Permalink