Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2014-125060: Improper Authentication (CWE-287)
value: A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The patch is identified as b80f6d1893607c99e5113967592417d0fe310ce6. It is recommended to apply a patch to fix this issue. VDB-217614 is the identifier assigned to this vulnerability.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2023-01-07T13:15Z
Repository: https://github.com/holdennb/CollabCal
Language: C++
Files changed: calenderServer.cpp
Commit date: 2014-12-08 21:34:17 -0800
Commit message: Fixed Login Exploit

Diff: diff --git a/calenderServer.cpp b/calenderServer.cpp
index 0d3aba3..9a7d217 100644
--- a/calenderServer.cpp
+++ b/calenderServer.cpp
@@ -243,11 +243,11 @@ string handleGet(map<string, string>* reqHeaders) {
     auto usersessionIt = sessionMap.find(sessionId);
     if (usersessionIt == sessionMap.end()){
       cout << "Bad session ID, redirecting to login." << endl;
       body = getLogin();
     } else
-      uid = sessionMap[sessionId];
+      uid = usersessionIt->second;
   }
   map<string, string> resHeaders;
   resHeaders["Server"] = "CSE461";
   resHeaders["Content-Type"] = "text/html; charset=UTF-8";
 
@@ -287,11 +287,13 @@ string handlePost(map<string, string>* reqHeaders) {
   cout << "handling post" << endl;
   if (reqHeaders->count("Cookie") != 0) {
     string cookies = (*reqHeaders)["Cookie"];
     string sessionIdString = cookies.substr(cookies.find("=") + 1);
     sessionId = stoll(sessionIdString, nullptr);
-    uid = sessionMap[sessionId];
+    auto sessionIt = sessionMap.find(sessionId);
+    if(sessionIt != sessionMap.end())
+      uid = sessionIt->second;
   }
   map<string, string> resHeaders;
   resHeaders["Server"] = "CSE461";
   resHeaders["Content-Type"] = "text/html; charset=UTF-8";
 

Vulnerable code:       uid = sessionMap[sessionId];
    uid = sessionMap[sessionId];
Fixed code:       uid = usersessionIt->second;
    auto sessionIt = sessionMap.find(sessionId);
    if(sessionIt != sessionMap.end())
      uid = sessionIt->second;
CVE-2021-25990: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-12-29T09:15Z
Repository: https://github.com/ifmeorg/ifme
Language: JavaScript
Files changed: client/app/utils/index.js
Commit date: 2021-11-18 23:01:15 -0500
Commit message: [#2052] Sanitize string content in renderContent

Diff: diff --git a/client/app/utils/index.js b/client/app/utils/index.js
index 7bd7b0390..b0015344d 100644
--- a/client/app/utils/index.js
+++ b/client/app/utils/index.js
@@ -1,8 +1,9 @@
 // @flow
 import axios from 'axios';
 import renderHTML from 'react-render-html';
+import { sanitize } from 'dompurify';
 
 const randomString = () => Math.random()
   .toString(36)
   .substring(2, 15)
   + Math.random()
@@ -32,11 +33,11 @@ const getPusher = () => {
   return null;
 };
 
 const renderContent = (content: string | any) => {
   if (typeof content === 'string') {
-    return renderHTML(content);
+    return renderHTML(sanitize(content));
   }
   return content;
 };
 
 export const Utils = {

Vulnerable code:     return renderHTML(content);
Fixed code: import { sanitize } from 'dompurify';
    return renderHTML(sanitize(content));
CVE-2021-25992: Insufficient Session Expiration (CWE-613)
value: In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2022-02-10T10:15Z
Repository: https://github.com/ifmeorg/ifme
Language: Ruby
Files changed: app/controllers/sessions_controller.rb
Commit date: 2022-02-04 02:25:03 -0500
Commit message: Call invalidate_all_sessions in prepend_before_action

Diff: diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 576a775e0..87fff44c6 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -1,10 +1,11 @@
 # frozen_string_literal: true
 
 class SessionsController < Devise::SessionsController
   prepend_before_action :check_recaptcha, only: [:create]
   before_action :set_recaptcha, only: [:new]
+  prepend_before_action :invalidate_all_sessions, only: [:destroy]
 
   def new
     super
   end
 
@@ -12,11 +13,10 @@ class SessionsController < Devise::SessionsController
     super
     set_user_locale if user_signed_in?
   end
 
   def destroy
-    current_user.invalidate_all_sessions!
     super
   end
 
   private
 
@@ -55,6 +55,10 @@ class SessionsController < Devise::SessionsController
     user = User.find_by(email: sign_in_params[:email])
     return false if user.nil?
 
     RecaptchaService.new(user).recaptcha_required_for_login?
   end
+
+  def invalidate_all_sessions
+    current_user.invalidate_all_sessions!
+  end
 end

Vulnerable code:     current_user.invalidate_all_sessions!
Fixed code:   prepend_before_action :invalidate_all_sessions, only: [:destroy]

  def invalidate_all_sessions
    current_user.invalidate_all_sessions!
  end
CVE-2021-44273: Improper Certificate Validation (CWE-295)
value: e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. In standalone mode (i.e., acting as a proxy or a transparent proxy), with SSL MITM enabled, e2guardian, if built with OpenSSL v1.1.x, did not validate hostnames in certificates of the web servers that it connected to, and thus was itself vulnerable to MITM attacks.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 7.4
Published: 2021-12-23T12:15Z
Repository: https://github.com/e2guardian/e2guardian
Language: C++
Files changed: src/Socket.cpp
Commit date: 2021-11-23 09:52:38 +0000
Commit message: Fix bug #707 cert hostnames not being checked
- only happened when openssl v1.1 is used

Diff: diff --git a/src/Socket.cpp b/src/Socket.cpp
index 6ef9619..2b687ef 100644
--- a/src/Socket.cpp
+++ b/src/Socket.cpp
@@ -375,10 +375,14 @@ int Socket::startSslClient(const std::string &certificate_path, String hostname)
     SSL_set_connect_state(ssl);
 
     //fcntl(this->getFD() ,F_SETFL, O_NONBLOCK); // blocking mode used currently
     SSL_set_fd(ssl, this->getFD());
     SSL_set_tlsext_host_name(ssl, hostname.c_str());
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#else
+  X509_VERIFY_PARAM_set1_host(SSL_get0_param(ssl),hostname.c_str(),0);
+#endif
 
     //make io non blocking as select wont tell us if we can do a read without blocking
     //BIO_set_nbio(SSL_get_rbio(ssl),1l);  // blocking mode used currently
     //BIO_set_nbio(SSL_get_wbio(ssl),1l); // blocking mode used currently
     ERR_clear_error();

Fixed code: #if OPENSSL_VERSION_NUMBER < 0x10100000L
#else
  X509_VERIFY_PARAM_set1_host(SSL_get0_param(ssl),hostname.c_str(),0);
#endif
CVE-2008-10002: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in cfire24 ajaxlife up to 0.3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.3.3 is able to address this issue. The patch is identified as 9fb53b67312fe3f4336e01c1e3e1bedb4be0c1c8. It is recommended to upgrade the affected component. VDB-222286 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-05T02:15Z
Repository: https://github.com/cfire24/ajaxlife
Language: JavaScript
Files changed: client/AjaxLife.InstantMessage.js, client/AjaxLife.SpatialChat.js
Commit date: 2008-05-18 14:41:38 +0000
Commit message: - Fixes injection exploit caused by link feature.
  - Example: saying the following to a user of AjaxLife:
    See <a href="http:/&#47;en.wikipedia.org/wiki/Second_Life" onclick="AjaxLife.Network.Send('SendAgentMoney',{Target: 'fa42243d-b76e-49f8-880c-ddc7b5479f78', Amount: 500);" target="_blank">http:/&#47;en.wikipedia.org/wiki/Second_Life</a> for an example.

Diff: diff --git a/client/AjaxLife.InstantMessage.js b/client/AjaxLife.InstantMessage.js
index eeee4ef..7d3dfb0 100644
--- a/client/AjaxLife.InstantMessage.js
+++ b/client/AjaxLife.InstantMessage.js
@@ -282,11 +282,11 @@ AjaxLife.InstantMessage = function() {
 	// Append a line to the box with a timestamp.
 	function appendline(session, text)
 	{
 		if(chats[session] && chats[session].content)
 		{
-			text = AjaxLife.Utils.LinkURLs(text);
+			text = AjaxLife.Utils.LinkURLs(text.escapeHTML());
 			var line = Ext.get(document.createElement('div'));
 			line.addClass(["agentmessage","chatline"]);
 			var timestamp = Ext.get(document.createElement('span'));
 			timestamp.addClass("chattimestamp");
 			var time = new Date();
diff --git a/client/AjaxLife.SpatialChat.js b/client/AjaxLife.SpatialChat.js
index ceb26b9..7c782f1 100644
--- a/client/AjaxLife.SpatialChat.js
+++ b/client/AjaxLife.SpatialChat.js
@@ -84,11 +84,11 @@ AjaxLife.SpatialChat = function() {
 	
 	// Add a line to the chatlog. Formatting is applied based on the sourcetype,
 	// and a timestamp is calculated in the user's timezone (assuming their computer clock is accurate)
 	function add(text, sourcetype)
 	{
-		text = AjaxLife.Utils.LinkURLs(text);
+		text = AjaxLife.Utils.LinkURLs(text.escapeHTML());
 		// Make a div to put this in.
 		var line = Ext.get(document.createElement('div'));
 		line.addClass("chatline");
 		// Give the line the appropriate class for the type of message it is.
 		if(sourcetype == AjaxLife.Constants.MainAvatar.ChatSourceType.System)

Vulnerable code: 			text = AjaxLife.Utils.LinkURLs(text);
		text = AjaxLife.Utils.LinkURLs(text);
Fixed code: 			text = AjaxLife.Utils.LinkURLs(text.escapeHTML());
		text = AjaxLife.Utils.LinkURLs(text.escapeHTML());
CVE-2022-24822: Insufficient Information (NVD-CWE-noinfo)
value: Podium is a library for building micro frontends. @podium/layout is a module for building a Podium layout server, and @podium/proxy is a module for proxying HTTP requests from a layout server to a podlet server. In @podium/layout prior to version 4.6.110 and @podium/proxy prior to version 4.2.74, an attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server. All Podium layouts that include podlets with proxy endpoints are affected. `@podium/layout`, which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.`@podium/proxy`, which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable. It is not easily possible to work around this issue without upgrading.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-04-06T18:15Z
Repository: https://github.com/podium-lib/layout
Language: JSON
Files changed: package.json
Commit date: 2022-04-05 14:18:49 +0200
Commit message: fix: update Proxy module to fix trailer header vulnerability
Diff: diff --git a/package.json b/package.json
index 60f66c1..7802222 100644
--- a/package.json
+++ b/package.json
@@ -37,11 +37,11 @@
   },
   "dependencies": {
     "@metrics/client": "2.5.0",
     "@podium/client": "4.5.22",
     "@podium/context": "4.1.74",
-    "@podium/proxy": "4.2.73",
+    "@podium/proxy": "4.2.74",
     "@podium/schemas": "4.1.32",
     "@podium/utils": "4.4.36",
     "abslog": "2.4.0",
     "lodash.merge": "4.6.2",
     "objobj": "1.0.0",

Vulnerable code:     "@podium/proxy": "4.2.73",
Fixed code:     "@podium/proxy": "4.2.74",
CVE-2018-7753: Improper Input Validation (CWE-20)
value: An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-03-07T23:29Z
Repository: https://github.com/mozilla/bleach
Language: Unknown
Commit date: 2018-03-05 16:17:29 -0500
Commit message: Merge pull request #356 from willkg/fix-entities

Fix url sanitizing
CVE-2020-22617: Use After Free (CWE-416)
value: Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2021-10-08T20:15Z
Repository: https://github.com/Ardour/ardour
Language: C++
Files changed: libs/pbd/xml++.cc
Commit date: 2020-03-11 08:50:29 -0600
Commit message: fix apparent free-ordering issue reported in #7926

Diff: diff --git a/libs/pbd/xml++.cc b/libs/pbd/xml++.cc
index 598a7684b..e09af7602 100644
--- a/libs/pbd/xml++.cc
+++ b/libs/pbd/xml++.cc
@@ -768,20 +768,20 @@ writenode(xmlDocPtr doc, XMLNode* n, xmlNodePtr p, int root = 0)
 static XMLSharedNodeList* find_impl(xmlXPathContext* ctxt, const string& xpath)
 {
 	xmlXPathObject* result = xmlXPathEval((const xmlChar*)xpath.c_str(), ctxt);
 
 	if (!result) {
-		xmlXPathFreeContext(ctxt);
 		xmlFreeDoc(ctxt->doc);
+		xmlXPathFreeContext(ctxt);
 
 		throw XMLException("Invalid XPath: " + xpath);
 	}
 
 	if (result->type != XPATH_NODESET) {
 		xmlXPathFreeObject(result);
-		xmlXPathFreeContext(ctxt);
 		xmlFreeDoc(ctxt->doc);
+		xmlXPathFreeContext(ctxt);
 
 		throw XMLException("Only nodeset result types are supported.");
 	}
 
 	xmlNodeSet* nodeset = result->nodesetval;

Vulnerable code: 		xmlXPathFreeContext(ctxt);
		xmlXPathFreeContext(ctxt);
Fixed code: 		xmlXPathFreeContext(ctxt);
		xmlXPathFreeContext(ctxt);
CVE-2021-27279: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-02-22T20:15Z
Repository: https://github.com/mybb/mybb
Language: PHP
Files changed: inc/class_parser.php
Commit date: 2021-02-22 17:42:36 +0100
Commit message: Fix Nested Email MyCode Persistent XSS

Diff: diff --git a/inc/class_parser.php b/inc/class_parser.php
index 17e1b4cfd..a4549ac95 100644
--- a/inc/class_parser.php
+++ b/inc/class_parser.php
@@ -1345,18 +1345,12 @@ class postParser
 
 		if(!$name)
 		{
 			$name = $email;
 		}
-		if(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+$/si", $email))
-		{
-			$email = $email;
-		}
-		elseif(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+\?(.*?)$/si", $email))
-		{
-			$email = htmlspecialchars_uni($email);
-		}
+
+		$email = $this->encode_url($email);
 
 		eval("\$mycode_email = \"".$templates->get("mycode_email", 1, 0)."\";");
 		return $mycode_email;
 	}
 

Vulnerable code: 		if(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+$/si", $email))
		{
			$email = $email;
		}
		elseif(preg_match("/^([a-zA-Z0-9-_\+\.]+?)@[a-zA-Z0-9-]+\.[a-zA-Z0-9\.-]+\?(.*?)$/si", $email))
		{
			$email = htmlspecialchars_uni($email);
		}
Fixed code: 
		$email = $this->encode_url($email);
CVE-2023-41362: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.2
Published: 2023-08-29T16:15Z
Repository: https://github.com/mybb/mybb
Language: PHP
Files changed: admin/inc/functions.php
Commit date: 2023-08-28 19:25:35 +0200
Commit message: Fix ACP Templates RCE

Diff: diff --git a/admin/inc/functions.php b/admin/inc/functions.php
index 15e00658d..0d6901d3b 100644
--- a/admin/inc/functions.php
+++ b/admin/inc/functions.php
@@ -665,24 +665,25 @@ function is_mobile($useragent)
  * @return boolean A true/false depending on if an issue was detected
  */
 function check_template($template)
 {
 	// Check to see if our database password is in the template
-	if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template)) 
+	if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template) !== 0)
 	{
 		return true;
 	}
 
 	// System calls via backtick
-	if(preg_match('#\$\s*\{#', $template))
+	if(preg_match('#\$\s*\{#', $template) !== 0)
 	{
 		return true;
 	}
 
 	// Any other malicious acts?
 	// Courtesy of ZiNgA BuRgA
-	if(preg_match("~\\{\\$.+?\\}~s", preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template)))
+	$allowed = preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template);
+	if($allowed === null || preg_match("~\\{\\$.+?\\}~s", $allowed) !== 0)
 	{
 		return true;
 	}
 
 	return false;

Vulnerable code: 	if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template)) 
	if(preg_match('#\$\s*\{#', $template))
	if(preg_match("~\\{\\$.+?\\}~s", preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template)))
Fixed code: 	if(preg_match('#\$config\[(([\'|"]database[\'|"])|([^\'"].*?))\]\[(([\'|"](database|hostname|password|table_prefix|username)[\'|"])|([^\'"].*?))\]#i', $template) !== 0)
	if(preg_match('#\$\s*\{#', $template) !== 0)
	$allowed = preg_replace('~\\{\\$+[a-zA-Z_][a-zA-Z_0-9]*((?:-\\>|\\:\\:)\\$*[a-zA-Z_][a-zA-Z_0-9]*|\\[\s*\\$*([\'"]?)[a-zA-Z_ 0-9 ]+\\2\\]\s*)*\\}~', '', $template);
	if($allowed === null || preg_match("~\\{\\$.+?\\}~s", $allowed) !== 0)
CVE-2024-23335: Insufficient Information (NVD-CWE-noinfo)
value: MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-01T07:15Z
Repository: https://github.com/mybb/mybb
Language: PHP
Files changed: admin/modules/tools/backupdb.php
Commit date: 2024-04-30 18:13:10 +0200
Commit message: Fix backups directory .htaccess deletion

Diff: diff --git a/admin/modules/tools/backupdb.php b/admin/modules/tools/backupdb.php
index 88919b9bb8..8d986c8460 100644
--- a/admin/modules/tools/backupdb.php
+++ b/admin/modules/tools/backupdb.php
@@ -98,12 +98,13 @@ if($mybb->input['action'] == "delete")
 	{
 		admin_redirect("index.php?module=tools-backupdb");
 	}
 
 	$file = basename($mybb->input['file']);
+    $ext = get_extension($file);
 
-	if(!trim($mybb->input['file']) || !file_exists(MYBB_ADMIN_DIR.'backups/'.$file))
+    if(!trim($mybb->input['file']) || !file_exists(MYBB_ADMIN_DIR.'backups/'.$file) || filetype(MYBB_ADMIN_DIR.'backups/'.$file) != 'file' || ($ext != 'gz' && $ext != 'sql'))
 	{
 		flash_message($lang->error_backup_doesnt_exist, 'error');
 		admin_redirect("index.php?module=tools-backupdb");
 	}
 

Vulnerable code: 	if(!trim($mybb->input['file']) || !file_exists(MYBB_ADMIN_DIR.'backups/'.$file))
Fixed code:     $ext = get_extension($file);
    if(!trim($mybb->input['file']) || !file_exists(MYBB_ADMIN_DIR.'backups/'.$file) || filetype(MYBB_ADMIN_DIR.'backups/'.$file) != 'file' || ($ext != 'gz' && $ext != 'sql'))
CVE-2024-23336: Insufficient Information (NVD-CWE-noinfo)
value: MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-01T07:15Z
Repository: https://github.com/mybb/mybb
Language: PHP
Files changed: install/index.php
Commit date: 2024-04-30 18:13:44 +0200
Commit message: Fix incomplete disallowed remote addresses list SSRF

Diff: diff --git a/install/index.php b/install/index.php
index dc6f856c8e..b47ca3b95b 100644
--- a/install/index.php
+++ b/install/index.php
@@ -1648,11 +1648,12 @@ function create_tables()
  *  Removing all values disables resolving hosts in that
  *  function.
  */
 
 \$config['disallowed_remote_addresses'] = array(
-	'127.0.0.1',
+	'0.0.0.0',
+	'127.0.0.0/8',
 	'10.0.0.0/8',
 	'172.16.0.0/12',
 	'192.168.0.0/16',
 );
 

Vulnerable code: 	'127.0.0.1',
Fixed code: 	'0.0.0.0',
	'127.0.0.0/8',
CVE-2020-36645: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T19:15Z
Repository: https://github.com/square/squalor
Language: Unknown
Commit date: 2020-03-06 10:40:55 -0500
Commit message: Merge pull request #76 from danrice-square/fix_sql_injection

Prevent a SQL injection
CVE-2021-23363: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-03-30T15:15Z
Repository: https://github.com/GuyMograbi/kill-by-port
Language: JavaScript
Files changed: index.js
Commit date: 2021-03-24 07:00:50 -0700
Commit message: fix kill by port

Diff: diff --git a/index.js b/index.js
index a827f37..e19507a 100644
--- a/index.js
+++ b/index.js
@@ -3,11 +3,11 @@
 const exec = require('child_process').execSync
 
 exports.killByPort = function (port) {
   var processId = null
   try {
-    processId = exec(`lsof -t -i:${port}`)
+    processId = exec(`lsof -t -i:${parseInt(port, 10)}`)
   } catch (e) {
 
   }
 
   if (processId !== null) { // if exists kill

Vulnerable code:     processId = exec(`lsof -t -i:${port}`)
Fixed code:     processId = exec(`lsof -t -i:${parseInt(port, 10)}`)
CVE-2022-24884: Improper Verification of Cryptographic Signature (CWE-347)
value: ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2022-05-06T00:15Z
Repository: https://github.com/freifunk-gluon/ecdsautils
Language: C
Files changed: src/lib/ecdsa.c
Commit date: 2022-04-27 18:56:10 +0200
Commit message: verify: fix signature verification (CVE-2022-24884)

Verify that r and s are non-zero. Without these checks, an all-zero
signature is always considered valid.

While it would be nicer to error out in ecdsa_verify_prepare_legacy()
already, that would require users of libecdsautil to check a return value
of the prepare step. To be safe, implement the fix in an API/ABI-compatible
way that doesn't need changes to the users.

Diff: diff --git a/src/lib/ecdsa.c b/src/lib/ecdsa.c
index 8cd7722..a661b56 100644
--- a/src/lib/ecdsa.c
+++ b/src/lib/ecdsa.c
@@ -133,10 +133,16 @@ regenerate:
 
 
 void ecdsa_verify_prepare_legacy(ecdsa_verify_context_t *ctx, const ecc_int256_t *hash, const ecdsa_signature_t *signature) {
   ecc_int256_t w, u1, tmp;
 
+  if (ecc_25519_gf_is_zero(&signature->s) || ecc_25519_gf_is_zero(&signature->r)) {
+    // Signature is invalid, mark by setting ctx->r to an invalid value
+    memset(&ctx->r, 0, sizeof(ctx->r));
+    return;
+  }
+
   ctx->r = signature->r;
 
   ecc_25519_gf_recip(&w, &signature->s);
   ecc_25519_gf_reduce(&tmp, hash);
   ecc_25519_gf_mult(&u1, &tmp, &w);
@@ -147,10 +153,14 @@ void ecdsa_verify_prepare_legacy(ecdsa_verify_context_t *ctx, const ecc_int256_t
 
 bool ecdsa_verify_legacy(const ecdsa_verify_context_t *ctx, const ecc_25519_work_t *pubkey) {
   ecc_25519_work_t s2, work;
   ecc_int256_t w, tmp;
 
+  // Signature was detected as invalid in prepare step
+  if (ecc_25519_gf_is_zero(&ctx->r))
+    return false;
+
   ecc_25519_scalarmult(&s2, &ctx->u2, pubkey);
   ecc_25519_add(&work, &ctx->s1, &s2);
   ecc_25519_store_xy_legacy(&w, NULL, &work);
   ecc_25519_gf_sub(&tmp, &ctx->r, &w);
 

Fixed code:   if (ecc_25519_gf_is_zero(&signature->s) || ecc_25519_gf_is_zero(&signature->r)) {
    // Signature is invalid, mark by setting ctx->r to an invalid value
    memset(&ctx->r, 0, sizeof(ctx->r));
    return;
  }

  // Signature was detected as invalid in prepare step
  if (ecc_25519_gf_is_zero(&ctx->r))
    return false;
CVE-2022-24884: Improper Verification of Cryptographic Signature (CWE-347)
value: ecdsautils is a tiny collection of programs used for ECDSA (keygen, sign, verify). `ecdsa_verify_[prepare_]legacy()` does not check whether the signature values `r` and `s` are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple signatures from different public keys does not mitigate the issue: `ecdsa_verify_list_legacy()` will accept an arbitrary number of such forged signatures. Both the `ecdsautil verify` CLI command and the libecdsautil library are affected. The issue has been fixed in ecdsautils 0.4.1. All older versions of ecdsautils (including versions before the split into a library and a CLI utility) are vulnerable.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2022-05-06T00:15Z
Repository: https://github.com/freifunk-gluon/ecdsautils
Language: Unknown
Commit date: 2022-05-05 18:01:14 +0200
Commit message: Merge pull request from GHSA-qhcg-9ffp-78pw

verify: fix signature verification (CVE-2022-24884)
CVE-2015-20110: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces the search space to a linear amount of guesses based on the token length times the possible characters.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 7.5
Published: 2023-10-31T03:15Z
Repository: https://github.com/jhipster/generator-jhipster
Language: Unknown
Commit date: 2015-10-16 14:55:19 +0200
Commit message: Merge pull request #2096 from maklemenz/tokenprovider-timingattack

fixed timing attack vulnerability in TokenProvider
CVE-2020-11080: Improper Neutralization (CWE-707)
value: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 7.5
Published: 2020-06-03T23:15Z
Repository: https://github.com/nghttp2/nghttp2
Language: C
Files changed: lib/nghttp2_session.c
Commit date: 2020-05-05 11:55:38 -0700
Commit message: Earlier check for settings flood

Diff: diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c
index 415e3477..39f81f49 100644
--- a/lib/nghttp2_session.c
+++ b/lib/nghttp2_session.c
@@ -5651,10 +5651,16 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
           busy = 1;
           iframe->state = NGHTTP2_IB_FRAME_SIZE_ERROR;
           break;
         }
 
+        /* Check the settings flood counter early to be safe */
+        if (session->obq_flood_counter_ >= session->max_outbound_ack &&
+            !(iframe->frame.hd.flags & NGHTTP2_FLAG_ACK)) {
+          return NGHTTP2_ERR_FLOODED;
+        }
+
         iframe->state = NGHTTP2_IB_READ_SETTINGS;
 
         if (iframe->payloadleft) {
           nghttp2_settings_entry *min_header_table_size_entry;
 

Fixed code:         /* Check the settings flood counter early to be safe */
        if (session->obq_flood_counter_ >= session->max_outbound_ack &&
            !(iframe->frame.hd.flags & NGHTTP2_FLAG_ACK)) {
          return NGHTTP2_ERR_FLOODED;
        }
CVE-2015-0284: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2016-04-14T14:59Z
Repository: https://github.com/spacewalkproject/spacewalk
Language: Other
Files changed: java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
Commit date: 2015-09-09 16:00:13 +0200
Commit message: 1181152 - WebUI -> Admin -> Users XSS

Diff: diff --git a/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp b/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
index 5880d44115..1bb595c1c1 100644
--- a/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
+++ b/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
@@ -53,11 +53,13 @@
         </rl:column>
         <rl:column bound="false"
                    sortable="false"
                    headerkey="realname.displayname"
                    attr="userLastName">
-                <c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="true"/>
+                <c:out value="<a href=\"mailto:${current.address}\">" escapeXml="false" />
+                <c:out value="${current.userLastName}, ${current.userFirstName}" escapeXml="true" />
+                <c:out value="</a>" escapeXml="false" />
         </rl:column>
         <rl:column bound="false"
                    sortable="false"
                    headerkey="org.displayname"
                    attr="orgName">

Vulnerable code:                 <c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="true"/>
Fixed code:                 <c:out value="<a href=\"mailto:${current.address}\">" escapeXml="false" />
                <c:out value="${current.userLastName}, ${current.userFirstName}" escapeXml="true" />
                <c:out value="</a>" escapeXml="false" />
CVE-2018-14474: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2018-07-20T18:29Z
Repository: https://github.com/s-gv/orangeforum
Language: Go
Files changed: views/auth.go
Commit date: 2018-03-04 00:37:49 +0530
Commit message: Fix open redirection

Diff: diff --git a/views/auth.go b/views/auth.go
index ae8568c..159a02d 100644
--- a/views/auth.go
+++ b/views/auth.go
@@ -18,11 +18,11 @@ import (
 	"time"
 )
 
 var LoginHandler = UA(func(w http.ResponseWriter, r *http.Request, sess Session) {
 	redirectURL, err := url.QueryUnescape(r.FormValue("next"))
-	if redirectURL == "" || err != nil {
+	if err != nil || redirectURL == "" || redirectURL[0] != '/' {
 		redirectURL = "/"
 	}
 	if sess.IsUserValid() {
 		http.Redirect(w, r, redirectURL, http.StatusSeeOther)
 		return
@@ -57,11 +57,11 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
 var SignupHandler = UA(func(w http.ResponseWriter, r *http.Request, sess Session) {
 	redirectURL, err := url.QueryUnescape(r.FormValue("next"))
-	if redirectURL == "" || err != nil {
+	if err != nil || redirectURL == "" || redirectURL[0] != '/' {
 		redirectURL = "/"
 	}
 	if sess.IsUserValid() && !sess.IsUserSuperAdmin() {
 		http.Redirect(w, r, redirectURL, http.StatusSeeOther)
 		return

Vulnerable code: 	if redirectURL == "" || err != nil {
	if redirectURL == "" || err != nil {
Fixed code: 	if err != nil || redirectURL == "" || redirectURL[0] != '/' {
	if err != nil || redirectURL == "" || redirectURL[0] != '/' {
CVE-2019-20791: Out-of-bounds Write (CWE-787)
value: OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-04-28T18:15Z
Repository: https://github.com/openthread/openthread
Language: C++
Files changed: src/core/meshcop/commissioner.cpp
Commit date: 2019-12-16 09:04:09 -0800
Commit message: [commissioner] add network name length check in GeneratePskc() (#4404)

Diff: diff --git a/src/core/meshcop/commissioner.cpp b/src/core/meshcop/commissioner.cpp
index 8659dfe7..9f09b280 100644
--- a/src/core/meshcop/commissioner.cpp
+++ b/src/core/meshcop/commissioner.cpp
@@ -1107,11 +1107,12 @@ otError Commissioner::GeneratePskc(const char *              aPassPhrase,
     const char *saltPrefix = "Thread";
     uint8_t     salt[OT_PBKDF2_SALT_MAX_LEN];
     uint16_t    saltLen = 0;
 
     VerifyOrExit((strlen(aPassPhrase) >= OT_COMMISSIONING_PASSPHRASE_MIN_SIZE) &&
-                     (strlen(aPassPhrase) <= OT_COMMISSIONING_PASSPHRASE_MAX_SIZE),
+                     (strlen(aPassPhrase) <= OT_COMMISSIONING_PASSPHRASE_MAX_SIZE) &&
+                     (strlen(aNetworkName) <= OT_NETWORK_NAME_MAX_SIZE),
                  error = OT_ERROR_INVALID_ARGS);
 
     memset(salt, 0, sizeof(salt));
     memcpy(salt, saltPrefix, strlen(saltPrefix));
     saltLen += static_cast<uint16_t>(strlen(saltPrefix));

Vulnerable code:                      (strlen(aPassPhrase) <= OT_COMMISSIONING_PASSPHRASE_MAX_SIZE),
Fixed code:                      (strlen(aPassPhrase) <= OT_COMMISSIONING_PASSPHRASE_MAX_SIZE) &&
                     (strlen(aNetworkName) <= OT_NETWORK_NAME_MAX_SIZE),
CVE-2014-3148: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in libahttp/err.c in OkCupid OKWS (OK Web Server) allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to a non-existent page, which is not properly handled in a 404 error page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-08-31T18:59Z
Repository: https://github.com/okws/okws
Language: Other
Files changed: libahttp/err.C
Commit date: 2014-05-02 10:52:38 -0400
Commit message: Escape error page content

Credit to Kenneth F. Belva (https://twitter.com/infosecmaverick)
https://hackerone.com/reports/3317

Diff: diff --git a/libahttp/err.C b/libahttp/err.C
index 2120ca5c..b6101f02 100644
--- a/libahttp/err.C
+++ b/libahttp/err.C
@@ -23,30 +23,31 @@
  */
 
 
 #include "resp.h"
 #include "ahttp.h"
+#include "pescape.h"
 
 strbuf
 http_error_t::make_body (int n, const str &si, const str &aux)
 {
   strbuf b;
   str ldesc;
-  const str sdesc = http_status.get_desc (n, &ldesc);
+  const str sdesc = xss_escape (http_status.get_desc (n, &ldesc));
   b << "<html>\n"
     << " <head>\n"
     << "  <title>" << n << " " << sdesc << "</title>\n"
     << " </head>\n"
     << " <body>\n"
     << " <h1>Error " << n << " " << sdesc << "</h1><br><br>\n"
     ;
   if (n == HTTP_NOT_FOUND && aux) {
-    b << "The file <tt>" << aux 
+    b << "The file <tt>" << xss_escape (aux)
       << "</tt> was not found on this server.<br><br>\n\n";
   }
   b << "  <hr>\n"
-    << "  <i>" << si << "</i>\n"
+    << "  <i>" << xss_escape (si) << "</i>\n"
     << " <br>\n"
     << " </body>\n"
     << "</html>\n"
     ;
   return b;

Vulnerable code:   const str sdesc = http_status.get_desc (n, &ldesc);
    b << "The file <tt>" << aux 
    << "  <i>" << si << "</i>\n"
Fixed code: #include "pescape.h"
  const str sdesc = xss_escape (http_status.get_desc (n, &ldesc));
    b << "The file <tt>" << xss_escape (aux)
    << "  <i>" << xss_escape (si) << "</i>\n"
CVE-2019-11924: Allocation of Resources Without Limits or Throttling (CWE-770)
value: A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2019-08-20T20:15Z
Repository: https://github.com/facebookincubator/fizz
Language: C++
Files changed: fizz/record/EncryptedRecordLayer.cpp, fizz/record/test/EncryptedRecordTest.cpp
Commit date: 2019-08-08 11:43:20 -0700
Commit message: Reject zero length handshake records.

Summary:
Zero length (all padding) handshake are forbidden by RFC. Allowing
these was a regression in D13754697 (2c6f78a).

This is a partial fix for CVE-2019-11924

Reviewed By: xybu

Differential Revision: D16285100

fbshipit-source-id: 05a19d31ad74601ce89156a0e59517aaad8dd928

Diff: diff --git a/fizz/record/EncryptedRecordLayer.cpp b/fizz/record/EncryptedRecordLayer.cpp
index 7fbc3d3..a56b762 100644
--- a/fizz/record/EncryptedRecordLayer.cpp
+++ b/fizz/record/EncryptedRecordLayer.cpp
@@ -145,11 +145,11 @@ folly::Optional<TLSMessage> EncryptedReadRecordLayer::read(
       throw std::runtime_error(folly::to<std::string>(
           "received encrypted content type ",
           static_cast<ContentTypeType>(msg.type)));
   }
 
-  if (!msg.fragment) {
+  if (!msg.fragment || msg.fragment->empty()) {
     if (msg.type == ContentType::application_data) {
       msg.fragment = folly::IOBuf::create(0);
     } else {
       throw std::runtime_error("received empty fragment");
     }
diff --git a/fizz/record/test/EncryptedRecordTest.cpp b/fizz/record/test/EncryptedRecordTest.cpp
index d3d1051..15307cd 100644
--- a/fizz/record/test/EncryptedRecordTest.cpp
+++ b/fizz/record/test/EncryptedRecordTest.cpp
@@ -178,11 +178,11 @@ TEST_F(EncryptedRecordTest, TestAllPaddingHandshake) {
   EXPECT_CALL(*readAead_, _decrypt(_, _, 0))
       .WillOnce(Invoke([](std::unique_ptr<IOBuf>& buf, const IOBuf*, uint64_t) {
         expectSame(buf, "0123456789");
         return getBuf("16000000");
       }));
-  EXPECT_NO_THROW(read_.read(queue_));
+  EXPECT_ANY_THROW(read_.read(queue_));
 }
 
 TEST_F(EncryptedRecordTest, TestNoContentType) {
   addToQueue("17030100050123456789");
   EXPECT_CALL(*readAead_, _decrypt(_, _, 0))

Vulnerable code:   if (!msg.fragment) {
  EXPECT_NO_THROW(read_.read(queue_));
Fixed code:   if (!msg.fragment || msg.fragment->empty()) {
  EXPECT_ANY_THROW(read_.read(queue_));
CVE-2023-23759: Reachable Assertion (CWE-617)
value: There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between the original ClientHello and the second ClientHello, crashing the process (impact is limited to denial of service).
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2023-05-18T22:15Z
Repository: https://github.com/facebookincubator/fizz
Language: C++
Files changed: fizz/server/ServerProtocol.cpp
Commit date: 2023-01-20 13:47:56 -0500
Commit message: Check HelloRetryRequest cipher consistency earlier.

CVE-2023-23759

Co-authored-by: Facebook Community Bot <6422482+facebook-github-bot@users.noreply.github.com>

Differential Revision: D42508182
Diff: diff --git a/fizz/server/ServerProtocol.cpp b/fizz/server/ServerProtocol.cpp
index 486c266e..52f12aaf 100644
--- a/fizz/server/ServerProtocol.cpp
+++ b/fizz/server/ServerProtocol.cpp
@@ -1212,10 +1212,16 @@ EventHandler<ServerTypes, StateEnum::ExpectingClientHello, Event::ClientHello>::
 
   validateClientHello(chlo);
 
   auto cipher = negotiateCipher(chlo, state.context()->getSupportedCiphers());
 
+  if (state.cipher().has_value() && cipher != *state.cipher()) {
+    throw FizzException(
+        "cipher mismatch with previous negotiation",
+        AlertDescription::illegal_parameter);
+  }
+
   verifyCookieState(cookieState, *version, cipher);
 
   auto resStateResult = getResumptionState(
       chlo,
       state.context()->getTicketCipher(),
@@ -1282,16 +1288,10 @@ EventHandler<ServerTypes, StateEnum::ExpectingClientHello, Event::ClientHello>::
             cookieState,
             pskType,
             std::move(state.handshakeContext()),
             version);
 
-        if (state.cipher().has_value() && cipher != *state.cipher()) {
-          throw FizzException(
-              "cipher mismatch with previous negotiation",
-              AlertDescription::illegal_parameter);
-        }
-
         auto alpn = negotiateAlpn(chlo, folly::none, *state.context());
 
         auto clockSkew = getClockSkew(
             resState,
             obfuscatedAge,

Vulnerable code:         if (state.cipher().has_value() && cipher != *state.cipher()) {
          throw FizzException(
              "cipher mismatch with previous negotiation",
              AlertDescription::illegal_parameter);
        }

Fixed code:   if (state.cipher().has_value() && cipher != *state.cipher()) {
    throw FizzException(
        "cipher mismatch with previous negotiation",
        AlertDescription::illegal_parameter);
  }
CVE-2024-33531: Insufficient Information (NVD-CWE-noinfo)
value: cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-24T06:15Z
Repository: https://github.com/cdbattags/lua-resty-jwt
Language: Unknown
Commit date: 2023-08-02 12:24:43 -0400
Commit message: Merge pull request #62 from nemmerich/master

Fix authentication bypass