Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-37848: Observable Discrepancy (CWE-203)
value: common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 7.5
Published: 2021-08-02T20:15Z
Repository: https://github.com/saschahauer/barebox
Language: C
Files changed: common/password.c
Commit date: 2021-07-30 19:50:36 +0200
Commit message: password: Use crypto_memneq() to compare hashes

Cryptographic verifications should be time-constant so that an attacker
cannot get information about the secrets used by observing the system,
so use crypto_memneq() rather than memcmp() to compare password hashes.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Diff: diff --git a/common/password.c b/common/password.c
index 3f05b81c0c..aea7c7ff5d 100644
--- a/common/password.c
+++ b/common/password.c
@@ -16,10 +16,11 @@
 #include <magicvar.h>
 #include <clock.h>
 #include <init.h>
 #include <stdlib.h>
 #include <globalvar.h>
+#include <crypto.h>
 #include <generated/passwd.h>
 #include <crypto/pbkdf2.h>
 
 #if defined(CONFIG_PASSWD_SUM_MD5)
 #define PASSWD_SUM "md5"
@@ -309,19 +310,19 @@ static int check_passwd(unsigned char *passwd, size_t length)
 		ret = pkcs5_pbkdf2_hmac_sha1(passwd, length, salt,
 			PBKDF2_SALT_LEN, PBKDF2_COUNT, keylen, passwd1_sum);
 		if (ret)
 			goto err;
 
-		if (strncmp(passwd1_sum, key, keylen) == 0)
+		if (!crypto_memneq(passwd1_sum, key, keylen))
 			ret = 1;
 	} else {
 		ret = digest_digest(d, passwd, length, passwd1_sum);
 
 		if (ret)
 			goto err;
 
-		if (strncmp(passwd1_sum, passwd2_sum, hash_len) == 0)
+		if (!crypto_memneq(passwd1_sum, passwd2_sum, hash_len))
 			ret = 1;
 	}
 
 err:
 	free(passwd1_sum);

Vulnerable code: 		if (strncmp(passwd1_sum, key, keylen) == 0)
		if (strncmp(passwd1_sum, passwd2_sum, hash_len) == 0)
Fixed code: #include <crypto.h>
		if (!crypto_memneq(passwd1_sum, key, keylen))
		if (!crypto_memneq(passwd1_sum, passwd2_sum, hash_len))
CVE-2011-1588: Use of Externally-Controlled Format String (CWE-134)
value: Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 7.8
Published: 2019-11-14T02:15Z
Repository: https://github.com/xfce-mirror/thunar
Language: C
Files changed: thunar/thunar-transfer-job.c
Commit date: 2011-04-15 14:10:58 +0200
Commit message: Don't interpret file display names as format strings

This avoids a segfault when copying/moving files containing "%" formatters
in their name.

Signed-off-by: Jannis Pohlmann <jannis@xfce.org>

Diff: diff --git a/thunar/thunar-transfer-job.c b/thunar/thunar-transfer-job.c
index f77839f3..c38cf85c 100644
--- a/thunar/thunar-transfer-job.c
+++ b/thunar/thunar-transfer-job.c
@@ -532,11 +532,11 @@ thunar_transfer_job_copy_node (ThunarTransferJob  *job,
           g_object_unref (target_file);
           break;
         }
 
       /* update progress information */
-      exo_job_info_message (EXO_JOB (job), g_file_info_get_display_name (info));
+      exo_job_info_message (EXO_JOB (job), "%s", g_file_info_get_display_name (info));
 
 retry_copy:
       /* copy the item specified by this node (not recursively) */
       real_target_file = thunar_transfer_job_copy_file (job, node->source_file, 
                                                         target_file, &err);

Vulnerable code:       exo_job_info_message (EXO_JOB (job), g_file_info_get_display_name (info));
Fixed code:       exo_job_info_message (EXO_JOB (job), "%s", g_file_info_get_display_name (info));
CVE-2014-6280: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt parameter in an items_reported action to oc-admin/index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-10-20T14:55Z
Repository: https://github.com/osclass/Osclass
Language: Unknown
Commit date: 2014-09-03 16:57:21 +0200
Commit message: Merge pull request #1699 from conejoninja/fixescve

some fixes
CVE-2014-6308: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter in a render action to oc-admin/index.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2014-10-20T14:55Z
Repository: https://github.com/osclass/Osclass
Language: Unknown
Commit date: 2014-09-03 16:57:21 +0200
Commit message: Merge pull request #1699 from conejoninja/fixescve

some fixes
CVE-2020-24619: Improper Certificate Validation (CWE-295)
value: In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 5.9
Published: 2020-09-22T12:15Z
Repository: https://github.com/mltframework/shotcut
Language: C++
Files changed: src/mainwindow.cpp
Commit date: 2020-08-22 14:03:33 -0700
Commit message: fix upgrade check is not using TLS correctly

Diff: diff --git a/src/mainwindow.cpp b/src/mainwindow.cpp
index 498056c0..d4efd5cd 100644
--- a/src/mainwindow.cpp
+++ b/src/mainwindow.cpp
@@ -3238,17 +3238,12 @@ void MainWindow::onShuttle(float x)
 
 void MainWindow::showUpgradePrompt()
 {
     if (Settings.checkUpgradeAutomatic()) {
         showStatusMessage("Checking for upgrade...");
-        QNetworkRequest request(QUrl("https://check.shotcut.org/version.json"));
-        QSslConfiguration sslConfig = request.sslConfiguration();
-        sslConfig.setPeerVerifyMode(QSslSocket::VerifyNone);
-        request.setSslConfiguration(sslConfig);
-        m_network.get(request);
+        m_network.get(QNetworkRequest(QUrl("https://check.shotcut.org/version.json")));
     } else {
-        m_network.setStrictTransportSecurityEnabled(false);
         QAction* action = new QAction(tr("Click here to check for a new version of Shotcut."), 0);
         connect(action, SIGNAL(triggered(bool)), SLOT(on_actionUpgrade_triggered()));
         showStatusMessage(action, 15 /* seconds */);
     }
 }
@@ -3700,11 +3695,11 @@ void MainWindow::on_actionUpgrade_triggered()
         Settings.setCheckUpgradeAutomatic(dialog.exec() == QMessageBox::Yes);
         if (dialog.checkBox()->isChecked())
             Settings.setAskUpgradeAutomatic(false);
     }
     showStatusMessage("Checking for upgrade...");
-    m_network.get(QNetworkRequest(QUrl("http://check.shotcut.org/version.json")));
+    m_network.get(QNetworkRequest(QUrl("https://check.shotcut.org/version.json")));
 }
 
 void MainWindow::on_actionOpenXML_triggered()
 {
     QString path = Settings.openPath();

Vulnerable code:         QNetworkRequest request(QUrl("https://check.shotcut.org/version.json"));
        QSslConfiguration sslConfig = request.sslConfiguration();
        sslConfig.setPeerVerifyMode(QSslSocket::VerifyNone);
        request.setSslConfiguration(sslConfig);
        m_network.get(request);
        m_network.setStrictTransportSecurityEnabled(false);
    m_network.get(QNetworkRequest(QUrl("http://check.shotcut.org/version.json")));
Fixed code:         m_network.get(QNetworkRequest(QUrl("https://check.shotcut.org/version.json")));
    m_network.get(QNetworkRequest(QUrl("https://check.shotcut.org/version.json")));
CVE-2014-125066: Improper Resource Shutdown or Release (CWE-404)
value: A vulnerability was found in emmflo yuko-bot. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument title leads to denial of service. The attack can be initiated remotely. The name of the patch is e580584b877934a4298d4dd0c497c79e579380d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217636.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 7.5
Published: 2023-01-08T09:15Z
Repository: https://github.com/emmflo/yuko-bot
Language: Other
Files changed: Yuko, config.rb
Commit date: 2014-11-13 07:51:03 +0100
Commit message: titles are limited to 512... thanks to the evil fool who exploited this to disconnect my cute little bot :(

Diff: diff --git a/Yuko b/Yuko
index a917e0d..bdefa39 100755
--- a/Yuko
+++ b/Yuko
@@ -122,19 +122,19 @@ def handle_privmsg_request(irc, message, request)
   if request[:name] == 'praisememore'
     irc.privmsg message.channel, "https://i.imgur.com/f3WLqUw.jpg"
   end
 
   if request[:name] == 'internet'
-    irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/" 	
+    irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/"
   end
 end
 
 def handle_privmsg_urls(irc, message, urls)
   urls.take(3).each do |url|
     begin
       object = LinkThumbnailer.generate url
-      irc.privmsg message.channel, object.title if object.title && object.title.size > 0
+      irc.privmsg message.channel, object.title[0...512] if object.title && object.title.size > 0
     rescue StandardError
     end
   end
 end
 
diff --git a/config.rb b/config.rb
index ac3a642..a4ef2c1 100644
--- a/config.rb
+++ b/config.rb
@@ -3,11 +3,11 @@ Yuko.configure do |config|
   # IRC Informations:
   config.irc.server   = 'irc.smoothirc.net'
   config.irc.port     = 6667
   config.irc.ssl      = false
   config.irc.channel  = '#mangas'
-  config.irc.nickname = 'Yuko'
+  config.irc.nickname = 'Yuko3'
   config.irc.greeting = 'Yuko kuruyo~ https://youtu.be/cIkoZbvTfwc \o/'
 
   # MyAnimeList Account:
   config.mal.username = 'Oli-'
   config.mal.password = nil

Vulnerable code:     irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/" 	
      irc.privmsg message.channel, object.title if object.title && object.title.size > 0
  config.irc.nickname = 'Yuko'
Fixed code:     irc.privmsg message.channel, "http://www.internetshouldbeillegal.com/"
      irc.privmsg message.channel, object.title[0...512] if object.title && object.title.size > 0
  config.irc.nickname = 'Yuko3'
CVE-2023-49801: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `get_pfp` and `get_banner` routes on Auth Server. The issue is that there is no check to ensure that the file that Auth Server is receiving through these URLs is correct. This could allow an attacker access to files they shouldn't have access to. This issue has been patched in version 1.4.0.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2024-01-12T21:15Z
Repository: https://github.com/Lif-Platforms/Lif-Auth-Server
Language: Unknown
Commit date: 2023-12-09 20:10:23 -0500
Commit message: Merge pull request from GHSA-3v77-pvqq-qg3f

Fix security issue
CVE-2022-3966: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the argument tpl leads to pathname traversal. The attack may be initiated remotely. Upgrading to version 2.5.1 is able to address this issue. The name of the patch is e1bc94c1100f02a129721ba4be5fbc44c3d78ec4. It is recommended to upgrade the affected component. The identifier VDB-213545 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-11-13T08:15Z
Repository: https://github.com/ultimatemember/ultimatemember
Language: PHP
Files changed: includes/core/class-shortcodes.php
Commit date: 2022-09-27 15:13:35 +0300
Commit message: - fixed Directory Traversal vulnerability. Using realpath for that;

Diff: diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php
index 461e06d2..fdc5ec7a 100644
--- a/includes/core/class-shortcodes.php
+++ b/includes/core/class-shortcodes.php
@@ -274,21 +274,23 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 				$args = apply_filters( 'um_template_load_args', $args, $tpl );
 
 				extract( $args );
 			}
 
-			// Avoid Directory Traversal vulnerability.
-			$tpl = trim( $tpl, "./\\" );
-
 			$file = um_path . "templates/{$tpl}.php";
 			$theme_file = get_stylesheet_directory() . "/ultimate-member/templates/{$tpl}.php";
 			if ( file_exists( $theme_file ) ) {
 				$file = $theme_file;
 			}
 
 			if ( file_exists( $file ) ) {
-				include $file;
+				// Avoid Directory Traversal vulnerability by the checking the realpath.
+				// Templates can be situated only in the get_stylesheet_directory() or plugindir templates.
+				$real_file = realpath( $file );
+				if ( 0 === strpos( $real_file, um_path . "templates" . DIRECTORY_SEPARATOR ) || 0 === strpos( $real_file, get_stylesheet_directory() . DIRECTORY_SEPARATOR . 'ultimate-member' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR ) ) {
+					include $file;
+				}
 			}
 		}
 
 
 		/**

Vulnerable code: 			// Avoid Directory Traversal vulnerability.
			$tpl = trim( $tpl, "./\\" );

				include $file;
Fixed code: 				// Avoid Directory Traversal vulnerability by the checking the realpath.
				// Templates can be situated only in the get_stylesheet_directory() or plugindir templates.
				$real_file = realpath( $file );
				if ( 0 === strpos( $real_file, um_path . "templates" . DIRECTORY_SEPARATOR ) || 0 === strpos( $real_file, get_stylesheet_directory() . DIRECTORY_SEPARATOR . 'ultimate-member' . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR ) ) {
					include $file;
				}
CVE-2019-10787: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-02-04T21:15Z
Repository: https://github.com/Turistforeningen/node-im-resize
Language: JavaScript
Files changed: index.js
Commit date: 2020-02-03 22:25:54 +0100
Commit message: fix: check image arguments before processing (#19)

Regex hotfix to check for command injection
Diff: diff --git a/index.js b/index.js
index 16654d1..4ca6998 100644
--- a/index.js
+++ b/index.js
@@ -5,17 +5,21 @@ var basename = require('path').basename;
 var extname = require('path').extname;
 var join = require('path').join;
 var sprintf = require('util').format;
 
 module.exports = function(image, output, cb) {
+  if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(image))) {
+    console.log('Input Validation failed, Suspicious Characters found');
+  } else {
   var cmd = module.exports.cmd(image, output);
   exec(cmd, {timeout: 30000}, function(e, stdout, stderr) {
     if (e) { return cb(e); }
     if (stderr) { return cb(new Error(stderr)); }
 
     return cb(null, output.versions);
   });
+}
 };
 
 /**
  * Get cropped geometry for given aspectratio
  *

Fixed code:   if(/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g.test(JSON.stringify(image))) {
    console.log('Input Validation failed, Suspicious Characters found');
  } else {
}
CVE-2022-24839: Uncontrolled Resource Consumption (CWE-400)
value: org.cyberneko.html is an html parser written in Java. The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup. Users are advised to upgrade to `>= 1.9.22.noko2`. Note: The upstream library `org.cyberneko.html` is no longer maintained. Nokogiri uses its own fork of this library located at https://github.com/sparklemotion/nekohtml and this CVE applies only to that fork. Other forks of nekohtml may have a similar vulnerability.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2022-04-11T22:15Z
Repository: https://github.com/sparklemotion/nekohtml
Language: Java
Files changed: src/org/cyberneko/html/HTMLScanner.java
Commit date: 2022-04-10 11:34:40 -0400
Commit message: fix: ensure ill-formed PIs are parsed correctly

Diff: diff --git a/src/org/cyberneko/html/HTMLScanner.java b/src/org/cyberneko/html/HTMLScanner.java
index fe414a4..0519316 100644
--- a/src/org/cyberneko/html/HTMLScanner.java
+++ b/src/org/cyberneko/html/HTMLScanner.java
@@ -2586,11 +2586,11 @@ public class HTMLScanner
                 while (true) {
                     int c = fCurrentEntity.read();
                     if (c == '?' || c == '/') {
                         char c0 = (char)c;
                         c = fCurrentEntity.read();
-                        if (c == '>') {
+                        if (c == '>' || c == -1) {
                             break;
                         }
                         fStringBuffer.append(c0);
                         fCurrentEntity.rewind();
                         continue;

Vulnerable code:                         if (c == '>') {
Fixed code:                         if (c == '>' || c == -1) {
CVE-2014-9753: Improper Authentication (CWE-287)
value: confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2020-02-11T18:15Z
Repository: https://github.com/atutor/ATutor
Language: PHP
Files changed: confirm.php
Commit date: 2014-08-25 09:20:35 +0100
Commit message: Added a confirmation code to auto_login URL to fix bug where anyone can login as anyone.

Diff: diff --git a/confirm.php b/confirm.php
index 36fa38ed5..4c689dc90 100644
--- a/confirm.php
+++ b/confirm.php
@@ -80,11 +80,11 @@ if (isset($_GET['e'], $_GET['id'], $_GET['m'])) {
 				</div>";
 		
 				require(AT_INCLUDE_PATH.'header.inc.php');
 				echo "<div class=\"input-form\">";
 				require(AT_INCLUDE_PATH.'html/auto_enroll_list_courses.inc.php');
-				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'">' . _AT("go_to_my_start_page") . '</a></p>';
+				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'&code=' . $code .'">' . _AT("go_to_my_start_page") . '</a></p>';
 				echo "</div>";
 				require(AT_INCLUDE_PATH.'footer.inc.php');
 				exit;
 			}
 			else
@@ -92,10 +92,11 @@ if (isset($_GET['e'], $_GET['id'], $_GET['m'])) {
 				$msg->addFeedback('CONFIRM_GOOD');
 				
 				// enable auto login student into "my start page"
 				$_REQUEST["auto_login"] = 1;
 				$_REQUEST["member_id"] = $id;
+				$_REQUEST["code"] = $code;
 			}
 		} else {
 			$msg->addError('CONFIRM_BAD');
 		}
 	} else {
@@ -140,12 +141,14 @@ if (isset($_GET['e'], $_GET['id'], $_GET['m'])) {
 if (isset($_REQUEST['auto_login']))
 {
 	
 	$sql = "SELECT M.member_id, M.login, M.preferences, M.language FROM %smembers M WHERE M.member_id=%d";
 	$row = queryDB($sql, array(TABLE_PREFIX, $_REQUEST["member_id"]), TRUE);
+
+	$code = substr(md5($e . $row['creation_date'] . $id), 0, 10);
 	
-	if ($row['member_id'] != '') 
+	if ($row['member_id'] != '' && isset($_REQUEST['code']) && $_REQUEST['code'] == $code) 
 	{
 		$_SESSION['valid_user'] = true;
 		$_SESSION['member_id']	= $_REQUEST["member_id"];
 		$_SESSION['course_id']  = 0;
 		$_SESSION['login']		= $row[login];

Vulnerable code: 				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'">' . _AT("go_to_my_start_page") . '</a></p>';
	if ($row['member_id'] != '') 
Fixed code: 				echo '<p style="text-align:center"><a href="'. $_SERVER['PHP_SELF'] . '?auto_login=1&member_id='. $id .'&code=' . $code .'">' . _AT("go_to_my_start_page") . '</a></p>';
				$_REQUEST["code"] = $code;

	$code = substr(md5($e . $row['creation_date'] . $id), 0, 10);
	if ($row['member_id'] != '' && isset($_REQUEST['code']) && $_REQUEST['code'] == $code)
CVE-2015-1583: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2020-03-02T16:15Z
Repository: https://github.com/atutor/ATutor
Language: PHP
Files changed: mods/_core/users/create_user.php
Commit date: 2015-02-22 16:18:00 -0500
Commit message: 5566 check to make sure user is not being created via CRSF remote form

Diff: diff --git a/mods/_core/users/create_user.php b/mods/_core/users/create_user.php
index 843e75cde..12745b799 100644
--- a/mods/_core/users/create_user.php
+++ b/mods/_core/users/create_user.php
@@ -13,10 +13,18 @@
 // $Id$
 
 define('AT_INCLUDE_PATH', '../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_USERS);
+// Prevent remote access via CSRF: 5566
+if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
+    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
+    if(!in_array($_pages[$referer_script], $_pages)){
+    echo "not a valid referer";
+    exit;
+    }
+}
 
 if (isset($_POST['cancel'])) {
 	header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');
 	exit;
 }

Fixed code: // Prevent remote access via CSRF: 5566
if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
CVE-2015-1583: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2020-03-02T16:15Z
Repository: https://github.com/atutor/ATutor
Language: PHP
Files changed: mods/_core/users/admins/create.php
Commit date: 2015-02-28 08:50:30 -0500
Commit message: 5566 added chech on referer to ensure it is in the pages array, to prevent remote access via CSRF

Diff: diff --git a/mods/_core/users/admins/create.php b/mods/_core/users/admins/create.php
index 2c3193b696..e8fed96c6d 100644
--- a/mods/_core/users/admins/create.php
+++ b/mods/_core/users/admins/create.php
@@ -13,10 +13,17 @@
 // $Id$
 
 define('AT_INCLUDE_PATH', '../../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_ADMIN);
+if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
+    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
+    if(!in_array($_pages[$referer_script], $_pages)){
+    echo "not a valid referer";
+    exit;
+    }
+}
 
 if (isset($_POST['cancel'])) {
 	$msg->addFeedback('CANCELLED');
 	header('Location: index.php');
 	exit;

Fixed code: if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
    if(!in_array($_pages[$referer_script], $_pages)){
    echo "not a valid referer";
    exit;
    }
}
CVE-2016-2555: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2017-04-13T14:59Z
Repository: https://github.com/atutor/ATutor
Language: PHP
Files changed: include/lib/mysql_connect.inc.php
Commit date: 2016-03-07 09:12:46 -0500
Commit message: Update mysql_connect.inc.php

This one patch, patches all SQL Injection that I found
Diff: diff --git a/include/lib/mysql_connect.inc.php b/include/lib/mysql_connect.inc.php
index 9c54fc38b4..93d22d8267 100644
--- a/include/lib/mysql_connect.inc.php
+++ b/include/lib/mysql_connect.inc.php
@@ -91,18 +91,12 @@ function my_null_slashes($string) {
 
 if ( get_magic_quotes_gpc() == 1 ) {
     $addslashes   = 'my_add_null_slashes';
     $stripslashes = 'stripslashes';
 } else {
-    if(defined('MYSQLI_ENABLED')){
-        // mysqli_real_escape_string requires 2 params, breaking wherever
-        // current $addslashes with 1 param exists. So hack with trim and 
-        // manually run mysqli_real_escape_string requires during sanitization below
-        $addslashes   = 'trim';
-    }else{
-        $addslashes   = 'mysql_real_escape_string';
-    }
+    // if get_magic_quotes_gpc is off, we set our own handler
+    $addslashes   = 'mysql_real_escape_string';
     $stripslashes = 'my_null_slashes';
 }
 
 /**
  * This function is used to make a DB query the same along the whole codebase
@@ -404,6 +398,6 @@ function at_field_name($result, $i){
         return mysql_field_name($result, $i);   
     }
 }
 
 ////
-?>
\ No newline at end of file
+?>

Vulnerable code:     if(defined('MYSQLI_ENABLED')){
        // mysqli_real_escape_string requires 2 params, breaking wherever
        // current $addslashes with 1 param exists. So hack with trim and 
        // manually run mysqli_real_escape_string requires during sanitization below
        $addslashes   = 'trim';
    }else{
        $addslashes   = 'mysql_real_escape_string';
    }
?>
Fixed code:     // if get_magic_quotes_gpc is off, we set our own handler
    $addslashes   = 'mysql_real_escape_string';
?>
CVE-2016-2555: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2017-04-13T14:59Z
Repository: https://github.com/atutor/ATutor
Language: Unknown
Commit date: 2016-03-07 19:18:23 -0500
Commit message: Merge pull request #106 from net-ninja/patch-1

Update mysql_connect.inc.php to replace mysqli trim with mysql_real_escape_string to properly filter potential injection attempts, thx mr_me aka net-ninja
CVE-2017-14981: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_feeds/edit_feed.php). An attacker could inject arbitrary HTML and script code into a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-10-03T01:29Z
Repository: https://github.com/atutor/ATutor
Language: PHP
Files changed: mods/_standard/rss_feeds/edit_feed.php
Commit date: 2017-10-01 10:12:48 -0400
Commit message: 5815 added htmlspecialchars to filter URL var before going to the db.

Diff: diff --git a/mods/_standard/rss_feeds/edit_feed.php b/mods/_standard/rss_feeds/edit_feed.php
index 550a4ea7e1..4abac11edd 100644
--- a/mods/_standard/rss_feeds/edit_feed.php
+++ b/mods/_standard/rss_feeds/edit_feed.php
@@ -36,11 +36,11 @@ if (isset($_GET['submit'])) {
 		$missing_fields = implode(', ', $missing_fields);
 		$msg->addError(array('EMPTY_FIELDS', $missing_fields));
 	}
 
 	if (!$msg->containsErrors()) {
-		$_GET['url'] = $addslashes($_GET['url']);
+        $_GET['url'] = htmlspecialchars(strip_tags($_GET['url']), ENT_QUOTES);
 
 		$sql	= "REPLACE INTO %sfeeds VALUES(%d, '%s')";
 		$result = queryDB($sql, array(TABLE_PREFIX, $feed_id, $_GET['url']));
 
 		//update language

Vulnerable code: 		$_GET['url'] = $addslashes($_GET['url']);
Fixed code:         $_GET['url'] = htmlspecialchars(strip_tags($_GET['url']), ENT_QUOTES);
CVE-2023-28625: NULL Pointer Dereference (CWE-476)
value: mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-04-03T14:15Z
Repository: https://github.com/OpenIDC/mod_auth_openidc
Language: Other
Files changed: ChangeLog, configure.ac
Commit date: 2023-03-28 11:25:53 +0200
Commit message: 2.4.13.2: prevent DoS core dump with OIDCStripCookies; CVE-2023-28625

https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>
Diff: diff --git a/ChangeLog b/ChangeLog
index 9fe293d..274d723 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,12 @@
+03/28/2023
+- CVE-2023-28625: prevent core dump when OIDCStripCookies is set and a crafted Cookie header is supplied
+  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr
+- release 2.4.13.2
+
 03/27/2023
-- fix code scanning alerts:
+- fix code scanning alerts
 - bump to 2.4.13.2rc2
   
 03/24/2023
 - add support for Elliptic Curve signing/encryption keys in addtion to RSA keys,
   i.e. client keys configured in OIDCPrivateKeyFiles/OIDCPublicKeyFiles, published on OIDCClientJwksUri
diff --git a/configure.ac b/configure.ac
index c5a8f57..442d92f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
-AC_INIT([mod_auth_openidc],[2.4.13.2rc2],[hans.zandbelt@openidc.com])
+AC_INIT([mod_auth_openidc],[2.4.13.2],[hans.zandbelt@openidc.com])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 
 AM_INIT_AUTOMAKE([-Wall -Werror foreign subdir-objects])
 

Vulnerable code: - fix code scanning alerts:
AC_INIT([mod_auth_openidc],[2.4.13.2rc2],[hans.zandbelt@openidc.com])
Fixed code: 03/28/2023
- CVE-2023-28625: prevent core dump when OIDCStripCookies is set and a crafted Cookie header is supplied
  https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr
- release 2.4.13.2

- fix code scanning alerts
AC_INIT([mod_auth_openidc],[2.4.13.2],[hans.zandbelt@openidc.com])
CVE-2016-1000003: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2016-10-07T18:59Z
Repository: https://github.com/fedora-infra/mirrormanager2
Language: Other
Files changed: client/report_mirror
Commit date: 2016-06-17 19:16:13 +0000
Commit message: Update client to use json serialization

This changes the client to use json serialization rather than
pickles.

Related: CVE-2016-1000003
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

Diff: diff --git a/client/report_mirror b/client/report_mirror
index 8931740..2b97aed 100755
--- a/client/report_mirror
+++ b/client/report_mirror
@@ -1,9 +1,9 @@
 #!/usr/bin/python
 
 import os, sys
-import pickle
+import json
 import ConfigParser
 import pprint
 import xmlrpclib
 import base64
 import bz2
@@ -184,11 +184,11 @@ def get_stats(conf, section):
             filenames = [ filenames ]
         for fn in filenames:
             try:
                 f = open(fn, 'r')
                 contents = contents + f.readlines()
-                statsdata[name] = pickle.dumps(contents, -1)
+                statsdata[name] = json.dumps(contents, -1)
                 f.close()
             except:
                 pass
     return statsdata
 
@@ -282,19 +282,19 @@ def main():
     (options, args) = parser.parse_args()
     item = HostConfig()
     get_exclude_dir_patterns_from_file(options)
     if options.input:
         infile = open(options.input, 'rb')
-        item.config = pickle.load(infile)
+        item.config = json.load(infile)
         infile.close()
         if not config(options.config, item, crawl=False):
             sys.exit(1)
     else:
         if not config(options.config, item, crawl=True):
             sys.exit(1)
 
-    p = pickle.dumps(item.config, -1)
+    p = json.dumps(item.config, -1)
 
     if options.debug:
         pp = pprint.PrettyPrinter(indent=4)
         pp.pprint(item.config)
 

Vulnerable code: import pickle
                statsdata[name] = pickle.dumps(contents, -1)
        item.config = pickle.load(infile)
    p = pickle.dumps(item.config, -1)
Fixed code: import json
                statsdata[name] = json.dumps(contents, -1)
        item.config = json.load(infile)
    p = json.dumps(item.config, -1)
CVE-2016-1000003: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2016-10-07T18:59Z
Repository: https://github.com/fedora-infra/mirrormanager2
Language: Python
Files changed: mirrormanager2/xmlrpc.py
Commit date: 2016-06-17 18:41:03 +0000
Commit message: Allow submission of checkin information via json

This means we still allow pickle submissions as a stopgap until we
manage to convince admins to move to json submissions.

Related: CVE-2016-1000003
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

Diff: diff --git a/mirrormanager2/xmlrpc.py b/mirrormanager2/xmlrpc.py
index 804f43a..82a90e3 100644
--- a/mirrormanager2/xmlrpc.py
+++ b/mirrormanager2/xmlrpc.py
@@ -23,10 +23,11 @@
 MirrorManager2 xmlrpc controller.
 '''
 
 import base64
 import pickle
+import json
 import bz2
 
 import flask
 from flaskext.xmlrpc import XMLRPCHandler, Fault
 
@@ -39,11 +40,15 @@ XMLRPC = XMLRPCHandler('xmlrpc')
 XMLRPC.connect(APP, '/xmlrpc')
 
 
 @XMLRPC.register
 def checkin(pickledata):
-    config = pickle.loads(bz2.decompress(base64.urlsafe_b64decode(pickledata)))
+    uncompressed = bz2.decompress(base64.urlsafe_b64decode(pickledata))
+    try:
+        config = json.loads(uncompressed)
+    except ValueError:
+        config = pickle.loads(uncompressed)
     r, message = read_host_config(SESSION, config)
     if r is not None:
         return message + 'checked in successful'
     else:
         return message + 'error checking in'

Vulnerable code:     config = pickle.loads(bz2.decompress(base64.urlsafe_b64decode(pickledata)))
Fixed code: import json
    uncompressed = bz2.decompress(base64.urlsafe_b64decode(pickledata))
    try:
        config = json.loads(uncompressed)
    except ValueError:
        config = pickle.loads(uncompressed)
CVE-2014-8321: Out-of-bounds Write (CWE-787)
value: Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitrary code or gain privileges via unspecified vectors.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2020-01-31T22:15Z
Repository: https://github.com/aircrack-ng/aircrack-ng
Language: C
Files changed: src/airodump-ng.c
Commit date: 2014-10-03 01:51:21 +0000
Commit message: Airodump-ng: Fixed GPS stack overflow (Closes #13 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2416 28c6078b-6c39-48e3-add9-af49d547ecab

Diff: diff --git a/src/airodump-ng.c b/src/airodump-ng.c
index 6cec912..222492c 100644
--- a/src/airodump-ng.c
+++ b/src/airodump-ng.c
@@ -4495,11 +4495,11 @@ void gps_tracker( void )
         		memset(line, 0, sizeof(line));
         		pos = 0;
         	}
 
         	// New version, JSON
-        	if( recv( gpsd_sock, line + pos, sizeof( line ) - 1, 0 ) <= 0 )
+        	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )
         		return;
 
         	// search for TPV class: {"class":"TPV"
         	temp = strstr(line, "{\"class\":\"TPV\"");
         	if (temp == NULL) {

Vulnerable code:         	if( recv( gpsd_sock, line + pos, sizeof( line ) - 1, 0 ) <= 0 )
Fixed code:         	if( recv( gpsd_sock, line + pos, sizeof( line ) - pos - 1, 0 ) <= 0 )
CVE-2014-8322: Out-of-bounds Write (CWE-787)
value: Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-01-31T22:15Z
Repository: https://github.com/aircrack-ng/aircrack-ng
Language: C
Files changed: src/aireplay-ng.c
Commit date: 2014-10-03 01:53:50 +0000
Commit message: Aireplay-ng: Fixed tcp_test stack overflow (Closes #14 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2417 28c6078b-6c39-48e3-add9-af49d547ecab

Diff: diff --git a/src/aireplay-ng.c b/src/aireplay-ng.c
index 7335442..b397015 100644
--- a/src/aireplay-ng.c
+++ b/src/aireplay-ng.c
@@ -5396,10 +5396,12 @@ int tcp_test(const char* ip_str, const short port)
         }
 
         if( (unsigned)caplen == sizeof(nh))
         {
             len = ntohl(nh.nh_len);
+            if (len > 1024 || len < 0)
+                continue;
             if( nh.nh_type == 1 && i==0 )
             {
                 i=1;
                 caplen = read(sock, packet, len);
                 if(caplen == len)

Fixed code:             if (len > 1024 || len < 0)
                continue;
CVE-2014-8323: Improper Input Validation (CWE-20)
value: buddy-ng.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-10-17T14:29Z
Repository: https://github.com/aircrack-ng/aircrack-ng
Language: C
Files changed: src/buddy-ng.c
Commit date: 2014-10-03 01:58:02 +0000
Commit message: Buddy-ng: Fixed segmentation fault (Closes #15 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2418 28c6078b-6c39-48e3-add9-af49d547ecab

Diff: diff --git a/src/buddy-ng.c b/src/buddy-ng.c
index 8a7927c7..8da8996d 100644
--- a/src/buddy-ng.c
+++ b/src/buddy-ng.c
@@ -81,10 +81,12 @@ int handle(int s, unsigned char* data, int len, struct sockaddr_in *s_in)
 	}
 
 	*cmd++ = htons(S_CMD_PACKET);
 	*cmd++ = *pid;
 	plen = len - 2;
+    if (plen < 0)
+        return 0;
 
 	last_id = ntohs(*pid);
 	if (last_id > 20000)
 		wrap = 1;
 	if (wrap && last_id < 100) {

Fixed code:     if (plen < 0)
        return 0;
CVE-2014-8324: Improper Input Validation (CWE-20)
value: network.c in Aircrack-ng before 1.2 Beta 3 allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-10-17T14:29Z
Repository: https://github.com/aircrack-ng/aircrack-ng
Language: C
Files changed: src/osdep/network.c
Commit date: 2014-10-03 02:00:34 +0000
Commit message: OSdep: Fixed segmentation fault that happens with a malicious server sending a negative length (Closes #16 on GitHub).

git-svn-id: http://svn.aircrack-ng.org/trunk@2419 28c6078b-6c39-48e3-add9-af49d547ecab

Diff: diff --git a/src/osdep/network.c b/src/osdep/network.c
index 4f0f8b23..4ebfaf41 100644
--- a/src/osdep/network.c
+++ b/src/osdep/network.c
@@ -129,11 +129,11 @@ int net_get(int s, void *arg, int *len)
 
 	plen = ntohl(nh.nh_len);
 	if (!(plen <= *len))
 		printf("PLEN %d type %d len %d\n",
 			plen, nh.nh_type, *len);
-	assert(plen <= *len); /* XXX */
+	assert(plen <= *len && plen > 0); /* XXX */
 
 	*len = plen;
 	if ((*len) && (net_read_exact(s, arg, *len) == -1))
         {
             return -1;

Vulnerable code: 	assert(plen <= *len); /* XXX */
Fixed code: 	assert(plen <= *len && plen > 0); /* XXX */
CVE-2014-4853: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-10T16:55Z
Repository: https://github.com/opendocman/opendocman
Language: PHP
Files changed: odm-init.php
Commit date: 2014-07-01 21:33:27 -0700
Commit message: issue163 - xss issue with files

Diff: diff --git a/odm-init.php b/odm-init.php
index ae347e6..1ee73f1 100644
--- a/odm-init.php
+++ b/odm-init.php
@@ -73,5 +73,6 @@ $CONFIG['archiveDir'] = $GLOBALS['CONFIG']['dataDir'] . 'archiveDir/';
 
 $_GET = sanitizeme($_GET);
 $_REQUEST = sanitizeme($_REQUEST);
 $_POST = sanitizeme($_POST);
 $_SERVER = sanitizeme($_SERVER);
+$_FILES = sanitizeme($_FILES);

Fixed code: $_FILES = sanitizeme($_FILES);
CVE-2023-50255: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.8
Published: 2023-12-27T17:15Z
Repository: https://github.com/linuxdeepin/deepin-compressor
Language: C++
Files changed: 3rdparty/libzipplugin/libzipplugin.cpp
Commit date: 2023-12-12 05:25:17 +0000
Commit message: fix: Zip Path Traversal

Zip Path Traversal

Bug: https://pms.uniontech.com/bug-view-232873.html

Log: Zip Path Traversal

Diff: diff --git a/3rdparty/libzipplugin/libzipplugin.cpp b/3rdparty/libzipplugin/libzipplugin.cpp
index c872778c..3c64fd6a 100644
--- a/3rdparty/libzipplugin/libzipplugin.cpp
+++ b/3rdparty/libzipplugin/libzipplugin.cpp
@@ -759,10 +759,15 @@ ErrorType LibzipPlugin::extractEntry(zip_t *archive, zip_int64_t index, const Ex
     if (zip_stat_index(archive, zip_uint64_t(index), ZIP_FL_ENC_RAW, &statBuffer) != 0) {
         return ET_FileReadError;
     }
 
     strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]);    // 解压文件名（压缩包中）
+    //fix 232873
+    if(strFileName.indexOf("../") != -1) {
+        qInfo() << "skipped ../ path component(s) in " << strFileName;
+        strFileName = strFileName.replace("../", "");
+    }
     if(strFileName.contains(QLatin1Char('\\')))
         strFileName = strFileName.replace(QLatin1Char('\\'), QDir::separator());
     QString strOriginName = strFileName;
 
     // 针对文件夹名称过长的情况，直接提示解压失败，文件夹名称过长

Fixed code:     //fix 232873
    if(strFileName.indexOf("../") != -1) {
        qInfo() << "skipped ../ path component(s) in " << strFileName;
        strFileName = strFileName.replace("../", "");
    }