Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-15132: Missing Release of Resource after Effective Lifetime (CWE-772)
value: A flaw was found in dovecot 2.0 up to 2.2.33 and 2.3.0. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 7.5
Published: 2018-01-25T20:29Z
Repository: https://github.com/dovecot/core
Language: C
Files changed: src/lib-auth/auth-client-request.c
Commit date: 2018-01-25 11:02:56 +0200
Commit message: lib-auth: Fix memory leak in auth_client_request_abort()

This caused memory leaks when authentication was aborted. For example
with IMAP:

a AUTHENTICATE PLAIN
*

Broken by 9137c55411aa39d41c1e705ddc34d5bd26c65021

Diff: diff --git a/src/lib-auth/auth-client-request.c b/src/lib-auth/auth-client-request.c
index 480fb42b3..046f7c307 100644
--- a/src/lib-auth/auth-client-request.c
+++ b/src/lib-auth/auth-client-request.c
@@ -184,10 +184,11 @@ void auth_client_request_abort(struct auth_client_request **_request)
 
 	*_request = NULL;
 
 	auth_client_send_cancel(request->conn->client, request->id);
 	call_callback(request, AUTH_REQUEST_STATUS_ABORT, NULL, NULL);
+	pool_unref(&request->pool);
 }
 
 unsigned int auth_client_request_get_id(struct auth_client_request *request)
 {
 	return request->id;

Fixed code: 	pool_unref(&request->pool);
CVE-2017-2669: Improper Input Validation (CWE-20)
value: Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-06-21T13:29Z
Repository: https://github.com/dovecot/core
Language: C
Files changed: src/auth/db-dict.c
Commit date: 2017-03-12 20:15:13 +0200
Commit message: auth: Do not double-expand key in passdb dict when authenticating

Broken by 79042f8c

Diff: diff --git a/src/auth/db-dict.c b/src/auth/db-dict.c
index 89d44d211..a4c3b53ce 100644
--- a/src/auth/db-dict.c
+++ b/src/auth/db-dict.c
@@ -411,16 +411,11 @@ static int db_dict_iter_lookup_key_values(struct db_dict_value_iter *iter)
 	array_foreach_modifiable(&iter->keys, key) {
 		if (!key->used)
 			continue;
 
 		str_truncate(path, strlen(DICT_PATH_SHARED));
-		ret = var_expand(path, key->key->key, iter->var_expand_table, &error);
-		if (ret <= 0) {
-			auth_request_log_error(iter->auth_request, AUTH_SUBSYS_DB,
-				"Failed to expand key %s: %s", key->key->key, error);
-			return -1;
-		}
+		str_append(path, key->key->key);
 		ret = dict_lookup(iter->conn->dict, iter->pool,
 				  str_c(path), &key->value, &error);
 		if (ret > 0) {
 			auth_request_log_debug(iter->auth_request, AUTH_SUBSYS_DB,
 					       "Lookup: %s = %s", str_c(path),

Vulnerable code: 		ret = var_expand(path, key->key->key, iter->var_expand_table, &error);
		if (ret <= 0) {
			auth_request_log_error(iter->auth_request, AUTH_SUBSYS_DB,
				"Failed to expand key %s: %s", key->key->key, error);
			return -1;
		}
Fixed code: 		str_append(path, key->key->key);
CVE-2019-9578: Use of Uninitialized Resource (CWE-908)
value: In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 7.5
Published: 2019-03-05T23:29Z
Repository: https://github.com/Yubico/libu2f-host
Language: C
Files changed: u2f-host/devs.c
Commit date: 2019-02-22 12:32:10 +0100
Commit message: fix filling out of initresp

Diff: diff --git a/u2f-host/devs.c b/u2f-host/devs.c
index 2b4ca67..1eaf3fb 100644
--- a/u2f-host/devs.c
+++ b/u2f-host/devs.c
@@ -300,21 +300,33 @@ init_device (u2fh_devs * devs, struct u2fdevice *dev)
 
   if (u2fh_sendrecv
       (devs, dev->id, U2FHID_INIT, nonce, sizeof (nonce), resp,
        &resplen) == U2FH_OK)
     {
-      U2FHID_INIT_RESP initresp;
-      if (resplen > sizeof (initresp))
+      int offs = sizeof (nonce);
+      /* the response has to be atleast 17 bytes, if it's more we discard that */
+      if (resplen < 17)
 	{
-	  return U2FH_MEMORY_ERROR;
+	  return U2FH_SIZE_ERROR;
 	}
-      memcpy (&initresp, resp, resplen);
-      dev->cid = initresp.cid;
-      dev->versionInterface = initresp.versionInterface;
-      dev->versionMajor = initresp.versionMajor;
-      dev->versionMinor = initresp.versionMinor;
-      dev->capFlags = initresp.capFlags;
+
+      /* incoming and outgoing nonce has to match */
+      if (memcmp (nonce, resp, sizeof (nonce)) != 0)
+	{
+	  return U2FH_TRANSPORT_ERROR;
+	}
+
+      dev->cid =
+	resp[offs] << 24 | resp[offs + 1] << 16 | resp[offs +
+						       2] << 8 | resp[offs +
+								      3];
+      offs += 4;
+      dev->versionInterface = resp[offs++];
+      dev->versionMajor = resp[offs++];
+      dev->versionMinor = resp[offs++];
+      dev->versionBuild = resp[offs++];
+      dev->capFlags = resp[offs++];
     }
   else
     {
       return U2FH_TRANSPORT_ERROR;
     }

Vulnerable code:       U2FHID_INIT_RESP initresp;
      if (resplen > sizeof (initresp))
	  return U2FH_MEMORY_ERROR;
      memcpy (&initresp, resp, resplen);
      dev->cid = initresp.cid;
      dev->versionInterface = initresp.versionInterface;
      dev->versionMajor = initresp.versionMajor;
      dev->versionMinor = initresp.versionMinor;
      dev->capFlags = initresp.capFlags;
Fixed code:       int offs = sizeof (nonce);
      /* the response has to be atleast 17 bytes, if it's more we discard that */
      if (resplen < 17)
	  return U2FH_SIZE_ERROR;

      /* incoming and outgoing nonce has to match */
      if (memcmp (nonce, resp, sizeof (nonce)) != 0)
	{
	  return U2FH_TRANSPORT_ERROR;
	}

      dev->cid =
	resp[offs] << 24 | resp[offs + 1] << 16 | resp[offs +
						       2] << 8 | resp[offs +
								      3];
      offs += 4;
      dev->versionInterface = resp[offs++];
      dev->versionMajor = resp[offs++];
      dev->versionMinor = resp[offs++];
      dev->versionBuild = resp[offs++];
      dev->capFlags = resp[offs++];
CVE-2017-6903: Insufficient Information (NVD-CWE-noinfo)
value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2017-03-14T22:59Z
Repository: https://github.com/ioquake/ioq3
Language: C
Files changed: code/client/snd_openal.c
Commit date: 2017-03-13 20:28:37 -0700
Commit message: Don't open .pk3 files as OpenAL drivers.

Diff: diff --git a/code/client/snd_openal.c b/code/client/snd_openal.c
index 2a4fb0a2..319ea371 100644
--- a/code/client/snd_openal.c
+++ b/code/client/snd_openal.c
@@ -2510,15 +2510,21 @@ qboolean S_AL_Init( soundInterface_t *si )
 	s_alMinDistance = Cvar_Get( "s_alMinDistance", "120", CVAR_CHEAT );
 	s_alMaxDistance = Cvar_Get("s_alMaxDistance", "1024", CVAR_CHEAT);
 	s_alRolloff = Cvar_Get( "s_alRolloff", "2", CVAR_CHEAT);
 	s_alGraceDistance = Cvar_Get("s_alGraceDistance", "512", CVAR_CHEAT);
 
-	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH );
+	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED );
 
 	s_alInputDevice = Cvar_Get( "s_alInputDevice", "", CVAR_ARCHIVE | CVAR_LATCH );
 	s_alDevice = Cvar_Get("s_alDevice", "", CVAR_ARCHIVE | CVAR_LATCH);
 
+	if ( COM_CompareExtension( s_alDriver->string, ".pk3" ) )
+	{
+		Com_Printf( "Rejecting DLL named \"%s\"", s_alDriver->string );
+		return qfalse;
+	}
+
 	// Load QAL
 	if( !QAL_Init( s_alDriver->string ) )
 	{
 		Com_Printf( "Failed to load library: \"%s\".\n", s_alDriver->string );
 		if( !Q_stricmp( s_alDriver->string, ALDRIVER_DEFAULT ) || !QAL_Init( ALDRIVER_DEFAULT ) ) {

Vulnerable code: 	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH );
Fixed code: 	s_alDriver = Cvar_Get( "s_alDriver", ALDRIVER_DEFAULT, CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED );
	if ( COM_CompareExtension( s_alDriver->string, ".pk3" ) )
	{
		Com_Printf( "Rejecting DLL named \"%s\"", s_alDriver->string );
		return qfalse;
	}
CVE-2017-6903: Insufficient Information (NVD-CWE-noinfo)
value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2017-03-14T22:59Z
Repository: https://github.com/ioquake/ioq3
Language: C
Files changed: code/client/cl_console.c, code/qcommon/common.c
Commit date: 2017-03-13 20:44:47 -0700
Commit message: Merge some file writing extension checks from OpenJK.

Thanks Ensiform.
https://github.com/JACoders/OpenJK/commit/05928a57f9e4aae15a3bd0
https://github.com/JACoders/OpenJK/commit/ef124fd0fc48af164581176

Diff: diff --git a/code/client/cl_console.c b/code/client/cl_console.c
index 7d806e94..32ab87e0 100644
--- a/code/client/cl_console.c
+++ b/code/client/cl_console.c
@@ -189,10 +189,16 @@ void Con_Dump_f (void)
 	}
 
 	Q_strncpyz( filename, Cmd_Argv( 1 ), sizeof( filename ) );
 	COM_DefaultExtension( filename, sizeof( filename ), ".txt" );
 
+	if (!COM_CompareExtension(filename, ".txt"))
+	{
+		Com_Printf("Con_Dump_f: Only the \".txt\" extension is supported by this command!\n");
+		return;
+	}
+
 	f = FS_FOpenFileWrite( filename );
 	if (!f)
 	{
 		Com_Printf ("ERROR: couldn't open %s.\n", filename);
 		return;
diff --git a/code/qcommon/common.c b/code/qcommon/common.c
index db9b435f..f3cf1214 100644
--- a/code/qcommon/common.c
+++ b/code/qcommon/common.c
@@ -2973,10 +2973,17 @@ void Com_WriteConfig_f( void ) {
 	if ( Cmd_Argc() != 2 ) {
 		Com_Printf( "Usage: writeconfig <filename>\n" );
 		return;
 	}
 
+
+	if (!COM_CompareExtension(filename, ".cfg"))
+	{
+		Com_Printf("Com_WriteConfig_f: Only the \".cfg\" extension is supported by this command!\n");
+		return;
+	}
+
 	Q_strncpyz( filename, Cmd_Argv(1), sizeof( filename ) );
 	COM_DefaultExtension( filename, sizeof( filename ), ".cfg" );
 	Com_Printf( "Writing %s.\n", filename );
 	Com_WriteConfigToFile( filename );
 }

Fixed code: 	if (!COM_CompareExtension(filename, ".txt"))
	{
		Com_Printf("Con_Dump_f: Only the \".txt\" extension is supported by this command!\n");
		return;
	}


	if (!COM_CompareExtension(filename, ".cfg"))
	{
		Com_Printf("Com_WriteConfig_f: Only the \".cfg\" extension is supported by this command!\n");
		return;
	}
CVE-2020-11024: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 8.2
Published: 2020-04-29T21:15Z
Repository: https://github.com/moonlight-stream/moonlight-ios
Language: Unknown
Commit date: 2020-04-17 12:40:29 -0700
Commit message: Merge pull request #405 from loki-47-6F-64/master

Don't send PIN to GFE
CVE-2020-11052: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: In Sorcery before 0.15.0, there is a brute force vulnerability when using password authentication via Sorcery. The brute force protection submodule will prevent a brute force attack for the defined lockout period, but once expired, protection will not be re-enabled until a user or malicious actor logs in successfully. This does not affect users that do not use the built-in brute force protection submodule, nor users that use permanent account lockout. This has been patched in 0.15.0.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 9.8
Published: 2020-05-07T21:15Z
Repository: https://github.com/Sorcery/sorcery
Language: Ruby
Files changed: lib/sorcery/model.rb
Commit date: 2020-05-02 20:56:58 +0000
Commit message: Fix brute force vuln due to callbacks not being ran (#235)

The authenticate method previously would return before callbacks executed if an
invalid password was provided, which causes the brute force protection to only
work for the first lockout period, and only resets after a successful login.

Fixes #231
Diff: diff --git a/lib/sorcery/model.rb b/lib/sorcery/model.rb
index 395710c..6a500fc 100644
--- a/lib/sorcery/model.rb
+++ b/lib/sorcery/model.rb
@@ -100,14 +100,10 @@ module Sorcery
           return authentication_response(failure: :invalid_login, &block)
         end
 
         set_encryption_attributes
 
-        unless user.valid_password?(credentials[1])
-          return authentication_response(user: user, failure: :invalid_password, &block)
-        end
-
         if user.respond_to?(:active_for_authentication?) && !user.active_for_authentication?
           return authentication_response(user: user, failure: :inactive, &block)
         end
 
         @sorcery_config.before_authenticate.each do |callback|
@@ -116,10 +112,14 @@ module Sorcery
           unless success
             return authentication_response(user: user, failure: reason, &block)
           end
         end
 
+        unless user.valid_password?(credentials[1])
+          return authentication_response(user: user, failure: :invalid_password, &block)
+        end
+
         authentication_response(user: user, return_value: user, &block)
       end
 
       # encrypt tokens using current encryption_provider.
       def encrypt(*tokens)

Vulnerable code:         unless user.valid_password?(credentials[1])
          return authentication_response(user: user, failure: :invalid_password, &block)
        end

Fixed code:         unless user.valid_password?(credentials[1])
          return authentication_response(user: user, failure: :invalid_password, &block)
        end
CVE-2014-3999: Improper Authentication (CWE-287)
value: The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2018-04-10T15:29Z
Repository: https://github.com/horde/horde
Language: PHP
Files changed: framework/Ldap/lib/Horde/Ldap.php, framework/Ldap/test/Horde/Ldap/LdapTest.php
Commit date: 2014-06-03 10:29:46 +0200
Commit message: Stricter parameter check.

Diff: diff --git a/framework/Ldap/lib/Horde/Ldap.php b/framework/Ldap/lib/Horde/Ldap.php
index fc3443a48dc..25be6c2b93f 100644
--- a/framework/Ldap/lib/Horde/Ldap.php
+++ b/framework/Ldap/lib/Horde/Ldap.php
@@ -204,14 +204,14 @@ class Horde_Ldap
      * @throws Horde_Ldap_Exception
      */
     public function bind($dn = null, $password = null)
     {
         /* Fetch current bind credentials. */
-        if (empty($dn)) {
+        if (is_null($dn)) {
             $dn = $this->_config['binddn'];
         }
-        if (empty($password)) {
+        if (is_null($password)) {
             $password = $this->_config['bindpw'];
         }
 
         /* Connect first, if we haven't so far.  This will also bind
          * us to the server. */
diff --git a/framework/Ldap/test/Horde/Ldap/LdapTest.php b/framework/Ldap/test/Horde/Ldap/LdapTest.php
index 15d12bb758a..5081a5178c2 100644
--- a/framework/Ldap/test/Horde/Ldap/LdapTest.php
+++ b/framework/Ldap/test/Horde/Ldap/LdapTest.php
@@ -81,10 +81,23 @@ class Horde_Ldap_LdapTest extends Horde_Ldap_TestBase
         $lcfg = array('hostspec' => self::$ldapcfg['server']['hostspec'],
                       'port'     => self::$ldapcfg['server']['port']);
         $ldap = new Horde_Ldap($lcfg);
     }
 
+    /**
+     * Tests if the server can connect and bind, but not rebind with empty
+     * password.
+     *
+     * @expectedException Horde_Ldap_Exception
+     */
+    public function testConnectAndEmptyRebind()
+    {
+        // Simple working connect and privileged bind.
+        $ldap = new Horde_Ldap(self::$ldapcfg['server']);
+        $ldap->bind(self::$ldapcfg['server']['binddn'], '');
+    }
+
     /**
      * Tests startTLS() if server supports it.
      */
     public function testStartTLS()
     {

Vulnerable code:         if (empty($dn)) {
        if (empty($password)) {
Fixed code:         if (is_null($dn)) {
        if (is_null($password)) {
    /**
     * Tests if the server can connect and bind, but not rebind with empty
     * password.
     *
     * @expectedException Horde_Ldap_Exception
     */
    public function testConnectAndEmptyRebind()
    {
        // Simple working connect and privileged bind.
        $ldap = new Horde_Ldap(self::$ldapcfg['server']);
        $ldap->bind(self::$ldapcfg['server']['binddn'], '');
    }
CVE-2015-8807: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-04-13T16:59Z
Repository: https://github.com/horde/horde
Language: PHP
Files changed: framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
Commit date: 2015-12-14 09:27:09 -0500
Commit message: Escape form value.

Even though this is a numeric field, this isn't enforced until
the form is submitted.

Diff: diff --git a/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php b/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
index 62ae5599915..580dc27409d 100644
--- a/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
+++ b/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
@@ -46,11 +46,11 @@ class Horde_Core_Ui_VarRenderer_Html extends Horde_Core_Ui_VarRenderer
             $value = str_replace('.', $linfo['mon_decimal_point'], $value);
         }
         return sprintf('<input type="text" size="5" name="%s" id="%s" value="%s"%s />',
                        htmlspecialchars($var->getVarName()),
                        $this->_genID($var->getVarName(), false),
-                       $value,
+                       htmlspecialchars($value),
                        $this->_getActionScripts($form, $var)
                );
     }
 
     protected function _renderVarInput_int($form, &$var, &$vars)

Vulnerable code:                        $value,
Fixed code:                        htmlspecialchars($value),
CVE-2016-5303: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-12-20T22:59Z
Repository: https://github.com/horde/horde
Language: XML
Files changed: framework/Text_Filter/package.xml
Commit date: 2016-09-06 16:15:10 +0200
Commit message: [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu <fantasy7082@hotmail.com>).

Diff: diff --git a/framework/Text_Filter/package.xml b/framework/Text_Filter/package.xml
index 231e35ec2d7..b507a3ff94b 100644
--- a/framework/Text_Filter/package.xml
+++ b/framework/Text_Filter/package.xml
@@ -31,11 +31,11 @@
   <release>stable</release>
   <api>stable</api>
  </stability>
  <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
  <notes>
-* 
+* [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu &lt;fantasy7082@hotmail.com&gt;).
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
    <dir name="doc">
     <dir name="Horde">
@@ -1109,10 +1109,10 @@ Initial release as a PEAR package
     <release>stable</release>
     <api>stable</api></stability>
    <date>2016-03-21</date>
    <license uri="http://www.horde.org/licenses/lgpl21">LGPL-2.1</license>
    <notes>
-* 
+* [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu &lt;fantasy7082@hotmail.com&gt;).
    </notes>
   </release>
  </changelog>
 </package>

Vulnerable code: * 
* 
Fixed code: * [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu &lt;fantasy7082@hotmail.com&gt;).
* [jan] SECURITY: Fix XSS via data:text/html content of form action and xlink attributes (Reported by Liuzhu &lt;fantasy7082@hotmail.com&gt;).
CVE-2017-14650: Improper Input Validation (CWE-20)
value: A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1, and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.1
Published: 2017-09-21T17:29Z
Repository: https://github.com/horde/horde
Language: PHP
Files changed: framework/Image/lib/Horde/Image/Im.php
Commit date: 2017-09-19 18:03:52 +0200
Commit message: Fix RCE in _raw() via $index parameter.

$index is passed down from getImageAtIndex($index).
Luckily the only official horde code calling it
is the PDF preview code with a fixed index of 0.

Still code from third party vendors using the Horde framework libs
might expose getImageAtIndex() to the web.

PoC:

----------------
<?php
$options = array('index' => "5'$(ls -al )'");
$max_pages = 10;

// php fun: implicit conversion to integer
if ($options['index'] < $max_pages)
{
    // _raw() call in Im.php might look like
    //        /usr/bin/convert  "/tmp/img1URPsC"'[0]'  -strip png:"/tmp/img0NgHfI"
    echo exec('echo \'[' . $options['index'] . ']\' ');
}
?>
----------------
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Jan Schneider <jan@horde.org>

Diff: diff --git a/framework/Image/lib/Horde/Image/Im.php b/framework/Image/lib/Horde/Image/Im.php
index f5b51f28877..e2c2eb95645 100644
--- a/framework/Image/lib/Horde/Image/Im.php
+++ b/framework/Image/lib/Horde/Image/Im.php
@@ -196,11 +196,11 @@ class Horde_Image_Im extends Horde_Image_Base
         }
 
         $tmpin = $this->toFile($this->_data);
         $tmpout = Horde_Util::getTempFile('img', false, $this->_tmpdir);
         $command = $this->_convert . ' ' . implode(' ', $this->_operations)
-            . ' "' . $tmpin . '"\'[' . $options['index'] . ']\' '
+            . ' "' . $tmpin . '"\'[' . (integer)$options['index'] . ']\' '
             . implode(' ', $this->_postSrcOperations)
             . ' -strip ' . $this->_type . ':"' . $tmpout . '" 2>&1';
         $this->_logDebug(sprintf("convert command executed by Horde_Image_im::raw(): %s", $command));
         exec($command, $output, $retval);
         if ($retval) {

Vulnerable code:             . ' "' . $tmpin . '"\'[' . $options['index'] . ']\' '
Fixed code:             . ' "' . $tmpin . '"\'[' . (integer)$options['index'] . ']\' '
CVE-2014-125040: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in stevejagodzinski DevNewsAggregator. It has been rated as critical. Affected by this issue is the function getByName of the file php/data_access/RemoteHtmlContentDataAccess.php. The manipulation of the argument name leads to sql injection. The name of the patch is b9de907e7a8c9ca9d75295da675e58c5bf06b172. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217484.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-05T14:15Z
Repository: https://github.com/stevejagodzinski/DevNewsAggregator
Language: PHP
Files changed: php/data_access/RemoteHtmlContentDataAccess.php
Commit date: 2014-11-30 17:40:55 -0500
Commit message: Fix SQL injection vulnerability

Diff: diff --git a/php/data_access/RemoteHtmlContentDataAccess.php b/php/data_access/RemoteHtmlContentDataAccess.php
index d64346e..ae8dcf4 100644
--- a/php/data_access/RemoteHtmlContentDataAccess.php
+++ b/php/data_access/RemoteHtmlContentDataAccess.php
@@ -18,11 +18,11 @@ class RemoteHtmlContentDataAccess {
 
         return self::getForQueryString($query, array($userId));
     }
 
     public static function getByName($name) {
-        return self::getForQueryString("SELECT * FROM \"DevNewsAggregatorConfiguration_htmlcontent\" WHERE name = $name");
+        return self::getForQueryString("SELECT * FROM \"DevNewsAggregatorConfiguration_htmlcontent\" WHERE name = $1", array($name));
     }
 
     private static function getForQueryString($query, $params=array()) {
         $connection = pg_connect("host=localhost port=5432 dbname=DevNewsAggregator user=DevNews password=DevNews") or die("Could not connect to Postgres");
         $result = pg_query_params($connection, $query, $params) or die("Could not execute query");

Vulnerable code:         return self::getForQueryString("SELECT * FROM \"DevNewsAggregatorConfiguration_htmlcontent\" WHERE name = $name");
Fixed code:         return self::getForQueryString("SELECT * FROM \"DevNewsAggregatorConfiguration_htmlcontent\" WHERE name = $1", array($name));
CVE-2014-125056: Observable Timing Discrepancy (CWE-208)
value: A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.
CWE description: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.3
Published: 2023-01-07T10:15Z
Repository: https://github.com/Pylons/horus
Language: Unknown
Commit date: 2014-05-06 22:02:20 -0700
Commit message: Merge pull request #1 from tilgovi/passwordtiming

Prevent timing attacks on passwords
CVE-2021-21371: Deserialization of Untrusted Data (CWE-502)
value: Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.6
Published: 2021-03-10T22:15Z
Repository: https://github.com/tenable/integration-jira-cloud
Language: Python
Files changed: tenable_jira/cli.py
Commit date: 2021-03-04 08:58:38 -0600
Commit message: switched yaml.load() to yaml.safe_load() to not load serialized python objects.

Diff: diff --git a/tenable_jira/cli.py b/tenable_jira/cli.py
index 17bb76b..1f16571 100644
--- a/tenable_jira/cli.py
+++ b/tenable_jira/cli.py
@@ -60,11 +60,11 @@ def cli(configfile, observed_since, setup_only=False, troubleshoot=False):
     '''
     Tenable.io -> Jira Cloud Transformer & Ingester
     '''
     # Load the config, but ensure that any additional fields are additive to the
     # basic field set.
-    config_from_file = yaml.load(configfile, Loader=yaml.Loader)
+    config_from_file = yaml.safe_load(configfile)
     fields = config_from_file.pop('custom_fields', list())
     config = dict_merge(base_config(), config_from_file)
     config['fields'] = config['fields'] + fields
 
     if config['tenable'].get('tio_transform_tags'):

Vulnerable code:     config_from_file = yaml.load(configfile, Loader=yaml.Loader)
Fixed code:     config_from_file = yaml.safe_load(configfile)
CVE-2022-23126: Improper Authentication (CWE-287)
value: TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2022-01-24T19:15Z
Repository: https://github.com/adriankumpf/teslamate
Language: Other
Files changed: grafana/Dockerfile, website/docs/installation/docker.md
Commit date: 2022-01-12 00:23:16 +0100
Commit message: Disable anonymous login to Grafana

Diff: diff --git a/grafana/Dockerfile b/grafana/Dockerfile
index f915c38..b1536ad 100644
--- a/grafana/Dockerfile
+++ b/grafana/Dockerfile
@@ -1,9 +1,9 @@
 FROM grafana/grafana:7.5.12
 
 ENV GF_ANALYTICS_REPORTING_ENABLED=FALSE \
-    GF_AUTH_ANONYMOUS_ENABLED=true \
+    GF_AUTH_ANONYMOUS_ENABLED=false \
     GF_AUTH_BASIC_ENABLED=false \
     GF_PATHS_PLUGINS="/var/lib/grafana-plugins" \
     GF_SECURITY_ADMIN_PASSWORD=admin \
     GF_SECURITY_ADMIN_USER=admin \
     GF_SECURITY_ALLOW_EMBEDDING=true \
diff --git a/website/docs/installation/docker.md b/website/docs/installation/docker.md
index 03292b6..a44b938 100644
--- a/website/docs/installation/docker.md
+++ b/website/docs/installation/docker.md
@@ -88,11 +88,11 @@ This setup is recommended only if you are running TeslaMate **on your home netwo
 
 ## Usage
 
 1. Open the web interface [http://your-ip-address:4000](http://localhost:4000)
 2. Sign in with your Tesla account
-3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000).
+3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000). Log in with the default user `admin` (inital password `admin`) and enter a secure password.
 
 ## [Update](../upgrading.mdx)
 
 To update the running TeslaMate configuration to the latest version, run the following commands:
 

Vulnerable code:     GF_AUTH_ANONYMOUS_ENABLED=true \
3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000).
Fixed code:     GF_AUTH_ANONYMOUS_ENABLED=false \
3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000). Log in with the default user `admin` (inital password `admin`) and enter a secure password.
CVE-2023-48311: Insufficient Information (NVD-CWE-noinfo)
value: dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.3
Published: 2023-12-08T20:15Z
Repository: https://github.com/jupyterhub/dockerspawner
Language: Unknown
Commit date: 2023-11-21 15:09:25 +0100
Commit message: Merge pull request from GHSA-hfgr-h3vc-p6c2

allow only configured image by default
CVE-2021-41689: NULL Pointer Dereference (CWE-476)
value: DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-06-28T13:15Z
Repository: https://github.com/DCMTK/dcmtk
Language: C++
Files changed: dcmnet/libsrc/diutil.cc
Commit date: 2021-09-15 09:04:12 +0200
Commit message: Fixed possible NULL pointer dereference.

Thanks to Jinsheng Ba <bajinsheng@u.nus.edu> for the report and patch.

Diff: diff --git a/dcmnet/libsrc/diutil.cc b/dcmnet/libsrc/diutil.cc
index 45d486e39..0a6f05ae4 100644
--- a/dcmnet/libsrc/diutil.cc
+++ b/dcmnet/libsrc/diutil.cc
@@ -169,11 +169,12 @@ DU_getStringDOElement(DcmItem *obj, DcmTagKey t, char *s, size_t bufsize)
     if (ec == EC_Normal && elem != NULL) {
         if (elem->getLength() == 0) {
             s[0] = '\0';
         } else {
             ec =  elem->getString(aString);
-            OFStandard::strlcpy(s, aString, bufsize);
+            if (ec == EC_Normal)
+                OFStandard::strlcpy(s, aString, bufsize);
         }
     }
     return (ec == EC_Normal);
 }
 

Vulnerable code:             OFStandard::strlcpy(s, aString, bufsize);
Fixed code:             if (ec == EC_Normal)
                OFStandard::strlcpy(s, aString, bufsize);
CVE-2021-36692: Divide By Zero (CWE-369)
value: libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2021-08-30T21:15Z
Repository: https://github.com/libjxl/libjxl
Language: Other
Files changed: AUTHORS, lib/extras/codec_apng.cc
Commit date: 2021-07-15 12:34:08 +0200
Commit message: Fix handling of APNG with 0 delay_den (#313)


Diff: diff --git a/AUTHORS b/AUTHORS
index d74bca2..bc1ff2a 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -14,10 +14,11 @@
 # Organizations:
 Cloudinary Ltd. <*@cloudinary.com>
 Google LLC <*@google.com>
 
 # Individuals:
+Alexander Sago <cagelight@gmail.com>
 Dirk Lemstra <dirk@lemstra.org>
 Jon Sneyers <jon@cloudinary.com>
 Pieter Wuille
 Marcin Konicki <ahwayakchih@gmail.com>
 Ziemowit Zabawa <ziemek.zabawa@outlook.com>
diff --git a/lib/extras/codec_apng.cc b/lib/extras/codec_apng.cc
index 48b7653..bef59f6 100644
--- a/lib/extras/codec_apng.cc
+++ b/lib/extras/codec_apng.cc
@@ -340,10 +340,12 @@ Status DecodeImageAPNG(Span<const uint8_t> bytes, ThreadPool* pool,
           delay_num = png_get_uint_16(chunk.p + 28);
           delay_den = png_get_uint_16(chunk.p + 30);
           dop = chunk.p[32];
           bop = chunk.p[33];
 
+          if (!delay_den) delay_den = 100;
+
           if (w0 > cMaxPNGSize || h0 > cMaxPNGSize || x0 > cMaxPNGSize ||
               y0 > cMaxPNGSize || x0 + w0 > w || y0 + h0 > h || dop > 2 ||
               bop > 1) {
             delete[] chunk.p;
             break;

Fixed code: Alexander Sago <cagelight@gmail.com>
          if (!delay_den) delay_den = 100;
CVE-2018-25060: Missing Encryption of Sensitive Data (CWE-311)
value: A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 7.5
Published: 2022-12-30T12:15Z
Repository: https://github.com/go-macaron/csrf
Language: Go
Files changed: csrf.go
Commit date: 2018-04-26 17:10:50 -0400
Commit message: Support secure mode for csrf cookie (#7)

Options struct has Secure flag for csrf cookie, but it's just ignored
and corresponding argument of SetCookie() is hardcodded to false.

This pass Options.Secure to SetCookie in csrf.Generate()

Signed-off-by: Aleksandr Bulyshchenko <A.Bulyshchenko@globallogic.com>
Diff: diff --git a/csrf.go b/csrf.go
index 9c1e38b..19c9b47 100644
--- a/csrf.go
+++ b/csrf.go
@@ -220,11 +220,11 @@ func Generate(options ...Options) macaron.Handler {
 
 		if needsNew {
 			// FIXME: actionId.
 			x.Token = GenerateToken(x.Secret, x.ID, "POST")
 			if opt.SetCookie {
-				ctx.SetCookie(opt.Cookie, x.Token, 0, opt.CookiePath, "", false, opt.CookieHttpOnly, time.Now().AddDate(0, 0, 1))
+				ctx.SetCookie(opt.Cookie, x.Token, 0, opt.CookiePath, "", opt.Secure, opt.CookieHttpOnly, time.Now().AddDate(0, 0, 1))
 			}
 		}
 
 		if opt.SetHeader {
 			ctx.Resp.Header().Add(opt.Header, x.Token)

Vulnerable code: 				ctx.SetCookie(opt.Cookie, x.Token, 0, opt.CookiePath, "", false, opt.CookieHttpOnly, time.Now().AddDate(0, 0, 1))
Fixed code: 				ctx.SetCookie(opt.Cookie, x.Token, 0, opt.CookiePath, "", opt.Secure, opt.CookieHttpOnly, time.Now().AddDate(0, 0, 1))
CVE-2020-28874: Improper Authentication (CWE-287)
value: reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2021-01-26T18:15Z
Repository: https://github.com/projectsend/projectsend
Language: PHP
Files changed: reset-password.php
Commit date: 2020-11-17 16:33:59 -0300
Commit message: Fix CVE-2020-28874 by @varandinawer

Diff: diff --git a/reset-password.php b/reset-password.php
index 4f88ea5..d2c5ebd 100644
--- a/reset-password.php
+++ b/reset-password.php
@@ -53,10 +53,15 @@ include_once ADMIN_VIEWS_DIR . DS . 'header-unlogged.php';
             $errorstate = 'token_invalid';
             $show_form = 'none';
         }
     }
 
+    /** Fix CVE-2020-28874 */
+    if (!empty($errorstate)) {
+        unset($user_data);
+    }
+
     /** The form was submitted */
     if ($_POST) {
         /**
          * Clean the posted form values.
          */

Fixed code:     /** Fix CVE-2020-28874 */
    if (!empty($errorstate)) {
        unset($user_data);
    }
CVE-2015-8949: Use After Free (CWE-416)
value: Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2016-08-19T21:59Z
Repository: https://github.com/perl5-dbi/DBD-mysql
Language: Unknown
Commit date: 2015-11-22 06:22:05 -0800
Commit message: Merge pull request #45 from hannob/master

Fix use after free error.
CVE-2016-1246: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2016-10-05T16:59Z
Repository: https://github.com/perl5-dbi/DBD-mysql
Language: C
Files changed: dbdimp.c
Commit date: 2016-10-02 22:09:26 +0200
Commit message: Do not use unsafe sprintf w/variable length input

This can cause a  buffer overflow to occur when reporting error
message about validation of (untrusted) user input parameters.

Diff: diff --git a/dbdimp.c b/dbdimp.c
index 77524ec..d0b46c3 100644
--- a/dbdimp.c
+++ b/dbdimp.c
@@ -4781,11 +4781,11 @@ int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,
 		 IV sql_type, SV *attribs, int is_inout, IV maxlen) {
   dTHX;
   int rc;
   int param_num= SvIV(param);
   int idx= param_num - 1;
-  char err_msg[64];
+  char *err_msg;
   D_imp_xxh(sth);
 
 #if MYSQL_VERSION_ID >= SERVER_PREPARE_VERSION
   STRLEN slen;
   char *buffer= NULL;
@@ -4824,13 +4824,13 @@ int dbd_bind_ph(SV *sth, imp_sth_t *imp_sth, SV *param, SV *value,
        sql_type == SQL_REAL     ||
        sql_type == SQL_DOUBLE) )
   {
     if (! looks_like_number(value))
     {
-      sprintf(err_msg,
+      err_msg = SvPVX(sv_2mortal(newSVpvf(
               "Binding non-numeric field %d, value %s as a numeric!",
-              param_num, neatsvpv(value,0));
+              param_num, neatsvpv(value,0))));
       do_error(sth, JW_ERR_ILLEGAL_PARAM_NUM, err_msg, NULL);
     }
   }
 
   if (is_inout)

Vulnerable code:   char err_msg[64];
      sprintf(err_msg,
              param_num, neatsvpv(value,0));
Fixed code:   char *err_msg;
      err_msg = SvPVX(sv_2mortal(newSVpvf(
              param_num, neatsvpv(value,0))));
CVE-2018-7663: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile (resources/views/layouts/app.blade.php) allows for server-side template injection of arbitrary JavaScript.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-05T07:29Z
Repository: https://github.com/voten-co/voten
Language: PHP
Files changed: app/Http/helpers.php, resources/views/layouts/app.blade.php
Commit date: 2017-08-25 22:26:25 +0430
Commit message: adds and uses strToHex helper

Diff: diff --git a/app/Http/helpers.php b/app/Http/helpers.php
index 3194eb3..c4bcd77 100644
--- a/app/Http/helpers.php
+++ b/app/Http/helpers.php
@@ -199,5 +199,22 @@ if (!function_exists('iso8601')) {
     function iso8601($time)
     {
         return gmdate('c', strtotime($time));
     }
 }
+
+if (!function_exists('strToHex')) {
+    /**
+     * Converts timestamp to ISO8601 format.
+     *
+     * @param string $string
+     *
+     * @return string
+     */
+    function strToHex($string) {
+        $hex = bin2hex($string);
+        $hex = chunk_split($hex, 2, "\\x");
+        $hex = "\\x" . substr($hex, 0, -2);
+
+        return $hex;
+    }
+}
diff --git a/resources/views/layouts/app.blade.php b/resources/views/layouts/app.blade.php
index 46a5f37..dc3e280 100755
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@@ -67,11 +67,11 @@
 </div>
 
 <script>
     var auth = {
         id: '{{ Auth::user()->id }}',
-        bio: `{!! Auth::user()->bio !!}`,
+        bio: '{!! strToHex(Auth::user()->bio) !!}',
         name: '{{ Auth::user()->name }}',
         email: '{{ Auth::user()->email }}',
         color: '{{ Auth::user()->color }}',
         avatar: '{{ Auth::user()->avatar }}',
         location: '{{ Auth::user()->location }}',

Vulnerable code:         bio: `{!! Auth::user()->bio !!}`,
Fixed code: 
if (!function_exists('strToHex')) {
    /**
     * Converts timestamp to ISO8601 format.
     *
     * @param string $string
     *
     * @return string
     */
    function strToHex($string) {
        $hex = bin2hex($string);
        $hex = chunk_split($hex, 2, "\\x");
        $hex = "\\x" . substr($hex, 0, -2);

        return $hex;
    }
}
        bio: '{!! strToHex(Auth::user()->bio) !!}',