Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-5690: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.2.2.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-10-20T17:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-10-17 15:06:30 +0200
Commit message: Merge pull request #3090 from modoboa/fix/csrf_issue_logout

Fixed CSRF vulnerability on logout view
CVE-2021-31783: Insufficient Verification of Data Authenticity (CWE-345)
value: show_default.php in the LocalFilesEditor extension before 11.4.0.1 for Piwigo allows Local File Inclusion because the file parameter is not validated with a proper regular-expression check.
CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 7.5
Published: 2021-04-26T19:15Z
Repository: https://github.com/Piwigo/LocalFilesEditor
Language: PHP
Files changed: show_default.php
Commit date: 2021-04-23 15:19:13 +0200
Commit message: fixes #2 strongly check the input parameter to avoid unexpected files to be displayed.

Privately reported by Harry Goodman from NCC

Diff: diff --git a/show_default.php b/show_default.php
index 2234e9e..26afe87 100644
--- a/show_default.php
+++ b/show_default.php
@@ -26,18 +26,20 @@ define('IN_ADMIN', true);
 include_once(PHPWG_ROOT_PATH . 'include/common.inc.php');
 include_once(LOCALEDIT_PATH.'include/functions.inc.php');
 load_language('plugin.lang', LOCALEDIT_PATH);
 check_status(ACCESS_WEBMASTER);
 
+check_input_parameter('file', $_GET, false, '/^(include\/config_default\.inc\.php|language\/[a-z]+_[A-Z]+\/(common|admin)\.lang\.php)$/');
+
 if (isset($_GET['file']))
 {
   $path = $_GET['file'];
-  if (!is_admin() or (!substr_count($path, 'config_default.inc.php') and !substr_count($path, '.lang.php')))
+  if (!is_admin())
   {
   	die('Hacking attempt!');
   }
-    
+
   $template->set_filename('show_default', dirname(__FILE__) . '/template/show_default.tpl');
   
   $file = file_get_contents(PHPWG_ROOT_PATH . $path);
   $title = str_replace('/', ' / ', $path);
 

Vulnerable code:   if (!is_admin() or (!substr_count($path, 'config_default.inc.php') and !substr_count($path, '.lang.php')))
    
Fixed code: check_input_parameter('file', $_GET, false, '/^(include\/config_default\.inc\.php|language\/[a-z]+_[A-Z]+\/(common|admin)\.lang\.php)$/');

  if (!is_admin())
CVE-2012-2673: Numeric Errors (CWE-189)
value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-07-25T19:55Z
Repository: https://github.com/ivmai/bdwgc
Language: C
Files changed: malloc.c
Commit date: 2012-03-15 21:09:05 +0400
Commit message: Speedup calloc size overflow check by preventing division if small values

* malloc.c (GC_SQRT_SIZE_MAX): New macro.
* malloc.c (calloc): Add fast initial size overflow check to avoid
integer division for reasonably small values passed.

Diff: diff --git a/malloc.c b/malloc.c
index cb49a5c..c9b9eb6 100644
--- a/malloc.c
+++ b/malloc.c
@@ -379,13 +379,16 @@ void * malloc(size_t lb)
 # define GC_SIZE_MAX SIZE_MAX
 #else
 # define GC_SIZE_MAX (~(size_t)0)
 #endif
 
+#define GC_SQRT_SIZE_MAX ((1U << (WORDSZ / 2)) - 1)
+
 void * calloc(size_t n, size_t lb)
 {
-    if (lb && n > GC_SIZE_MAX / lb)
+    if ((lb | n) > GC_SQRT_SIZE_MAX /* fast initial test */
+        && lb && n > GC_SIZE_MAX / lb)
       return NULL;
 #   if defined(GC_LINUX_THREADS) /* && !defined(USE_PROC_FOR_LIBRARIES) */
         /* libpthread allocated some memory that is only pointed to by  */
         /* mmapped thread stacks.  Make sure it's not collectable.      */
         {

Vulnerable code:     if (lb && n > GC_SIZE_MAX / lb)
Fixed code: #define GC_SQRT_SIZE_MAX ((1U << (WORDSZ / 2)) - 1)

    if ((lb | n) > GC_SQRT_SIZE_MAX /* fast initial test */
        && lb && n > GC_SIZE_MAX / lb)
CVE-2012-2673: Numeric Errors (CWE-189)
value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-07-25T19:55Z
Repository: https://github.com/ivmai/bdwgc
Language: C
Files changed: malloc.c
Commit date: 2012-03-15 20:30:11 +0400
Commit message: Fix calloc-related code to prevent SIZE_MAX redefinition in sys headers

* malloc.c: Include limits.h for SIZE_MAX.
* malloc.c (SIZE_MAX, calloc): Define GC_SIZE_MAX instead of SIZE_MAX.

Diff: diff --git a/malloc.c b/malloc.c
index 899d6ff..cb49a5c 100644
--- a/malloc.c
+++ b/malloc.c
@@ -372,16 +372,20 @@ void * malloc(size_t lb)
         WARN("Failed to find ld.so text mapping: Expect crash\n", 0);
     }
   }
 #endif /* GC_LINUX_THREADS */
 
-#ifndef SIZE_MAX
-#define SIZE_MAX (~(size_t)0)
+#include <limits.h>
+#ifdef SIZE_MAX
+# define GC_SIZE_MAX SIZE_MAX
+#else
+# define GC_SIZE_MAX (~(size_t)0)
 #endif
+
 void * calloc(size_t n, size_t lb)
 {
-    if (lb && n > SIZE_MAX / lb)
+    if (lb && n > GC_SIZE_MAX / lb)
       return NULL;
 #   if defined(GC_LINUX_THREADS) /* && !defined(USE_PROC_FOR_LIBRARIES) */
         /* libpthread allocated some memory that is only pointed to by  */
         /* mmapped thread stacks.  Make sure it's not collectable.      */
         {

Vulnerable code: #ifndef SIZE_MAX
#define SIZE_MAX (~(size_t)0)
    if (lb && n > SIZE_MAX / lb)
Fixed code: #include <limits.h>
#ifdef SIZE_MAX
# define GC_SIZE_MAX SIZE_MAX
#else
# define GC_SIZE_MAX (~(size_t)0)

    if (lb && n > GC_SIZE_MAX / lb)
CVE-2012-2673: Numeric Errors (CWE-189)
value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-07-25T19:55Z
Repository: https://github.com/ivmai/bdwgc
Language: C
Files changed: malloc.c
Commit date: 2012-03-15 16:46:46 +0800
Commit message: Fix calloc() overflow

* malloc.c (calloc): Check multiplication overflow in calloc(),
assuming REDIRECT_MALLOC.

Diff: diff --git a/malloc.c b/malloc.c
index da68f13..cc0cc00 100644
--- a/malloc.c
+++ b/malloc.c
@@ -370,12 +370,17 @@ void * malloc(size_t lb)
         WARN("Failed to find ld.so text mapping: Expect crash\n", 0);
     }
   }
 #endif /* GC_LINUX_THREADS */
 
+#ifndef SIZE_MAX
+#define SIZE_MAX (~(size_t)0)
+#endif
 void * calloc(size_t n, size_t lb)
 {
+    if (lb && n > SIZE_MAX / lb)
+      return NULL;
 #   if defined(GC_LINUX_THREADS) /* && !defined(USE_PROC_FOR_LIBRARIES) */
         /* libpthread allocated some memory that is only pointed to by  */
         /* mmapped thread stacks.  Make sure it's not collectable.      */
         {
           static GC_bool lib_bounds_set = FALSE;

Fixed code: #ifndef SIZE_MAX
#define SIZE_MAX (~(size_t)0)
#endif
    if (lb && n > SIZE_MAX / lb)
      return NULL;
CVE-2012-2673: Numeric Errors (CWE-189)
value: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-07-25T19:55Z
Repository: https://github.com/ivmai/bdwgc
Language: C
Files changed: malloc.c, mallocx.c
Commit date: 2012-03-15 21:20:46 +0800
Commit message: Fix allocation size overflows due to rounding.

* malloc.c (GC_generic_malloc): Check if the allocation size is
rounded to a smaller value.
* mallocx.c (GC_generic_malloc_ignore_off_page): Likewise.

Diff: diff --git a/malloc.c b/malloc.c
index cc0cc00..899d6ff 100644
--- a/malloc.c
+++ b/malloc.c
@@ -167,10 +167,12 @@ GC_API void * GC_CALL GC_generic_malloc(size_t lb, int k)
         size_t lb_rounded;
         word n_blocks;
         GC_bool init;
         lg = ROUNDED_UP_GRANULES(lb);
         lb_rounded = GRANULES_TO_BYTES(lg);
+        if (lb_rounded < lb)
+            return((*GC_get_oom_fn())(lb));
         n_blocks = OBJ_SZ_TO_BLOCKS(lb_rounded);
         init = GC_obj_kinds[k].ok_init;
         LOCK();
         result = (ptr_t)GC_alloc_large(lb_rounded, k, 0);
         if (0 != result) {
diff --git a/mallocx.c b/mallocx.c
index 2c79f41..0d9c0a6 100644
--- a/mallocx.c
+++ b/mallocx.c
@@ -180,10 +180,12 @@ GC_INNER void * GC_generic_malloc_ignore_off_page(size_t lb, int k)
 
     if (SMALL_OBJ(lb))
         return(GC_generic_malloc((word)lb, k));
     lg = ROUNDED_UP_GRANULES(lb);
     lb_rounded = GRANULES_TO_BYTES(lg);
+    if (lb_rounded < lb)
+        return((*GC_get_oom_fn())(lb));
     n_blocks = OBJ_SZ_TO_BLOCKS(lb_rounded);
     init = GC_obj_kinds[k].ok_init;
     if (EXPECT(GC_have_errors, FALSE))
       GC_print_all_errors();
     GC_INVOKE_FINALIZERS();

Fixed code:         if (lb_rounded < lb)
            return((*GC_get_oom_fn())(lb));
    if (lb_rounded < lb)
        return((*GC_get_oom_fn())(lb));
CVE-2019-1010199: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-07-23T18:15Z
Repository: https://github.com/ServiceStack/ServiceStack
Language: C#
Files changed: src/ServiceStack/Formats/HtmlFormat.cs
Commit date: 2018-08-17 11:05:59 -0400
Commit message: HtmlEncode Raw URL in HtmlFormat snapshot

Diff: diff --git a/src/ServiceStack/Formats/HtmlFormat.cs b/src/ServiceStack/Formats/HtmlFormat.cs
index e62df99e5..482955e38 100644
--- a/src/ServiceStack/Formats/HtmlFormat.cs
+++ b/src/ServiceStack/Formats/HtmlFormat.cs
@@ -88,16 +88,17 @@ public async Task SerializeToStreamAsync(IRequest req, object response, Stream o
             var dto = response.GetDto();
             if (!(dto is string html))
             {
                 // Serialize then escape any potential script tags to avoid XSS when displaying as HTML
                 var json = JsonDataContractSerializer.Instance.SerializeToString(dto) ?? "null";
-                json = json.Replace("<", "&lt;").Replace(">", "&gt;");
+                json = json.HtmlEncode();
 
                 var url = req.ResolveAbsoluteUrl()
                     .Replace("format=html", "")
                     .Replace("format=shtm", "")
-                    .TrimEnd('?', '&');
+                    .TrimEnd('?', '&')
+                    .HtmlEncode();
 
                 url += url.Contains("?") ? "&" : "?";
 
                 var now = DateTime.UtcNow;
                 var requestName = req.OperationName ?? dto.GetType().GetOperationName();

Vulnerable code:                 json = json.Replace("<", "&lt;").Replace(">", "&gt;");
                    .TrimEnd('?', '&');
Fixed code:                 json = json.HtmlEncode();
                    .TrimEnd('?', '&')
                    .HtmlEncode();
CVE-2020-28042: Improper Verification of Cryptographic Signature (CWE-347)
value: ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 5.3
Published: 2020-11-02T21:15Z
Repository: https://github.com/ServiceStack/ServiceStack
Language: C#
Files changed: src/ServiceStack.Common/EnumerableExtensions.cs
Commit date: 2020-08-04 14:16:17 +0800
Commit message: Update EquivalentTo to test length & null for equality as well

Diff: diff --git a/src/ServiceStack.Common/EnumerableExtensions.cs b/src/ServiceStack.Common/EnumerableExtensions.cs
index cc791c31b..475351e18 100644
--- a/src/ServiceStack.Common/EnumerableExtensions.cs
+++ b/src/ServiceStack.Common/EnumerableExtensions.cs
@@ -232,10 +232,16 @@ public static T FirstNonDefault<T>(this IEnumerable<T> values)
         }
 
         [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static bool EquivalentTo(this byte[] bytes, byte[] other)
         {
+            if (bytes == null || other == null)
+                return bytes == other;
+
+            if (bytes.Length != other.Length)
+                return false;
+
             var compare = 0;
             for (var i = 0; i < other.Length; i++)
                 compare |= other[i] ^ bytes[i];
 
             return compare == 0;

Fixed code:             if (bytes == null || other == null)
                return bytes == other;

            if (bytes.Length != other.Length)
                return false;
CVE-2022-2885: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-08-21T08:15Z
Repository: https://github.com/yetiforcecompany/yetiforcecrm
Language: PHP
Files changed: config/version.php, modules/Rss/models/Record.php
Commit date: 2022-08-13 10:18:52 +0200
Commit message: Improved input data cleanup

Diff: diff --git a/config/version.php b/config/version.php
index fc8e3f31d2b..bc0bffe481d 100644
--- a/config/version.php
+++ b/config/version.php
@@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.3.427',
-	'patchVersion' => '2022.08.12',
+	'appVersion' => '6.3.428',
+	'patchVersion' => '2022.08.13',
 	'lib_roundcube' => '0.3.0',
 ];
diff --git a/modules/Rss/models/Record.php b/modules/Rss/models/Record.php
index bbf25fcaac6..857b1627665 100644
--- a/modules/Rss/models/Record.php
+++ b/modules/Rss/models/Record.php
@@ -71,11 +71,11 @@ class Rss_Record_Model extends Vtiger_Record_Model
 	 * @param <object> $rss - Rss fetched object
 	 */
 	public function setRssValues($rss)
 	{
 		$this->set('rsstitle', \App\Purifier::purifyByType((string) $rss->title, 'Text'));
-		$this->set('url', $rss->link);
+		$this->set('url', \App\Purifier::purifyByType((string) $rss->link, 'Text'));
 	}
 
 	/**
 	 * Function to save the record.
 	 *

Vulnerable code: 	'appVersion' => '6.3.427',
	'patchVersion' => '2022.08.12',
		$this->set('url', $rss->link);
Fixed code: 	'appVersion' => '6.3.428',
	'patchVersion' => '2022.08.13',
		$this->set('url', \App\Purifier::purifyByType((string) $rss->link, 'Text'));
CVE-2023-0592: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A path traversal vulnerability affects jefferson's JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.


CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.5
Published: 2023-01-31T10:15Z
Repository: https://github.com/sviehb/jefferson
Language: Unknown
Commit date: 2022-07-05 10:52:58 +0200
Commit message: Merge pull request #48 from sviehb/fix-path-traversal

Fix path traversal bug.
CVE-2017-20191: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is bb240ce0c71c01caabaa43eed30c78ba8d7d3591. It is recommended to upgrade the affected component. The identifier VDB-258621 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-03-31T09:15Z
Repository: https://github.com/Zimbra/zm-admin-ajax
Language: JavaScript
Files changed: WebRoot/js/ajax/dwt/xforms/XFormItem.js
Commit date: 2017-07-24 23:33:37 +0530
Commit message: ZCS-1795 Persistent XSS happens on textbox

Issue:
- Error text in form fields were executing text in dom, which can be used for XSS attacks

Resolution:
- Before adding error to DOM, html encode the text to make sure it is not executed in browser
- This is done at a generic place so it will affect error display for all form fields

Diff: diff --git a/WebRoot/js/ajax/dwt/xforms/XFormItem.js b/WebRoot/js/ajax/dwt/xforms/XFormItem.js
index 1eb97e94..de37d34b 100644
--- a/WebRoot/js/ajax/dwt/xforms/XFormItem.js
+++ b/WebRoot/js/ajax/dwt/xforms/XFormItem.js
@@ -686,11 +686,11 @@ XFormItem.prototype.setError = function(message, childError) {
 		return;
 	}
 	this.getForm().addErrorItem(this);
 	this.__errorState = XFormItem.ERROR_STATE_ERROR;
 	var container = this.getErrorContainer(true);
-	if (container) container.innerHTML = message;
+	if (container) container.innerHTML = AjxStringUtil.htmlEncode(message);
 };
 
 /** 
  * Clears the error message for this form item. 
  * This will clear the error for this item, or 

Vulnerable code: 	if (container) container.innerHTML = message;
Fixed code: 	if (container) container.innerHTML = AjxStringUtil.htmlEncode(message);
CVE-2023-42800: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 8.8
Published: 2023-12-14T17:15Z
Repository: https://github.com/moonlight-stream/moonlight-common-c
Language: C
Files changed: src/RtspConnection.c
Commit date: 2023-10-06 21:14:30 -0500
Commit message: Fix buffer overflow in performRtspHandshake (CVE-2023-42800)

Diff: diff --git a/src/RtspConnection.c b/src/RtspConnection.c
index 18e15dd..a75572b 100644
--- a/src/RtspConnection.c
+++ b/src/RtspConnection.c
@@ -774,11 +774,12 @@ int performRtspHandshake(PSERVER_INFORMATION serverInfo) {
     if (OriginalVideoBitrate >= HIGH_AUDIO_BITRATE_THRESHOLD &&
             (AudioCallbacks.capabilities & CAPABILITY_SLOW_OPUS_DECODER) == 0 &&
             (StreamConfig.streamingRemotely != STREAM_CFG_REMOTE || CHANNEL_COUNT_FROM_AUDIO_CONFIGURATION(StreamConfig.audioConfiguration) <= 2)) {
         // If we have an RTSP URL string and it was successfully parsed, use that string
         if (serverInfo->rtspSessionUrl != NULL && parseUrlAddrFromRtspUrlString(serverInfo->rtspSessionUrl, urlAddr, sizeof(urlAddr))) {
-            strcpy(rtspTargetUrl, serverInfo->rtspSessionUrl);
+            PltSafeStrcpy(rtspTargetUrl, sizeof(rtspTargetUrl), serverInfo->rtspSessionUrl);
+            rtspTargetUrl[sizeof(rtspTargetUrl) - 1] = '\0';
         }
         else {
             // If an RTSP URL string was not provided or failed to parse, we will construct one now as best we can.
             //
             // NB: If the remote address is not a LAN address, the host will likely not enable high quality

Vulnerable code:             strcpy(rtspTargetUrl, serverInfo->rtspSessionUrl);
Fixed code:             PltSafeStrcpy(rtspTargetUrl, sizeof(rtspTargetUrl), serverInfo->rtspSessionUrl);
            rtspTargetUrl[sizeof(rtspTargetUrl) - 1] = '\0';
CVE-2022-31040: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open redirect by injecting a `referer` querystring parameter and failing to validate the value. A malicious actor is able to redirect users to a website under their control, opening them up for phishing attacks. The redirect is initiated by the open forms backend which is a legimate page, making it less obvious to end users they are being redirected to a malicious website. Versions 1.0.9 and 1.1.1 contain patches for this issue. There are no known workarounds avaialble.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-06-13T12:15Z
Repository: https://github.com/open-formulieren/open-forms
Language: Unknown
Commit date: 2022-06-13 10:17:22 +0200
Commit message: Merge pull request from GHSA-c97h-m5qf-j8mf

Fix open redirect vulnerability in cookie list page
CVE-2022-31041: Improper Input Validation (CWE-20)
value: Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2022-06-13T13:15Z
Repository: https://github.com/open-formulieren/open-forms
Language: Unknown
Commit date: 2022-06-13 10:18:10 +0200
Commit message: Merge pull request from GHSA-h85r-xv4w-cg8g

Fix GHSA-h85r-xv4w-cg8g - perform backend file type validation
CVE-2022-31041: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be configured to allow only certain file extensions to be uploaded by end users (e.g. only PDF / Excel / ...). The input validation of uploaded files is insufficient in versions prior to 1.0.9 and 1.1.1. Users could alter or strip file extensions to bypass this validation. This results in files being uploaded to the server that are of a different file type than indicated by the file name extension. These files may be downloaded (manually or automatically) by staff and/or other applications for further processing. Malicious files can therefore find their way into internal/trusted networks. Versions 1.0.9 and 1.1.1 contain patches for this issue. As a workaround, an API gateway or intrusion detection solution in front of open-forms may be able to scan for and block malicious content before it reaches the Open Forms application.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 6.5
Published: 2022-06-13T13:15Z
Repository: https://github.com/open-formulieren/open-forms
Language: Unknown
Commit date: 2022-06-13 10:18:10 +0200
Commit message: Merge pull request from GHSA-h85r-xv4w-cg8g

Fix GHSA-h85r-xv4w-cg8g - perform backend file type validation
CVE-2020-26233: Use of Incorrectly-Resolved Name or Reference (CWE-706)
value: Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will first clone the top-level repository and then recursively clone all submodules by starting new Git processes from the top-level working directory. If a malicious git.exe executable is present in the top-level repository then this binary will be started by Git Credential Manager Core when attempting to read configuration, and not git.exe as found on the %PATH%. This only affects GCM Core on Windows, not macOS or Linux-based distributions. GCM Core version 2.0.289 contains the fix for this vulnerability, and is available from the project's GitHub releases page. GCM Core 2.0.289 is also bundled in the latest Git for Windows release; version 2.29.2(3). As a workaround, users should avoid recursively cloning untrusted repositories with the --recurse-submodules option.
CWE description: The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CVSS v3 base score: 7.3
Published: 2020-12-08T20:15Z
Repository: https://github.com/microsoft/Git-Credential-Manager-Core
Language: Unknown
Commit date: 2020-11-17 12:19:55 +0000
Commit message: Merged PR 585167: [Security] Enumerate the PATH environment variable to locate programs on Windows

Enumerate the PATH environment variable to manually locate executables/programs rather than shell out to where.exe on Windows locate these for us. The where.exe utility first checks the current working directory before the PATH for the executable, which we do not want for various security reasons.

The which utility on UNIX/POSIX systems does _NOT_ include the current working directory in the search; only the PATH, which is exactly what we want - leave this in place on those platforms.

Additionally for locating `git(.exe)` we first check in the `GIT_EXEC_PATH` directory for the executable, if that environment variable was set.
CVE-2021-43852: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution. This issue has been patched in version 4.2.8. Users unable to upgrade may configure a firewall to drop requests containing next strings: `__proto__` , `constructor[prototype]`, and `constructor.prototype` to mitigate this issue.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 8.8
Published: 2022-01-04T20:15Z
Repository: https://github.com/oroinc/platform
Language: JavaScript
Files changed: src/Oro/Bundle/UIBundle/Resources/public/js/tools.js
Commit date: 2021-12-24 10:40:19 -0500
Commit message: BAP-21092: JavaScript Prototype Pollution (#31464)


Diff: diff --git a/src/Oro/Bundle/UIBundle/Resources/public/js/tools.js b/src/Oro/Bundle/UIBundle/Resources/public/js/tools.js
index ededa96a81..93096aa748 100644
--- a/src/Oro/Bundle/UIBundle/Resources/public/js/tools.js
+++ b/src/Oro/Bundle/UIBundle/Resources/public/js/tools.js
@@ -83,10 +83,14 @@ define(function(require) {
         unpackFromQueryString: function(query) {
             if (query.charAt(0) === '?') {
                 query = query.slice(1);
             }
             const setValue = function(root, path, value) {
+                if (path[0] === '__proto__') {
+                    // Prevent Object.prototype pollution
+                    return;
+                }
                 if (path.length > 1) {
                     const dir = path.shift();
                     if (typeof root[dir] === 'undefined') {
                         root[dir] = path[0] === '' ? [] : {};
                     }

Fixed code:                 if (path[0] === '__proto__') {
                    // Prevent Object.prototype pollution
                    return;
                }
CVE-2016-8675: NULL Pointer Dereference (CWE-476)
value: The get_vlc2 function in get_bits.h in Libav before 11.9 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted mp3 file, possibly related to startcode sequences during m4v detection.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2017-02-15T21:59Z
Repository: https://github.com/libav/libav
Language: C
Files changed: libavformat/m4vdec.c
Commit date: 2016-08-03 08:27:02 +0200
Commit message: m4vdec: Check for non-startcode 00 00 00 sequences in probe

This makes the m4v detection less trigger-happy.

Bug-Id: 949
Signed-off-by: Diego Biurrun <diego@biurrun.de>

Diff: diff --git a/libavformat/m4vdec.c b/libavformat/m4vdec.c
index 4a0af3c03..9d69dcc04 100644
--- a/libavformat/m4vdec.c
+++ b/libavformat/m4vdec.c
@@ -31,20 +31,22 @@ static int mpeg4video_probe(AVProbeData *probe_packet)
     int VO = 0, VOL = 0, VOP = 0, VISO = 0, res = 0;
     int i;
 
     for (i = 0; i < probe_packet->buf_size; i++) {
         temp_buffer = (temp_buffer << 8) + probe_packet->buf[i];
-        if ((temp_buffer & 0xffffff00) != 0x100)
+        if (temp_buffer & 0xfffffe00)
+            continue;
+        if (temp_buffer < 2)
             continue;
 
         if (temp_buffer == VOP_START_CODE)
             VOP++;
         else if (temp_buffer == VISUAL_OBJECT_START_CODE)
             VISO++;
-        else if (temp_buffer < 0x120)
+        else if (temp_buffer >= 0x100 && temp_buffer < 0x120)
             VO++;
-        else if (temp_buffer < 0x130)
+        else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
             VOL++;
         else if (!(0x1AF < temp_buffer && temp_buffer < 0x1B7) &&
                  !(0x1B9 < temp_buffer && temp_buffer < 0x1C4))
             res++;
     }

Vulnerable code:         if ((temp_buffer & 0xffffff00) != 0x100)
        else if (temp_buffer < 0x120)
        else if (temp_buffer < 0x130)
Fixed code:         if (temp_buffer & 0xfffffe00)
            continue;
        if (temp_buffer < 2)
        else if (temp_buffer >= 0x100 && temp_buffer < 0x120)
        else if (temp_buffer >= 0x120 && temp_buffer < 0x130)
CVE-2017-16803: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2017-11-13T17:29Z
Repository: https://github.com/libav/libav
Language: C
Files changed: libavcodec/smacker.c
Commit date: 2017-11-10 20:38:44 -0500
Commit message: smacker: add sanity check for length in smacker_decode_tree()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>

Diff: diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
index 0e057a1c2a..7deccffa54 100644
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -41,11 +41,11 @@
 #include "mathops.h"
 #include "vlc.h"
 
 #define SMKTREE_BITS 9
 #define SMK_NODE 0x80000000
-
+#define SMKTREE_DECODE_MAX_RECURSION 32
 
 typedef struct SmackVContext {
     AVCodecContext *avctx;
     AVFrame *pic;
 
@@ -95,10 +95,15 @@ enum SmkBlockTypes {
  * Decode local frame tree
  */
 static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
                                uint32_t prefix, int length)
 {
+    if (length > SMKTREE_DECODE_MAX_RECURSION) {
+        av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!bitstream_read_bit(bc)) { // Leaf
         if(hc->current >= 256){
             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
             return AVERROR_INVALIDDATA;
         }

Fixed code: #define SMKTREE_DECODE_MAX_RECURSION 32
    if (length > SMKTREE_DECODE_MAX_RECURSION) {
        av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
        return AVERROR_INVALIDDATA;
    }
CVE-2017-9051: NULL Pointer Dereference (CWE-476)
value: libav before 12.1 is vulnerable to an invalid read of size 1 due to NULL pointer dereferencing in the nsv_read_chunk function in libavformat/nsvdec.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 9.8
Published: 2017-05-18T06:29Z
Repository: https://github.com/libav/libav
Language: C
Files changed: libavformat/nsvdec.c
Commit date: 2017-03-26 12:43:57 -0400
Commit message: nsvdec: don't ignore the return value of av_get_packet()

Fixes invalid reads with corrupted files.

CC: libav-stable@libav.org
Bug-Id: 1039

Diff: diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c
index c91d2a15dd..924c8694b1 100644
--- a/libavformat/nsvdec.c
+++ b/libavformat/nsvdec.c
@@ -518,10 +518,11 @@ static int nsv_read_chunk(AVFormatContext *s, int fill_header)
     int i, err = 0;
     uint8_t auxcount; /* number of aux metadata, also 4 bits of vsize */
     uint32_t vsize;
     uint16_t asize;
     uint16_t auxsize;
+    int ret;
 
     if (nsv->ahead[0].data || nsv->ahead[1].data)
         return 0; //-1; /* hey! eat what you've in your plate first! */
 
 null_chunk_retry:
@@ -569,11 +570,12 @@ null_chunk_retry:
         st[s->streams[1]->id] = s->streams[1];
 
     if (vsize && st[NSV_ST_VIDEO]) {
         nst = st[NSV_ST_VIDEO]->priv_data;
         pkt = &nsv->ahead[NSV_ST_VIDEO];
-        av_get_packet(pb, pkt, vsize);
+        if ((ret = av_get_packet(pb, pkt, vsize)) < 0)
+            return ret;
         pkt->stream_index = st[NSV_ST_VIDEO]->index;//NSV_ST_VIDEO;
         pkt->dts = nst->frame_offset;
         pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0; /* keyframe only likely on a sync frame */
         for (i = 0; i < FFMIN(8, vsize); i++)
             av_log(s, AV_LOG_TRACE, "NSV video: [%d] = %02"PRIx8"\n",
@@ -613,11 +615,12 @@ null_chunk_retry:
                 st[NSV_ST_AUDIO]->codecpar->sample_rate = samplerate;
                 av_log(s, AV_LOG_TRACE, "NSV RAWAUDIO: bps %"PRIu8", nchan %"PRIu8", srate %"PRIu16"\n",
                        bps, channels, samplerate);
             }
         }
-        av_get_packet(pb, pkt, asize);
+        if ((ret = av_get_packet(pb, pkt, asize)) < 0)
+            return ret;
         pkt->stream_index = st[NSV_ST_AUDIO]->index;//NSV_ST_AUDIO;
         pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0; /* keyframe only likely on a sync frame */
         if( nsv->state == NSV_HAS_READ_NSVS && st[NSV_ST_VIDEO] ) {
             /* on a nsvs frame we have new information on a/v sync */
             pkt->dts = (((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset-1);

Vulnerable code:         av_get_packet(pb, pkt, vsize);
        av_get_packet(pb, pkt, asize);
Fixed code:     int ret;
        if ((ret = av_get_packet(pb, pkt, vsize)) < 0)
            return ret;
        if ((ret = av_get_packet(pb, pkt, asize)) < 0)
            return ret;
CVE-2024-24569: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version <=1.1.1, use ZipSecurity as a guard against path traversal, and have an exploit path. Although the control still protects attackers from escaping the application path into higher level directories (e.g., /etc/), it will allow "escaping" into sibling paths. For example, if your running path is /my/app/path you an attacker could navigate into /my/app/path-something-else. This vulnerability is patched in 1.1.2.


CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 4.8
Published: 2024-02-01T19:15Z
Repository: https://github.com/pixee/java-security-toolkit
Language: Unknown
Commit date: 2024-01-31 19:02:41 -0500
Commit message: Merge pull request from GHSA-qh4g-4m4w-jgv2

Fix partial path traversal in zip file overwite protection
CVE-2022-4564: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability classified as problematic has been found in University of Central Florida Materia up to 9.0.0. This affects the function before of the file fuel/app/classes/controller/api.php of the component API Controller. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 9.0.1-alpha1 is able to address this issue. The name of the patch is af259115d2e8f17068e61902151ee8a9dbac397b. It is recommended to upgrade the affected component. The identifier VDB-215973 was assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-12-16T17:15Z
Repository: https://github.com/ucfopen/Materia
Language: Unknown
Commit date: 2022-04-18 16:06:47 -0400
Commit message: Merge pull request #1371 from FrenjaminBanklin/feature/api-v1-csrf-mitigation

Add Origin/Referer request header checks to old V1 API controller.
CVE-2016-15022: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-29T19:15Z
Repository: https://github.com/mosbth/cimage
Language: PHP
Files changed: REVISION.md, webroot/check_system.php
Commit date: 2016-08-31 15:26:14 +0200
Commit message: Correct XSS injection in check_system.php.

Diff: diff --git a/REVISION.md b/REVISION.md
index 3a83d21..cf05f1c 100644
--- a/REVISION.md
+++ b/REVISION.md
@@ -3,13 +3,14 @@ Revision history
 
 [![Build Status](https://travis-ci.org/mosbth/cimage.svg?branch=master)](https://travis-ci.org/mosbth/cimage)
 [![Build Status](https://scrutinizer-ci.com/g/mosbth/cimage/badges/build.png?b=master)](https://scrutinizer-ci.com/g/mosbth/cimage/build-status/master)
 
 
-v0.7.19* (2016-08-11)
+v0.7.19* (2016-08-31)
 -------------------------------------
 
+* Correct XSS injection in `check_system.php`.
 * Composer suggests ext-imagick and ext-curl.
 
 
 v0.7.18 (2016-08-09)
 -------------------------------------
diff --git a/webroot/check_system.php b/webroot/check_system.php
index 1443de8..889d176 100644
--- a/webroot/check_system.php
+++ b/webroot/check_system.php
@@ -1,10 +1,10 @@
 <?php
 
 echo 'Current PHP version: ' . phpversion() . '<br><br>';
 
-echo 'Running on: ' . $_SERVER['SERVER_SOFTWARE'] . '<br><br>';
+echo 'Running on: ' . htmlentities($_SERVER['SERVER_SOFTWARE']) . '<br><br>';
 
 $no = extension_loaded('exif') ? null : 'NOT';
 echo "Extension exif is $no loaded.<br>";
 
 $no = extension_loaded('curl') ? null : 'NOT';

Vulnerable code: v0.7.19* (2016-08-11)
echo 'Running on: ' . $_SERVER['SERVER_SOFTWARE'] . '<br><br>';
Fixed code: v0.7.19* (2016-08-31)
* Correct XSS injection in `check_system.php`.
echo 'Running on: ' . htmlentities($_SERVER['SERVER_SOFTWARE']) . '<br><br>';
CVE-2021-27213: Deserialization of Untrusted Data (CWE-502)
value: config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2021-02-14T04:15Z
Repository: https://github.com/cvandeplas/pystemon
Language: Python
Files changed: pystemon/config.py
Commit date: 2021-02-13 23:06:38 +0530
Commit message: Fixed code execution bug using SafeLoader()
Diff: diff --git a/pystemon/config.py b/pystemon/config.py
index 45a403f..203c358 100644
--- a/pystemon/config.py
+++ b/pystemon/config.py
@@ -302,22 +302,22 @@ class PystemonConfig():
         yamlconfig = None
         try:
             if self._recent_pyyaml():
                 # https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
                 # only for 5.1+
-                yamlconfig = yaml.load(open(configfile), Loader=yaml.FullLoader)
+                yamlconfig = yaml.load(open(configfile), Loader=yaml.SafeLoader)
             else:
-                yamlconfig = yaml.load(open(configfile))
+                yamlconfig = yaml.safe_load(open(configfile))
         except yaml.YAMLError as exc:
             logger.error("Error in configuration file {0}:".format(configfile))
             if hasattr(exc, 'problem_mark'):
                 mark = exc.problem_mark
                 raise PystemonConfigException("error position: (%s:%s)" % (mark.line + 1, mark.column + 1))
         for includes in yamlconfig.get("includes", []):
             try:
                 logger.debug("loading include '{0}'".format(includes))
-                yamlconfig.update(yaml.load(open(includes)))
+                yamlconfig.update(yaml.safe_load(open(includes)))
             except Exception as e:
                 raise PystemonConfigException("failed to load '{0}': {1}".format(includes, e))
         return yamlconfig
 
 

Vulnerable code:                 yamlconfig = yaml.load(open(configfile), Loader=yaml.FullLoader)
                yamlconfig = yaml.load(open(configfile))
                yamlconfig.update(yaml.load(open(includes)))
Fixed code:                 yamlconfig = yaml.load(open(configfile), Loader=yaml.SafeLoader)
                yamlconfig = yaml.safe_load(open(configfile))
                yamlconfig.update(yaml.safe_load(open(includes)))