Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-23014: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: APfell 1.4 is vulnerable to authenticated reflected cross-site scripting (XSS) in /apiui/command_ through the payloadtypes_callback function, which allows an attacker to steal remote admin/user session and/or adding new users to the administration panel.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-01-26T18:15Z
Repository: https://github.com/its-a-feature/Apfell
Language: Python
Files changed: apfell-docker/app/routes/api_routes.py
Commit date: 2020-04-19 09:58:23 -0700
Commit message: fixed an 'Authenticated Cross-Site Scripting' bug on the command help page reported by 'Mohamed A. Baset' of 'Seekurity SA de C.V.' at 'Seekurity.com' on April 17,2020

Diff: diff --git a/apfell-docker/app/routes/api_routes.py b/apfell-docker/app/routes/api_routes.py
index f4d0aa2..42389ea 100755
--- a/apfell-docker/app/routes/api_routes.py
+++ b/apfell-docker/app/routes/api_routes.py
@@ -1,11 +1,12 @@
-from app import apfell, links, use_ssl
+from app import apfell, links, use_ssl, db_objects
 from sanic import response
 from jinja2 import Environment, PackageLoader
 from sanic_jwt.decorators import scoped, inject_user
 from app.routes.routes import respect_pivot
 import urllib.parse
+import app.database_models.model as db_model
 
 env = Environment(loader=PackageLoader('app', 'templates'))
 
 
 @apfell.route("/apiui/command_help")
@@ -13,11 +14,15 @@ env = Environment(loader=PackageLoader('app', 'templates'))
 @scoped(['auth:user', 'auth:apitoken_user'], False)  # user or user-level api token are ok
 async def apiui_command_help(request, user):
     template = env.get_template('apiui_command_help.html')
     if len(request.query_args) != 0:
         data = urllib.parse.unquote(request.query_args[0][1])
-        print(data)
+        query = await db_model.payloadtype_query()
+        try:
+            payloadtype = await db_objects.get(query, ptype=data)
+        except Exception as e:
+            data = ""
     else:
         data = ""
     if use_ssl:
         content = template.render(links=await respect_pivot(links, request), name=user['username'], http="https",
                                   ws="wss", config=user['ui_config'], view_utc_time=user['view_utc_time'], agent=data)

Vulnerable code: from app import apfell, links, use_ssl
        print(data)
Fixed code: from app import apfell, links, use_ssl, db_objects
import app.database_models.model as db_model
        query = await db_model.payloadtype_query()
        try:
            payloadtype = await db_objects.get(query, ptype=data)
        except Exception as e:
            data = ""
CVE-2019-15522: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2020-03-20T21:15Z
Repository: https://github.com/LINBIT/csync2
Language: C
Files changed: daemon.c
Commit date: 2019-08-29 15:07:41 +0200
Commit message: fail HELLO command when SSL is required

Diff: diff --git a/daemon.c b/daemon.c
index 2d8407d..2a1a8af 100644
--- a/daemon.c
+++ b/daemon.c
@@ -745,10 +745,11 @@ void csync_daemon_session()
 					if ( !fnmatch(t->pattern_from, myhostname, 0) &&
 					     !fnmatch(t->pattern_to, peer, 0) )
 						goto conn_without_ssl_ok;
 				}
 				cmd_error = conn_response(CR_ERR_SSL_EXPECTED);
+				peer = NULL;
 			}
 conn_without_ssl_ok:;
 #endif
 			break;
 		case A_GROUP:

Fixed code: 				peer = NULL;
CVE-2022-21687: Improper Input Validation (CWE-20)
value: gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2022-02-01T12:15Z
Repository: https://github.com/github/gh-ost
Language: Go
Files changed: build.sh, go/cmd/gh-ost/main.go
Commit date: 2022-01-18 17:12:05 +0000
Commit message: Security: fix vulnerability where `-database` parameter accepts arbitrary DSN strings

(cherry picked from commit 4dab3d5a689c6a5727174980071c7f9a563193f1)

Diff: diff --git a/build.sh b/build.sh
index ef24e81..2d0fcd0 100755
--- a/build.sh
+++ b/build.sh
@@ -16,11 +16,11 @@ function build {
   osname=$1
   osshort=$2
   GOOS=$3
   GOARCH=$4
 
-  if ! go version | egrep -q 'go(1\.1[56])' ; then
+  if ! go version | egrep -q 'go1\.(1[5-9]|[2-9][0-9]{1})' ; then
     echo "go version must be 1.15 or above"
     exit 1
   fi
 
   # TODO: remove GO111MODULE once gh-ost uses Go modules
diff --git a/go/cmd/gh-ost/main.go b/go/cmd/gh-ost/main.go
index c8029b8..04d4eeb 100644
--- a/go/cmd/gh-ost/main.go
+++ b/go/cmd/gh-ost/main.go
@@ -6,10 +6,11 @@
 package main
 
 import (
 	"flag"
 	"fmt"
+	"net/url"
 	"os"
 	"os/signal"
 	"syscall"
 
 	"github.com/github/gh-ost/go/base"
@@ -186,10 +187,15 @@ func main() {
 			migrationContext.DatabaseName = parser.GetExplicitSchema()
 		} else {
 			log.Fatalf("--database must be provided and database name must not be empty, or --alter must specify database name")
 		}
 	}
+
+	if err := flag.Set("database", url.QueryEscape(migrationContext.DatabaseName)); err != nil {
+		migrationContext.Log.Fatale(err)
+	}
+
 	if migrationContext.OriginalTableName == "" {
 		if parser.HasExplicitTable() {
 			migrationContext.OriginalTableName = parser.GetExplicitTable()
 		} else {
 			log.Fatalf("--table must be provided and table name must not be empty, or --alter must specify table name")

Vulnerable code:   if ! go version | egrep -q 'go(1\.1[56])' ; then
Fixed code:   if ! go version | egrep -q 'go1\.(1[5-9]|[2-9][0-9]{1})' ; then
	"net/url"

	if err := flag.Set("database", url.QueryEscape(migrationContext.DatabaseName)); err != nil {
		migrationContext.Log.Fatale(err)
	}
CVE-2019-16766: Insufficient Information (NVD-CWE-noinfo)
value: When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched in version 1.3.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2019-11-29T17:15Z
Repository: https://github.com/labd/wagtail-2fa
Language: Other
Files changed: CHANGES
Commit date: 2019-11-26 12:56:05 +0100
Commit message: Update changelog for 1.3.0 release

Diff: diff --git a/CHANGES b/CHANGES
index bc43997..4ade220 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,13 @@
+1.3.0 (2019.11.26)
+==================
+ - Add OtpRequiredMixin to enforce OTP checks in views
+ - Resolve possible vulnerabilities:
+    - [CWE-290](http://cwe.mitre.org/data/definitions/290.html)
+    - [CWE-20](http://cwe.mitre.org/data/definitions/20.html)
+
+
 1.2.0 (2019-10-30)
 ==================
  - Added missing deps for generation of the docs
  - Added Microsoft Authenticator as example app and removed double space
  - Allow admins to delete devices from user accounts

Fixed code: 1.3.0 (2019.11.26)
==================
 - Add OtpRequiredMixin to enforce OTP checks in views
 - Resolve possible vulnerabilities:
    - [CWE-290](http://cwe.mitre.org/data/definitions/290.html)
    - [CWE-20](http://cwe.mitre.org/data/definitions/20.html)
CVE-2021-3829: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: openwhyd is vulnerable to URL Redirection to Untrusted Site
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-12-10T16:15Z
Repository: https://github.com/openwhyd/openwhyd
Language: JavaScript
Files changed: app/models/logging.js, test/api/security.api.tests.js
Commit date: 2021-12-10 11:03:41 +0100
Commit message: fix(security): Prevent redirect to a disguised domain (#498)

Improves #496, as suggested on this report: https://huntr.dev/bounties/6b8acb0c-8b5d-461e-9b46-b1bfb5a8ccdf/
Diff: diff --git a/app/models/logging.js b/app/models/logging.js
index fff3fbe..4724576 100644
--- a/app/models/logging.js
+++ b/app/models/logging.js
@@ -260,11 +260,12 @@ http.ServerResponse.prototype.redirect = function (url) {
   return this.renderHTML(loggingTemplate.htmlRedirect(url));
 };
 
 http.ServerResponse.prototype.safeRedirect = function (url) {
   const fullURL = new URL(url, config.urlPrefix);
-  if (!fullURL.toString().startsWith(config.urlPrefix)) return this.forbidden();
+  if (`${fullURL.protocol}//${fullURL.host}` !== config.urlPrefix)
+    return this.forbidden();
   this.redirect(url);
 };
 
 http.ServerResponse.prototype.redirectWithTracking = function (url, title) {
   return this.renderHTML(
diff --git a/test/api/security.api.tests.js b/test/api/security.api.tests.js
index 4061fed..c4d09f3 100644
--- a/test/api/security.api.tests.js
+++ b/test/api/security.api.tests.js
@@ -41,7 +41,16 @@ describe('security', () => {
         lang: 'en',
         redirect: `http://google.com`,
       });
       assert.equal(response.statusCode, 403); // forbidden
     });
+
+    it('should NOT allow redirect to a disguised domain', async () => {
+      const { jar } = await loginAs(ADMIN_USER);
+      const { response } = await postRaw(jar, `/consent`, {
+        lang: 'en',
+        redirect: `${URL_PREFIX}@google.com`,
+      });
+      assert.equal(response.statusCode, 403); // forbidden
+    });
   });
 });

Vulnerable code:   if (!fullURL.toString().startsWith(config.urlPrefix)) return this.forbidden();
Fixed code:   if (`${fullURL.protocol}//${fullURL.host}` !== config.urlPrefix)
    return this.forbidden();

    it('should NOT allow redirect to a disguised domain', async () => {
      const { jar } = await loginAs(ADMIN_USER);
      const { response } = await postRaw(jar, `/consent`, {
        lang: 'en',
        redirect: `${URL_PREFIX}@google.com`,
      });
      assert.equal(response.statusCode, 403); // forbidden
    });
CVE-2023-26141: Insufficient Verification of Data Authenticity (CWE-345)
value: Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 4.9
Published: 2023-09-14T05:15Z
Repository: https://github.com/sidekiq/sidekiq
Language: JavaScript
Files changed: web/assets/javascripts/application.js, web/assets/javascripts/dashboard-charts.js
Commit date: 2023-09-05 10:33:39 -0700
Commit message: Validate page refresh interval to ensure a minimum amount of delay

Diff: diff --git a/web/assets/javascripts/application.js b/web/assets/javascripts/application.js
index 6628af5a..9f50ca80 100644
--- a/web/assets/javascripts/application.js
+++ b/web/assets/javascripts/application.js
@@ -138,10 +138,11 @@ function checkResponse(resp) {
   return resp
 }
 
 function scheduleLivePoll() {
   let ti = parseInt(localStorage.sidekiqTimeInterval) || 5000;
+  if (ti < 2000) { ti = 2000 }
   livePollTimer = setTimeout(livePollCallback, ti);
 }
 
 function replacePage(text) {
   var parser = new DOMParser();
diff --git a/web/assets/javascripts/dashboard-charts.js b/web/assets/javascripts/dashboard-charts.js
index 0565a0c0..7c249c2e 100644
--- a/web/assets/javascripts/dashboard-charts.js
+++ b/web/assets/javascripts/dashboard-charts.js
@@ -55,11 +55,13 @@ class DashboardChart extends BaseChart {
 }
 
 class RealtimeChart extends DashboardChart {
   constructor(el, options) {
     super(el, options);
-    this.delay = parseInt(localStorage.sidekiqTimeInterval) || 5000;
+    let d = parseInt(localStorage.sidekiqTimeInterval) || 5000;
+    if (d < 2000) { d = 2000; }
+    this.delay = d
     this.startPolling();
     document.addEventListener("interval:update", this.handleUpdate.bind(this));
   }
 
   async startPolling() {

Vulnerable code:     this.delay = parseInt(localStorage.sidekiqTimeInterval) || 5000;
Fixed code:   if (ti < 2000) { ti = 2000 }
    let d = parseInt(localStorage.sidekiqTimeInterval) || 5000;
    if (d < 2000) { d = 2000; }
    this.delay = d
CVE-2024-34446: Insufficient Information (NVD-CWE-noinfo)
value: Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-03T15:15Z
Repository: https://github.com/mullvad/mullvadvpn-app
Language: Rust
Files changed: talpid-tunnel/src/tun_provider/android/mod.rs
Commit date: 2024-05-02 16:26:04 +0200
Commit message: Set dummy DNS servers on Android

Diff: diff --git a/talpid-tunnel/src/tun_provider/android/mod.rs b/talpid-tunnel/src/tun_provider/android/mod.rs
index 187dd3b4f..abd75de95 100644
--- a/talpid-tunnel/src/tun_provider/android/mod.rs
+++ b/talpid-tunnel/src/tun_provider/android/mod.rs
@@ -217,10 +217,11 @@ impl AndroidTunProvider {
     }
 
     fn prepare_tun_config(&self, config: &mut TunConfig) {
         self.prepare_tun_config_for_allow_lan(config);
         self.prepare_tun_config_for_custom_dns(config);
+        maybe_set_dummy_dns_servers(config);
     }
 
     fn prepare_tun_config_for_allow_lan(&self, config: &mut TunConfig) {
         if self.allow_lan {
             let (required_ipv4_routes, required_ipv6_routes) = config
@@ -322,10 +323,18 @@ impl AndroidTunProvider {
 
         Ok(JnixEnv::from(jni_env))
     }
 }
 
+/// Add dummy servers if no DNS servers are set. Android may sometimes leak DNS otherwise.
+fn maybe_set_dummy_dns_servers(config: &mut TunConfig) {
+    if !config.dns_servers.is_empty() {
+        return;
+    }
+    config.dns_servers = vec!["192.0.2.1".parse().unwrap()];
+}
+
 /// Handle to a tunnel device on Android.
 pub struct VpnServiceTun {
     tunnel: RawFd,
     jvm: JavaVM,
     class: GlobalRef,

Fixed code:         maybe_set_dummy_dns_servers(config);
/// Add dummy servers if no DNS servers are set. Android may sometimes leak DNS otherwise.
fn maybe_set_dummy_dns_servers(config: &mut TunConfig) {
    if !config.dns_servers.is_empty() {
        return;
    }
    config.dns_servers = vec!["192.0.2.1".parse().unwrap()];
}
CVE-2021-21372: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Nimble is a package manager for the Nim programming language. In Nim release version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different places and can be leveraged to execute arbitrary commands. An attacker can craft a malicious entry in the packages.json package list to trigger code execution.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-03-26T22:15Z
Repository: https://github.com/nim-lang/nimble
Language: Unknown
Commit date: 2021-02-08 11:38:02 +0100
Commit message: Merge pull request #894 from nim-lang/fixes-rce

Fixes RCE reported by Consensys.
CVE-2022-3979: Incorrect Type Conversion or Cast (CWE-704)
value: A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.9.34 is able to address this issue. The identifier of the patch is 7574fd8a2903282c2e0d1feef5c4876763db21d5. It is recommended to upgrade the affected component. The identifier VDB-213557 was assigned to this vulnerability.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 8.1
Published: 2022-11-13T23:15Z
Repository: https://github.com/NagVis/nagvis
Language: PHP
Files changed: share/server/core/classes/CoreLogonMultisite.php
Commit date: 2022-08-29 21:23:23 +0200
Commit message: Fix type juggling vulnerability

PHP evaluates `!=` a bit loose on the type. So "0000" == "0e5678" is
true in PHP. An attacker could send a zeroed cookie_hash `"0"*32` and
only need an collision with a calculated hash beginning with `0e`
followed by only numbers.

In our tests (with auth.secret set to `stable`) a valid cookie is
`cmkadmin:58191275:00000000000000000000000000000000`.

For a remote attacker this would have needed 58,191,275 guesses.

Diff: diff --git a/share/server/core/classes/CoreLogonMultisite.php b/share/server/core/classes/CoreLogonMultisite.php
index 4c98e4b7d..f4acd4107 100644
--- a/share/server/core/classes/CoreLogonMultisite.php
+++ b/share/server/core/classes/CoreLogonMultisite.php
@@ -112,16 +112,14 @@ class CoreLogonMultisite extends CoreLogonModule {
             $hash = $this->generatePre20Hash($username, $sessionId, (string) $user_secret);
         else
             $hash = $this->generateHash($username, $sessionId, (string) $user_secret);
 
         // Validate the hash
-        if ($cookieHash != $hash) {
+        if ($cookieHash !== $hash) {
             throw new Exception();
         }
 
-        // FIXME: Maybe renew the cookie here too
-
         return $username;
     }
 
     private function checkAuth() {
         // Loop all cookies trying to fetch a valid authentication

Vulnerable code:         if ($cookieHash != $hash) {
        // FIXME: Maybe renew the cookie here too

Fixed code:         if ($cookieHash !== $hash) {
CVE-2022-46945: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2023-05-26T15:15Z
Repository: https://github.com/NagVis/nagvis
Language: PHP
Files changed: share/server/core/classes/NagVisHoverUrl.php
Commit date: 2022-08-29 21:23:53 +0200
Commit message: Mitigate arbitrary file read

With this change the URL is restricted to http and https. So no local
files can be read. This still is a Server-side request forgery (SSRF).

Diff: diff --git a/share/server/core/classes/NagVisHoverUrl.php b/share/server/core/classes/NagVisHoverUrl.php
index 115abe0e4..b5aa87461 100644
--- a/share/server/core/classes/NagVisHoverUrl.php
+++ b/share/server/core/classes/NagVisHoverUrl.php
@@ -82,11 +82,11 @@ class NagVisHoverUrl {
         */
 
         // Only allow urls not paths for security reasons
         // Reported here: http://news.gmane.org/find-root.php?message_id=%3cf60c42280909021938s7f36c0edhd66d3e9156a5d081%40mail.gmail.com%3e
         $aUrl = parse_url($this->url);
-        if(!isset($aUrl['scheme']) || $aUrl['scheme'] == '')
+        if(!isset($aUrl['scheme']) || $aUrl['scheme'] == '' || ($aUrl['scheme'] != 'http' && $aUrl['scheme'] != 'https'))
             throw new NagVisException(l('problemReadingUrl', Array('URL' => $this->url,
                                                                    'MSG' => l('Not allowed url'))));
 
 
         if(!$content = file_get_contents($this->url)) {

Vulnerable code:         if(!isset($aUrl['scheme']) || $aUrl['scheme'] == '')
Fixed code:         if(!isset($aUrl['scheme']) || $aUrl['scheme'] == '' || ($aUrl['scheme'] != 'http' && $aUrl['scheme'] != 'https'))
CVE-2021-23664: Server-Side Request Forgery (SSRF) (CWE-918)
value: The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2022-01-21T20:15Z
Repository: https://github.com/isomorphic-git/cors-proxy
Language: JavaScript
Files changed: azure-pipelines.yml, middleware.js
Commit date: 2022-01-06 21:30:39 -0500
Commit message: fix(security): don't follow redirects (#10)


Diff: diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 1d864fa..556ea2d 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -1,10 +1,10 @@
 jobs:
 - job: Linux
 
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-latest'
 
   steps:
   - task: NodeTool@0
     inputs:
       versionSpec: '10.x'
diff --git a/bin.js b/bin.js
old mode 100644
new mode 100755
diff --git a/middleware.js b/middleware.js
index d7f7b16..582a37b 100644
--- a/middleware.js
+++ b/middleware.js
@@ -33,10 +33,11 @@ const exposeHeaders = [
   'content-type',
   'date',
   'etag',
   'expires',
   'last-modified',
+  'location',
   'pragma',
   'server',
   'transfer-encoding',
   'vary',
   'x-github-request-id',
@@ -123,14 +124,20 @@ module.exports = ({ origin, insecure_origins = [], authorization = noop } = {})
 
     fetch(
       `${protocol}://${pathdomain}/${remainingpath}`,
       {
         method: req.method,
+        redirect: 'manual',
         headers,
         body: (req.method !== 'GET' && req.method !== 'HEAD') ? req : undefined
       }
     ).then(f => {
+      if (f.headers.has('location')) {
+        // Modify the location so the client continues to use the proxy
+        let newUrl = f.headers.get('location').replace(/^https?:\//, '')
+        f.headers.set('location', newUrl)
+      }
       res.statusCode = f.status
       for (let h of exposeHeaders) {
         if (h === 'content-length') continue
         if (f.headers.has(h)) {
           res.setHeader(h, f.headers.get(h))

Vulnerable code:     vmImage: 'Ubuntu 16.04'
Fixed code:     vmImage: 'ubuntu-latest'
  'location',
        redirect: 'manual',
      if (f.headers.has('location')) {
        // Modify the location so the client continues to use the proxy
        let newUrl = f.headers.get('location').replace(/^https?:\//, '')
        f.headers.set('location', newUrl)
      }
CVE-2019-14459: Integer Overflow or Wraparound (CWE-190)
value: nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2019-07-31T21:15Z
Repository: https://github.com/phaag/nfdump
Language: Other
Files changed: ChangeLog, bin/ipfix.c
Commit date: 2019-07-27 15:20:30 +0200
Commit message: Fix potential unsigned integer underflow

Diff: diff --git a/ChangeLog b/ChangeLog
index 4509030..d9b9546 100755
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,9 @@
 2019-07-25
 - Rework nfpcapd and add it officially to the nfdump collection.
 - Add nfpcapd man page
+- Fix potential unsigned integer underflow #171
 
 2019-07-16
 - Add latency extension if dumping flowcache
 
 2019-07-15
diff --git a/bin/ipfix.c b/bin/ipfix.c
index 2d7d084..b4757e5 100644
--- a/bin/ipfix.c
+++ b/bin/ipfix.c
@@ -1245,11 +1245,11 @@ int i;
 	// a template flowset can contain multiple records ( templates )
 	while ( size_left ) {
 		uint32_t table_id, count, size_required;
 		uint32_t num_extensions = 0;
 
-		if ( size_left && size_left < 4 ) {
+		if ( size_left < 4 ) {
 			LogError("Process_ipfix [%u] Template size error at %s line %u" , 
 				exporter->info.id, __FILE__, __LINE__, strerror (errno));
 			size_left = 0;
 			continue;
 		}
@@ -1424,10 +1424,18 @@ ipfix_template_record_t *ipfix_template_record;
 
 	// a template flowset can contain multiple records ( templates )
 	while ( size_left ) {
 		uint32_t id;
 
+		if ( size_left < 4 ) {
+			LogError("Process_ipfix [%u] Template withdraw size error at %s line %u" , 
+				exporter->info.id, __FILE__, __LINE__, strerror (errno));
+			size_left = 0;
+			continue;
+		}
+
+
 		// map next record.
 		ipfix_template_record = (ipfix_template_record_t *)DataPtr;
 		size_left 		-= 4;
 
 		id 	  = ntohs(ipfix_template_record->TemplateID);

Vulnerable code: 		if ( size_left && size_left < 4 ) {
Fixed code: - Fix potential unsigned integer underflow #171
		if ( size_left < 4 ) {
		if ( size_left < 4 ) {
			LogError("Process_ipfix [%u] Template withdraw size error at %s line %u" , 
				exporter->info.id, __FILE__, __LINE__, strerror (errno));
			size_left = 0;
			continue;
		}
CVE-2015-0258: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2020-02-17T18:15Z
Repository: https://github.com/philippK-de/Collabtive
Language: PHP
Files changed: manageuser.php
Commit date: 2015-02-05 05:15:40 +0100
Commit message: fix code execution filter

in avatar upload

Diff: diff --git a/manageuser.php b/manageuser.php
index 85c9024..08e126c 100644
--- a/manageuser.php
+++ b/manageuser.php
@@ -149,11 +149,11 @@ if ($action == "loginerror") {
             $loc = $url . "manageuser.php?action=profile&id=$userid";
             header("Location: $loc");
             die();
         }
         // don't upload php scripts
-        if ($erweiterung == "php" or $erweiterung == "pl") {
+        if (stristr($erweiterung,"php") or $erweiterung == "pl") {
             $loc = $url . "manageuser.php?action=profile&id=$userid";
             header("Location: $loc");
             die();
         }
 

Vulnerable code:         if ($erweiterung == "php" or $erweiterung == "pl") {
Fixed code:         if (stristr($erweiterung,"php") or $erweiterung == "pl") {
CVE-2022-31124: Generation of Error Message Containing Sensitive Information (CWE-209)
value: openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 6.5
Published: 2022-07-06T18:15Z
Repository: https://github.com/scottcwang/openssh_key_parser
Language: Python
Files changed: openssh_key/pascal_style_byte_stream.py
Commit date: 2022-06-22 10:49:37 -0400
Commit message: Changed an exception message to prevent possible disclosures of keying material.

Diff: diff --git a/openssh_key/pascal_style_byte_stream.py b/openssh_key/pascal_style_byte_stream.py
index e6d4003..f8fefa6 100644
--- a/openssh_key/pascal_style_byte_stream.py
+++ b/openssh_key/pascal_style_byte_stream.py
@@ -234,11 +234,12 @@ class PascalStyleByteStream(io.BytesIO):
             EOFError: Fewer than ``num_bytes`` bytes remained in the
                 underlying bytestream.
         """
         read_bytes = self.read(num_bytes)
         if len(read_bytes) < num_bytes:
-            raise EOFError(read_bytes)
+            raise EOFError("Fewer than 'num_bytes' bytes remaining in the "
+                    "underlying bytestream")
         return read_bytes
 
     def read_pascal_bytes(self, string_length_size: int) -> bytes:
         """Reads a Pascal-style byte string from the underlying bytestream,
         given the size of the length prefix.

Vulnerable code:             raise EOFError(read_bytes)
Fixed code:             raise EOFError("Fewer than 'num_bytes' bytes remaining in the "
                    "underlying bytestream")
CVE-2022-31124: Generation of Error Message Containing Sensitive Information (CWE-209)
value: openssh_key_parser is an open source Python package providing utilities to parse and pack OpenSSH private and public key files. In versions prior to 0.0.6 if a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field. Users are advised to upgrade to version 0.0.6, which no longer includes the raw field value in the error message. There are no known workarounds for this issue.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 6.5
Published: 2022-07-06T18:15Z
Repository: https://github.com/scottcwang/openssh_key_parser
Language: Unknown
Commit date: 2022-06-24 22:49:01 -0500
Commit message: Merge pull request #5 from mike-arnica/security-review

Fix insecure/undeclared raised errors; initial commit of scripts for atheris fuzzer
CVE-2017-5226: Improper Input Validation (CWE-20)
value: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 10
Published: 2017-03-29T20:59Z
Repository: https://github.com/projectatomic/bubblewrap
Language: C
Files changed: bubblewrap.c
Commit date: 2017-01-09 19:48:44 +0000
Commit message: Call setsid() before executing sandboxed code (CVE-2017-5226)

This prevents the sandboxed code from getting a controlling tty,
which in turn prevents it from accessing the TIOCSTI ioctl and hence
faking terminal input.

Fixes: #142

Closes: #143
Approved by: cgwalters

Diff: diff --git a/bubblewrap.c b/bubblewrap.c
index 6e04459..4b5b8e6 100644
--- a/bubblewrap.c
+++ b/bubblewrap.c
@@ -2069,10 +2069,13 @@ main (int    argc,
     close (opt_sync_fd);
 
   /* We want sigchild in the child */
   unblock_sigchild ();
 
+  if (setsid () == (pid_t) -1)
+    die_with_error ("setsid");
+
   if (label_exec (opt_exec_label) == -1)
     die_with_error ("label_exec %s", argv[0]);
 
   if (execvp (argv[0], argv) == -1)
     die_with_error ("execvp %s", argv[0]);

Fixed code:   if (setsid () == (pid_t) -1)
    die_with_error ("setsid");
CVE-2023-43655: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice.

CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-09-29T20:15Z
Repository: https://github.com/composer/composer
Language: Other
Files changed: bin/composer
Commit date: 2023-09-29 10:15:51 +0200
Commit message: Merge pull request from GHSA-jm6m-4632-36hf


Diff: diff --git a/bin/composer b/bin/composer
index 642714f56..8bc77e660 100755
--- a/bin/composer
+++ b/bin/composer
@@ -1,9 +1,14 @@
 #!/usr/bin/env php
 <?php
 
 if (PHP_SAPI !== 'cli' && PHP_SAPI !== 'phpdbg') {
+    if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
+        echo 'Composer cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
+        exit(1);
+    }
+
     echo 'Warning: Composer should be invoked via the CLI version of PHP, not the '.PHP_SAPI.' SAPI'.PHP_EOL;
 }
 
 if (PHP_VERSION_ID < 70205) {
     echo 'Composer 2.3.0 dropped support for PHP <7.2.5 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;

Fixed code:     if (0 === strpos(__FILE__, 'phar:') && ini_get('register_argc_argv')) {
        echo 'Composer cannot be run safely on non-CLI SAPIs with register_argc_argv=On. Aborting.'.PHP_EOL;
        exit(1);
    }
CVE-2024-35241: Insufficient Information (NVD-CWE-noinfo)
value: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-10T22:15Z
Repository: https://github.com/composer/composer
Language: PHP
Files changed: src/Composer/Downloader/GitDownloader.php
Commit date: 2024-06-10 14:56:42 +0200
Commit message: Merge pull request from GHSA-47f6-5gq3-vx9c


Diff: diff --git a/src/Composer/Downloader/GitDownloader.php b/src/Composer/Downloader/GitDownloader.php
index 0840219d0f..b29782d1af 100644
--- a/src/Composer/Downloader/GitDownloader.php
+++ b/src/Composer/Downloader/GitDownloader.php
@@ -292,13 +292,13 @@ public function getUnpushedChanges(PackageInterface $package, string $path): ?st
                 // so we get the real diff output no matter its length
                 if ($branchNotFoundError) {
                     $unpushedChanges = null;
                 }
                 foreach ($remoteBranches as $remoteBranch) {
-                    $command = sprintf('git diff --name-status %s...%s --', $remoteBranch, $branch);
+                    $command = ['git', 'diff', '--name-status', $remoteBranch.'...'.$branch, '--'];
                     if (0 !== $this->process->execute($command, $output, $path)) {
-                        throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
+                        throw new \RuntimeException('Failed to execute ' . implode(' ', $command) . "\n\n" . $this->process->getErrorOutput());
                     }
 
                     $output = trim($output);
                     // keep the shortest diff from all remote branches we compare against
                     if ($unpushedChanges === null || strlen($output) < strlen($unpushedChanges)) {

Vulnerable code:                     $command = sprintf('git diff --name-status %s...%s --', $remoteBranch, $branch);
                        throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
Fixed code:                     $command = ['git', 'diff', '--name-status', $remoteBranch.'...'.$branch, '--'];
                        throw new \RuntimeException('Failed to execute ' . implode(' ', $command) . "\n\n" . $this->process->getErrorOutput());
CVE-2015-1839: Data Processing Errors (CWE-19)
value: modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
CWE description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CVSS v3 base score: 5.3
Published: 2017-04-13T14:59Z
Repository: https://github.com/saltstack/salt
Language: Python
Files changed: salt/modules/chef.py
Commit date: 2015-03-25 14:29:26 -0600
Commit message: Create randomized logfile name in windows for chef.py

Diff: diff --git a/salt/modules/chef.py b/salt/modules/chef.py
index 36eb6ff72d..9c6d928fc3 100644
--- a/salt/modules/chef.py
+++ b/salt/modules/chef.py
@@ -4,10 +4,11 @@ Execute chef in server or solo mode
 '''
 
 # Import Python libs
 import logging
 import os
+import tempfile
 
 # Import Salt libs
 import salt.utils
 import salt.utils.decorators as decorators
 
@@ -22,16 +23,20 @@ def __virtual__():
         return False
     return True
 
 
 def _default_logfile(exe_name):
-
+    '''
+    Retrieve the logfile name
+    '''
     if salt.utils.is_windows():
-        logfile = salt.utils.path_join(
-            os.environ['TMP'],
-            '{0}.log'.format(exe_name)
-        )
+        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
+                                                  prefix=exe_name,
+                                                  suffix='.log',
+                                                  delete=False)
+        logfile = logfile_tmp.name
+        logfile_tmp.close()
     else:
         logfile = salt.utils.path_join(
             '/var/log',
             '{0}.log'.format(exe_name)
         )

Vulnerable code: 
        logfile = salt.utils.path_join(
            os.environ['TMP'],
            '{0}.log'.format(exe_name)
        )
Fixed code: import tempfile
    '''
    Retrieve the logfile name
    '''
        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
                                                  prefix=exe_name,
                                                  suffix='.log',
                                                  delete=False)
        logfile = logfile_tmp.name
        logfile_tmp.close()
CVE-2015-1839: Data Processing Errors (CWE-19)
value: modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
CWE description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CVSS v3 base score: 5.3
Published: 2017-04-13T14:59Z
Repository: https://github.com/saltstack/salt
Language: Python
Files changed: salt/modules/chef.py
Commit date: 2015-03-25 16:01:20 -0600
Commit message: Use cachedir

Diff: diff --git a/salt/modules/chef.py b/salt/modules/chef.py
index 9c6d928fc3..40d01f10dc 100644
--- a/salt/modules/chef.py
+++ b/salt/modules/chef.py
@@ -27,11 +27,14 @@ def __virtual__():
 def _default_logfile(exe_name):
     '''
     Retrieve the logfile name
     '''
     if salt.utils.is_windows():
-        logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
+        tmp_dir = os.path.join(__opts__['cachedir'], 'tmp')
+        if not os.path.isdir(tmp_dir):
+            os.mkdir(tmp_dir)
+        logfile_tmp = tempfile.NamedTemporaryFile(dir=tmp_dir,
                                                   prefix=exe_name,
                                                   suffix='.log',
                                                   delete=False)
         logfile = logfile_tmp.name
         logfile_tmp.close()

Vulnerable code:         logfile_tmp = tempfile.NamedTemporaryFile(dir=os.environ['TMP'],
Fixed code:         tmp_dir = os.path.join(__opts__['cachedir'], 'tmp')
        if not os.path.isdir(tmp_dir):
            os.mkdir(tmp_dir)
        logfile_tmp = tempfile.NamedTemporaryFile(dir=tmp_dir,
CVE-2015-6918: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: salt before 2015.5.5 leaks git usernames and passwords to the log.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.3
Published: 2017-10-10T16:29Z
Repository: https://github.com/saltstack/salt
Language: Unknown
Commit date: 2015-08-20 10:04:52 -0600
Commit message: Merge pull request #26486 from thusoy/git-confidential-auth

Git: Don't leak https user/pw to log
CVE-2016-7797: 7PK - Security Features (CWE-254)
value: Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.
CWE description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
CVSS v3 base score: 7.5
Published: 2017-03-24T15:59Z
Repository: https://github.com/ClusterLabs/pacemaker
Language: C
Files changed: lrmd/tls_backend.c
Commit date: 2016-02-22 18:12:05 +0100
Commit message: Fix: remote: cl#5269 - Notify other clients of a new connection only if the handshake has completed (bsc#967388)

Diff: diff --git a/lrmd/tls_backend.c b/lrmd/tls_backend.c
index fd316e42a..0e0782869 100644
--- a/lrmd/tls_backend.c
+++ b/lrmd/tls_backend.c
@@ -77,10 +77,13 @@ lrmd_remote_client_msg(gpointer data)
             client->remote->tls_handshake_complete = TRUE;
             if (client->remote->auth_timeout) {
                 g_source_remove(client->remote->auth_timeout);
             }
             client->remote->auth_timeout = 0;
+
+            /* Alert other clients of the new connection */
+            notify_of_new_client(client);
         }
         return 0;
     }
 
     rc = crm_remote_ready(client->remote, 0);
@@ -287,12 +290,10 @@ lrmd_remote_listen(gpointer data)
     new_client->remote->source =
         mainloop_add_fd("lrmd-remote-client", G_PRIORITY_DEFAULT, csock, new_client,
                         &lrmd_remote_fd_cb);
     g_hash_table_insert(client_connections, new_client->id, new_client);
 
-    /* Alert other clients of the new connection */
-    notify_of_new_client(new_client);
     return TRUE;
 }
 
 static void
 lrmd_remote_connection_destroy(gpointer user_data)

Vulnerable code:     /* Alert other clients of the new connection */
    notify_of_new_client(new_client);
Fixed code: 
            /* Alert other clients of the new connection */
            notify_of_new_client(client);
CVE-2023-3227: Insufficient Granularity of Access Control (CWE-1220)
value: Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.
CWE description: The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
CVSS v3 base score: 5.7
Published: 2023-06-14T06:15Z
Repository: https://github.com/fossbilling/fossbilling
Language: PHP
Files changed: src/modules/Cart/Api/Guest.php
Commit date: 2023-06-12 06:30:20 +0200
Commit message: Validate add-on configs before adding to cart (#1313)

* Validate addon configs before adding to cart

* Fix spelling mistake
Diff: diff --git a/src/modules/Cart/Api/Guest.php b/src/modules/Cart/Api/Guest.php
index 7c11e92a..2992d8c3 100644
--- a/src/modules/Cart/Api/Guest.php
+++ b/src/modules/Cart/Api/Guest.php
@@ -157,16 +157,32 @@ class Guest extends \Api_Abstract
     public function add_item($data)
     {
         $required = [
             'id' => 'Product id not passed',
         ];
+
         $this->di['validator']->checkRequiredParamsForArray($required, $data);
 
         $cart = $this->getService()->getSessionCart();
 
         $product = $this->di['db']->getExistingModelById('Product', $data['id'], 'Product not found');
 
+        if ($product->is_addon) {
+            throw new \Box_Exception('Addon products cannot be added separately.');
+        }
+
+        $validAddons = json_decode($product->addons ?? '');
+        if(empty($validAddons)){
+            $validAddons = [];
+        }
+
+        foreach ($data['addons'] as $addon => $properties) {
+            if($properties['selected'] && !in_array($addon, $validAddons)){
+                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
+            }
+        }
+
         // reset cart by default
         if (!isset($data['multiple']) || !$data['multiple']) {
             $this->reset();
         }
 

Fixed code: 
        if ($product->is_addon) {
            throw new \Box_Exception('Addon products cannot be added separately.');
        }

        $validAddons = json_decode($product->addons ?? '');
        if(empty($validAddons)){
            $validAddons = [];
        }

        foreach ($data['addons'] as $addon => $properties) {
            if($properties['selected'] && !in_array($addon, $validAddons)){
                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
            }
        }