Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-16876: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-12-29T15:29Z
Repository: https://github.com/lepture/mistune
Language: Python
Files changed: mistune.py
Commit date: 2017-11-21 00:15:09 +0900
Commit message: Fix CVE-2017-16876

Diff: diff --git a/mistune.py b/mistune.py
index d6ecf7e..5b05fcb 100644
--- a/mistune.py
+++ b/mistune.py
@@ -9,11 +9,11 @@
 """
 
 import re
 import inspect
 
-__version__ = '0.8'
+__version__ = '0.8.1'
 __author__ = 'Hsiaoming Yang <me@lepture.com>'
 __all__ = [
     'BlockGrammar', 'BlockLexer',
     'InlineGrammar', 'InlineLexer',
     'Renderer', 'Markdown',
@@ -46,11 +46,12 @@ def _pure_pattern(regex):
         pattern = pattern[1:]
     return pattern
 
 
 def _keyify(key):
-    return _key_pattern.sub(' ', key.lower())
+    key = escape(key.lower(), quote=True)
+    return _key_pattern.sub(' ', key)
 
 
 def escape(text, quote=False, smart_amp=True):
     """Replace special characters "&", "<" and ">" to HTML-safe sequences.
 
@@ -443,11 +444,12 @@ class InlineGrammar(object):
 
     escape = re.compile(r'^\\([\\`*{}\[\]()#+\-.!_>~|])')  # \* \+ \! ....
     inline_html = re.compile(
         r'^(?:%s|%s|%s)' % (
             r'<!--[\s\S]*?-->',
-            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (_valid_end, _valid_attr),
+            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (
+                _valid_end, _valid_attr),
             r'<\w+%s(?:%s)*?\s*\/?>' % (_valid_end, _valid_attr),
         )
     )
     autolink = re.compile(r'^<([^ >]+(@|:)[^ >]+)>')
     link = re.compile(

Vulnerable code: __version__ = '0.8'
    return _key_pattern.sub(' ', key.lower())
            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (_valid_end, _valid_attr),
Fixed code: __version__ = '0.8.1'
    key = escape(key.lower(), quote=True)
    return _key_pattern.sub(' ', key)
            r'<(\w+%s)((?:%s)*?)\s*>([\s\S]*?)<\/\1>' % (
                _valid_end, _valid_attr),
CVE-2022-21159: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2022-04-15T16:15Z
Repository: https://github.com/mz-automation/libiec61850
Language: C
Files changed: src/mms/iso_presentation/iso_presentation.c
Commit date: 2022-02-25 18:21:45 +0100
Commit message: - fixed - Bug in presentation layer parser can cause infinite loop (LIB61850-302)

Diff: diff --git a/src/mms/iso_presentation/iso_presentation.c b/src/mms/iso_presentation/iso_presentation.c
index 96fd8a3..e2ee12a 100644
--- a/src/mms/iso_presentation/iso_presentation.c
+++ b/src/mms/iso_presentation/iso_presentation.c
@@ -467,10 +467,14 @@ parseNormalModeParameters(IsoPresentation* self, uint8_t* buffer, int totalLengt
 
         case 0xa4: /* presentation-context-definition list */
             if (DEBUG_PRES)
                 printf("PRES: pcd list\n");
             bufPos = parsePresentationContextDefinitionList(self, buffer, len, bufPos);
+
+            if (bufPos < 0)
+                return -1;
+
             break;
 
         case 0xa5: /* context-definition-result-list */
 
             bufPos += len;

Fixed code: 
            if (bufPos < 0)
                return -1;
CVE-2014-2829: Permissions, Privileges, and Access Controls (CWE-264)
value: Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-04-11T01:55Z
Repository: https://github.com/esl/MongooseIM
Language: Unknown
Commit date: 2014-04-09 15:05:37 +0200
Commit message: Merge pull request #167 from esl/zlib_cwe400_fix

Add zlib inflated data size limit
CVE-2020-15084: Incorrect Authorization (CWE-863)
value: In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 9.1
Published: 2020-06-30T16:15Z
Repository: https://github.com/auth0/express-jwt
Language: Unknown
Commit date: 2020-06-29 16:36:49 -0300
Commit message: Merge pull request from GHSA-6g6m-m6h5-w9gf

Made algorithms mandatory
CVE-2016-7150: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-01-18T17:59Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: skins_site/_site_body_header.inc.php
Commit date: 2016-08-12 18:24:55 +0300
Commit message: Fix XSS vulnerability on "site name"

Diff: diff --git a/skins_site/_site_body_header.inc.php b/skins_site/_site_body_header.inc.php
index 70e3c21796..99e63b9a90 100644
--- a/skins_site/_site_body_header.inc.php
+++ b/skins_site/_site_body_header.inc.php
@@ -15,12 +15,12 @@ global $baseurl, $Settings;
 <nav class="sitewide_header">
 
 <?php
 if( $Settings->get( 'notification_logo' ) != '' )
 {
-	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.$Settings->get( 'notification_long_name' ).'"' : '';
-	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.$Settings->get( 'notification_short_name' ).'"'.$site_title.' />';
+	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.format_to_output( $Settings->get( 'notification_long_name' ), 'htmlattr' ).'"' : '';
+	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.format_to_output( $Settings->get( 'notification_short_name' ), 'htmlattr' ).'"'.$site_title.' />';
 	$site_title_class = ' swhead_logo';
 }
 else
 {
 	$site_name_text = $Settings->get( 'notification_short_name' );

Vulnerable code: 	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.$Settings->get( 'notification_long_name' ).'"' : '';
	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.$Settings->get( 'notification_short_name' ).'"'.$site_title.' />';
Fixed code: 	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.format_to_output( $Settings->get( 'notification_long_name' ), 'htmlattr' ).'"' : '';
	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.format_to_output( $Settings->get( 'notification_short_name' ), 'htmlattr' ).'"'.$site_title.' />';
CVE-2016-8901: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2019-05-23T18:29Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: htsrv/call_plugin.php
Commit date: 2016-10-03 10:40:07 +0300
Commit message: Fix object injection vulnerability

Diff: diff --git a/htsrv/call_plugin.php b/htsrv/call_plugin.php
index 919c8e7106..542df0d16f 100644
--- a/htsrv/call_plugin.php
+++ b/htsrv/call_plugin.php
@@ -34,11 +34,11 @@ if( is_null( $params ) )
 {	// Use empty array by default if params are not sent by request:
 	$params = array();
 }
 else
 {	// Params given:
-	if( ( substr( $params, 0, 2 ) == 'a:' ) && ( ! preg_match( '/(;|{|})O:\+?[0-9]+:"/', $params ) ) )
+	if( ( substr( $params, 0, 2 ) == 'a:' ) && ( ! preg_match( '/(s:\d+:"[^"]*"|i:\d+)(;|{|})O:\+?[0-9]+:"/', $params ) ) )
 	{	// Allow to unserialize only arrays + check there is no Object in the array (We NEVER want to unserialize an object)
 		// (This may result in "false", but this means that unserializing failed)
 		$params = @unserialize( $params );
 	}
 	else

Vulnerable code: 	if( ( substr( $params, 0, 2 ) == 'a:' ) && ( ! preg_match( '/(;|{|})O:\+?[0-9]+:"/', $params ) ) )
Fixed code: 	if( ( substr( $params, 0, 2 ) == 'a:' ) && ( ! preg_match( '/(s:\d+:"[^"]*"|i:\d+)(;|{|})O:\+?[0-9]+:"/', $params ) ) )
CVE-2016-8901: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2019-05-23T18:29Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: htsrv/call_plugin.php
Commit date: 2016-09-28 07:23:33 +0300
Commit message: Fix object injection vulnerability

Diff: diff --git a/htsrv/call_plugin.php b/htsrv/call_plugin.php
index 1b18e47f84..044d48c703 100644
--- a/htsrv/call_plugin.php
+++ b/htsrv/call_plugin.php
@@ -28,17 +28,25 @@ param( 'plugin_ID', 'integer', true );
 // instead of calling handle_htsrv_action() all the time
 // and letting the plugin deal with its methods internally.
 param( 'method', 'string', '' );
 param( 'params', 'string', null ); // serialized
 
-if( is_null($params) )
-{ // Default:
+if( is_null( $params ) )
+{	// Use empty array by default if params are not sent by request:
 	$params = array();
 }
 else
-{ // params given. This may result in "false", but this means that unserializing failed.
-	$params = @unserialize($params);
+{	// Params given:
+	if( substr( $params, 0, 2 ) == 'a:' )
+	{	// Allow to unserialize only arrays, to avoid object injection vulnerability:
+		// (This may result in "false", but this means that unserializing failed)
+		$params = @unserialize( $params );
+	}
+	else
+	{	// Restrict all non array params to empty array:
+		$params = array();
+	}
 }
 
 
 if( $plugin_ID )
 {

Vulnerable code: if( is_null($params) )
{ // Default:
{ // params given. This may result in "false", but this means that unserializing failed.
	$params = @unserialize($params);
Fixed code: if( is_null( $params ) )
{	// Use empty array by default if params are not sent by request:
{	// Params given:
	if( substr( $params, 0, 2 ) == 'a:' )
	{	// Allow to unserialize only arrays, to avoid object injection vulnerability:
		// (This may result in "false", but this means that unserializing failed)
		$params = @unserialize( $params );
	}
	else
	{	// Restrict all non array params to empty array:
		$params = array();
	}
CVE-2017-5480: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2017-01-15T22:59Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: inc/files/files.ctrl.php
Commit date: 2017-01-15 16:31:00 +0800
Commit message: Fixed fm_selected parameter exploit

Diff: diff --git a/inc/files/files.ctrl.php b/inc/files/files.ctrl.php
index 66a473a5b8..e7ecda94e8 100644
--- a/inc/files/files.ctrl.php
+++ b/inc/files/files.ctrl.php
@@ -341,12 +341,19 @@ $Debuglog->add( count($fm_selected).' selected files/directories', 'files' );
  * The selected files (must be within current fileroot)
  *
  * @global Filelist
  */
 $selected_Filelist = new Filelist( $fm_FileRoot, $ads_list_path );
+
+// Prevent directory traversal using '..'
+$re = '/\/?\.\.\/+/';
 foreach( $fm_selected as $l_source_path )
 {
+	if( preg_match( $re, $l_source_path ) )
+	{
+		debug_die( 'Invalid fm_selected parameter value' );
+	}
 	$selected_Filelist->add_by_subpath( urldecode($l_source_path), true );
 }
 
 
 /*

Fixed code: 
// Prevent directory traversal using '..'
$re = '/\/?\.\.\/+/';
	if( preg_match( $re, $l_source_path ) )
	{
		debug_die( 'Invalid fm_selected parameter value' );
	}
CVE-2017-5539: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2017-01-23T07:59Z
Repository: https://github.com/b2evolution/b2evolution
Language: Unknown
Commit date: 2017-01-19 17:14:27 +0100
Commit message: Merge branch 'develop'
CVE-2020-24654: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 3.3
Published: 2020-09-02T17:15Z
Repository: https://github.com/KDE/ark
Language: C++
Files changed: plugins/libarchive/libarchiveplugin.cpp
Commit date: 2020-08-27 21:47:49 +0200
Commit message: Pass the ARCHIVE_EXTRACT_SECURE_SYMLINKS flag to libarchive

There are archive types which allow to first create a symlink and then
later on dereference it. If the symlink points outside of the archive,
this results in writing outside of the destination directory.

With the ARCHIVE_EXTRACT_SECURE_SYMLINKS option set, libarchive avoids
this situation by verifying that none of the target path components are
symlinks before writing.

Remove the commented out code in the method, which would actually
misbehave if enabled again.

Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de>

Diff: diff --git a/plugins/libarchive/libarchiveplugin.cpp b/plugins/libarchive/libarchiveplugin.cpp
index 50e81da1..8a0fed21 100644
--- a/plugins/libarchive/libarchiveplugin.cpp
+++ b/plugins/libarchive/libarchiveplugin.cpp
@@ -507,25 +507,13 @@ void LibarchivePlugin::emitEntryFromArchiveEntry(struct archive_entry *aentry)
     m_emittedEntries << e;
 }
 
 int LibarchivePlugin::extractionFlags() const
 {
-    int result = ARCHIVE_EXTRACT_TIME;
-    result |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
-
-    // TODO: Don't use arksettings here
-    /*if ( ArkSettings::preservePerms() )
-    {
-        result &= ARCHIVE_EXTRACT_PERM;
-    }
-
-    if ( !ArkSettings::extractOverwrite() )
-    {
-        result &= ARCHIVE_EXTRACT_NO_OVERWRITE;
-    }*/
-
-    return result;
+    return ARCHIVE_EXTRACT_TIME
+           | ARCHIVE_EXTRACT_SECURE_NODOTDOT
+           | ARCHIVE_EXTRACT_SECURE_SYMLINKS;
 }
 
 void LibarchivePlugin::copyData(const QString& filename, struct archive *dest, bool partialprogress)
 {
     char buff[10240];

Vulnerable code:     int result = ARCHIVE_EXTRACT_TIME;
    result |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;

    // TODO: Don't use arksettings here
    /*if ( ArkSettings::preservePerms() )
    {
        result &= ARCHIVE_EXTRACT_PERM;
    }

    if ( !ArkSettings::extractOverwrite() )
    {
        result &= ARCHIVE_EXTRACT_NO_OVERWRITE;
    }*/

    return result;
Fixed code:     return ARCHIVE_EXTRACT_TIME
           | ARCHIVE_EXTRACT_SECURE_NODOTDOT
           | ARCHIVE_EXTRACT_SECURE_SYMLINKS;
CVE-2014-0177: Cryptographic Issues (CWE-310)
value: The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2014-05-27T14:55Z
Repository: https://github.com/github/hub
Language: Ruby
Files changed: lib/hub/commands.rb, lib/hub/context.rb
Commit date: 2014-04-15 19:04:30 +0200
Commit message: Use non-predictable filename for downloaded patch file

Since the /tmp directory is readable by everybody on Unix, and since
the patch name could be public or easy to guess, a attacker could create a symlink
to a file writable by the user running hub, which would be replaced by the patch.

This has been assigned CVE-2014-0177

Diff: diff --git a/lib/hub/commands.rb b/lib/hub/commands.rb
index f24e6f3..4b55529 100644
--- a/lib/hub/commands.rb
+++ b/lib/hub/commands.rb
@@ -517,11 +517,11 @@ module Hub
           else
             raise ArgumentError, url
           end
         end
 
-        patch_file = File.join(tmp_dir, patch_name)
+        patch_file = Tempfile.new('patch_name')
         File.open(patch_file, 'w') { |file| file.write(patch) }
         args[idx] = patch_file
       end
     end
 
diff --git a/lib/hub/context.rb b/lib/hub/context.rb
index a41fcbb..46c4c41 100644
--- a/lib/hub/context.rb
+++ b/lib/hub/context.rb
@@ -554,14 +554,10 @@ module Hub
       # Returns a Boolean.
       def command?(name)
         !which(name).nil?
       end
 
-      def tmp_dir
-        ENV['TMPDIR'] || ENV['TEMP'] || '/tmp'
-      end
-
       def terminal_width
         if unix?
           width = %x{stty size 2>#{NULL}}.split[1].to_i
           width = %x{tput cols 2>#{NULL}}.to_i if width.zero?
         else

Vulnerable code:         patch_file = File.join(tmp_dir, patch_name)
      def tmp_dir
        ENV['TMPDIR'] || ENV['TEMP'] || '/tmp'
      end

Fixed code:         patch_file = Tempfile.new('patch_name')
CVE-2024-3651: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2024-07-07T18:15Z
Repository: https://github.com/kjd/idna
Language: Python
Files changed: HISTORY.rst, LICENSE.md, idna/package_data.py
Commit date: 2024-04-10 20:30:58 -0700
Commit message: Release v3.7

Diff: diff --git a/HISTORY.rst b/HISTORY.rst
index eea8a70..76dc8bc 100644
--- a/HISTORY.rst
+++ b/HISTORY.rst
@@ -1,10 +1,18 @@
 .. :changelog:
 
 History
 -------
 
+3.7 (2024-04-11)
+++++++++++++++++
+
+- Fix issue where specially crafted inputs to encode() could
+  take exceptionally long amount of time to process. [CVE-2024-3651]
+
+Thanks to Guido Vranken for reporting the issue.
+
 3.6 (2023-11-25)
 ++++++++++++++++
 
 - Fix regression to include tests in source distribution.
 
diff --git a/LICENSE.md b/LICENSE.md
index ce36701..19b6b45 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -1,8 +1,8 @@
 BSD 3-Clause License
 
-Copyright (c) 2013-2023, Kim Davies and contributors.
+Copyright (c) 2013-2024, Kim Davies and contributors.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
diff --git a/idna/package_data.py b/idna/package_data.py
index c5b7220..ed81113 100644
--- a/idna/package_data.py
+++ b/idna/package_data.py
@@ -1,2 +1,2 @@
-__version__ = '3.6'
+__version__ = '3.7'
 

Vulnerable code: Copyright (c) 2013-2023, Kim Davies and contributors.
__version__ = '3.6'
Fixed code: 3.7 (2024-04-11)

- Fix issue where specially crafted inputs to encode() could
  take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Copyright (c) 2013-2024, Kim Davies and contributors.
__version__ = '3.7'
CVE-2024-29900: Insufficient Information (NVD-CWE-noinfo)
value: Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory _could_ contain sensitive information such as environment variables, secrets files, etc. This issue is patched in 18.3.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-29T16:15Z
Repository: https://github.com/electron/packager
Language: TypeScript
Files changed: src/resedit.ts
Commit date: 2024-03-28 09:26:41 -0700
Commit message: fix: do not deref the integrity buffer (#1699)


Diff: diff --git a/src/resedit.ts b/src/resedit.ts
index aa9c503..b517da2 100644
--- a/src/resedit.ts
+++ b/src/resedit.ts
@@ -114,14 +114,19 @@ export async function resedit(exePath: string, options: ExeMetadata) {
   // Output version info
   versionInfo[0].outputToResourceEntries(res.entries);
 
   // Asar Integrity
   if (options.asarIntegrity) {
+    const integrityList = Object.keys(options.asarIntegrity).map((file) => ({
+      file,
+      alg: options.asarIntegrity![file].algorithm,
+      value: options.asarIntegrity![file].hash,
+    }));
     res.entries.push({
-      type: 'Integrity',
-      id: 'ElectronAsar',
-      bin: Buffer.from(JSON.stringify(options.asarIntegrity)).buffer,
+      type: 'INTEGRITY',
+      id: 'ELECTRONASAR',
+      bin: Buffer.from(JSON.stringify(integrityList), 'utf-8'),
       lang: languageInfo[0].lang,
       codepage: languageInfo[0].codepage,
     });
   }
 

Vulnerable code:       type: 'Integrity',
      id: 'ElectronAsar',
      bin: Buffer.from(JSON.stringify(options.asarIntegrity)).buffer,
Fixed code:     const integrityList = Object.keys(options.asarIntegrity).map((file) => ({
      file,
      alg: options.asarIntegrity![file].algorithm,
      value: options.asarIntegrity![file].hash,
    }));
      type: 'INTEGRITY',
      id: 'ELECTRONASAR',
      bin: Buffer.from(JSON.stringify(integrityList), 'utf-8'),
CVE-2014-8351: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in info.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz before 1.0.1 allows remote web servers to execute arbitrary SQL commands via the domain parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-11-06T15:55Z
Repository: https://github.com/LaboCNIL/CookieViz
Language: PHP
Files changed: cookieviz/info.php, cookieviz/json.php
Commit date: 2014-11-04 11:30:34 +0100
Commit message: Patch vulnerabilities

Patch vulnerabilities :
CVE-2014-8352
CVE-2014-8351

Diff: diff --git a/cookieviz/info.php b/cookieviz/info.php
index 9344255..84cffba 100755
--- a/cookieviz/info.php
+++ b/cookieviz/info.php
@@ -1,6 +1,6 @@
-<?php
+﻿<?php
 /*Copyright (c) 2013, Stéphane Petitcolas
 This file is part of CookieViz
 
 CookieViz is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -18,12 +18,18 @@ along with CookieViz.  If not, see <http://www.gnu.org/licenses/>.
 
 require "connect.php";
 
 if(isset($_GET["domain"]))
 {
-	$domain = $_GET["domain"];
+	$domain = mysql_real_escape_string($_GET["domain"]);
+	
 }
+else
+{
+	exit;
+}
+
 echo '<table id="infos">';
  echo "<thead>";
  echo "<tr>";
  echo "<th>From</th>";
  echo "<th>To</th>";
diff --git a/cookieviz/json.php b/cookieviz/json.php
index d9b9147..7b5d5e2 100755
--- a/cookieviz/json.php
+++ b/cookieviz/json.php
@@ -21,16 +21,20 @@ require "load_point.php";
 $domain="";
 $init_max_date=0;
 
 if(isset($_GET["max_date"]))
 {
-	$init_max_date = $_GET["max_date"];
+	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
+	if (!is_numeric($init_max_date))
+	{
+		$init_max_date="";
+	}
 }
 
 if(isset($_GET["domain"]))
 {
-	$domain = $_GET["domain"];
+	$domain = mysql_real_escape_string($_GET["domain"]);
 }
 
 $max_date = $init_max_date;
 $point_map = new point_map($domain);
 $map = $point_map->get_map();

Vulnerable code: <?php
	$domain = $_GET["domain"];
	$init_max_date = $_GET["max_date"];
	$domain = $_GET["domain"];
Fixed code: ﻿<?php
	$domain = mysql_real_escape_string($_GET["domain"]);
	
else
{
	exit;
}

	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
	if (!is_numeric($init_max_date))
	{
		$init_max_date="";
	}
	$domain = mysql_real_escape_string($_GET["domain"]);
CVE-2014-8352: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in json.php in French National Commission on Informatics and Liberty (aka CNIL) CookieViz allows remote we servers to inject arbitrary web script or HTML via the max_date parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-06T15:55Z
Repository: https://github.com/LaboCNIL/CookieViz
Language: PHP
Files changed: cookieviz/info.php, cookieviz/json.php
Commit date: 2014-11-04 11:30:34 +0100
Commit message: Patch vulnerabilities

Patch vulnerabilities :
CVE-2014-8352
CVE-2014-8351

Diff: diff --git a/cookieviz/info.php b/cookieviz/info.php
index 9344255..84cffba 100755
--- a/cookieviz/info.php
+++ b/cookieviz/info.php
@@ -1,6 +1,6 @@
-<?php
+﻿<?php
 /*Copyright (c) 2013, Stéphane Petitcolas
 This file is part of CookieViz
 
 CookieViz is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -18,12 +18,18 @@ along with CookieViz.  If not, see <http://www.gnu.org/licenses/>.
 
 require "connect.php";
 
 if(isset($_GET["domain"]))
 {
-	$domain = $_GET["domain"];
+	$domain = mysql_real_escape_string($_GET["domain"]);
+	
 }
+else
+{
+	exit;
+}
+
 echo '<table id="infos">';
  echo "<thead>";
  echo "<tr>";
  echo "<th>From</th>";
  echo "<th>To</th>";
diff --git a/cookieviz/json.php b/cookieviz/json.php
index d9b9147..7b5d5e2 100755
--- a/cookieviz/json.php
+++ b/cookieviz/json.php
@@ -21,16 +21,20 @@ require "load_point.php";
 $domain="";
 $init_max_date=0;
 
 if(isset($_GET["max_date"]))
 {
-	$init_max_date = $_GET["max_date"];
+	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
+	if (!is_numeric($init_max_date))
+	{
+		$init_max_date="";
+	}
 }
 
 if(isset($_GET["domain"]))
 {
-	$domain = $_GET["domain"];
+	$domain = mysql_real_escape_string($_GET["domain"]);
 }
 
 $max_date = $init_max_date;
 $point_map = new point_map($domain);
 $map = $point_map->get_map();

Vulnerable code: <?php
	$domain = $_GET["domain"];
	$init_max_date = $_GET["max_date"];
	$domain = $_GET["domain"];
Fixed code: ﻿<?php
	$domain = mysql_real_escape_string($_GET["domain"]);
	
else
{
	exit;
}

	$init_max_date = 	mysql_real_escape_string($_GET["max_date"]);
	if (!is_numeric($init_max_date))
	{
		$init_max_date="";
	}
	$domain = mysql_real_escape_string($_GET["domain"]);
CVE-2018-1000041: Insufficient Information (NVD-CWE-noinfo)
value: GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2018-02-09T23:29Z
Repository: https://github.com/ImageMagick/librsvg
Language: C
Files changed: rsvg-io.c
Commit date: 2017-11-27 21:18:43 +0100
Commit message: Fixed possible credentials leaking reported by Alex Birsan.

Diff: diff --git a/rsvg-io.c b/rsvg-io.c
index 7452b73..6e68b6f 100644
--- a/rsvg-io.c
+++ b/rsvg-io.c
@@ -128,11 +128,11 @@ gchar *
 _rsvg_io_get_file_path (const gchar * filename,
                         const gchar * base_uri)
 {
     gchar *absolute_filename;
 
-    if (g_file_test (filename, G_FILE_TEST_EXISTS) || g_path_is_absolute (filename)) {
+    if (g_path_is_absolute (filename)) {
         absolute_filename = g_strdup (filename);
     } else {
         gchar *tmpcdir;
         gchar *base_filename;
 

Vulnerable code:     if (g_file_test (filename, G_FILE_TEST_EXISTS) || g_path_is_absolute (filename)) {
Fixed code:     if (g_path_is_absolute (filename)) {
CVE-2020-29074: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 8.8
Published: 2020-11-25T23:15Z
Repository: https://github.com/LibVNC/x11vnc
Language: C
Files changed: src/scan.c
Commit date: 2020-11-18 08:40:45 +0100
Commit message: scan: limit access to shared memory segments to current user

Diff: diff --git a/src/scan.c b/src/scan.c
index 43e00d2..12994d5 100644
--- a/src/scan.c
+++ b/src/scan.c
@@ -318,11 +318,11 @@ static int shm_create(XShmSegmentInfo *shm, XImage **ximg_ptr, int w, int h,
 
 	*ximg_ptr = xim;
 
 #if HAVE_XSHM
 	shm->shmid = shmget(IPC_PRIVATE,
-	    xim->bytes_per_line * xim->height, IPC_CREAT | 0777);
+	    xim->bytes_per_line * xim->height, IPC_CREAT | 0600);
 
 	if (shm->shmid == -1) {
 		rfbErr("shmget(%s) failed.\n", name);
 		rfbLogPerror("shmget");
 

Vulnerable code: 	    xim->bytes_per_line * xim->height, IPC_CREAT | 0777);
Fixed code: 	    xim->bytes_per_line * xim->height, IPC_CREAT | 0600);
CVE-2021-4286: Observable Discrepancy (CWE-203)
value: A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 7.5
Published: 2022-12-27T11:15Z
Repository: https://github.com/cocagne/pysrp
Language: Unknown
Commit date: 2021-02-01 10:15:45 -0600
Commit message: Merge pull request #43 from ddealmei/fix-srp-vuln

Fix side channel leaks
CVE-2022-4639: Use of Externally-Controlled Format String (CWE-134)
value: A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet Dumping Handler. The manipulation of the argument msg_info leads to format string. The attack may be initiated remotely. The name of the patch is b19f8a6046b080e4c2e28354a58556bb26040c6f. It is recommended to apply a patch to fix this issue. The identifier VDB-216497 was assigned to this vulnerability.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 9.8
Published: 2022-12-21T22:15Z
Repository: https://github.com/yrutschle/sslh
Language: C
Files changed: probe.c
Commit date: 2022-09-10 12:53:57 +0200
Commit message: fix possible format string exploit if packet dumping enabled

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

Diff: diff --git a/probe.c b/probe.c
index bef73af..da35d3d 100644
--- a/probe.c
+++ b/probe.c
@@ -114,11 +114,11 @@ void hexdump(msg_info msg_info, const char *mem, unsigned int len)
                 else /* other char */
                     str[c++] = '.';
             }
             str[c++] = '\n';
             str[c++] = 0;
-            print_message(msg_info, str);
+            print_message(msg_info, "%s", str);
             c = 0;
         }
     }
 }
 

Vulnerable code:             print_message(msg_info, str);
Fixed code:             print_message(msg_info, "%s", str);
CVE-2014-125079: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in agy pontifex.http. It has been declared as critical. This vulnerability affects unknown code of the file lib/Http.coffee. The manipulation leads to sql injection. Upgrading to version 0.1.0 is able to address this issue. The name of the patch is e52a758f96861dcef2dabfecb9da191bb2e07761. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218356.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T09:15Z
Repository: https://github.com/agy/pontifex.http
Language: Other
Files changed: lib/Http.coffee
Commit date: 2014-07-30 13:47:31 -0400
Commit message: Fixed SQL Injection Hole

Diff: diff --git a/lib/Http.coffee b/lib/Http.coffee
index d089d5e..0442cbc 100644
--- a/lib/Http.coffee
+++ b/lib/Http.coffee
@@ -24,11 +24,11 @@ Http = (Bridge,Url) =>
 			self.server.stats.push [ 'wrote_connection', req.url, req.session, domain, req.socket.bytesWritten, new Date().getTime()]
 			self.server.stats.push [ 'closed_connection', req.url, req.session, domain, "#{req.socket.remoteAddress}:#{req.socket.remotePort}", new Date().getTime()]
 			return
 		token = req.headers.authorization.match(/bearer (.*)/i)[1]
 		auth_req =
-			url: "http://auth.wot.io/authenticate_token/#{token}/#{command}/#{path}"
+			url: "http://auth.wot.io/authenticate_token/#{token}/#{command}/#{path}".replace("'", "''")
 			json: true
 		try
 			request auth_req, (error, response, body) ->
 				if !error and response.statusCode == 200
 					console.log body

Vulnerable code: 			url: "http://auth.wot.io/authenticate_token/#{token}/#{command}/#{path}"
Fixed code: 			url: "http://auth.wot.io/authenticate_token/#{token}/#{command}/#{path}".replace("'", "''")
CVE-2016-4444: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 7
Published: 2017-04-11T18:59Z
Repository: https://github.com/fedora-selinux/setroubleshoot
Language: Python
Files changed: plugins/src/allow_execmod.py
Commit date: 2015-04-09 14:14:44 +0200
Commit message: plugins: get rid of commands.getstatusoutput()

Diff: diff --git a/plugins/src/allow_execmod.py b/plugins/src/allow_execmod.py
index a839fe3..42f2751 100644
--- a/plugins/src/allow_execmod.py
+++ b/plugins/src/allow_execmod.py
@@ -89,14 +89,20 @@ setroubleshoot examined '$FIX_TARGET_PATH' to make sure it was built correctly,
     def __init__(self):
         Plugin.__init__(self,__name__)
         self.set_priority(10)
 
     def analyze(self, avc):
-        import commands
+        import subprocess
         if avc.has_any_access_in(['execmod']):
             # MATCH
-            if (commands.getstatusoutput("eu-readelf -d %s | fgrep -q TEXTREL" % avc.tpath)[0] == 1):
+            # from https://docs.python.org/2.7/library/subprocess.html#replacing-shell-pipeline
+            p1 = subprocess.Popen(['eu-readelf', '-d', avc.tpath], stdout=subprocess.PIPE)
+            p2 = subprocess.Popen(["fgrep", "-q", "TEXTREL"], stdin=p1.stdout, stdout=subprocess.PIPE)
+            p1.stdout.close()  # Allow p1 to receive a SIGPIPE if p2 exits.
+            p1.wait()
+            p2.wait()
+            if p2.returncode == 1:
                 return self.report(("unsafe"))
 
             mcon = selinux.matchpathcon(avc.tpath.strip('"'), S_IFREG)[1]
             if mcon.split(":")[2] == "lib_t":
                 return self.report()

Vulnerable code:         import commands
            if (commands.getstatusoutput("eu-readelf -d %s | fgrep -q TEXTREL" % avc.tpath)[0] == 1):
Fixed code:         import subprocess
            # from https://docs.python.org/2.7/library/subprocess.html#replacing-shell-pipeline
            p1 = subprocess.Popen(['eu-readelf', '-d', avc.tpath], stdout=subprocess.PIPE)
            p2 = subprocess.Popen(["fgrep", "-q", "TEXTREL"], stdin=p1.stdout, stdout=subprocess.PIPE)
            p1.stdout.close()  # Allow p1 to receive a SIGPIPE if p2 exits.
            p1.wait()
            p2.wait()
            if p2.returncode == 1:
CVE-2020-1763: Out-of-bounds Read (CWE-125)
value: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-05-12T14:15Z
Repository: https://github.com/libreswan/libreswan
Language: C
Files changed: programs/pluto/ikev1.c
Commit date: 2020-05-11 10:50:12 -0400
Commit message: security: Fix for CVE-2020-1763

pluto will crash on a null pointer dereference when trying to log an error
for an IKEv1 packet containing bogus information and/or flags.

Signed-off-by: Paul Wouters <pwouters@redhat.com>

Diff: diff --git a/programs/pluto/ikev1.c b/programs/pluto/ikev1.c
index 78d5c3eca1..244b00f5cc 100644
--- a/programs/pluto/ikev1.c
+++ b/programs/pluto/ikev1.c
@@ -2127,11 +2127,11 @@ void process_packet_tail(struct msg_digest *md)
 					      LELEM(ISAKMP_NEXT_CERT))) {
 					loglog(RC_LOG_SERIOUS,
 						"%smessage ignored because it contains a payload type (%s) unexpected by state %s",
 						excuse,
 						enum_show(&ikev1_payload_names, np),
-						st->st_state->name);
+						finite_states[smc->state]->name);
 					if (!md->encrypted) {
 						SEND_NOTIFICATION(INVALID_PAYLOAD_TYPE);
 					}
 					return;
 				}

Vulnerable code: 						st->st_state->name);
Fixed code: 						finite_states[smc->state]->name);
CVE-2021-27582: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.1
Published: 2021-02-23T18:15Z
Repository: https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
Language: Java
Files changed: openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java
Commit date: 2021-02-18 16:13:36 -0500
Commit message: Fix Spring Autobinding vulnerability

1. Make authorizationRequest no longer affected by http request parameters due to @ModelAttribute. See http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.html

Diff: diff --git a/openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java b/openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java
index d8946469..29c9a141 100644
--- a/openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java
+++ b/openid-connect-server/src/main/java/org/mitre/oauth2/web/OAuthConfirmationController.java
@@ -101,13 +101,13 @@ public class OAuthConfirmationController {
 		this.clientService = clientService;
 	}
 
 	@PreAuthorize("hasRole('ROLE_USER')")
 	@RequestMapping("/oauth/confirm_access")
-	public String confimAccess(Map<String, Object> model, @ModelAttribute("authorizationRequest") AuthorizationRequest authRequest,
-			Principal p) {
+	public String confirmAccess(Map<String, Object> model, Principal p) {
 
+		AuthorizationRequest authRequest = (AuthorizationRequest) model.get("authorizationRequest");
 		// Check the "prompt" parameter to see if we need to do special processing
 
 		String prompt = (String)authRequest.getExtensions().get(PROMPT);
 		List<String> prompts = Splitter.on(PROMPT_SEPARATOR).splitToList(Strings.nullToEmpty(prompt));
 		ClientDetailsEntity client = null;

Vulnerable code: 	public String confimAccess(Map<String, Object> model, @ModelAttribute("authorizationRequest") AuthorizationRequest authRequest,
			Principal p) {
Fixed code: 	public String confirmAccess(Map<String, Object> model, Principal p) {
		AuthorizationRequest authRequest = (AuthorizationRequest) model.get("authorizationRequest");
CVE-2017-20155: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Sterc Google Analytics Dashboard for MODX up to 1.0.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file core/components/analyticsdashboardwidget/elements/tpl/widget.analytics.tpl of the component Internal Search. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.0.6 is able to address this issue. The identifier of the patch is 855d9560d3782c105568eedf9b22a769fbf29cc0. It is recommended to upgrade the affected component. The identifier VDB-217069 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-30T23:15Z
Repository: https://github.com/Sterc/Analytics-dashboard-widget
Language: Unknown
Commit date: 2017-03-09 09:06:14 +0100
Commit message: Merge pull request #12 from gpsietzema/development

Fixed XSS vulnerability #11
CVE-2021-3831: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-14T11:15Z
Repository: https://github.com/gnuboard/gnuboard5
Language: PHP
Files changed: bbs/memo.php
Commit date: 2021-12-14 16:10:41 +0900
Commit message: $kind 변수를 이용한 XSS 취약점 수정 (Pocas님,211214)

Diff: diff --git a/bbs/memo.php b/bbs/memo.php
index 8dc446c13..86ffb7930 100644
--- a/bbs/memo.php
+++ b/bbs/memo.php
@@ -13,12 +13,14 @@ $kind = isset($_GET['kind']) ? clean_xss_tags($_GET['kind'], 0, 1) : 'recv';
 
 if ($kind == 'recv')
     $unkind = 'send';
 else if ($kind == 'send')
     $unkind = 'recv';
-else
+else {
+    $kind = clean_xss_tags(trim($kind));
     alert(''.$kind .'값을 넘겨주세요.');
+}
 
 if ($page < 1) { $page = 1; } // 페이지가 없으면 첫 페이지 (1 페이지)
 
 run_event('memo_list', $kind, $unkind, $page);
 

Vulnerable code: else
Fixed code: else {
    $kind = clean_xss_tags(trim($kind));
}