Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-25092: Other (NVD-CWE-Other)
value: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The patch is named cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244483.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2023-11-05T21:15Z
Repository: https://github.com/Vaerys-Dawn/DiscordSailv2
Language: Unknown
Commit date: 2018-03-18 15:55:35 +1100
Commit message: 2.10.3 Bug Fixes and Removed Vulnerabilites

+ added Ban logging
+ added Kick logging
* Remove ability for CCs to contain existing command names.
* Make the return message more informative.
* Fixes a vulnerability in some commands that would allow users to use
mentions they would not normally have access to.
* fixed a bug involving the commands command showing dm commands
regardless of what page you were on.
+ added page system to the listJoinMessages
* fixed vulerability in the tag handler that would allow users to use
mentions.
+ added ChannelSetting Profiles
* addprofile no longer adds profiles if the user already has one
+ added toggle SendJoinMessages
* renamed JoinServerMessages tp WelcomeMessages
fixed a bug that caused daily messages to crash
* stoped sail from logging pin messages

Diff: diff --git a/target/JavaDiscordSAILv2.jar b/target/JavaDiscordSAILv2.jar
index ef84cbb..d2feb1c 100644
Binary files a/target/JavaDiscordSAILv2.jar and b/target/JavaDiscordSAILv2.jar differ
CVE-2018-25093: Other (NVD-CWE-Other)
value: A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.10.3 is able to address this issue. The name of the patch is cc12e0be82a5d05d9f359ed8e56088f4f8b8eb69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-244484.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2023-11-06T01:15Z
Repository: https://github.com/Vaerys-Dawn/DiscordSailv2
Language: Unknown
Commit date: 2018-03-18 15:55:35 +1100
Commit message: 2.10.3 Bug Fixes and Removed Vulnerabilites

+ added Ban logging
+ added Kick logging
* Remove ability for CCs to contain existing command names.
* Make the return message more informative.
* Fixes a vulnerability in some commands that would allow users to use
mentions they would not normally have access to.
* fixed a bug involving the commands command showing dm commands
regardless of what page you were on.
+ added page system to the listJoinMessages
* fixed vulerability in the tag handler that would allow users to use
mentions.
+ added ChannelSetting Profiles
* addprofile no longer adds profiles if the user already has one
+ added toggle SendJoinMessages
* renamed JoinServerMessages tp WelcomeMessages
fixed a bug that caused daily messages to crash
* stoped sail from logging pin messages

Diff: diff --git a/target/JavaDiscordSAILv2.jar b/target/JavaDiscordSAILv2.jar
index ef84cbb..d2feb1c 100644
Binary files a/target/JavaDiscordSAILv2.jar and b/target/JavaDiscordSAILv2.jar differ
CVE-2020-7791: Insufficient Information (NVD-CWE-noinfo)
value: This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-12-11T17:15Z
Repository: https://github.com/turquoiseowl/i18n
Language: C#
Files changed: src/i18n/Concrete/TextLocalizer.cs, src/i18n/LocalizedApplication.cs
Commit date: 2019-08-14 10:51:41 +0100
Commit message: FIX - NullReferenceException caused by bad langtag #387

Diff: diff --git a/src/i18n/Concrete/TextLocalizer.cs b/src/i18n/Concrete/TextLocalizer.cs
index 16b09e5..ca54577 100644
--- a/src/i18n/Concrete/TextLocalizer.cs
+++ b/src/i18n/Concrete/TextLocalizer.cs
@@ -124,10 +124,13 @@ namespace i18n
         /// <returns>true if one or more localized messages exist for the language; otherwise false.</returns>
         private bool IsLanguageValid(string langtag)
         {
         // Note that there is no need to serialize access to System.Web.HttpRuntime.Cache when just reading from it.
         //
+            if (!langtag.IsSet()) {
+                return false; }
+
             // Default language is always valid.
             if (LocalizedApplication.Current.MessageKeyIsValueInDefaultLanguage
                 && LocalizedApplication.Current.DefaultLanguageTag.Equals(langtag)) {
                 return true; }
 
diff --git a/src/i18n/LocalizedApplication.cs b/src/i18n/LocalizedApplication.cs
index f0034f3..d537807 100644
--- a/src/i18n/LocalizedApplication.cs
+++ b/src/i18n/LocalizedApplication.cs
@@ -116,14 +116,16 @@ namespace i18n
             {
                 return DefaultLanguageTag.ToString();
             }
             set
             {
-                DefaultLanguageTag = LanguageTag.GetCachedInstance(value);
+                LanguageTag defaultLanguageTag = LanguageTag.GetCachedInstance(value);
+                if (defaultLanguageTag != null) {
+                    DefaultLanguageTag = defaultLanguageTag; }
             }
         }
-        public LanguageTag DefaultLanguageTag { get; set; }
+        public LanguageTag DefaultLanguageTag { get; private set; }
 
         /// <summary>
         /// Specifies whether the key for a message may be assumed to be the value for
         /// the message in the default language. Defaults to true.
         /// </summary>

Vulnerable code:                 DefaultLanguageTag = LanguageTag.GetCachedInstance(value);
        public LanguageTag DefaultLanguageTag { get; set; }
Fixed code:             if (!langtag.IsSet()) {
                return false; }

                LanguageTag defaultLanguageTag = LanguageTag.GetCachedInstance(value);
                if (defaultLanguageTag != null) {
                    DefaultLanguageTag = defaultLanguageTag; }
        public LanguageTag DefaultLanguageTag { get; private set; }
CVE-2023-32698: Incorrect Default Permissions (CWE-276)
value: nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged 
the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creating packages without checking/setting file permissions before packaging could result in bad permissions for files/folders.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 7.1
Published: 2023-05-30T04:15Z
Repository: https://github.com/goreleaser/nfpm
Language: Unknown
Commit date: 2023-05-24 02:57:09 +0000
Commit message: sec: fix for CVE-2023-32698

This commit merely documents all commits related to fixing
CVE-2023-32698, as they were a bit spread.

It also has the intent of showing up properly in our changelog.

Here's the commit list:

* 8e517cca1704e5af68769e9401e51ea139022f9c
* f64a311eefea340cd3f20cd4568de41b4c5e9aa6
* 66c3d277cfee061b2ec3b2a31c15a1f879b8539d

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
CVE-2018-13797: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2018-07-10T12:29Z
Repository: https://github.com/scravy/node-macaddress
Language: Unknown
Commit date: 2018-06-24 00:40:24 +0200
Commit message: Merge pull request #20 from flypapertech/fixCommandInjection

Fixes arbitrary command injection by using execFile instead of exec
CVE-2020-5259: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.6
Published: 2020-03-10T18:15Z
Repository: https://github.com/dojo/dojox
Language: JavaScript
Files changed: jq.js
Commit date: 2020-03-10 07:25:04 -0700
Commit message: Merge pull request from GHSA-3hw5-q855-g6cw

Prevent the special __proto__ property name from being mixed in to
prevent polluting the prototoype of the object being mixed into in the
jqMix function in jq.js
Diff: diff --git a/jq.js b/jq.js
index 81d3387c6..b0c2c21ad 100644
--- a/jq.js
+++ b/jq.js
@@ -453,11 +453,11 @@ dojo.query differences that cause some tests to fail:
 		for(var x in props){
 			// the "tobj" condition avoid copying properties in "props"
 			// inherited from Object.prototype.  For example, if obj has a custom
 			// toString() method, don't overwrite it with the toString() method
 			// that props inherited from Object.prototype
-			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
+			if(x !== '__proto__ ' && ((tobj[x] === undefined || tobj[x] != props[x])) && props[x] !== undefined && obj != props[x]){
 				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
 					if(dojo.isArray(props[x])){
 						obj[x] = props[x];
 					}else{
 						obj[x] = jqMix(obj[x], props[x]);

Vulnerable code: 			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
Fixed code: 			if(x !== '__proto__ ' && ((tobj[x] === undefined || tobj[x] != props[x])) && props[x] !== undefined && obj != props[x]){
CVE-2021-28117: Insufficient Information (NVD-CWE-noinfo)
value: libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-03-20T21:15Z
Repository: https://github.com/KDE/discover
Language: C++
Files changed: libdiscover/backends/KNSBackend/KNSResource.cpp
Commit date: 2021-03-10 21:52:52 +0100
Commit message: Only turn http[s] links into clickable links

CVE-2021-28117

(cherry picked from commit d375031ff0262cedac7d6ee2b26d6a164ddebb67)

Diff: diff --git a/libdiscover/backends/KNSBackend/KNSResource.cpp b/libdiscover/backends/KNSBackend/KNSResource.cpp
index e2b40a62..e84ca4aa 100644
--- a/libdiscover/backends/KNSBackend/KNSResource.cpp
+++ b/libdiscover/backends/KNSBackend/KNSResource.cpp
@@ -99,11 +99,11 @@ QString KNSResource::longDescription()
     ret.replace(QStringLiteral("[li]"), QStringLiteral("\n* "));
     // Get rid of all BBCode markup we don't handle above
     ret.remove(QRegularExpression(QStringLiteral("\\[\\/?[a-z]*\\]")));
     // Find anything that looks like a link (but which also is not some html
     // tag value or another already) and make it a link
-    static const QRegularExpression urlRegExp(QStringLiteral("(^|\\s)([-a-zA-Z0-9@:%_\\+.~#?&//=]{2,256}\\.[a-z]{2,4}\\b(\\/[-a-zA-Z0-9@:;%_\\+.~#?&//=]*)?)"), QRegularExpression::CaseInsensitiveOption);
+    static const QRegularExpression urlRegExp(QStringLiteral("(^|\\s)(http[-a-zA-Z0-9@:%_\\+.~#?&//=]{2,256}\\.[a-z]{2,4}\\b(\\/[-a-zA-Z0-9@:;%_\\+.~#?&//=]*)?)"), QRegularExpression::CaseInsensitiveOption);
     ret.replace(urlRegExp, QStringLiteral("<a href=\"\\2\">\\2</a>"));
     return ret;
 }
 
 QString KNSResource::name() const

Vulnerable code:     static const QRegularExpression urlRegExp(QStringLiteral("(^|\\s)([-a-zA-Z0-9@:%_\\+.~#?&//=]{2,256}\\.[a-z]{2,4}\\b(\\/[-a-zA-Z0-9@:;%_\\+.~#?&//=]*)?)"), QRegularExpression::CaseInsensitiveOption);
Fixed code:     static const QRegularExpression urlRegExp(QStringLiteral("(^|\\s)(http[-a-zA-Z0-9@:%_\\+.~#?&//=]{2,256}\\.[a-z]{2,4}\\b(\\/[-a-zA-Z0-9@:;%_\\+.~#?&//=]*)?)"), QRegularExpression::CaseInsensitiveOption);
CVE-2023-6709: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
value: Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
CWE description: The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CVSS v3 base score: 8.8
Published: 2023-12-12T04:15Z
Repository: https://github.com/mlflow/mlflow
Language: Python
Files changed: mlflow/recipes/cards/__init__.py
Commit date: 2023-12-07 11:09:41 -0500
Commit message: Use `SandboxedEnvironment` when rendering cards (#10640)

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>
Diff: diff --git a/mlflow/recipes/cards/__init__.py b/mlflow/recipes/cards/__init__.py
index 24361b8acb..dafdaa89f2 100644
--- a/mlflow/recipes/cards/__init__.py
+++ b/mlflow/recipes/cards/__init__.py
@@ -118,13 +118,14 @@ class CardTab:
         """
         Returns a rendered HTML representing the content of the tab.
 
         :return: a HTML string
         """
-        import jinja2
+        from jinja2 import BaseLoader
+        from jinja2.sandbox import SandboxedEnvironment
 
-        j2_env = jinja2.Environment(loader=jinja2.BaseLoader()).from_string(self.template)
+        j2_env = SandboxedEnvironment(loader=BaseLoader()).from_string(self.template)
         return j2_env.render({**self._context})
 
 
 class BaseCard:
     def __init__(self, recipe_name: str, step_name: str) -> None:

Vulnerable code:         import jinja2
        j2_env = jinja2.Environment(loader=jinja2.BaseLoader()).from_string(self.template)
Fixed code:         from jinja2 import BaseLoader
        from jinja2.sandbox import SandboxedEnvironment
        j2_env = SandboxedEnvironment(loader=BaseLoader()).from_string(self.template)
CVE-2023-6977: Path Traversal: '\..\filename' (CWE-29)
value: This vulnerability enables malicious users to read sensitive files on the server.
CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
CVSS v3 base score: 7.5
Published: 2023-12-20T06:15Z
Repository: https://github.com/mlflow/mlflow
Language: Python
Files changed: mlflow/utils/uri.py, tests/utils/test_uri.py
Commit date: 2023-12-07 13:28:07 -0500
Commit message: Improve `is_local_uri` (#10638)

Signed-off-by: harupy <17039389+harupy@users.noreply.github.com>
Diff: diff --git a/mlflow/utils/uri.py b/mlflow/utils/uri.py
index eb59148ccb..331648b8e4 100644
--- a/mlflow/utils/uri.py
+++ b/mlflow/utils/uri.py
@@ -39,19 +39,22 @@ def is_local_uri(uri, is_tracking_or_registry_uri=True):
     if is_windows() and uri.startswith("\\\\"):
         # windows network drive path looks like: "\\<server name>\path\..."
         return False
 
     parsed_uri = urllib.parse.urlparse(uri)
+    scheme = parsed_uri.scheme
+    if scheme == "":
+        return True
+
     if parsed_uri.hostname and not (
         parsed_uri.hostname == "."
         or parsed_uri.hostname.startswith("localhost")
         or parsed_uri.hostname.startswith("127.0.0.1")
     ):
         return False
 
-    scheme = parsed_uri.scheme
-    if scheme == "" or scheme == "file":
+    if scheme == "file":
         return True
 
     if is_windows() and len(scheme) == 1 and scheme.lower() == pathlib.Path(uri).drive.lower()[0]:
         return True
 
diff --git a/tests/utils/test_uri.py b/tests/utils/test_uri.py
index 758642e9be..b776795c61 100644
--- a/tests/utils/test_uri.py
+++ b/tests/utils/test_uri.py
@@ -97,10 +97,12 @@ def test_is_local_uri():
     assert is_local_uri("file://./mlruns")
     assert is_local_uri("file://localhost/mlruns")
     assert is_local_uri("file://localhost:5000/mlruns")
     assert is_local_uri("file://127.0.0.1/mlruns")
     assert is_local_uri("file://127.0.0.1:5000/mlruns")
+    assert is_local_uri("//proc/self/root")
+    assert is_local_uri("/proc/self/root")
 
     assert not is_local_uri("file://myhostname/path/to/file")
     assert not is_local_uri("https://whatever")
     assert not is_local_uri("http://whatever")
     assert not is_local_uri("databricks")

Vulnerable code:     scheme = parsed_uri.scheme
    if scheme == "" or scheme == "file":
Fixed code:     scheme = parsed_uri.scheme
    if scheme == "":
        return True

    if scheme == "file":
    assert is_local_uri("//proc/self/root")
    assert is_local_uri("/proc/self/root")
CVE-2021-47154: Insufficient Information (NVD-CWE-noinfo)
value: The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T05:15Z
Repository: https://github.com/stigtsp/Net-CIDR-Lite
Language: Perl
Files changed: Lite.pm, t/base.t
Commit date: 2021-03-31 17:33:13 +0200
Commit message: Security: Prevent leading zeroes in ipv4 octets

This prevents prevents octal ipv4 addresses from being incorrectly
handled by not supporting leading zeroes.

010.0.0.1 was incorrectly treated as 10.0.0.1, rather than 8.0.0.1

More information is availabe here:
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/

Diff: diff --git a/Lite.pm b/Lite.pm
index fd6df73..d44f881 100644
--- a/Lite.pm
+++ b/Lite.pm
@@ -179,11 +179,11 @@ sub _init {
 
 sub _pack_ipv4 {
     my @nums = split /\./, shift(), -1;
     return unless @nums == 4;
     for (@nums) {
-        return unless /^\d{1,3}$/ and $_ <= 255;
+        return unless /^\d{1,3}$/ and !/^0\d{1,2}$/ and $_ <= 255;
     }
     pack("CC*", 0, @nums);
 }
 
 sub _unpack_ipv4 {
diff --git a/t/base.t b/t/base.t
index cf32c5e..292456d 100644
--- a/t/base.t
+++ b/t/base.t
@@ -6,11 +6,11 @@
 # change 'tests => 1' to 'tests => last_test_to_print';
 
 use Test;
 use strict;
 $|++;
-BEGIN { plan tests => 39 };
+BEGIN { plan tests => 42 };
 use Net::CIDR::Lite;
 ok(1); # If we made it this far, we are ok.
 
 #########################
 
@@ -131,5 +131,16 @@ ok(join(', ', @list_short_range), '10.0.0.1-2, 10.0.0.5');
 	10.0.1.22
 	10.0.2.250-10.0.5.8
 })->list_short_range;
 ok(join(', ', @list_short_range), '10.0.0.250-255, 10.0.1.0-20, 10.0.1.22, 10.0.2.250-255, 10.0.3.0-255, 10.0.4.0-255, 10.0.5.0-8');
 
+
+# Tests for vulnerability: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
+eval { Net::CIDR::Lite->new("010.0.0.0/8") };
+ok($@=~/Can't determine ip format/);
+
+my $err_octal = Net::CIDR::Lite->new;
+eval { $err_octal->add("010.0.0.0/8") };
+ok($@=~/Can't determine ip format/);
+
+eval { $err_octal->add("10.01.0.0/8") };
+ok($@=~/Can't determine ip format/);

Vulnerable code:         return unless /^\d{1,3}$/ and $_ <= 255;
BEGIN { plan tests => 39 };
Fixed code:         return unless /^\d{1,3}$/ and !/^0\d{1,2}$/ and $_ <= 255;
BEGIN { plan tests => 42 };

# Tests for vulnerability: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/
eval { Net::CIDR::Lite->new("010.0.0.0/8") };
ok($@=~/Can't determine ip format/);

my $err_octal = Net::CIDR::Lite->new;
eval { $err_octal->add("010.0.0.0/8") };
ok($@=~/Can't determine ip format/);

eval { $err_octal->add("10.01.0.0/8") };
ok($@=~/Can't determine ip format/);
CVE-2024-30187: Insufficient Information (NVD-CWE-noinfo)
value: Anope before 2.0.15 does not prevent resetting the password of a suspended account.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T08:15Z
Repository: https://github.com/anope/anope
Language: C++
Files changed: modules/commands/ns_resetpass.cpp
Commit date: 2024-02-17 19:52:39 +0000
Commit message: Prevent resetting the password of suspended accounts.

Closes #351.

Diff: diff --git a/modules/commands/ns_resetpass.cpp b/modules/commands/ns_resetpass.cpp
index bf5f3023..fe94c939 100644
--- a/modules/commands/ns_resetpass.cpp
+++ b/modules/commands/ns_resetpass.cpp
@@ -27,10 +27,12 @@ class CommandNSResetPass : public Command
 	{
 		const NickAlias *na;
 
 		if (!(na = NickAlias::Find(params[0])))
 			source.Reply(NICK_X_NOT_REGISTERED, params[0].c_str());
+		else if (na->nc->HasExt("NS_SUSPENDED"))
+			source.Reply(NICK_X_SUSPENDED, na->nc->display.c_str());
 		else if (!na->nc->email.equals_ci(params[1]))
 			source.Reply(_("Incorrect email address."));
 		else
 		{
 			if (SendResetEmail(source.GetUser(), na, source.service))
@@ -87,10 +89,16 @@ class NSResetPass : public Module
 
 			ResetInfo *ri = na ? reset.Get(na->nc) : NULL;
 			if (na && ri)
 			{
 				NickCore *nc = na->nc;
+				if (nc->HasExt("NS_SUSPENDED"))
+				{
+					source.Reply(NICK_X_SUSPENDED, nc->display.c_str());
+					return EVENT_STOP;
+				}
+
 				const Anope::string &passcode = params[1];
 				if (ri->time < Anope::CurTime - 3600)
 				{
 					reset.Unset(nc);
 					source.Reply(_("Your password reset request has expired."));

Fixed code: 		else if (na->nc->HasExt("NS_SUSPENDED"))
			source.Reply(NICK_X_SUSPENDED, na->nc->display.c_str());
				if (nc->HasExt("NS_SUSPENDED"))
				{
					source.Reply(NICK_X_SUSPENDED, nc->display.c_str());
					return EVENT_STOP;
				}
CVE-2019-13578: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-08-15T16:15Z
Repository: https://github.com/impress-org/give
Language: PHP
Files changed: includes/donors/class-give-donors-query.php
Commit date: 2019-07-11 17:58:17 +0530
Commit message: fix: allow orderby only for whitelist columns

Diff: diff --git a/includes/donors/class-give-donors-query.php b/includes/donors/class-give-donors-query.php
index ed8347bad..ab8ce7e9d 100644
--- a/includes/donors/class-give-donors-query.php
+++ b/includes/donors/class-give-donors-query.php
@@ -464,10 +464,11 @@ class Give_Donors_Query {
 		// Remove non existing column.
 		// Filter orderby values.
 		foreach ( $ordersby as $orderby => $order ) {
 			if( ! array_key_exists( $orderby, $table_columns ) ) {
 				unset( $ordersby[$orderby] );
+				continue;
 			}
 
 			$ordersby[ esc_sql( $orderby ) ] = esc_sql( $order );
 		}
 

Fixed code: 				continue;
CVE-2019-13578: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-08-15T16:15Z
Repository: https://github.com/impress-org/give
Language: PHP
Files changed: includes/payments/class-payments-query.php
Commit date: 2019-07-12 19:10:02 +0530
Commit message: chore: validate order param for payment query

Diff: diff --git a/includes/payments/class-payments-query.php b/includes/payments/class-payments-query.php
index 4553ad7a1..e3a7fb5c3 100644
--- a/includes/payments/class-payments-query.php
+++ b/includes/payments/class-payments-query.php
@@ -155,10 +155,13 @@ class Give_Payments_Query extends Give_Stats {
 	private function set_filters() {
 		// Reset param to apply filters.
 		// While set filters $args will get override and multiple get_payments call will not work.
 		$this->args = $this->_args;
 
+		// Whitelist order.
+		$this->args['order'] = in_array( strtoupper( $this->args['order'] ), array( 'ASC', 'DESC' ) ) ? $this->args['order'] : 'DESC' ;
+
 		$this->date_filter_pre();
 		$this->orderby();
 		$this->status();
 		$this->month();
 		$this->per_page();

Fixed code: 		// Whitelist order.
		$this->args['order'] = in_array( strtoupper( $this->args['order'] ), array( 'ASC', 'DESC' ) ) ? $this->args['order'] : 'DESC' ;
CVE-2019-13578: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-08-15T16:15Z
Repository: https://github.com/impress-org/give
Language: PHP
Files changed: includes/payments/class-payments-query.php
Commit date: 2019-07-12 21:27:05 +0530
Commit message: chore: validate orderby param for payment query

Diff: diff --git a/includes/payments/class-payments-query.php b/includes/payments/class-payments-query.php
index e3a7fb5c33..61f10ccb7d 100644
--- a/includes/payments/class-payments-query.php
+++ b/includes/payments/class-payments-query.php
@@ -813,10 +813,30 @@ class Give_Payments_Query extends Give_Stats {
 	 * @return string
 	 */
 	private function get_sql() {
 		global $wpdb;
 
+		$allowed_keys = array(
+			'post_name',
+			'post_author',
+			'post_date',
+			'post_title',
+			'post_status',
+			'post_modified',
+			'post_parent',
+			'post_type',
+			'menu_order',
+			'comment_count',
+		);
+
+		$this->args['orderby'] = 'post_parent__in';
+
+		// Whitelist orderby.
+		if( ! in_array( $this->args['orderby'], $allowed_keys ) ) {
+			$this->args['orderby'] = 'ID';
+		}
+
 		$where = "WHERE {$wpdb->posts}.post_type = 'give_payment'";
 		$where .= " AND {$wpdb->posts}.post_status IN ('" . implode( "','", $this->args['post_status'] ) . "')";
 
 		if ( is_numeric( $this->args['post_parent'] ) ) {
 			$where .= " AND {$wpdb->posts}.post_parent={$this->args['post_parent']}";

Fixed code: 		$allowed_keys = array(
			'post_name',
			'post_author',
			'post_date',
			'post_title',
			'post_status',
			'post_modified',
			'post_parent',
			'post_type',
			'menu_order',
			'comment_count',
		);

		$this->args['orderby'] = 'post_parent__in';

		// Whitelist orderby.
		if( ! in_array( $this->args['orderby'], $allowed_keys ) ) {
			$this->args['orderby'] = 'ID';
		}
CVE-2024-21488: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2024-01-30T05:15Z
Repository: https://github.com/tomas/network
Language: JavaScript
Files changed: lib/win32.js
Commit date: 2024-01-23 22:32:25 -0300
Commit message: Remove unneeded require in win32
Diff: diff --git a/lib/win32.js b/lib/win32.js
index 3519643..d9a4a07 100644
--- a/lib/win32.js
+++ b/lib/win32.js
@@ -1,9 +1,8 @@
 "use strict";
 
 var wmic = require('wmic'),
-    exec = require('child_process').exec,
     os   = require('os');
 
 function get_wmic_ip_value(what, nic_name, cb){
   exports.mac_address_for(nic_name, function(err, mac){
     if (err || !mac)

Vulnerable code:     exec = require('child_process').exec,
CVE-2022-36073: Improper Authentication (CWE-287)
value: RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.8
Published: 2022-09-07T20:15Z
Repository: https://github.com/rubygems/rubygems.org
Language: Unknown
Commit date: 2022-08-31 20:59:52 -0700
Commit message: Merge pull request from GHSA-8qpf-wf2p-25vg

Stop persisting unconfirmed_email when generating a new confirmation token
CVE-2019-11502: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2019-04-24T21:29Z
Repository: https://github.com/snapcore/snapd
Language: C
Files changed: cmd/snap-confine/mount-support.c
Commit date: 2019-03-04 18:40:11 +0100
Commit message: cmd/snap-confine: chown private /tmp parent to root.root

When snap-confine creates a private /tmp directory for a given snap it
first creates a temporary directory in /tmp/ named after the snap, along
with a random name. Inside that directory it creates a /tmp directory
with permissions appropriate for a future /tmp, namely 1777.

Up until recently the that directory was owned by the user who first
invoked snap-confine. Since the directory is reused by all the users on
the system this logic makes no sense.

This patch changes the related logic so that the private /tmp directory
is owned by root, just like the real one.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Diff: diff --git a/cmd/snap-confine/mount-support.c b/cmd/snap-confine/mount-support.c
index 3b43ec72e..6004b6391 100644
--- a/cmd/snap-confine/mount-support.c
+++ b/cmd/snap-confine/mount-support.c
@@ -60,12 +60,10 @@
 
 // TODO: simplify this, after all it is just a tmpfs
 // TODO: fold this into bootstrap
 static void setup_private_mount(const char *snap_name)
 {
-	uid_t uid = getuid();
-	gid_t gid = getgid();
 	char tmpdir[MAX_BUF] = { 0 };
 
 	// Create a 0700 base directory, this is the base dir that is
 	// protected from other users.
 	//
@@ -96,11 +94,11 @@ static void setup_private_mount(const char *snap_name)
 	// MS_BIND is there from linux 2.4
 	sc_do_mount(tmpdir, "/tmp", NULL, MS_BIND, NULL);
 	// MS_PRIVATE needs linux > 2.6.11
 	sc_do_mount("none", "/tmp", NULL, MS_PRIVATE, NULL);
 	// do the chown after the bind mount to avoid potential shenanigans
-	if (chown("/tmp/", uid, gid) < 0) {
+	if (chown("/tmp/", 0, 0) < 0) {
 		die("cannot change ownership of /tmp");
 	}
 	// chdir to original directory
 	if (chdir(pwd) != 0)
 		die("cannot change current working directory to the original directory");

Vulnerable code: 	uid_t uid = getuid();
	gid_t gid = getgid();
	if (chown("/tmp/", uid, gid) < 0) {
Fixed code: 	if (chown("/tmp/", 0, 0) < 0) {
CVE-2021-3155: Incorrect Default Permissions (CWE-276)
value: snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 5.5
Published: 2022-02-17T23:15Z
Repository: https://github.com/snapcore/snapd
Language: Unknown
Commit date: 2021-05-31 09:11:35 +0200
Commit message: Merge pull request #9897 from anonymouse64/bugfix/lp-1910298-part-1

usersession/autostart: change ~/snap perms to 0700 on startup
CVE-2021-3155: Incorrect Default Permissions (CWE-276)
value: snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 5.5
Published: 2022-02-17T23:15Z
Repository: https://github.com/snapcore/snapd
Language: Unknown
Commit date: 2021-11-12 15:17:57 +0100
Commit message: Merge pull request #10992 from MiguelPires/fix-snap-perm

cmd: create ~/snap dir with 0700 perms
CVE-2015-9241: Improper Input Validation (CWE-20)
value: Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of sending a HTTP 500 error back to the sender, hapi node module before 11.1.3 will continue to hold the socket open until timed out (default node timeout is 2 minutes).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-05-29T20:29Z
Repository: https://github.com/hapijs/hapi
Language: Unknown
Commit date: 2015-12-23 13:54:47 -0800
Commit message: Merge pull request #2988 from hapijs/v11.1.x

Handle invalid date exceptions
CVE-2022-31093: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to the **API route handler timing out and logging in to fail**. This has been remedied in versions 3.29.5 and 4.5.0. If for some reason you cannot upgrade, the workaround requires you to rely on Advanced Initialization. Please see the documentation for more.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.5
Published: 2022-06-27T22:15Z
Repository: https://github.com/nextauthjs/next-auth
Language: TypeScript
Files changed: packages/next-auth/tests/assert.test.ts
Commit date: 2022-06-20 10:38:21 +0200
Commit message: test: add test for invalid `callbackUrl` handling

Diff: diff --git a/packages/next-auth/tests/assert.test.ts b/packages/next-auth/tests/assert.test.ts
index 75454165..13cd2454 100644
--- a/packages/next-auth/tests/assert.test.ts
+++ b/packages/next-auth/tests/assert.test.ts
@@ -11,10 +11,26 @@ it("Show error page if secret is not defined", async () => {
   expect(res.html).toMatch(/check the server logs for more information./i)
 
   expect(log.error).toBeCalledWith("NO_SECRET", expect.anything())
 })
 
+it("Should show configuration error page on invalid `callbackUrl`", async () => {
+  const { res, log } = await handler(
+    { providers: [] },
+    { prod: true, params: { callbackUrl: "invalid-callback" } }
+  )
+
+  expect(res.status).toBe(500)
+  expect(res.html).toMatch(/there is a problem with the server configuration./i)
+  expect(res.html).toMatch(/check the server logs for more information./i)
+
+  expect(log.error).toBeCalledWith(
+    "INVALID_CALLBACK_URL_ERROR",
+    expect.anything()
+  )
+})
+
 it("Allow relative `callbackUrl`", async () => {
   const { res, log } = await handler(
     { providers: [] },
     { prod: true, params: { callbackUrl: "/callback" } }
   )

Fixed code: it("Should show configuration error page on invalid `callbackUrl`", async () => {
  const { res, log } = await handler(
    { providers: [] },
    { prod: true, params: { callbackUrl: "invalid-callback" } }
  )

  expect(res.status).toBe(500)
  expect(res.html).toMatch(/there is a problem with the server configuration./i)
  expect(res.html).toMatch(/check the server logs for more information./i)

  expect(log.error).toBeCalledWith(
    "INVALID_CALLBACK_URL_ERROR",
    expect.anything()
  )
})
CVE-2022-39263: Improper Authentication (CWE-287)
value: `@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation did not check for both the identifier (email) and the token, but only checking for the identifier when verifying the token in the email callback flow. An attacker who knows about the victim's email could easily sign in as the victim, given the attacker also knows about the verification token's expired duration. The vulnerability is patched in v3.0.2. A workaround is available. Using Advanced Initialization, developers can check the requests and compare the query's token and identifier before proceeding.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2022-09-28T21:15Z
Repository: https://github.com/nextauthjs/next-auth
Language: TypeScript
Files changed: packages/adapter-upstash-redis/src/index.ts
Commit date: 2022-09-25 09:10:55 +0100
Commit message: fix(adapters): check token during email verification in Upstash Adapter (#5377)

* Check token during email verification

* Undo accidental linter fix

* Update index.ts

Co-authored-by: Balázs Orbán <info@balazsorban.com>
Diff: diff --git a/packages/adapter-upstash-redis/src/index.ts b/packages/adapter-upstash-redis/src/index.ts
index 9049cf594..0f2918e71 100644
--- a/packages/adapter-upstash-redis/src/index.ts
+++ b/packages/adapter-upstash-redis/src/index.ts
@@ -163,17 +163,24 @@ export function UpstashRedisAdapter(
     async deleteSession(sessionToken) {
       await client.del(sessionKeyPrefix + sessionToken)
     },
     async createVerificationToken(verificationToken) {
       await setObjectAsJson(
-        verificationTokenKeyPrefix + verificationToken.identifier,
+        verificationTokenKeyPrefix +
+          verificationToken.identifier +
+          ":" +
+          verificationToken.token,
         verificationToken
       )
       return verificationToken
     },
     async useVerificationToken(verificationToken) {
-      const tokenKey = verificationTokenKeyPrefix + verificationToken.identifier
+      const tokenKey =
+        verificationTokenKeyPrefix +
+        verificationToken.identifier +
+        ":" +
+        verificationToken.token
 
       const token = await client.get<VerificationToken>(tokenKey)
       if (!token) return null
 
       await client.del(tokenKey)

Vulnerable code:         verificationTokenKeyPrefix + verificationToken.identifier,
      const tokenKey = verificationTokenKeyPrefix + verificationToken.identifier
Fixed code:         verificationTokenKeyPrefix +
          verificationToken.identifier +
          ":" +
          verificationToken.token,
      const tokenKey =
        verificationTokenKeyPrefix +
        verificationToken.identifier +
        ":" +
        verificationToken.token
CVE-2018-8097: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2018-03-14T12:29Z
Repository: https://github.com/pyeve/eve
Language: Python
Files changed: eve/io/mongo/parser.py
Commit date: 2018-01-14 17:51:26 +0100
Commit message: fix mongo visitor parser

Diff: diff --git a/eve/io/mongo/parser.py b/eve/io/mongo/parser.py
index 6b75120..ac633c0 100644
--- a/eve/io/mongo/parser.py
+++ b/eve/io/mongo/parser.py
@@ -120,20 +120,23 @@ class MongoVisitor(ast.NodeVisitor):
     def visit_Call(self, node):
         """ A couple function calls are supported: bson's ObjectId() and
         datetime().
         """
         if isinstance(node.func, ast.Name):
-            expr = None
             if node.func.id == 'ObjectId':
-                expr = "('" + node.args[0].s + "')"
+                try:
+                    self.current_value = ObjectId(node.args[0].s)
+                except:
+                    pass
             elif node.func.id == 'datetime':
                 values = []
                 for arg in node.args:
-                    values.append(str(arg.n))
-                expr = "(" + ", ".join(values) + ")"
-            if expr:
-                self.current_value = eval(node.func.id + expr)
+                    values.append(arg.n)
+                try:
+                    self.current_value = datetime(*values)
+                except:
+                    pass
 
     def visit_Attribute(self, node):
         """ Attribute handler ('Contact.Id').
         """
         self.visit(node.value)

Vulnerable code:             expr = None
                expr = "('" + node.args[0].s + "')"
                    values.append(str(arg.n))
                expr = "(" + ", ".join(values) + ")"
            if expr:
                self.current_value = eval(node.func.id + expr)
Fixed code:                 try:
                    self.current_value = ObjectId(node.args[0].s)
                except:
                    pass
                    values.append(arg.n)
                try:
                    self.current_value = datetime(*values)
                except:
                    pass
CVE-2021-37695: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-08-13T00:15Z
Repository: https://github.com/ckeditor/ckeditor4
Language: Unknown
Commit date: 2021-08-09 15:03:51 +0200
Commit message: Merge pull request #49 from cksource/sec/48

Filter fakeobject content.
CVE-2024-24815: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-02-07T16:15Z
Repository: https://github.com/ckeditor/ckeditor4
Language: Unknown
Commit date: 2024-01-16 13:47:10 +0100
Commit message: Merge commit