Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-47517: Off-by-one Error (CWE-193)
value: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.5
Published: 2022-12-18T05:15Z
Repository: https://github.com/davehorton/sofia-sip
Language: C
Files changed: libsofia-sip-ua/url/url.c
Commit date: 2022-11-27 20:06:46 -0500
Commit message: better fix for prev commit

Diff: diff --git a/libsofia-sip-ua/url/url.c b/libsofia-sip-ua/url/url.c
index 6e437a4b..bc87ba68 100644
--- a/libsofia-sip-ua/url/url.c
+++ b/libsofia-sip-ua/url/url.c
@@ -362,12 +362,16 @@ char *url_canonize2(char *d, char const * const s, size_t n,
 	return NULL;
       *d = c;
       continue;
     }
 
-    if (i >= strlen(s) - 1) return NULL;
-    h1 = s[i + 1], h2 = s[i + 2];
+    h1 = s[i + 1];
+    if (!h1) {
+        *d = '\0';
+        return NULL;
+    }
+    h2 = s[i + 2];
 
     if (!IS_HEX(h1) || !IS_HEX(h2)) {
       *d = '\0';
       return NULL;
     }
@@ -396,11 +400,10 @@ char *url_canonize2(char *d, char const * const s, size_t n,
   *d = '\0';
 
   return d;
 }
 
-
 /** Canonize a URL component (with precomputed mask).
  *
  * This version does not flag error if *s contains character that should
  * be escaped.
  */

Vulnerable code:     if (i >= strlen(s) - 1) return NULL;
    h1 = s[i + 1], h2 = s[i + 2];

Fixed code:     h1 = s[i + 1];
    if (!h1) {
        *d = '\0';
        return NULL;
    }
    h2 = s[i + 2];
CVE-2017-15284: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-12T08:29Z
Repository: https://github.com/octobercms/library
Language: PHP
Files changed: src/Filesystem/Definitions.php
Commit date: 2017-10-10 10:13:08 +1100
Commit message: Remove SVG from image types

SVG files should not be treated as images - especially when coming to uploads. An SVG file can contain arbitrary HTML data as well as event handlers in native elements
Refs: https://html5sec.org/#svg
Original report by: Ishaq Mohammed

Diff: diff --git a/src/Filesystem/Definitions.php b/src/Filesystem/Definitions.php
index baa4d98..63660e4 100644
--- a/src/Filesystem/Definitions.php
+++ b/src/Filesystem/Definitions.php
@@ -180,12 +180,11 @@ class Definitions
             'jpg',
             'jpeg',
             'bmp',
             'png',
             'webp',
-            'gif',
-            'svg'
+            'gif'
         ];
     }
 
     /**
      * Extensions typically used as video files.

Vulnerable code:             'gif',
            'svg'
Fixed code:             'gif'
CVE-2021-3311: Insufficient Session Expiration (CWE-613)
value: An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2021-02-05T14:15Z
Repository: https://github.com/octobercms/library
Language: PHP
Files changed: src/Auth/Manager.php
Commit date: 2021-01-30 11:48:20 +1100
Commit message: Invalidate the session ID to prevent reuse

1. Good logs in
2. Bad captures Good's session cookie
3. Good logs out
4. Session cookie no longer works
5. Good logs in a second time
6. ORIGINAL session cookie works (Bad is also signed in)

Diff: diff --git a/src/Auth/Manager.php b/src/Auth/Manager.php
index 1bb65baf..a8dc26a2 100644
--- a/src/Auth/Manager.php
+++ b/src/Auth/Manager.php
@@ -684,11 +684,11 @@ class Manager implements \Illuminate\Contracts\Auth\StatefulGuard
             $this->user->forceSave();
         }
 
         $this->user = null;
 
-        Session::flush();
+        Session::invalidate();
         Cookie::queue(Cookie::forget($this->sessionKey));
     }
 
     //
     // Impersonation

Vulnerable code:         Session::flush();
Fixed code:         Session::invalidate();
CVE-2018-14718: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit date: 2018-08-16 14:42:57 -0700
Commit message: Fix #2097 for 2.6.7.2

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 859acc715..30efa6f3b 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -3,11 +3,14 @@ Project: jackson-databind
 ------------------------------------------------------------------------
 === Releases ===
 ------------------------------------------------------------------------
 
 2.6.7.2 (not yet released)
+
 #1737: Block more JDK types from polymorphic deserialization
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
 
 2.6.7.1 (11-Jul-2017)
 
 #1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
 #1599: Backport the extra safety checks for polymorphic deserialization
diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
index 0b1613b04..fb4c904b7 100644
--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
@@ -66,10 +66,16 @@ public class BeanDeserializerFactory
         s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
 
+        // [databind#2097]: some 3rd party, one JDK-bundled
+        s.add("org.slf4j.ext.EventData");
+        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
+        s.add("com.sun.deploy.security.ruleset.DRSHelper");
+        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: 
#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-14719: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit date: 2018-08-16 14:42:57 -0700
Commit message: Fix #2097 for 2.6.7.2

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 859acc715..30efa6f3b 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -3,11 +3,14 @@ Project: jackson-databind
 ------------------------------------------------------------------------
 === Releases ===
 ------------------------------------------------------------------------
 
 2.6.7.2 (not yet released)
+
 #1737: Block more JDK types from polymorphic deserialization
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
 
 2.6.7.1 (11-Jul-2017)
 
 #1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
 #1599: Backport the extra safety checks for polymorphic deserialization
diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
index 0b1613b04..fb4c904b7 100644
--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
@@ -66,10 +66,16 @@ public class BeanDeserializerFactory
         s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
 
+        // [databind#2097]: some 3rd party, one JDK-bundled
+        s.add("org.slf4j.ext.EventData");
+        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
+        s.add("com.sun.deploy.security.ruleset.DRSHelper");
+        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: 
#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-14720: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
Commit date: 2018-08-16 14:42:57 -0700
Commit message: Fix #2097 for 2.6.7.2

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 859acc715..30efa6f3b 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -3,11 +3,14 @@ Project: jackson-databind
 ------------------------------------------------------------------------
 === Releases ===
 ------------------------------------------------------------------------
 
 2.6.7.2 (not yet released)
+
 #1737: Block more JDK types from polymorphic deserialization
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
 
 2.6.7.1 (11-Jul-2017)
 
 #1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
 #1599: Backport the extra safety checks for polymorphic deserialization
diff --git a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
index 0b1613b04..fb4c904b7 100644
--- a/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
+++ b/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
@@ -66,10 +66,16 @@ public class BeanDeserializerFactory
         s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
         s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
         s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
         s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
 
+        // [databind#2097]: some 3rd party, one JDK-bundled
+        s.add("org.slf4j.ext.EventData");
+        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
+        s.add("com.sun.deploy.security.ruleset.DRSHelper");
+        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: 
#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
  - CVE-2018-14721)
        // [databind#2097]: some 3rd party, one JDK-bundled
        s.add("org.slf4j.ext.EventData");
        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
        s.add("com.sun.deploy.security.ruleset.DRSHelper");
        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
CVE-2018-19360: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit date: 2018-11-23 10:33:23 -0800
Commit message: Backport #2186 to 2.7.9[.5]

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 7a8d1a558..209c323c3 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -8,10 +8,13 @@ Project: jackson-databind
 
 #1899: Another two gadgets to exploit default typing issue in jackson-databind
  (reported by OneSourceCat@github)
 #2097: Block more classes from polymorphic deserialization (CVE-2018-14718
   - CVE-2018-14721)
+#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
+  CVE-2018-19361, CVE-2018-19362)
+ (reported by Guixiong Wu)
 
 2.7.9.4 (08-Jun-2018)
 
 #2032: CVE-2018-11307: Potential information exfiltration with default typing, serialization gadget from MyBatis
 #2052: CVE-2018-12022: Block polymorphic deserialization of types from Jodd-db library
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
index a8b1bcef5..03a8ed3fb 100644
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -71,10 +71,15 @@ public class SubTypeValidator
         s.add("org.slf4j.ext.EventData");
         s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
         s.add("com.sun.deploy.security.ruleset.DRSHelper");
         s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
 
+        // [databind#2186]: yet more 3rd party gadgets
+        s.add("org.jboss.util.propertyeditor.DocumentEditor");
+        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
+        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
+        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");        
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: #2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
  CVE-2018-19361, CVE-2018-19362)
 (reported by Guixiong Wu)
        // [databind#2186]: yet more 3rd party gadgets
        s.add("org.jboss.util.propertyeditor.DocumentEditor");
        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
CVE-2018-19361: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit date: 2018-11-23 10:33:23 -0800
Commit message: Backport #2186 to 2.7.9[.5]

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 7a8d1a558..209c323c3 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -8,10 +8,13 @@ Project: jackson-databind
 
 #1899: Another two gadgets to exploit default typing issue in jackson-databind
  (reported by OneSourceCat@github)
 #2097: Block more classes from polymorphic deserialization (CVE-2018-14718
   - CVE-2018-14721)
+#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
+  CVE-2018-19361, CVE-2018-19362)
+ (reported by Guixiong Wu)
 
 2.7.9.4 (08-Jun-2018)
 
 #2032: CVE-2018-11307: Potential information exfiltration with default typing, serialization gadget from MyBatis
 #2052: CVE-2018-12022: Block polymorphic deserialization of types from Jodd-db library
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
index a8b1bcef5..03a8ed3fb 100644
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -71,10 +71,15 @@ public class SubTypeValidator
         s.add("org.slf4j.ext.EventData");
         s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
         s.add("com.sun.deploy.security.ruleset.DRSHelper");
         s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
 
+        // [databind#2186]: yet more 3rd party gadgets
+        s.add("org.jboss.util.propertyeditor.DocumentEditor");
+        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
+        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
+        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");        
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: #2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
  CVE-2018-19361, CVE-2018-19362)
 (reported by Guixiong Wu)
        // [databind#2186]: yet more 3rd party gadgets
        s.add("org.jboss.util.propertyeditor.DocumentEditor");
        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
CVE-2018-19362: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2019-01-02T18:29Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION, src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit date: 2018-11-23 10:33:23 -0800
Commit message: Backport #2186 to 2.7.9[.5]

Diff: diff --git a/release-notes/VERSION b/release-notes/VERSION
index 7a8d1a558..209c323c3 100644
--- a/release-notes/VERSION
+++ b/release-notes/VERSION
@@ -8,10 +8,13 @@ Project: jackson-databind
 
 #1899: Another two gadgets to exploit default typing issue in jackson-databind
  (reported by OneSourceCat@github)
 #2097: Block more classes from polymorphic deserialization (CVE-2018-14718
   - CVE-2018-14721)
+#2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
+  CVE-2018-19361, CVE-2018-19362)
+ (reported by Guixiong Wu)
 
 2.7.9.4 (08-Jun-2018)
 
 #2032: CVE-2018-11307: Potential information exfiltration with default typing, serialization gadget from MyBatis
 #2052: CVE-2018-12022: Block polymorphic deserialization of types from Jodd-db library
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
index a8b1bcef5..03a8ed3fb 100644
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -71,10 +71,15 @@ public class SubTypeValidator
         s.add("org.slf4j.ext.EventData");
         s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
         s.add("com.sun.deploy.security.ruleset.DRSHelper");
         s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
 
+        // [databind#2186]: yet more 3rd party gadgets
+        s.add("org.jboss.util.propertyeditor.DocumentEditor");
+        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
+        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
+        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");        
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: #2186: Block more classes from polymorphic deserialization (CVE-2018-19360,
  CVE-2018-19361, CVE-2018-19362)
 (reported by Guixiong Wu)
        // [databind#2186]: yet more 3rd party gadgets
        s.add("org.jboss.util.propertyeditor.DocumentEditor");
        s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
        s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
        s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
CVE-2019-14439: Deserialization of Untrusted Data (CWE-502)
value: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.5
Published: 2019-07-30T11:15Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Java
Files changed: src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit date: 2019-07-25 21:58:11 -0700
Commit message: Backport #2387, #2389 fixes

Diff: diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
index c4d7f3827..fa7ff2368 100644
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -87,10 +87,16 @@ public class SubTypeValidator
 
         // [databind#2341]: jdom/jdom2
         s.add("org.jdom.transform.XSLTransformer");
         s.add("org.jdom2.transform.XSLTransformer");
 
+        // [databind#2387]: EHCache
+        s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");
+
+        // [databind#2389]: logback/jndi
+        s.add("ch.qos.logback.core.db.JNDIConnectionSource");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code:         // [databind#2387]: EHCache
        s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");

        // [databind#2389]: logback/jndi
        s.add("ch.qos.logback.core.db.JNDIConnectionSource");
CVE-2020-10650: Deserialization of Untrusted Data (CWE-502)
value: A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.1
Published: 2022-12-26T20:15Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION-2.x, src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
Commit date: 2020-03-15 17:28:51 -0700
Commit message: Fix #2658

Diff: diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index 683346e6c..4aca62393 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -12,10 +12,11 @@ Project: jackson-databind
  (reported by threedr3am & V1ZkRA)
 #2642: Block one more gadget type (javax.swing, CVE-to-be-allocated)
  (reported by threedr3am)
 #2648: Block one more gadget type (shiro-core)
 #2653: Block one more gadget type (shiro-core)
+#2658: Block one more gadget type (ignite-jta)
 
 2.9.10.3 (23-Feb-2020)
 
 #2620: Block one more gadget type (xbean-reflect/JNDI - CVE-2020-8840)
  (reported by threedr3am@github)
diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
index 08f06ed41..c935f3ce4 100644
--- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
+++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -140,10 +140,15 @@ public class SubTypeValidator
 
         // [databind#2648], [databind#2653]: shire-core
         s.add("org.apache.shiro.realm.jndi.JndiRealmFactory");
         s.add("org.apache.shiro.jndi.JndiObjectFactory");
 
+        // [databind#2658]: ignite-jta (, quartz-core)
+        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
+        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
+        s.add("org.quartz.utils.JNDIConnectionProvider");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 
     /**
      * Set of class names of types that are never to be deserialized.

Fixed code: #2658: Block one more gadget type (ignite-jta)
        // [databind#2658]: ignite-jta (, quartz-core)
        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
        s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
        s.add("org.quartz.utils.JNDIConnectionProvider");
CVE-2020-24750: Deserialization of Untrusted Data (CWE-502)
value: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.1
Published: 2020-09-17T19:15Z
Repository: https://github.com/FasterXML/jackson-databind
Language: Other
Files changed: release-notes/VERSION-2.x
Commit date: 2020-09-18 10:17:24 -0700
Commit message: Add cve id for #2798

Diff: diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index 55fd50aec7..6a13e3ff79 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -9,11 +9,11 @@ Project: jackson-databind
 #2854: Block one more gadget type (javax.swing, CVE-2020-xxx)
  (reported by Yangkun(ICSL))
 
 2.9.10.6 (24-Aug-2020)
 
-#2798: Block one more gadget type (xxx, CVE-xxxx-xxx)
+#2798: Block one more gadget type (com.pastdev.httpcomponents, CVE-2020-24750)
  (reported by Al1ex@knownsec)
 #2814: Block one more gadget type (Anteros-DBCP, CVE-2020-24616)
  (reported by ChenZhaojun)
 #2826: Block one more gadget type (xxx, CVE-xxxx-xxx)
  (reported by ChenZhaojun)

Vulnerable code: #2798: Block one more gadget type (xxx, CVE-xxxx-xxx)
Fixed code: #2798: Block one more gadget type (com.pastdev.httpcomponents, CVE-2020-24750)
CVE-2022-0515: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2022-03-21T19:15Z
Repository: https://github.com/crater-invoice/crater
Language: PHP
Files changed: routes/web.php
Commit date: 2022-02-11 09:39:11 +0530
Commit message: changed route method

Diff: diff --git a/routes/web.php b/routes/web.php
index 0e254368..7cb68846 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -40,11 +40,11 @@ Route::get('/modules/scripts/{script}', ScriptController::class);
 // Admin Auth
 // ----------------------------------------------
 
 Route::post('login', [LoginController::class, 'login']);
 
-Route::get('auth/logout', function () {
+Route::post('auth/logout', function () {
     Auth::guard('web')->logout();
 });
 
 
 // Customer auth

Vulnerable code: Route::get('auth/logout', function () {
Fixed code: Route::post('auth/logout', function () {
CVE-2022-1033: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.8
Published: 2022-03-23T08:15Z
Repository: https://github.com/crater-invoice/crater
Language: PHP
Files changed: app/Http/Requests/UploadExpenseReceiptRequest.php
Commit date: 2022-03-22 16:58:55 +0530
Commit message: Expense attachment validation fix (#855)

https://huntr.dev/bounties/4d7d4fc9-e0cf-42d3-b89c-6ea57a769045/
Diff: diff --git a/app/Http/Requests/UploadExpenseReceiptRequest.php b/app/Http/Requests/UploadExpenseReceiptRequest.php
index 5a605e12..2e79e79f 100644
--- a/app/Http/Requests/UploadExpenseReceiptRequest.php
+++ b/app/Http/Requests/UploadExpenseReceiptRequest.php
@@ -23,11 +23,11 @@ class UploadExpenseReceiptRequest extends FormRequest
      * @return array
      */
     public function rules()
     {
         return [
-            'upload_receipt' => [
+            'attachment_receipt' => [
                 'nullable',
                 new Base64Mime(['gif', 'jpg', 'png'])
             ]
         ];
     }

Vulnerable code:             'upload_receipt' => [
Fixed code:             'attachment_receipt' => [
CVE-2011-5098: Permissions, Privileges, and Access Controls (CWE-264)
value: chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-08-08T10:26Z
Repository: https://github.com/opscode/chef
Language: Ruby
Files changed: chef-server-api/app/controllers/clients.rb
Commit date: 2011-10-29 19:08:47 -0700
Commit message: CHEF-2649: Only allow admin clients to create admins (not validators)

Diff: diff --git a/chef-server-api/app/controllers/clients.rb b/chef-server-api/app/controllers/clients.rb
index 81ca0c9ba..efa2b4a3d 100644
--- a/chef-server-api/app/controllers/clients.rb
+++ b/chef-server-api/app/controllers/clients.rb
@@ -47,17 +47,17 @@ class Clients < Application
   # POST /clients
   def create
     exists = true 
     if params.has_key?(:inflated_object)
       params[:name] ||= params[:inflated_object].name
-      # We can only get here if we're admin or the validator. Only
-      # allow creating admin clients if we're already an admin.
-      if @auth_user.admin
-        params[:admin] ||= params[:inflated_object].admin
-      else
-        params[:admin] = false
-      end
+      params[:admin] ||= params[:inflated_object].admin
+    end
+
+    # We can only create clients if we're the admin or the validator.
+    # But only allow creating admin clients if we're already an admin.
+    if params[:admin] == true && @auth_user.admin != true
+      raise Forbidden, "You are not allowed to take this action."
     end
 
     begin
       Chef::ApiClient.cdb_load(params[:name])
     rescue Chef::Exceptions::CouchDBNotFound

Vulnerable code:       # We can only get here if we're admin or the validator. Only
      # allow creating admin clients if we're already an admin.
      if @auth_user.admin
        params[:admin] ||= params[:inflated_object].admin
      else
        params[:admin] = false
      end
Fixed code:       params[:admin] ||= params[:inflated_object].admin
    end

    # We can only create clients if we're the admin or the validator.
    # But only allow creating admin clients if we're already an admin.
    if params[:admin] == true && @auth_user.admin != true
      raise Forbidden, "You are not allowed to take this action."
CVE-2021-37710: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-08-16T23:15Z
Repository: https://github.com/shopware/platform
Language: Other
Files changed: public/.htaccess.dist
Commit date: 2021-08-02 16:28:57 +0200
Commit message: NEXT-15677 - Fix XSS for SVG files

Diff: diff --git a/public/.htaccess.dist b/public/.htaccess.dist
index c81ffef81e5..62601e581c2 100644
--- a/public/.htaccess.dist
+++ b/public/.htaccess.dist
@@ -34,11 +34,11 @@ DirectoryIndex index.php
         RedirectMatch 302 ^/$ /index.php/
     </IfModule>
 </IfModule>
 
 <IfModule mod_headers.c>
-    <FilesMatch "\.svg$">
+    <FilesMatch "\.(?i:svg)$">
         Header set Content-Security-Policy "script-src 'none'"
     </FilesMatch>
 </IfModule>
 
 # END Shopware

Vulnerable code:     <FilesMatch "\.svg$">
Fixed code:     <FilesMatch "\.(?i:svg)$">
CVE-2022-27475: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-13T12:15Z
Repository: https://github.com/tramyardg/hotel-mgmt-system
Language: PHP
Files changed: app/Util.php
Commit date: 2022-03-27 22:47:33 -0400
Commit message: + sanitize xss function

Diff: diff --git a/app/Util.php b/app/Util.php
index bda28cd..dc9fd9e 100644
--- a/app/Util.php
+++ b/app/Util.php
@@ -34,6 +34,13 @@ class Util
           <h4 class="alert-heading">' . $message["heading"] . '</h4>
           <p>' . $message["content"] . '</p><hr>
           <p class="mb-0">' . $message["footer"] . '</p>
         </div>';
     }
+
+    public static function sanitize_xss($value) 
+    {
+      return htmlspecialchars(strip_tags($value));
+    }
+      
+  
 }

Fixed code: 
    public static function sanitize_xss($value) 
    {
      return htmlspecialchars(strip_tags($value));
    }
CVE-2021-32659: Missing Authentication for Critical Function (CWE-306)
value: Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 4.9
Published: 2021-06-16T19:15Z
Repository: https://github.com/matrix-org/matrix-appservice-bridge
Language: TypeScript
Files changed: src/components/room-upgrade-handler.ts
Commit date: 2021-05-28 10:32:25 +0100
Commit message: Check m.room.create event on room upgrade

Diff: diff --git a/src/components/room-upgrade-handler.ts b/src/components/room-upgrade-handler.ts
index 2a4237b..7f62ca7 100644
--- a/src/components/room-upgrade-handler.ts
+++ b/src/components/room-upgrade-handler.ts
@@ -143,10 +143,17 @@ export class RoomUpgradeHandler {
     }
 
     private async onJoinedNewRoom(oldRoomId: string, newRoomId: string) {
         log.debug(`Joined ${newRoomId}`);
         const intent = this.bridge.getIntent();
+        const { predecessor } = await intent.getStateEvent(newRoomId, 'm.room.create');
+        if (predecessor.room_id !== oldRoomId) {
+            log.error(
+    `Room doesn't have a matching predecessor (expected: ${oldRoomId}, got: ${predecessor.room_id}), not bridging.`
+            );
+            return false;
+        }
         const asBot = this.bridge.getBot();
         if (this.opts.migrateStoreEntries) {
             const success = await this.migrateStoreEntries(oldRoomId, newRoomId);
             if (!success) {
                 log.error("Failed to migrate room entries. Not continuing with migration.");

Fixed code:         const { predecessor } = await intent.getStateEvent(newRoomId, 'm.room.create');
        if (predecessor.room_id !== oldRoomId) {
            log.error(
    `Room doesn't have a matching predecessor (expected: ${oldRoomId}, got: ${predecessor.room_id}), not bridging.`
            );
            return false;
        }
CVE-2023-38691: Improper Authentication (CWE-287)
value: matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when using the provisioning API. The library does not check that the servername part of the `sub` parameter (containing the user's *claimed* MXID) is the the same as the servername we are talking to. A malicious actor could spin up a server on any given domain, respond with a `sub` parameter according to the user they want to act as and use the resulting token to perform provisioning requests. Versions 8.1.2 and 9.0.1 contain a patch. As a workaround, disable the provisioning API.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 6.5
Published: 2023-08-04T17:15Z
Repository: https://github.com/matrix-org/matrix-appservice-bridge
Language: TypeScript
Files changed: src/provisioning/api.ts
Commit date: 2023-07-31 09:48:56 +0200
Commit message: Merge pull request from GHSA-vc7j-h8xg-fv5x

* Refuse to accept foreign users in OpenID responses

* Make sure we correctly handle server names with colons in them

---------

Co-authored-by: Tadeusz Sośnierz <tadeusz@sosnierz.com>
Diff: diff --git a/src/provisioning/api.ts b/src/provisioning/api.ts
index 80f3a6d..d3cfce8 100644
--- a/src/provisioning/api.ts
+++ b/src/provisioning/api.ts
@@ -386,10 +386,20 @@ export class ProvisioningApi {
             if (!response.data.sub) {
                 log.warn(`Server responded with invalid sub information for ${server}`, response.data);
                 throw new ApiError("Server did not respond with the correct sub information", ErrCode.BadOpenID);
             }
             const userId = response.data.sub;
+
+            const mxidMatch = userId.match(/([^:]+):(.+)/);
+            if (!mxidMatch) {
+                throw new ApiError("Server did not respond with a valid MXID", ErrCode.BadOpenID);
+            }
+            const [, _localpart, serverName] = mxidMatch;
+            if (serverName !== server) {
+                throw new ApiError("Server returned a MXID belonging to another homeserver", ErrCode.BadOpenID);
+            }
+
             const token = this.widgetTokenPrefix + uuid().replace(/-/g, "");
             const expiresTs = Date.now() + this.widgetTokenLifetimeMs;
             await this.store.createSession({
                 userId,
                 token,

Fixed code: 
            const mxidMatch = userId.match(/([^:]+):(.+)/);
            if (!mxidMatch) {
                throw new ApiError("Server did not respond with a valid MXID", ErrCode.BadOpenID);
            }
            const [, _localpart, serverName] = mxidMatch;
            if (serverName !== server) {
                throw new ApiError("Server returned a MXID belonging to another homeserver", ErrCode.BadOpenID);
            }
CVE-2014-3741: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2017-10-23T18:29Z
Repository: https://github.com/tojocky/node-printer
Language: JavaScript
Files changed: lib/printer.js
Commit date: 2013-06-28 14:30:28 -0400
Commit message: Removed possible command injection

Diff: diff --git a/lib/printer.js b/lib/printer.js
index a184034..6cb06da 100644
--- a/lib/printer.js
+++ b/lib/printer.js
@@ -91,11 +91,11 @@ function printDirect(parameters){
 			error(e);
 		}
     }else if (!printer_helper.printDirect){// should be POSIX
         var temp_file_name = path.join(os.tmpDir(),"printing");
         fs.writeFileSync(temp_file_name, data);
-        child_process.exec('lpr -P'+printer+' -oraw -r'+' '+temp_file_name, function(err, stdout, stderr){
+        child_process.execFile('lpr', ['-P' + printer, '-oraw', '-r', temp_file_name], function(err, stdout, stderr){
             if (err !== null) {
                 error('ERROR: ' + err);
                 return;
             }
             if (stderr) {

Vulnerable code:         child_process.exec('lpr -P'+printer+' -oraw -r'+' '+temp_file_name, function(err, stdout, stderr){
Fixed code:         child_process.execFile('lpr', ['-P' + printer, '-oraw', '-r', temp_file_name], function(err, stdout, stderr){
CVE-2022-21669: Use of Hard-coded Credentials (CWE-798)
value: PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of publication, the maintainers are planning to update code to reflect this change at a later date.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 7.5
Published: 2022-01-11T15:15Z
Repository: https://github.com/PuddingBot/pudding-bot
Language: Unknown
Commit date: 2022-01-21 11:10:34 +0100
Commit message: Merge pull request #15 from PuddingBot/CVE-2022-21669

CVE-2022-21669

Remove exposed bot token and integrate with gitleaks as a pre-commit hook
to prevent future security leaks.
CVE-2017-20170: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in ollpu parontalli. It has been classified as critical. Affected is an unknown function of the file httpdocs/index.php. The manipulation of the argument s leads to sql injection. The patch is identified as 6891bb2dec57dca6daabc15a6d2808c8896620e5. It is recommended to apply a patch to fix this issue. VDB-218418 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-17T14:15Z
Repository: https://github.com/ollpu/parontalli
Language: PHP
Files changed: httpdocs/index.php
Commit date: 2017-01-21 21:11:39 +0200
Commit message: Fix SQL-injection vulnerability in page identifier parameter

Well that's embarrassing...

Diff: diff --git a/httpdocs/index.php b/httpdocs/index.php
index 267a6d0..f91beb6 100644
--- a/httpdocs/index.php
+++ b/httpdocs/index.php
@@ -10,11 +10,14 @@ include $rel."db.php";
 $haku_fp = mysqli_query($yht, "SELECT * FROM `sivut` LIMIT 1");
 $fprow = mysqli_fetch_assoc($haku_fp);
 
 
 //Go to first page in order (front page) if ?s argument is not set
-if(!isset($_GET["s"]))	{$_GET['s'] = $fprow['uid'];}
+if(!isset($_GET["s"])) {$_GET['s'] = $fprow['uid'];}
+else {
+  $_GET['s'] = mysqli_real_escape_string($yht, $_GET['s']);
+}
 
 
 $haku_s = mysqli_query($yht, "SELECT * FROM `sivut` WHERE uid = '".$_GET['s']."' LIMIT 1");
 
 

Vulnerable code: if(!isset($_GET["s"]))	{$_GET['s'] = $fprow['uid'];}
Fixed code: if(!isset($_GET["s"])) {$_GET['s'] = $fprow['uid'];}
else {
  $_GET['s'] = mysqli_real_escape_string($yht, $_GET['s']);
}