Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-39246: Key Exchange without Entity Authentication (CWE-322)
value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
CWE description: The product performs a key exchange with an actor without verifying the identity of that actor.
CVSS v3 base score: 5.3
Published: 2022-09-28T20:15Z
Repository: https://github.com/matrix-org/matrix-android-sdk2
Language: Unknown
Commit date: 2022-09-28 18:09:06 +0200
Commit message: Merge branch 'release/1.5.1' into develop
CVE-2022-39248: Improper Authentication (CWE-287)
value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-android-sdk2 version 1.5.1 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2022-09-28T20:15Z
Repository: https://github.com/matrix-org/matrix-android-sdk2
Language: Unknown
Commit date: 2022-09-28 18:09:06 +0200
Commit message: Merge branch 'release/1.5.1' into develop
CVE-2022-39248: Key Exchange without Entity Authentication (CWE-322)
value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device. These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm. matrix-android-sdk2 version 1.5.1 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption. Out of caution, several other checks have been audited or added. This attack requires coordination between a malicious home server and an attacker, so those who trust their home servers do not need a workaround.
CWE description: The product performs a key exchange with an actor without verifying the identity of that actor.
CVSS v3 base score: 7.5
Published: 2022-09-28T20:15Z
Repository: https://github.com/matrix-org/matrix-android-sdk2
Language: Unknown
Commit date: 2022-09-28 18:09:06 +0200
Commit message: Merge branch 'release/1.5.1' into develop
CVE-2020-5233: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2020-01-30T19:15Z
Repository: https://github.com/pusher/oauth2_proxy
Language: Unknown
Commit date: 2020-01-29 12:37:58 +0000
Commit message: Merge pull request from GHSA-qqxw-m5fj-f7gv

check for /\ redirects
CVE-2022-2651: Authentication Bypass by Primary Weakness (CWE-305)
value: Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.
CWE description: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CVSS v3 base score: 9.8
Published: 2022-08-04T09:15Z
Repository: https://github.com/bookwyrm-social/bookwyrm
Language: Unknown
Commit date: 2022-07-28 11:26:19 -0700
Commit message: Merge pull request #2230 from bookwyrm-social/nginx-rate-limit

Adds rate limiting to some views in nginx
CVE-2022-31136: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being rendered to users. Unprivileged users are able to inject scripts into user profiles, book descriptions, and statuses. These vulnerabilities may be exploited as cross site scripting attacks on users viewing these fields. Users are advised to upgrade to version 0.4.1. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-07-07T18:15Z
Repository: https://github.com/bookwyrm-social/bookwyrm
Language: Unknown
Commit date: 2022-07-04 14:07:36 -0700
Commit message: Merge pull request #2173 from bookwyrm-social/html-sanitizer

Html sanitizer
CVE-2015-8863: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2016-05-06T17:59Z
Repository: https://github.com/stedolan/jq
Language: C
Files changed: src/jv_parse.c
Commit date: 2015-10-24 17:27:56 -0500
Commit message: Heap buffer overflow in tokenadd() (fix #105)

This was an off-by one: the NUL terminator byte was not allocated on
resize.  This was triggered by JSON-encoded numbers longer than 256
bytes.

Diff: diff --git a/src/jv_parse.c b/src/jv_parse.c
index 3102ed4..84245b8 100644
--- a/src/jv_parse.c
+++ b/src/jv_parse.c
@@ -381,11 +381,11 @@ static pfunc stream_token(struct jv_parser* p, char ch) {
   return 0;
 }
 
 static void tokenadd(struct jv_parser* p, char c) {
   assert(p->tokenpos <= p->tokenlen);
-  if (p->tokenpos == p->tokenlen) {
+  if (p->tokenpos >= (p->tokenlen - 1)) {
     p->tokenlen = p->tokenlen*2 + 256;
     p->tokenbuf = jv_mem_realloc(p->tokenbuf, p->tokenlen);
   }
   assert(p->tokenpos < p->tokenlen);
   p->tokenbuf[p->tokenpos++] = c;
@@ -483,11 +483,11 @@ static pfunc check_literal(struct jv_parser* p) {
       if (p->tokenbuf[i] != pattern[i])
         return "Invalid literal";
     TRY(value(p, v));
   } else {
     // FIXME: better parser
-    p->tokenbuf[p->tokenpos] = 0; // FIXME: invalid
+    p->tokenbuf[p->tokenpos] = 0;
     char* end = 0;
     double d = jvp_strtod(&p->dtoa, p->tokenbuf, &end);
     if (end == 0 || *end != 0)
       return "Invalid numeric literal";
     TRY(value(p, jv_number(d)));

Vulnerable code:   if (p->tokenpos == p->tokenlen) {
    p->tokenbuf[p->tokenpos] = 0; // FIXME: invalid
Fixed code:   if (p->tokenpos >= (p->tokenlen - 1)) {
    p->tokenbuf[p->tokenpos] = 0;
CVE-2021-4124: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-16T14:15Z
Repository: https://github.com/meetecho/janus-gateway
Language: JavaScript
Files changed: html/textroomtest.js
Commit date: 2021-12-15 14:10:01 +0100
Commit message: Fixed missing XSS mitigation (see #2817)

Diff: diff --git a/html/textroomtest.js b/html/textroomtest.js
index bf95a260..7d5ae832 100644
--- a/html/textroomtest.js
+++ b/html/textroomtest.js
@@ -349,11 +349,11 @@ function sendPrivateMsg(username) {
 			};
 			textroom.data({
 				text: JSON.stringify(message),
 				error: function(reason) { bootbox.alert(reason); },
 				success: function() {
-					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result);
+					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result));
 					$('#chatroom').get(0).scrollTop = $('#chatroom').get(0).scrollHeight;
 				}
 			});
 		}
 	});

Vulnerable code: 					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result);
Fixed code: 					$('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result));
CVE-2021-23807: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 9.8
Published: 2021-11-03T18:15Z
Repository: https://github.com/janl/node-jsonpointer
Language: Unknown
Commit date: 2021-10-31 18:11:00 +0100
Commit message: Merge pull request #51 from dellalibera/fix-prototype-pollution

fix-prototype-pollution
CVE-2018-18635: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: www/guis/admin/application/controllers/UserController.php in the administration login interface in MailCleaner CE 2018.08 and 2018.09 allows XSS via the admin/login/user/message/ PATH_INFO.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-10-24T21:29Z
Repository: https://github.com/MailCleaner/MailCleaner
Language: PHP
Files changed: www/guis/admin/application/controllers/UserController.php
Commit date: 2018-10-24 11:47:23 +0200
Commit message: Bug fix - Issue #53

Bug fix of a XSS issue on MailCleaner login (administration) interface. See issue #53 
The "message" parameter was only used for the logoutAction(). However, the parameter was not checked and not escaped.
Diff: diff --git a/www/guis/admin/application/controllers/UserController.php b/www/guis/admin/application/controllers/UserController.php
index d5d553f..27912ca 100644
--- a/www/guis/admin/application/controllers/UserController.php
+++ b/www/guis/admin/application/controllers/UserController.php
@@ -31,12 +31,14 @@ class UserController extends Zend_Controller_Action
             $redirect = '/index';
 
 
         $request = $this->getRequest();
         $form    = new Default_Form_Login();
-        if ($this->getRequest()->getParam('message')) {
-        	$form->addErrorMessage($this->getRequest()->getParam('message'));
+        
+        // Display only loggedOut message
+        if ($this->getRequest()->getParam('message') == "loggedOut") {
+        	$form->addErrorMessage(htmlspecialchars($this->getRequest()->getParam('message')));
         }
         
         if ($this->getRequest()->isPost() && $form->isValid($request->getPost())) {
         	
     	    $authAdapter = new Zend_Auth_Adapter_DbTable(

Vulnerable code:         if ($this->getRequest()->getParam('message')) {
        	$form->addErrorMessage($this->getRequest()->getParam('message'));
Fixed code:         
        // Display only loggedOut message
        if ($this->getRequest()->getParam('message') == "loggedOut") {
        	$form->addErrorMessage(htmlspecialchars($this->getRequest()->getParam('message')));
CVE-2019-1010246: Missing Authorization (CWE-862)
value: MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersController.php. The attack vector is: HTTP Get request. The fixed version is: c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 7.5
Published: 2019-07-18T19:15Z
Repository: https://github.com/MailCleaner/MailCleaner
Language: PHP
Files changed: www/guis/users/application/controllers/NewslettersController.php
Commit date: 2019-01-21 17:37:26 +0100
Commit message: Update NewslettersController.php

Test if an Exim ID was passed.
Diff: diff --git a/www/guis/users/application/controllers/NewslettersController.php b/www/guis/users/application/controllers/NewslettersController.php
index 34f7c7f..c0393c9 100644
--- a/www/guis/users/application/controllers/NewslettersController.php
+++ b/www/guis/users/application/controllers/NewslettersController.php
@@ -20,10 +20,12 @@ class NewslettersController extends Zend_Controller_Action
     public function allowAction()
     {        
         $status = 0;
         
         $eximId = $this->getRequest()->getParam('id');
+	
+	if (strlen($eximId) == 0) { die(); }
 
         $spam = new Default_Model_DbTable_Spam();
 
         $row = $spam->fetchRow($spam->select()->where('exim_id = ?', $eximId));
                 

Fixed code: 	
	if (strlen($eximId) == 0) { die(); }
CVE-2020-26214: Improper Authentication (CWE-287)
value: In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2020-11-06T18:15Z
Repository: https://github.com/alerta/alerta
Language: Unknown
Commit date: 2020-10-24 22:50:43 +0200
Commit message: Merge pull request #1345 from alerta/fix-ldap-empty-bind

Do not allow LDAP login with empty password
CVE-2021-40839: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2021-09-10T02:15Z
Repository: https://github.com/aresch/rencode
Language: Python
Files changed: rencode/_rencode.pyx, tests/test_rencode.py
Commit date: 2021-08-09 20:52:35 -0700
Commit message: Fix checking if typecode is valid while decoding.

This bug will cause rencode to hang if the invalid typecode is included
in a sequence type (list, dict) since the position will not change and
the loop checking for the termination byte never returns.

This change is a copy of PR #29 with a few aesthetic changes.

Diff: diff --git a/rencode/_rencode.pyx b/rencode/_rencode.pyx
index d649c85..3db1180 100644
--- a/rencode/_rencode.pyx
+++ b/rencode/_rencode.pyx
@@ -525,10 +525,12 @@ cdef decode(char *data, unsigned int *pos):
         return decode_list(data, pos)
     elif DICT_FIXED_START <= typecode < DICT_FIXED_START + DICT_FIXED_COUNT:
         return decode_fixed_dict(data, pos)
     elif typecode == CHR_DICT:
         return decode_dict(data, pos)
+    else:
+        raise ValueError("Invalid typecode: %d at pos: %d" % (typecode, pos[0]))
 
 def loads(data, decode_utf8=False):
     """
     Decodes the string into an object
 
diff --git a/tests/test_rencode.py b/tests/test_rencode.py
index 7233fd6..74737eb 100644
--- a/tests/test_rencode.py
+++ b/tests/test_rencode.py
@@ -399,8 +399,13 @@ class TestRencode(unittest.TestCase):
             rencode.__version__[1:],
             rencode_orig.__version__[1:],
             "version number does not match",
         )
 
+    def test_invalid_typecode(self):
+        s = b";\x2f\x7f"
+        with self.assertRaises(ValueError):
+            rencode.loads(s)
+
 
 if __name__ == "__main__":
     unittest.main()

Fixed code:     else:
        raise ValueError("Invalid typecode: %d at pos: %d" % (typecode, pos[0]))
    def test_invalid_typecode(self):
        s = b";\x2f\x7f"
        with self.assertRaises(ValueError):
            rencode.loads(s)
CVE-2022-1706: Incorrect Authorization (CWE-863)
value: A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2022-05-17T18:15Z
Repository: https://github.com/coreos/ignition
Language: Go
Files changed: internal/providers/virtualbox/virtualbox.go
Commit date: 2022-05-03 08:46:41 -0700
Commit message: Merge pull request #1350 from bgilbert/userdata

Delete userdata from VirtualBox/VMware after Ignition completes
Diff: diff --cc internal/providers/virtualbox/virtualbox.go
index 51c205df,bc805a3d..e37304c0
--- a/internal/providers/virtualbox/virtualbox.go
+++ b/internal/providers/virtualbox/virtualbox.go
@@@ -85,14 -98,26 +98,32 @@@ func fetchProperty(name string) ([]byte
  		return nil, fmt.Errorf("fetching VirtualBox guest property %q: error %d", name, ret)
  	}
  	if buf == nil {
  		return nil, nil
  	}
 -	// properties are double-NUL-terminated
 -	return bytes.TrimRight(C.GoBytes(buf, C.int(size)), "\x00"), nil
 +	// property format: <data> NUL <flags> NUL
 +	// return only the data; ignore the flags
 +	s := C.GoBytes(buf, C.int(size))
 +	len := bytes.IndexByte(s, 0)
 +	if len == -1 {
 +		return nil, fmt.Errorf("VirtualBox guest property %q is not NUL-terminated", name)
 +	}
 +	return s[0:len], nil
  }
+ 
+ func deleteProperty(name string) error {
+ 	cName := C.CString(name)
+ 	defer C.free(unsafe.Pointer(cName))
+ 
+ 	ret, errno := C.virtualbox_delete_guest_property(cName)
+ 	if ret != C.VINF_SUCCESS {
+ 		if ret == C.VERR_GENERAL_FAILURE && errno != nil {
+ 			return fmt.Errorf("deleting VirtualBox guest property %q: %w", name, errno)
+ 		}
+ 		if ret == C.VERR_PERMISSION_DENIED {
+ 			return fmt.Errorf("deleting VirtualBox guest property %q: permission denied; is the property read-only?", name)
+ 		}
+ 		// see <linux/vbox_err.h>
+ 		return fmt.Errorf("deleting VirtualBox guest property %q: error %d", name, ret)
+ 	}
+ 	return nil
+ }

Fixed code:  
 func deleteProperty(name string) error {
 	cName := C.CString(name)
 	defer C.free(unsafe.Pointer(cName))
 
 	ret, errno := C.virtualbox_delete_guest_property(cName)
 	if ret != C.VINF_SUCCESS {
 		if ret == C.VERR_GENERAL_FAILURE && errno != nil {
 			return fmt.Errorf("deleting VirtualBox guest property %q: %w", name, errno)
 		}
 		if ret == C.VERR_PERMISSION_DENIED {
 			return fmt.Errorf("deleting VirtualBox guest property %q: permission denied; is the property read-only?", name)
 		}
 		// see <linux/vbox_err.h>
 		return fmt.Errorf("deleting VirtualBox guest property %q: error %d", name, ret)
 	}
 	return nil
 }
CVE-2015-5725: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2018-02-21T16:29Z
Repository: https://github.com/bcit-ci/CodeIgniter
Language: PHP
Files changed: system/database/DB_active_rec.php
Commit date: 2015-08-20 13:26:13 +0300
Commit message: fixes potential SQL injection vector in Active Record offset()

Diff: diff --git a/system/database/DB_active_rec.php b/system/database/DB_active_rec.php
index f4b796cc..33e2ea27 100644
--- a/system/database/DB_active_rec.php
+++ b/system/database/DB_active_rec.php
@@ -893,11 +893,11 @@ class CI_DB_active_record extends CI_DB_driver {
 	 * @param	integer	the offset value
 	 * @return	object
 	 */
 	public function offset($offset)
 	{
-		$this->ar_offset = $offset;
+		$this->ar_offset = (int) $offset;
 		return $this;
 	}
 
 	// --------------------------------------------------------------------
 

Vulnerable code: 		$this->ar_offset = $offset;
Fixed code: 		$this->ar_offset = (int) $offset;
CVE-2022-4572: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.1
Published: 2022-12-17T02:15Z
Repository: https://github.com/jrspruitt/ubi_reader
Language: Unknown
Commit date: 2022-06-16 23:34:05 -0700
Commit message: Merge pull request #57 from onekey-sec/fix-path-traversal

Fix path traversal vulnerability.
CVE-2014-4501: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-07-23T14:55Z
Repository: https://github.com/sgminer-dev/sgminer
Language: C
Files changed: util.c
Commit date: 2014-06-05 23:07:08 +0300
Commit message: stratum: parse_reconnect(): treat pool-sent URL as untrusted.

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for reminding
that this existed and highlighting the offender.

Also to Luke-jr for actually fixing this in bfgminer. :D

Diff: diff --git a/util.c b/util.c
index 77f20431..94154518 100644
--- a/util.c
+++ b/util.c
@@ -1716,29 +1716,27 @@ static void __suspend_stratum(struct pool *pool)
 	pool->sock = 0;
 }
 
 static bool parse_reconnect(struct pool *pool, json_t *val)
 {
-	char *sockaddr_url, *stratum_port, *tmp;
-	char *url, *port, address[256];
-
 	if (opt_disable_client_reconnect) {
-		applog(LOG_WARNING, "Stratum client.reconnect forbidden, aborting.");
+		applog(LOG_WARNING, "Stratum client.reconnect received but is disabled, not reconnecting.");
 		return false;
 	}
 
-	memset(address, 0, 255);
+	char *url, *port, address[256];
+	char *sockaddr_url, *stratum_port, *tmp; /* Tempvars. */
+
 	url = (char *)json_string_value(json_array_get(val, 0));
 	if (!url)
 		url = pool->sockaddr_url;
 
 	port = (char *)json_string_value(json_array_get(val, 1));
 	if (!port)
 		port = pool->stratum_port;
 
-	sprintf(address, "%s:%s", url, port);
-
+	snprintf(address, sizeof(address), "%s:%s", url, port);
 	if (!extract_sockaddr(address, &sockaddr_url, &stratum_port))
 		return false;
 
 	applog(LOG_NOTICE, "Reconnect requested from %s to %s", get_pool_name(pool), address);
 

Vulnerable code: 	char *sockaddr_url, *stratum_port, *tmp;
	char *url, *port, address[256];

		applog(LOG_WARNING, "Stratum client.reconnect forbidden, aborting.");
	memset(address, 0, 255);
	sprintf(address, "%s:%s", url, port);

Fixed code: 		applog(LOG_WARNING, "Stratum client.reconnect received but is disabled, not reconnecting.");
	char *url, *port, address[256];
	char *sockaddr_url, *stratum_port, *tmp; /* Tempvars. */

	snprintf(address, sizeof(address), "%s:%s", url, port);
CVE-2014-4501: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-07-23T14:55Z
Repository: https://github.com/sgminer-dev/sgminer
Language: C
Files changed: util.c
Commit date: 2014-06-05 21:29:44 +0300
Commit message: Stratum: extract_sockaddr: Truncate overlong addresses rather than stack overflow

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!

Diff: diff --git a/util.c b/util.c
index 16aa98a4..77f20431 100644
--- a/util.c
+++ b/util.c
@@ -1217,10 +1217,17 @@ bool extract_sockaddr(char *url, char **sockaddr_url, char **sockaddr_port)
 	} else
 		url_len = strlen(url_begin);
 
 	if (url_len < 1)
 		return false;
+	
+	if (url_len >= sizeof(url_address))
+	{
+		applog(LOG_WARNING, "%s: Truncating overflowed address '%.*s'",
+		       __func__, url_len, url_begin);
+		url_len = sizeof(url_address) - 1;
+	}
 
 	sprintf(url_address, "%.*s", url_len, url_begin);
 
 	if (port_len) {
 		char *slash;

Fixed code: 	
	if (url_len >= sizeof(url_address))
	{
		applog(LOG_WARNING, "%s: Truncating overflowed address '%.*s'",
		       __func__, url_len, url_begin);
		url_len = sizeof(url_address) - 1;
	}
CVE-2014-4502: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-07-23T14:55Z
Repository: https://github.com/sgminer-dev/sgminer
Language: C
Files changed: util.c
Commit date: 2014-06-05 21:20:25 +0300
Commit message: Bugfix: initiate_stratum: Ensure extranonce2 size is not negative (which could lead to exploits later as too little memory gets allocated)

Thanks to Mick Ayzenberg <mick@dejavusecurity.com> for finding this!

Diff: diff --git a/util.c b/util.c
index d1846437..16aa98a4 100644
--- a/util.c
+++ b/util.c
@@ -2503,11 +2503,12 @@ resend:
 		applog(LOG_INFO, "Failed to get nonce1 in initiate_stratum");
 		free(sessionid);
 		goto out;
 	}
 	n2size = json_integer_value(json_array_get(res_val, 2));
-	if (!n2size) {
+	if (n2size < 1)
+	{
 		applog(LOG_INFO, "Failed to get n2size in initiate_stratum");
 		free(sessionid);
 		free(nonce1);
 		goto out;
 	}

Vulnerable code: 	if (!n2size) {
Fixed code: 	if (n2size < 1)
	{
CVE-2014-4503: Improper Input Validation (CWE-20)
value: The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of service (application exit) via a crafted (1) bbversion, (2) prev_hash, (3) nbit, or (4) ntime parameter in a mining.notify action stratum message.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2014-07-23T14:55Z
Repository: https://github.com/sgminer-dev/sgminer
Language: C
Files changed: util.c
Commit date: 2014-06-05 23:07:47 +0300
Commit message: stratum: parse_notify(): Don't die on malformed bbversion/prev_hash/nbit/ntime.

Might have introduced a memory leak, don't have time to check. :(

Should the other hex2bin()'s be checked?

Thanks to Mick Ayzenberg <mick.dejavusecurity.com> for finding this.

Diff: diff --git a/util.c b/util.c
index 94154518..b3d2f0b3 100644
--- a/util.c
+++ b/util.c
@@ -1598,28 +1598,35 @@ static bool parse_notify(struct pool *pool, json_t *val)
 		blank_merkel,
 		pool->swork.ntime,
 		pool->swork.nbit,
 		"00000000", /* nonce */
 		workpadding);
-	if (unlikely(!hex2bin(pool->header_bin, header, 128)))
-		quit(1, "Failed to convert header to header_bin in parse_notify");
+	if (unlikely(!hex2bin(pool->header_bin, header, 128))) {
+		applog(LOG_WARNING, "%s: Failed to convert header to header_bin, got %s", __func__, header);
+		pool_failed(pool);
+		// TODO: memory leaks? goto out, clean up there?
+		return false;
+	}
 
 	cb1 = (unsigned char *)calloc(cb1_len, 1);
 	if (unlikely(!cb1))
 		quithere(1, "Failed to calloc cb1 in parse_notify");
 	hex2bin(cb1, coinbase1, cb1_len);
+
 	cb2 = (unsigned char *)calloc(cb2_len, 1);
 	if (unlikely(!cb2))
 		quithere(1, "Failed to calloc cb2 in parse_notify");
 	hex2bin(cb2, coinbase2, cb2_len);
+
 	free(pool->coinbase);
 	align_len(&alloc_len);
 	pool->coinbase = (unsigned char *)calloc(alloc_len, 1);
 	if (unlikely(!pool->coinbase))
 		quit(1, "Failed to calloc pool coinbase in parse_notify");
 	memcpy(pool->coinbase, cb1, cb1_len);
 	memcpy(pool->coinbase + cb1_len, pool->nonce1bin, pool->n1_len);
+	// NOTE: gap for nonce2, filled at work generation time
 	memcpy(pool->coinbase + cb1_len + pool->n1_len + pool->n2size, cb2, cb2_len);
 	cg_wunlock(&pool->data_lock);
 
 	if (opt_protocol) {
 		applog(LOG_DEBUG, "job_id: %s", job_id);

Vulnerable code: 	if (unlikely(!hex2bin(pool->header_bin, header, 128)))
		quit(1, "Failed to convert header to header_bin in parse_notify");
Fixed code: 	if (unlikely(!hex2bin(pool->header_bin, header, 128))) {
		applog(LOG_WARNING, "%s: Failed to convert header to header_bin, got %s", __func__, header);
		pool_failed(pool);
		// TODO: memory leaks? goto out, clean up there?
		return false;
	}


	// NOTE: gap for nonce2, filled at work generation time
CVE-2023-52083: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Winter is a free, open-source content management system.  Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-12-28T23:15Z
Repository: https://github.com/wintercms/winter
Language: PHP
Files changed: modules/system/classes/MediaLibrary.php
Commit date: 2023-11-30 13:40:01 -0600
Commit message: Improve detection of renames to SVG
Diff: diff --git a/modules/system/classes/MediaLibrary.php b/modules/system/classes/MediaLibrary.php
index 032ee92e3..0a28ea023 100644
--- a/modules/system/classes/MediaLibrary.php
+++ b/modules/system/classes/MediaLibrary.php
@@ -349,11 +349,11 @@ public function moveFile($oldPath, $newPath, $isRename = false)
         $fullNewPath = $this->getMediaPath($newPath);
 
         // If the file extension is changed to SVG, ensure that it has been sanitized
         $oldExt = pathinfo($oldPath, PATHINFO_EXTENSION);
         $newExt = pathinfo($newPath, PATHINFO_EXTENSION);
-        if ($oldExt !== $newExt && $newExt === 'svg') {
+        if ($oldExt !== $newExt && strtolower($newExt) === 'svg') {
             $contents = $this->getStorageDisk()->get($fullOldPath);
             $contents = Svg::sanitize($contents);
             $this->getStorageDisk()->put($fullOldPath, $contents);
         }
 

Vulnerable code:         if ($oldExt !== $newExt && $newExt === 'svg') {
Fixed code:         if ($oldExt !== $newExt && strtolower($newExt) === 'svg') {
CVE-2023-52084: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-12-28T23:15Z
Repository: https://github.com/wintercms/winter
Language: PHP
Files changed: modules/backend/formwidgets/colorpicker/partials/_colorpicker.php
Commit date: 2023-12-11 13:10:05 -0600
Commit message: Escape output of colorpicker values

Diff: diff --git a/modules/backend/formwidgets/colorpicker/partials/_colorpicker.php b/modules/backend/formwidgets/colorpicker/partials/_colorpicker.php
index 7bdb0e50ca..468f41476c 100644
--- a/modules/backend/formwidgets/colorpicker/partials/_colorpicker.php
+++ b/modules/backend/formwidgets/colorpicker/partials/_colorpicker.php
@@ -29,18 +29,18 @@ class="
         <?php if ($readOnly || !$allowCustom || $this->previewMode): ?>
             <span
                 data-color-value
                 class="form-control"
             >
-                <?= $value ?>
+                <?= e($value); ?>
             </span>
         <?php else: ?>
             <input
                 data-color-value
                 class="form-control"
                 placeholder="No color"
-                value="<?= $value ?>"
+                value="<?= e($value); ?>"
                 <?php if ($disabled): ?>
                     disabled
                 <?php endif ?>
             >
         <?php endif ?>

Vulnerable code:                 <?= $value ?>
                value="<?= $value ?>"
Fixed code:                 <?= e($value); ?>
                value="<?= e($value); ?>"
CVE-2014-1875: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Published: 2014-10-06T23:55Z
Repository: https://github.com/dagolden/Capture-Tiny
Language: Other
Files changed: Changes, lib/Capture/Tiny.pm
Commit date: 2014-02-06 17:07:48 -0500
Commit message: close security hole opening semaphore file in /tmp

Diff: diff --git a/Changes b/Changes
index e002c99..845ec4a 100644
--- a/Changes
+++ b/Changes
@@ -1,9 +1,14 @@
 Revision history for Capture-Tiny
 
 {{$NEXT}}
 
+  Fixed:
+
+  - Closed security hole in use of semaphore flag in /tmp;
+    now opens semaphore the using O_CREAT|O_EXCL
+    
 0.23      2013-10-20 11:25:34 America/New_York
 
   Fixed:
 
   - minimum Perl prereq is back to 5.6 (but $diety help you if
diff --git a/lib/Capture/Tiny.pm b/lib/Capture/Tiny.pm
index c3eab67..3464ce7 100644
--- a/lib/Capture/Tiny.pm
+++ b/lib/Capture/Tiny.pm
@@ -61,15 +61,22 @@ our $TIMEOUT = 30;
 # command to tee output -- the argument is a filename that must
 # be opened to signal that the process is ready to receive input.
 # This is annoying, but seems to be the best that can be done
 # as a simple, portable IPC technique
 #--------------------------------------------------------------------------#
-my @cmd = ($^X, '-C0', '-e', '$SIG{HUP}=sub{exit}; '
-  . 'if( my $fn=shift ){ open my $fh, qq{>$fn}; print {$fh} $$; close $fh;} '
-  . 'my $buf; while (sysread(STDIN, $buf, 2048)) { '
-  . 'syswrite(STDOUT, $buf); syswrite(STDERR, $buf)}'
-);
+my @cmd = ($^X, '-C0', '-e', <<'HERE');
+use Fcntl;
+$SIG{HUP}=sub{exit};
+if ( my $fn=shift ) {
+    sysopen(my $fh, qq{$fn}, O_WRONLY|O_CREAT|O_EXCL) or die $!;
+    print {$fh} $$;
+    close $fh;
+}
+my $buf; while (sysread(STDIN, $buf, 2048)) {
+    syswrite(STDOUT, $buf); syswrite(STDERR, $buf);
+}
+HERE
 
 #--------------------------------------------------------------------------#
 # filehandle manipulation
 #--------------------------------------------------------------------------#
 

Vulnerable code: my @cmd = ($^X, '-C0', '-e', '$SIG{HUP}=sub{exit}; '
  . 'if( my $fn=shift ){ open my $fh, qq{>$fn}; print {$fh} $$; close $fh;} '
  . 'my $buf; while (sysread(STDIN, $buf, 2048)) { '
  . 'syswrite(STDOUT, $buf); syswrite(STDERR, $buf)}'
);
Fixed code:   Fixed:

  - Closed security hole in use of semaphore flag in /tmp;
    now opens semaphore the using O_CREAT|O_EXCL
    
my @cmd = ($^X, '-C0', '-e', <<'HERE');
use Fcntl;
$SIG{HUP}=sub{exit};
if ( my $fn=shift ) {
    sysopen(my $fh, qq{$fn}, O_WRONLY|O_CREAT|O_EXCL) or die $!;
    print {$fh} $$;
    close $fh;
}
my $buf; while (sysread(STDIN, $buf, 2048)) {
    syswrite(STDOUT, $buf); syswrite(STDERR, $buf);
}
HERE
CVE-2021-3798: Other (NVD-CWE-Other)
value: A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.5
Published: 2022-08-23T16:15Z
Repository: https://github.com/opencryptoki/opencryptoki
Language: C
Files changed: usr/lib/soft_stdll/soft_specific.c
Commit date: 2021-05-11 20:05:36 +0200
Commit message: SOFT: Check the EC Key on C_CreateObject and C_DeriveKey

When constructing an OpenSSL EC public or private key from PKCS#11
attributes or ECDH public data, check that the key is valid, i.e. that
the point is on the curve.

This prevents one from creating an EC key object via C_CreateObject with
invalid key data. It also prevents C_DeriveKey to derive a secret using
ECDH with an EC public key (public data) that uses a different curve
or is invalid by other means.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>

Diff: diff --git a/usr/lib/soft_stdll/soft_specific.c b/usr/lib/soft_stdll/soft_specific.c
index c30be1da..aeff39a9 100644
--- a/usr/lib/soft_stdll/soft_specific.c
+++ b/usr/lib/soft_stdll/soft_specific.c
@@ -4363,10 +4363,16 @@ static CK_RV fill_ec_key_from_pubkey(EC_KEY *ec_key, const CK_BYTE *data,
         TRACE_ERROR("EC_KEY_oct2key failed\n");
         rc = CKR_FUNCTION_FAILED;
         goto out;
     }
 
+    if (!EC_KEY_check_key(ec_key)) {
+        TRACE_ERROR("EC_KEY_check_key failed\n");
+        rc = CKR_PUBLIC_KEY_INVALID;
+        goto out;
+    }
+
 out:
     if (allocated && ecpoint != NULL)
         free(ecpoint);
 
     return rc;
@@ -4402,10 +4408,16 @@ static CK_RV fill_ec_key_from_privkey(EC_KEY *ec_key, const CK_BYTE *data,
         TRACE_ERROR("EC_KEY_set_public_key failed\n");
         rc = CKR_FUNCTION_FAILED;
         goto out;
     }
 
+    if (!EC_KEY_check_key(ec_key)) {
+        TRACE_ERROR("EC_KEY_check_key failed\n");
+        rc = CKR_FUNCTION_FAILED;
+        goto out;
+    }
+
 out:
     if (point != NULL)
         EC_POINT_free(point);
 
     return rc;

Fixed code:     if (!EC_KEY_check_key(ec_key)) {
        TRACE_ERROR("EC_KEY_check_key failed\n");
        rc = CKR_PUBLIC_KEY_INVALID;
        goto out;
    }

    if (!EC_KEY_check_key(ec_key)) {
        TRACE_ERROR("EC_KEY_check_key failed\n");
        rc = CKR_FUNCTION_FAILED;
        goto out;
    }
CVE-2021-38173: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2021-08-07T19:15Z
Repository: https://github.com/digint/btrbk
Language: Shell
Files changed: ssh_filter_btrbk.sh
Commit date: 2021-03-21 13:24:59 +0100
Commit message: ssh_filter_btrbk.sh: fix alternation regex

Security vulnerability fixed in alternation regex. Specialy crafted
commands may be executed without being propely checked.

Affects all versions >= btrbk-v0.23.0

Regression from:

   ccb5ed5e71 ssh_filter_btrbk: allow "realpath" and "cat /proc/self/mounts" on targets

Reported by: @protree (responsible disclosure)

Diff: diff --git a/ssh_filter_btrbk.sh b/ssh_filter_btrbk.sh
index 5240597..c742aa5 100755
--- a/ssh_filter_btrbk.sh
+++ b/ssh_filter_btrbk.sh
@@ -84,11 +84,11 @@ reject_filtered_cmd()
     allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}"
     if [[ $SSH_ORIGINAL_COMMAND =~ $allow_stream_match ]] ; then
         return 0
     fi
 
-    exact_cmd_match="^${allow_exact_list}$";
+    exact_cmd_match="^(${allow_exact_list})$";
     if [[ $SSH_ORIGINAL_COMMAND =~ $exact_cmd_match ]] ; then
         return 0
     fi
 
     reject_and_die "disallowed command${restrict_path_list:+ (restrict-path: \"${restrict_path_list//|/\", \"}\")}"

Vulnerable code:     exact_cmd_match="^${allow_exact_list}$";
Fixed code:     exact_cmd_match="^(${allow_exact_list})$";