Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2024-21668: Insertion of Sensitive Information into Log File (CWE-532)
value: react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 4.9
Published: 2024-01-09T19:15Z
Repository: https://github.com/mrousavy/react-native-mmkv
Language: C++
Files changed: android/src/main/cpp/MmkvHostObject.cpp
Commit date: 2023-09-30 13:11:25 +0200
Commit message: fix: Don't leak encryption key in logs

Diff: diff --git a/android/src/main/cpp/MmkvHostObject.cpp b/android/src/main/cpp/MmkvHostObject.cpp
index 3d715d0..1ffbdc2 100644
--- a/android/src/main/cpp/MmkvHostObject.cpp
+++ b/android/src/main/cpp/MmkvHostObject.cpp
@@ -13,13 +13,14 @@
 #include <string>
 #include <vector>
 
 MmkvHostObject::MmkvHostObject(const std::string& instanceId, std::string path,
                                std::string cryptKey) {
+  bool hasEncryptionKey = cryptKey.size() > 0;
   __android_log_print(ANDROID_LOG_INFO, "RNMMKV",
-                      "Creating MMKV instance \"%s\"... (Path: %s, Encryption-Key: %s)",
-                      instanceId.c_str(), path.c_str(), cryptKey.c_str());
+                      "Creating MMKV instance \"%s\"... (Path: %s, Encrypted: %b)",
+                      instanceId.c_str(), path.c_str(), hasEncryptionKey);
   std::string* pathPtr = path.size() > 0 ? &path : nullptr;
   std::string* cryptKeyPtr = cryptKey.size() > 0 ? &cryptKey : nullptr;
   instance = MMKV::mmkvWithID(instanceId, mmkv::DEFAULT_MMAP_SIZE, MMKV_SINGLE_PROCESS, cryptKeyPtr,
                               pathPtr);
 

Vulnerable code:                       "Creating MMKV instance \"%s\"... (Path: %s, Encryption-Key: %s)",
                      instanceId.c_str(), path.c_str(), cryptKey.c_str());
Fixed code:   bool hasEncryptionKey = cryptKey.size() > 0;
                      "Creating MMKV instance \"%s\"... (Path: %s, Encrypted: %b)",
                      instanceId.c_str(), path.c_str(), hasEncryptionKey);
CVE-2021-21323: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2021-02-23T23:15Z
Repository: https://github.com/brave/brave-core
Language: Unknown
Commit date: 2021-02-04 13:32:48 -0800
Commit message: Merge pull request #7769 from brave/tor-dns-leak

Fix Tor dns leak
CVE-2022-47932: Other (NVD-CWE-Other)
value: Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.5
Published: 2022-12-24T22:15Z
Repository: https://github.com/brave/brave-core
Language: Unknown
Commit date: 2022-07-19 07:04:56 -0700
Commit message: Merge pull request #14211 from brave/brave_24093

Block incorrect IPFS\IPNS urls.
CVE-2022-47933: Improper Handling of Exceptional Conditions (CWE-755)
value: Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 6.5
Published: 2022-12-24T22:15Z
Repository: https://github.com/brave/brave-core
Language: Unknown
Commit date: 2022-07-01 23:18:47 -0700
Commit message: Merge pull request #13989 from brave/brave_23646

Do not proceed loading ipfs resources if ipfs is disabled
CVE-2020-5277: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-03-25T19:15Z
Repository: https://github.com/PrestaShop/ps_facetedsearch
Language: Unknown
Commit date: 2020-03-24 17:37:48 +0100
Commit message: Merge pull request from GHSA-mmmv-m5q9-g3cm

Escape url_name parameter
CVE-2020-26205: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-10-29T20:15Z
Repository: https://github.com/salopensource/sal
Language: Unknown
Commit date: 2020-10-06 19:56:18 -0700
Commit message: Merge pull request #405 from salopensource/xss

Prevents an XSS vulnerability on the machine_list view
CVE-2013-0294: Use of Insufficiently Random Values (CWE-330)
value: packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.
CWE description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CVSS v3 base score: 5.9
Published: 2020-01-28T16:15Z
Repository: https://github.com/wichert/pyrad
Language: Other
Files changed: CHANGES.txt, pyrad/packet.py
Commit date: 2013-01-15 16:55:54 +0100
Commit message: Use a better random generator.

Diff: diff --git a/CHANGES.txt b/CHANGES.txt
index 17aaffe..6dd92ef 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,8 +1,15 @@
 Changelog
 =========
 
+2.1 - Unreleased
+------------------
+
+* Use a different random generator to improve the security of generated
+  packet ids and authenticators.
+
+
 2.0 - May 15, 2011
 ------------------
 
 * Start moving codebase to PEP8 compatible coding style.
 
diff --git a/pyrad/packet.py b/pyrad/packet.py
index e3682b2..2366140 100644
--- a/pyrad/packet.py
+++ b/pyrad/packet.py
@@ -31,12 +31,15 @@ DisconnectACK = 41
 DisconnectNAK = 42
 CoARequest = 43
 CoAACK = 44
 CoANAK = 45
 
+# Use cryptographic-safe random generator as provided by the OS.
+random_generator = random.SystemRandom()
+
 # Current ID
-CurrentID = random.randrange(1, 255)
+CurrentID = random_generator.randrange(1, 255)
 
 
 class PacketError(Exception):
     pass
 
@@ -206,11 +209,11 @@ class Packet(dict):
         :rtype: binary string
         """
 
         data = []
         for i in range(16):
-            data.append(random.randrange(0, 256))
+            data.append(random_generator.randrange(0, 256))
         if six.PY3:
             return bytes(data)
         else:
             return ''.join(chr(b) for b in data)
 
@@ -221,11 +224,11 @@ class Packet(dict):
 
         :return: ID number
         :rtype:  integer
 
         """
-        return random.randrange(0, 256)
+        return random_generator.randrange(0, 256)
 
     def ReplyPacket(self):
         """Create a ready-to-transmit authentication reply packet.
         Returns a RADIUS packet which can be directly transmitted
         to a RADIUS server. This differs with Packet() in how

Vulnerable code: CurrentID = random.randrange(1, 255)
            data.append(random.randrange(0, 256))
        return random.randrange(0, 256)
Fixed code: 2.1 - Unreleased
------------------

* Use a different random generator to improve the security of generated
  packet ids and authenticators.


# Use cryptographic-safe random generator as provided by the OS.
random_generator = random.SystemRandom()

CurrentID = random_generator.randrange(1, 255)
            data.append(random_generator.randrange(0, 256))
        return random_generator.randrange(0, 256)
CVE-2023-43364: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-12-12T18:15Z
Repository: https://github.com/ArjunSharda/Searchor
Language: Unknown
Commit date: 2022-10-31 19:06:54 +1000
Commit message: Merge pull request #130 from dan-pavlov/remove-eval-from-cli

removed eval from search cli method
CVE-2023-28851: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Silverstripe Form Capture provides a method to capture simple silverstripe forms and an admin interface for users. Starting in version 0.2.0 and prior to versions 1.0.2, 1.1.0, 2.2.5, and 3.1.1, improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack. The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-03T18:15Z
Repository: https://github.com/bigfork/silverstripe-form-capture
Language: PHP
Files changed: src/Model/CapturedFormSubmission.php
Commit date: 2023-03-31 17:14:35 +0100
Commit message: Fix improper escaping of details fields in GridField view

Diff: diff --git a/src/Model/CapturedFormSubmission.php b/src/Model/CapturedFormSubmission.php
index e33c0fb..5f37431 100644
--- a/src/Model/CapturedFormSubmission.php
+++ b/src/Model/CapturedFormSubmission.php
@@ -132,11 +132,11 @@ class CapturedFormSubmission extends DataObject implements PermissionProvider
 		foreach ($this->CapturedFields()->filter(['IsInDetails' => '1']) as $field) {
 			if (!$field->Value) {
                 continue;
             }
 
-			$htmlEnt = '<strong>'. $field->Title .'</strong>: '. $field->Value;
+			$htmlEnt = '<strong>'. $field->Title .'</strong>: '. $field->dbObject('Value')->forTemplate();
 			$toAdd[] = $htmlEnt;
 		}
 
 		$html->setValue(join('<br />', $toAdd));
         return $html;

Vulnerable code: 			$htmlEnt = '<strong>'. $field->Title .'</strong>: '. $field->Value;
Fixed code: 			$htmlEnt = '<strong>'. $field->Title .'</strong>: '. $field->dbObject('Value')->forTemplate();
CVE-2023-40267: Insufficient Information (NVD-CWE-noinfo)
value: GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-08-11T07:15Z
Repository: https://github.com/gitpython-developers/GitPython
Language: Unknown
Commit date: 2023-07-10 19:41:35 +0200
Commit message: Merge pull request #1609 from Beuc/block-insecure-options-clone-non-multi

Block insecure non-multi options in clone/clone_from
CVE-2024-22190: Untrusted Search Path (CWE-426)
value: GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2024-01-11T02:15Z
Repository: https://github.com/gitpython-developers/GitPython
Language: Unknown
Commit date: 2024-01-10 13:08:17 +0100
Commit message: Merge pull request #1792 from EliahKagan/popen

Fix two remaining Windows untrusted search path cases
CVE-2022-21712: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2022-02-07T22:15Z
Repository: https://github.com/twisted/twisted
Language: Unknown
Commit date: 2022-01-23 18:42:58 -0500
Commit message: Merge pull request from GHSA-92x2-jw7w-xvvx

10294 Advisory fix 1
CVE-2022-21716: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2022-03-03T21:15Z
Repository: https://github.com/twisted/twisted
Language: Other
Files changed: NEWS.rst
Commit date: 2022-03-01 10:39:34 +0000
Commit message: Update the release date.

Diff: diff --git a/NEWS.rst b/NEWS.rst
index f9e3c04b29..66a31d0742 100644
--- a/NEWS.rst
+++ b/NEWS.rst
@@ -1,12 +1,12 @@
 Ticket numbers in this file can be looked up by visiting
 http://twistedmatrix.com/trac/ticket/<number>
 
 .. towncrier release notes start
 
-Twisted 22.2.0.rc1 (2022-02-08)
-===============================
+Twisted 22.2.0 (2022-03-01)
+===========================
 
 Bugfixes
 --------
 
 - twisted.internet.gireactor.PortableGIReactor.simulate and twisted.internet.gtk2reactor.PortableGtkReactor.simulate no longer raises TypeError when there are no delayed called. This was a regression introduced with the migration to Python 3 in which the builtin `min` function no longer accepts `None` as an argument. (#9660)

Vulnerable code: Twisted 22.2.0.rc1 (2022-02-08)
===============================
Fixed code: Twisted 22.2.0 (2022-03-01)
===========================
CVE-2022-24801: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 8.1
Published: 2022-04-04T18:15Z
Repository: https://github.com/twisted/twisted
Language: Unknown
Commit date: 2022-04-04 10:30:28 +0100
Commit message: Merge pull request from GHSA-c2jg-hw38-jrqq

10323: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in twisted.web
CVE-2022-39348: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-10-26T20:15Z
Repository: https://github.com/twisted/twisted
Language: Unknown
Commit date: 2022-10-26 19:52:32 +0100
Commit message: Merge pull request from GHSA-vg46-2rrj-3647

#11716 Fix NameVirtualHost HTML injection and deprecate t.w.r.ErrorPage in favor of t.w.pages
CVE-2022-39348: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CVSS v3 base score: 5.4
Published: 2022-10-26T20:15Z
Repository: https://github.com/twisted/twisted
Language: Unknown
Commit date: 2022-10-26 19:52:32 +0100
Commit message: Merge pull request from GHSA-vg46-2rrj-3647

#11716 Fix NameVirtualHost HTML injection and deprecate t.w.r.ErrorPage in favor of t.w.pages
CVE-2022-39348: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-10-26T20:15Z
Repository: https://github.com/twisted/twisted
Language: Python
Files changed: twisted/web/vhost.py
Commit date: 2001-07-23 00:21:39 +0000
Commit message: vhost bugfix...


git-svn-id: svn://svn.twistedmatrix.com/svn/Twisted/trunk@53 bbbe8e31-12d6-0310-92fd-ac37d47ddeeb

Diff: diff --git a/twisted/web/vhost.py b/twisted/web/vhost.py
index 217102ff83..ab2777faf9 100644
--- a/twisted/web/vhost.py
+++ b/twisted/web/vhost.py
@@ -32,11 +32,11 @@ class NameVirtualHost(resource.Resource):
 
     def _getResourceForRequest(self, request):
         """(Internal) Get the appropriate resource for the given host.
         """
         host = string.lower(request.getHeader('host'))
-        return self.hosts.get(host, error.NoResource())
+        return self.hosts.get(host, error.NoResource("host %s not in vhost map" % repr(host)))
         
     def render(self, request):
         """Implementation of resource.Resource's render method.
         """
         resrc = self._getResourceForRequest(request)

Vulnerable code:         return self.hosts.get(host, error.NoResource())
Fixed code:         return self.hosts.get(host, error.NoResource("host %s not in vhost map" % repr(host)))
CVE-2022-39348: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
value: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
CWE description: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CVSS v3 base score: 5.4
Published: 2022-10-26T20:15Z
Repository: https://github.com/twisted/twisted
Language: Python
Files changed: twisted/web/vhost.py
Commit date: 2001-07-23 00:21:39 +0000
Commit message: vhost bugfix...


git-svn-id: svn://svn.twistedmatrix.com/svn/Twisted/trunk@53 bbbe8e31-12d6-0310-92fd-ac37d47ddeeb

Diff: diff --git a/twisted/web/vhost.py b/twisted/web/vhost.py
index 217102ff83..ab2777faf9 100644
--- a/twisted/web/vhost.py
+++ b/twisted/web/vhost.py
@@ -32,11 +32,11 @@ class NameVirtualHost(resource.Resource):
 
     def _getResourceForRequest(self, request):
         """(Internal) Get the appropriate resource for the given host.
         """
         host = string.lower(request.getHeader('host'))
-        return self.hosts.get(host, error.NoResource())
+        return self.hosts.get(host, error.NoResource("host %s not in vhost map" % repr(host)))
         
     def render(self, request):
         """Implementation of resource.Resource's render method.
         """
         resrc = self._getResourceForRequest(request)

Vulnerable code:         return self.hosts.get(host, error.NoResource())
Fixed code:         return self.hosts.get(host, error.NoResource("host %s not in vhost map" % repr(host)))
CVE-2019-18224: Out-of-bounds Write (CWE-787)
value: idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-10-21T17:15Z
Repository: https://github.com/libidn/libidn2
Language: C
Files changed: lib/lookup.c
Commit date: 2019-01-09 14:36:16 +0100
Commit message: idn2_to_ascii_4i(): Restrict output length to 63

Diff: diff --git a/lib/lookup.c b/lib/lookup.c
index 7c5b52b..cc918d9 100644
--- a/lib/lookup.c
+++ b/lib/lookup.c
@@ -615,14 +615,22 @@ idn2_to_ascii_4i (const uint32_t * input, size_t inlen, char * output, int flags
     {
       /* wow, this is ugly, but libidn manpage states:
        * char * out  output zero terminated string that must have room for at
        * least 63 characters plus the terminating zero.
        */
+      size_t len = strlen ((char *) output_u8);
+
+      if (len > 63)
+        {
+	  free (output_u8);
+	  return IDN2_TOO_BIG_DOMAIN;
+        }
+
       if (output)
-	strcpy (output, (const char *) output_u8);
+	strcpy (output, (char *) output_u8);
 
-      free(output_u8);
+      free (output_u8);
     }
 
   return rc;
 }
 

Vulnerable code: 	strcpy (output, (const char *) output_u8);
      free(output_u8);
Fixed code:       size_t len = strlen ((char *) output_u8);

      if (len > 63)
        {
	  free (output_u8);
	  return IDN2_TOO_BIG_DOMAIN;
        }

	strcpy (output, (char *) output_u8);
      free (output_u8);
CVE-2020-4070: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-06-22T16:15Z
Repository: https://github.com/w3c/css-validator
Language: Java
Files changed: org/w3c/css/css/StyleSheetParser.java
Commit date: 2020-06-19 13:20:13 +0200
Commit message: escape also the throwable message, see #278

Diff: diff --git a/org/w3c/css/css/StyleSheetParser.java b/org/w3c/css/css/StyleSheetParser.java
index 33fd3544..ab809600 100644
--- a/org/w3c/css/css/StyleSheetParser.java
+++ b/org/w3c/css/css/StyleSheetParser.java
@@ -232,11 +232,11 @@ public final class StyleSheetParser
             doneref = true;
             cssFouffa.parseStyle();
         } catch (Exception e) {
             Errors er = new Errors();
             er.addError(new org.w3c.css.parser.CssError(Messages.escapeString(url.toString()),
-                    -1, e));
+                    -1, new Exception(Messages.escapeString(e.getMessage()))));
             notifyErrors(er);
         } finally {
             if (doneref) {
                 ac.setReferrer(ref);
             }

Vulnerable code:                     -1, e));
Fixed code:                     -1, new Exception(Messages.escapeString(e.getMessage()))));
CVE-2022-39200: Improper Verification of Cryptographic Signature (CWE-347)
value: Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 5.3
Published: 2022-09-12T20:15Z
Repository: https://github.com/matrix-org/dendrite
Language: Go
Files changed: roomserver/internal/input/input_missing.go
Commit date: 2022-09-12 13:30:51 +0100
Commit message: Fix missing signature check on the `/get_missing_events` response

Diff: diff --git a/roomserver/internal/input/input_missing.go b/roomserver/internal/input/input_missing.go
index 0dd2b64c..d789c3a1 100644
--- a/roomserver/internal/input/input_missing.go
+++ b/roomserver/internal/input/input_missing.go
@@ -551,15 +551,18 @@ func (t *missingStateReq) getMissingEvents(ctx context.Context, e *gomatrixserve
 		}
 	}
 
 	// Make sure events from the missingResp are using the cache - missing events
 	// will be added and duplicates will be removed.
-	logger.Debugf("get_missing_events returned %d events", len(missingResp.Events))
 	missingEvents := make([]*gomatrixserverlib.Event, 0, len(missingResp.Events))
 	for _, ev := range missingResp.Events.UntrustedEvents(roomVersion) {
+		if err = ev.VerifyEventSignatures(ctx, t.keys); err != nil {
+			continue
+		}
 		missingEvents = append(missingEvents, t.cacheAndReturn(ev))
 	}
+	logger.Debugf("get_missing_events returned %d events (%d passed signature checks)", len(missingResp.Events), len(missingEvents))
 
 	// topologically sort and sanity check that we are making forward progress
 	newEvents = gomatrixserverlib.ReverseTopologicalOrdering(missingEvents, gomatrixserverlib.TopologicalOrderByPrevEvents)
 	shouldHaveSomeEventIDs := e.PrevEventIDs()
 	hasPrevEvent := false

Vulnerable code: 	logger.Debugf("get_missing_events returned %d events", len(missingResp.Events))
Fixed code: 		if err = ev.VerifyEventSignatures(ctx, t.keys); err != nil {
			continue
		}
	logger.Debugf("get_missing_events returned %d events (%d passed signature checks)", len(missingResp.Events), len(missingEvents))
CVE-2020-35846: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2020-12-30T01:15Z
Repository: https://github.com/agentejo/cockpit
Language: PHP
Files changed: lib/MongoLite/Database.php
Commit date: 2020-09-14 20:23:06 +0200
Commit message: don't allow callable strings for $func (MongoLite)

Diff: diff --git a/lib/MongoLite/Database.php b/lib/MongoLite/Database.php
index fb47438c..08141f40 100644
--- a/lib/MongoLite/Database.php
+++ b/lib/MongoLite/Database.php
@@ -427,11 +427,11 @@ class UtilArrayQuery {
                 break;
 
             case '$func' :
             case '$fn' :
             case '$f' :
-                if (! \is_callable($b))
+                if (\is_string($b) || !\is_callable($b))
                     throw new \InvalidArgumentException('Function should be callable');
                 $r = $b($a);
                 break;
 
             case '$exists':

Vulnerable code:                 if (! \is_callable($b))
Fixed code:                 if (\is_string($b) || !\is_callable($b))
CVE-2020-35847: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2020-12-30T01:15Z
Repository: https://github.com/agentejo/cockpit
Language: PHP
Files changed: lib/MongoLite/Database.php
Commit date: 2020-09-14 20:23:06 +0200
Commit message: don't allow callable strings for $func (MongoLite)

Diff: diff --git a/lib/MongoLite/Database.php b/lib/MongoLite/Database.php
index fb47438c..08141f40 100644
--- a/lib/MongoLite/Database.php
+++ b/lib/MongoLite/Database.php
@@ -427,11 +427,11 @@ class UtilArrayQuery {
                 break;
 
             case '$func' :
             case '$fn' :
             case '$f' :
-                if (! \is_callable($b))
+                if (\is_string($b) || !\is_callable($b))
                     throw new \InvalidArgumentException('Function should be callable');
                 $r = $b($a);
                 break;
 
             case '$exists':

Vulnerable code:                 if (! \is_callable($b))
Fixed code:                 if (\is_string($b) || !\is_callable($b))
CVE-2020-35848: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2020-12-30T01:15Z
Repository: https://github.com/agentejo/cockpit
Language: PHP
Files changed: lib/MongoLite/Database.php
Commit date: 2020-09-14 20:23:06 +0200
Commit message: don't allow callable strings for $func (MongoLite)

Diff: diff --git a/lib/MongoLite/Database.php b/lib/MongoLite/Database.php
index fb47438c..08141f40 100644
--- a/lib/MongoLite/Database.php
+++ b/lib/MongoLite/Database.php
@@ -427,11 +427,11 @@ class UtilArrayQuery {
                 break;
 
             case '$func' :
             case '$fn' :
             case '$f' :
-                if (! \is_callable($b))
+                if (\is_string($b) || !\is_callable($b))
                     throw new \InvalidArgumentException('Function should be callable');
                 $r = $b($a);
                 break;
 
             case '$exists':

Vulnerable code:                 if (! \is_callable($b))
Fixed code:                 if (\is_string($b) || !\is_callable($b))
CVE-2021-32857: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-21T15:15Z
Repository: https://github.com/agentejo/cockpit
Language: PHP
Files changed: modules/Cockpit/module/auth.php
Commit date: 2021-09-26 15:27:59 +0200
Commit message: prevent session fixation attacks

Diff: diff --git a/modules/Cockpit/module/auth.php b/modules/Cockpit/module/auth.php
index 303fbff37..2cb3214c0 100644
--- a/modules/Cockpit/module/auth.php
+++ b/modules/Cockpit/module/auth.php
@@ -45,10 +45,12 @@ $this->module('cockpit')->extend([
     },
 
     'setUser' => function($user, $permanent = true) use($app) {
 
         if ($permanent) {
+            // prevent session fixation attacks
+            session_regenerate_id(true);
             $app('session')->write('cockpit.app.auth', $user);
         }
 
         $app->trigger('cockpit.auth.setuser', [&$user, $permanent]);
 
@@ -71,10 +73,13 @@ $this->module('cockpit')->extend([
     },
 
     'logout' => function() use($app) {
         $app->trigger('cockpit.account.logout', [$this->getUser()]);
         $app('session')->delete('cockpit.app.auth');
+
+        // prevent session fixation attacks
+        session_regenerate_id(true);
     },
 
     'hasaccess' => function($resource, $action, $group = null) use($app) {
 
         if (!$group) {

Fixed code:             // prevent session fixation attacks
            session_regenerate_id(true);

        // prevent session fixation attacks
        session_regenerate_id(true);
CVE-2023-25015: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-02-02T04:15Z
Repository: https://github.com/ankane/clockwork_web
Language: Ruby
Files changed: CHANGELOG.md, app/controllers/clockwork_web/home_controller.rb
Commit date: 2023-02-01 16:46:15 -0800
Commit message: Fixed CSRF vulnerability with Rails < 5.2

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index a55a4b1..c8b76d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+## 0.1.2 (unreleased)
+
+- Fixed CSRF vulnerability with Rails < 5.2 - [more info](https://github.com/ankane/clockwork_web/issues/4)
+
 ## 0.1.1 (2020-03-19)
 
 - Fixed load error
 
 ## 0.1.0 (2019-10-28)
diff --git a/app/controllers/clockwork_web/home_controller.rb b/app/controllers/clockwork_web/home_controller.rb
index a0a5697..f289b1b 100644
--- a/app/controllers/clockwork_web/home_controller.rb
+++ b/app/controllers/clockwork_web/home_controller.rb
@@ -1,10 +1,12 @@
 module ClockworkWeb
   class HomeController < ActionController::Base
     layout false
     helper ClockworkWeb::HomeHelper
 
+    protect_from_forgery with: :exception
+
     http_basic_authenticate_with name: ENV["CLOCKWORK_USERNAME"], password: ENV["CLOCKWORK_PASSWORD"] if ENV["CLOCKWORK_PASSWORD"]
 
     def index
       @events =
         Clockwork.manager.instance_variable_get(:@events).sort_by do |e|

Fixed code: ## 0.1.2 (unreleased)

- Fixed CSRF vulnerability with Rails < 5.2 - [more info](https://github.com/ankane/clockwork_web/issues/4)

    protect_from_forgery with: :exception
CVE-2023-22452: Improper Input Validation (CWE-20)
value: kenny2automate is a Discord bot. In the web interface for server settings, form elements were generated with Discord channel IDs as part of input names. Prior to commit a947d7c, no validation was performed to ensure that the channel IDs submitted actually belonged to the server being configured. Thus anyone who has access to the channel ID they wish to change settings for and the server settings panel for any server could change settings for the requested channel no matter which server it belonged to. Commit a947d7c resolves the issue and has been deployed to the official instance of the bot. The only workaround that exists is to disable the web config entirely by changing it to run on localhost. Note that a workaround is only necessary for those who run their own instance of the bot.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2023-01-02T20:15Z
Repository: https://github.com/Kenny2github/kenny2automate
Language: Python
Files changed: kenny2automate/server/__init__.py
Commit date: 2023-01-02 13:19:15 -0500
Commit message: SECURITY: Prevent changing other servers' settings

Diff: diff --git a/kenny2automate/server/__init__.py b/kenny2automate/server/__init__.py
index bc7ace7..f8070ba 100644
--- a/kenny2automate/server/__init__.py
+++ b/kenny2automate/server/__init__.py
@@ -574,10 +574,13 @@ FROM guilds WHERE guild_id=?',
                 else:
                     param[v[0]] = v[-1] or None
             param['ping'] = '|'.join(param.get('ping', ())) or None
             params.append(param)
         otherparams['guild_id'] = guild.id
+        if set(param['channel_id'] for param in params) \
+                - set(channel.id for channel in guild.channels): # is not empty
+            raise web.HTTPBadRequest
         try:
             with self.db.connection:
                 self.db.executemany(
                     'UPDATE channels SET lang=:lang, games_ping=:ping \
 WHERE channel_id=:channel_id',

Fixed code:         if set(param['channel_id'] for param in params) \
                - set(channel.id for channel in guild.channels): # is not empty
            raise web.HTTPBadRequest
CVE-2023-50252: External Control of System or Configuration Setting (CWE-15)
value: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue. 
CWE description: One or more system settings or configuration elements can be externally controlled by a user.
CVSS v3 base score: 9.8
Published: 2023-12-12T21:15Z
Repository: https://github.com/dompdf/php-svg-lib
Language: PHP
Files changed: src/Svg/Tag/UseTag.php
Commit date: 2023-12-11 15:56:08 -0500
Commit message: Do not merge additional USE element attributes

Diff: diff --git a/src/Svg/Tag/UseTag.php b/src/Svg/Tag/UseTag.php
index 4fae752..9e71d59 100644
--- a/src/Svg/Tag/UseTag.php
+++ b/src/Svg/Tag/UseTag.php
@@ -83,11 +83,11 @@ class UseTag extends AbstractTag
         if (!$this->reference) {
             return;
         }
 
         $mergedAttributes = $this->reference->attributes;
-        $attributesToNotMerge = ['x', 'y', 'width', 'height'];
+        $attributesToNotMerge = ['x', 'y', 'width', 'height', 'href', 'xlink:href', 'id'];
         foreach ($attributes as $attrKey => $attrVal) {
             if (!in_array($attrKey, $attributesToNotMerge) && !isset($mergedAttributes[$attrKey])) {
                 $mergedAttributes[$attrKey] = $attrVal;
             }
         }

Vulnerable code:         $attributesToNotMerge = ['x', 'y', 'width', 'height'];
Fixed code:         $attributesToNotMerge = ['x', 'y', 'width', 'height', 'href', 'xlink:href', 'id'];
CVE-2023-50252: Deserialization of Untrusted Data (CWE-502)
value: php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue. 
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-12-12T21:15Z
Repository: https://github.com/dompdf/php-svg-lib
Language: PHP
Files changed: src/Svg/Tag/UseTag.php
Commit date: 2023-12-11 15:56:08 -0500
Commit message: Do not merge additional USE element attributes

Diff: diff --git a/src/Svg/Tag/UseTag.php b/src/Svg/Tag/UseTag.php
index 4fae752..9e71d59 100644
--- a/src/Svg/Tag/UseTag.php
+++ b/src/Svg/Tag/UseTag.php
@@ -83,11 +83,11 @@ class UseTag extends AbstractTag
         if (!$this->reference) {
             return;
         }
 
         $mergedAttributes = $this->reference->attributes;
-        $attributesToNotMerge = ['x', 'y', 'width', 'height'];
+        $attributesToNotMerge = ['x', 'y', 'width', 'height', 'href', 'xlink:href', 'id'];
         foreach ($attributes as $attrKey => $attrVal) {
             if (!in_array($attrKey, $attributesToNotMerge) && !isset($mergedAttributes[$attrKey])) {
                 $mergedAttributes[$attrKey] = $attrVal;
             }
         }

Vulnerable code:         $attributesToNotMerge = ['x', 'y', 'width', 'height'];
Fixed code:         $attributesToNotMerge = ['x', 'y', 'width', 'height', 'href', 'xlink:href', 'id'];