Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-8898: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2019-05-24T17:29Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/core/subsystems/expRouter.php
Commit date: 2016-09-20 19:29:35 -0400
Commit message: remove warning from expRouter code

Diff: diff --git a/framework/core/subsystems/expRouter.php b/framework/core/subsystems/expRouter.php
index 5c2e72e32f..b9ae99dff1 100644
--- a/framework/core/subsystems/expRouter.php
+++ b/framework/core/subsystems/expRouter.php
@@ -207,11 +207,11 @@ class expRouter {
 
             $_REQUEST['id'] = intval($_REQUEST['id']);
         }
         // do the same for the other id's
         foreach ($_REQUEST as $key=>$var) {
-            if (is_string($var) && strrpos($key,'_id',-3) !== false) {
+            if (is_string($var) && strlen($key) >= 3 && strrpos($key,'_id',-3) !== false) {
                 if (isset($_GET[$key]))
                     $_GET[$key] = intval($_GET[$key]);
                 if (isset($_POST[$key]))
                     $_POST[$key] = intval($_POST[$key]);
 

Vulnerable code:             if (is_string($var) && strrpos($key,'_id',-3) !== false) {
Fixed code:             if (is_string($var) && strlen($key) >= 3 && strrpos($key,'_id',-3) !== false) {
CVE-2016-9184: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2016-11-04T10:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/core/controllers/expHTMLEditorController.php
Commit date: 2016-11-03 10:59:50 -0400
Commit message: better fix security vulnerability in editor preview; reported by fyth

Diff: diff --git a/framework/modules/core/controllers/expHTMLEditorController.php b/framework/modules/core/controllers/expHTMLEditorController.php
index 0b347b925bb..10623b6e7e1 100644
--- a/framework/modules/core/controllers/expHTMLEditorController.php
+++ b/framework/modules/core/controllers/expHTMLEditorController.php
@@ -60,10 +60,12 @@ class expHTMLEditorController extends expController
     function __construct($src = null, $params = array())
     {
         parent:: __construct($src, $params);
         if (empty($this->params['editor'])) {
             $this->params['editor'] = SITE_WYSIWYG_EDITOR;
+        } else {
+            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
         }
     }
 
     function manage()
     {
@@ -169,11 +171,11 @@ class expHTMLEditorController extends expController
                 $demo->skin = 'kama';
             } elseif ($this->params['editor'] == 'tinymce') {
                 $demo->skin = 'lightgray';
             }
         } else {
-            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
+            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
         }
         assign_to_template(
             array(
                 'demo' => $demo,
                 'editor' => $this->params['editor']

Vulnerable code:             $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
Fixed code:         } else {
            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
CVE-2016-9184: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2016-11-04T10:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/core/controllers/expHTMLEditorController.php
Commit date: 2016-11-03 10:59:50 -0400
Commit message: better fix security vulnerability in editor preview; reported by fyth

Diff: diff --git a/framework/modules/core/controllers/expHTMLEditorController.php b/framework/modules/core/controllers/expHTMLEditorController.php
index 0b347b925bb..10623b6e7e1 100644
--- a/framework/modules/core/controllers/expHTMLEditorController.php
+++ b/framework/modules/core/controllers/expHTMLEditorController.php
@@ -60,10 +60,12 @@ class expHTMLEditorController extends expController
     function __construct($src = null, $params = array())
     {
         parent:: __construct($src, $params);
         if (empty($this->params['editor'])) {
             $this->params['editor'] = SITE_WYSIWYG_EDITOR;
+        } else {
+            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
         }
     }
 
     function manage()
     {
@@ -169,11 +171,11 @@ class expHTMLEditorController extends expController
                 $demo->skin = 'kama';
             } elseif ($this->params['editor'] == 'tinymce') {
                 $demo->skin = 'lightgray';
             }
         } else {
-            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
+            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
         }
         assign_to_template(
             array(
                 'demo' => $demo,
                 'editor' => $this->params['editor']

Vulnerable code:             $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
Fixed code:         } else {
            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
CVE-2016-9272: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.1
Published: 2016-11-11T11:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/core/controllers/expController.php
Commit date: 2016-11-06 05:53:19 -0500
Commit message: fix sql injection security vulnerability; reported by Nicky [#1394 state:resolved] [#1395 state:resolved]

Diff: diff --git a/framework/core/controllers/expController.php b/framework/core/controllers/expController.php
index a989f3ff455..17516b7563a 100755
--- a/framework/core/controllers/expController.php
+++ b/framework/core/controllers/expController.php
@@ -770,11 +770,11 @@ abstract class expController {
      */
     public function manage_ranks() {
         $rank = 1;
         foreach ($this->params['rerank'] as $id) {
             $modelname = $this->params['model'];
-            $obj = new $modelname($id);
+            $obj = new $modelname(intval($id));
             $obj->rank = $rank;
             $obj->save(false, true);
             $rank++;
         }
 

Vulnerable code:             $obj = new $modelname($id);
Fixed code:             $obj = new $modelname(intval($id));
CVE-2016-9282: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2016-11-11T22:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/search/controllers/searchController.php
Commit date: 2016-11-03 09:45:47 -0400
Commit message: fix security vulnerability in search method, reported by pang0lin

Diff: diff --git a/framework/modules/search/controllers/searchController.php b/framework/modules/search/controllers/searchController.php
index 47bceb426e9..fc1f9630b37 100755
--- a/framework/modules/search/controllers/searchController.php
+++ b/framework/modules/search/controllers/searchController.php
@@ -56,11 +56,11 @@ class searchController extends expController {
 
         // If magic quotes is on and the user uses modifiers like " (quotes) they get escaped. We don't want that in this case.
         if (get_magic_quotes_gpc()) {
             $terms = stripslashes($terms);
         }
-        $terms = htmlspecialchars($terms);
+        $terms = expString::escape(htmlspecialchars($terms));
 
         if ($router->current_url == substr(URL_FULL, 0, -1)) {  // give us a user friendly url
             unset($router->params['int']);
 //            unset($router->params['src']);
 //            $router->params['src'] = '1';

Vulnerable code:         $terms = htmlspecialchars($terms);
Fixed code:         $terms = expString::escape(htmlspecialchars($terms));
CVE-2016-9284: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-11-11T22:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/users/controllers/usersController.php
Commit date: 2016-11-03 09:28:08 -0400
Commit message: fix security vulnerability to get user list, reported by pang0lin

Diff: diff --git a/framework/modules/users/controllers/usersController.php b/framework/modules/users/controllers/usersController.php
index 7012b8496c4..3b4568633ed 100755
--- a/framework/modules/users/controllers/usersController.php
+++ b/framework/modules/users/controllers/usersController.php
@@ -37,10 +37,11 @@ class usersController extends expController {
         'import'           => 'Import Users',
         'export'           => 'Export Users',
         'update'           => 'Update Users',
         'show'             => 'Show User',
         'showall'          => 'Show Users',
+        'getUsersByJSON'   => 'Get Users',
     );
 
     static function displayname() {
         return gt("User Manager");
     }

Fixed code:         'getUsersByJSON'   => 'Get Users',
CVE-2016-9286: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-11-11T22:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/users/controllers/usersController.php
Commit date: 2016-11-05 15:31:58 -0400
Commit message: Prevent logged in uses from view other user records and admins from super-admin records; thanks to pang0lin

Diff: diff --git a/framework/modules/users/controllers/usersController.php b/framework/modules/users/controllers/usersController.php
index 73820bb6b3b..352c982c4e3 100755
--- a/framework/modules/users/controllers/usersController.php
+++ b/framework/modules/users/controllers/usersController.php
@@ -60,10 +60,29 @@ class usersController extends expController {
 
     static function canImportData() {
         return true;
     }
 
+    public function show() {
+        global $user;
+
+        $id = !empty($this->params['id']) ? $this->params['id'] : null;
+
+        // check to see if we should be editing.  You either need to be an admin, or viewing own account.
+        if ($user->isAdmin() || ($user->id == $id)) {
+            $u = new user($id);
+            if ($u->isSuperAdmin() && $user->isActingAdmin()) {
+                flash('error', gt('You do not have the proper permissions to view this record'));
+                expHistory::back();
+            }
+            parent::show();
+        } else {
+            flash('error', gt('You do not have the proper permissions to view this record'));
+            expHistory::back();
+        }
+    }
+
     public function manage() {
         global $user;
 
         expHistory::set('manageable', $this->params);
 //        $limit = empty($this->config['limit']) ? 10 : $this->config['limit'];

Fixed code:     public function show() {
        global $user;

        $id = !empty($this->params['id']) ? $this->params['id'] : null;

        // check to see if we should be editing.  You either need to be an admin, or viewing own account.
        if ($user->isAdmin() || ($user->id == $id)) {
            $u = new user($id);
            if ($u->isSuperAdmin() && $user->isActingAdmin()) {
                flash('error', gt('You do not have the proper permissions to view this record'));
                expHistory::back();
            }
            parent::show();
        } else {
            flash('error', gt('You do not have the proper permissions to view this record'));
            expHistory::back();
        }
    }
CVE-2016-9288: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2016-11-11T23:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/navigation/controllers/navigationController.php
Commit date: 2016-11-03 10:15:00 -0400
Commit message: fix security vulnerability to reranking pages; reported by kyohpc

Diff: diff --git a/framework/modules/navigation/controllers/navigationController.php b/framework/modules/navigation/controllers/navigationController.php
index 90180d6276e..ebe59313bfc 100644
--- a/framework/modules/navigation/controllers/navigationController.php
+++ b/framework/modules/navigation/controllers/navigationController.php
@@ -37,10 +37,12 @@ class navigationController extends expController {
     );
     protected $manage_permissions = array(
         'move'      => 'Move Page',
         'remove'    => 'Remove Page',
         'reparent'    => 'Reparent Page',
+        'dragndroprerank'    => 'Rerank Page',
+        'dragndroprerank2'    => 'Rerank Page',
     );
     public $remove_configs = array(
         'aggregation',
         'categories',
         'comments',
@@ -856,12 +858,12 @@ class navigationController extends expController {
      * Ajax function to reorder page hierarchy from yui tree control
      */
     public static function DragnDropReRank() {
         global $db, $router;
 
-        $move   = $router->params['move'];
-        $target = $router->params['target'];
+        $move   = intval($router->params['move']);
+        $target = intval($router->params['target']);
         $type   = $router->params['type'];
         $targSec = $db->selectObject("section","id=".$target);
 //        $targSec  = new section($target);
         $check_id = $targSec->parent;
         $moveSec = $db->selectObject("section","id=".$move);

Vulnerable code:         $move   = $router->params['move'];
        $target = $router->params['target'];
Fixed code:         'dragndroprerank'    => 'Rerank Page',
        'dragndroprerank2'    => 'Rerank Page',
        $move   = intval($router->params['move']);
        $target = intval($router->params['target']);
CVE-2017-7991: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2017-04-22T01:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/eaas/controllers/eaasController.php
Commit date: 2020-04-27 16:34:18 -0400
Commit message: fix sql injection issue

Diff: diff --git a/framework/modules/eaas/controllers/eaasController.php b/framework/modules/eaas/controllers/eaasController.php
index b836ff05600..1512a55ad26 100644
--- a/framework/modules/eaas/controllers/eaasController.php
+++ b/framework/modules/eaas/controllers/eaasController.php
@@ -78,10 +78,12 @@ class eaasController extends expController {
             $_REQUEST['apikey'] = true;  // set this to force an ajax reply
             $ar = new expAjaxReply(550, 'Permission Denied', 'You need an API key in order to access Exponent as a Service', null);
             $ar->send();  //FIXME this doesn't seem to work correctly in this scenario
         } else {
             $key = expUnserialize(base64_decode(urldecode($this->params['apikey'])));
+            preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $key, $matches);
+            $key = $matches[0];
             $cfg = new expConfig($key);
             $this->config = $cfg->config;
             if(empty($cfg->id)) {
                 $ar = new expAjaxReply(550, 'Permission Denied', 'Incorrect API key or Exponent as a Service module configuration missing', null);
                 $ar->send();

Fixed code:             preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $key, $matches);
            $key = $matches[0];
CVE-2017-8085: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-04-24T14:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/file/connector/elfinder.php
Commit date: 2017-04-22 12:56:20 -0400
Commit message: fix possible xss security issue with elFinder (thanks to chengable)

Diff: diff --git a/framework/modules/file/connector/elfinder.php b/framework/modules/file/connector/elfinder.php
index ac9103c8a90..4ad6f4abc66 100644
--- a/framework/modules/file/connector/elfinder.php
+++ b/framework/modules/file/connector/elfinder.php
@@ -507,7 +507,7 @@ $opts = array(
         )
     )
 );
 
 //header('Access-Control-Allow-Origin: *');
-$connector = new elFinderConnector(new elFinderExponent($opts), true);
+$connector = new elFinderConnector(new elFinderExponent($opts));
 $connector->run();

Vulnerable code: $connector = new elFinderConnector(new elFinderExponent($opts), true);
Fixed code: $connector = new elFinderConnector(new elFinderExponent($opts));
CVE-2022-32168: Uncontrolled Search Path Element (CWE-427)
value: Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
CWE description: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVSS v3 base score: 7.8
Published: 2022-09-28T09:15Z
Repository: https://github.com/notepad-plus-plus/notepad-plus-plus
Language: C++
Files changed: PowerEditor/src/MISC/Exception/MiniDumper.cpp, PowerEditor/src/Parameters.cpp
Commit date: 2022-09-07 20:31:03 +0200
Commit message: Fixes security vulnerability

Fix #12113, close #12114

Diff: diff --git a/PowerEditor/src/MISC/Exception/MiniDumper.cpp b/PowerEditor/src/MISC/Exception/MiniDumper.cpp
index 9cb2d996..48c22efd 100644
--- a/PowerEditor/src/MISC/Exception/MiniDumper.cpp
+++ b/PowerEditor/src/MISC/Exception/MiniDumper.cpp
@@ -32,11 +32,11 @@ bool MiniDumper::writeDump(EXCEPTION_POINTERS * pExceptionInfo)
 	TCHAR szDumpPath[MAX_PATH];
 	TCHAR szScratch[MAX_PATH];
 	LPCTSTR szResult = NULL;
 	bool retval = false;
 
-	HMODULE hDll = ::LoadLibrary( TEXT("DBGHELP.DLL") );	//that wont work on older windows version than XP, #care :)
+	HMODULE hDll = ::LoadLibraryEx(TEXT("DBGHELP.DLL"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);	//that wont work on older windows version than XP, #care :)
 
 	if (hDll)
 	{
 		MINIDUMPWRITEDUMP pDump = (MINIDUMPWRITEDUMP)::GetProcAddress( hDll, "MiniDumpWriteDump" );
 		if (pDump)
diff --git a/PowerEditor/src/Parameters.cpp b/PowerEditor/src/Parameters.cpp
index 66cde374..9233d44f 100644
--- a/PowerEditor/src/Parameters.cpp
+++ b/PowerEditor/src/Parameters.cpp
@@ -1167,11 +1167,11 @@ bool NppParameters::load()
 		_transparentFuncAddr = (WNDPROC)::GetProcAddress(hUser32, "SetLayeredWindowAttributes");
 
 	//---------------------------------------------//
 	// Dlg theme texture function for xp and vista //
 	//---------------------------------------------//
-	_hUXTheme = ::LoadLibrary(TEXT("uxtheme.dll"));
+	_hUXTheme = ::LoadLibraryEx(TEXT("uxtheme.dll"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);
 	if (_hUXTheme)
 		_enableThemeDialogTextureFuncAddr = (WNDPROC)::GetProcAddress(_hUXTheme, "EnableThemeDialogTexture");
 
 	//--------------------------//
 	// langs.xml : for per user //

Vulnerable code: 	HMODULE hDll = ::LoadLibrary( TEXT("DBGHELP.DLL") );	//that wont work on older windows version than XP, #care :)
	_hUXTheme = ::LoadLibrary(TEXT("uxtheme.dll"));
Fixed code: 	HMODULE hDll = ::LoadLibraryEx(TEXT("DBGHELP.DLL"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);	//that wont work on older windows version than XP, #care :)
	_hUXTheme = ::LoadLibraryEx(TEXT("uxtheme.dll"), nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);
CVE-2021-32843: NULL Pointer Dereference (CWE-476)
value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has is a call to `vc_cfgread` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit df0e46c7dbfd81a957d85e449ba41b52f6f7beb4.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-02-17T23:15Z
Repository: https://github.com/moby/hyperkit
Language: C
Files changed: src/lib/virtio.c
Commit date: 2021-06-24 10:28:38 +0200
Commit message: Fix vi_pci_read null vc_cfgread function pointer dereference (GHSL-2021-054)

This is backport of what is done in bhyve

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>

Diff: diff --git a/src/lib/virtio.c b/src/lib/virtio.c
index 9cd44ce..8321ae3 100644
--- a/src/lib/virtio.c
+++ b/src/lib/virtio.c
@@ -557,11 +557,14 @@ vi_pci_read(UNUSED int vcpu, struct pci_devinst *pi, int baridx,
 		 */
 		newoff = (uint32_t) (offset - virtio_config_size);
 		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
 		if ((newoff + ((unsigned) size)) > max)
 			goto bad;
-		error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);
+		if (vc->vc_cfgread != NULL)
+			error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);
+		else
+			error = 0;
 		if (!error)
 			goto done;
 	}
 
 bad:

Vulnerable code: 		error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);
Fixed code: 		if (vc->vc_cfgread != NULL)
			error = (*vc->vc_cfgread)(DEV_SOFTC(vs), ((int) newoff), size, &value);
		else
			error = 0;
CVE-2021-32844: NULL Pointer Dereference (CWE-476)
value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write` has is a call to `vc_cfgwrite` that does not check for null which when called makes the host crash. This issue may lead to a guest crashing the host causing a denial of service. This issue is fixed in commit 451558fe8aaa8b24e02e34106e3bb9fe41d7ad13.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-02-17T23:15Z
Repository: https://github.com/moby/hyperkit
Language: C
Files changed: src/lib/virtio.c
Commit date: 2021-06-24 10:28:38 +0200
Commit message: Fix vi_pci_write null vc_cfgwrite function pointer dereference (GHSL-2021-055)

This is a backport of what is done in bhyve.

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>

Diff: diff --git a/src/lib/virtio.c b/src/lib/virtio.c
index 8321ae3..7306941 100644
--- a/src/lib/virtio.c
+++ b/src/lib/virtio.c
@@ -679,12 +679,15 @@ vi_pci_write(UNUSED int vcpu, struct pci_devinst *pi, int baridx,
 		 */
 		newoff = (uint32_t) (offset - virtio_config_size);
 		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
 		if ((newoff + ((unsigned) size)) > max)
 			goto bad;
-		error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
-			((uint32_t) value));
+		if (vc->vc_cfgwrite != NULL)
+			error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
+				((uint32_t) value));
+		else
+			error = 0;
 		if (!error)
 			goto done;
 	}
 
 bad:

Vulnerable code: 		error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
			((uint32_t) value));
Fixed code: 		if (vc->vc_cfgwrite != NULL)
			error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), ((int) newoff), size,
				((uint32_t) value));
		else
			error = 0;
CVE-2021-32845: Unchecked Return Value (CWE-252)
value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 7.8
Published: 2023-02-17T23:15Z
Repository: https://github.com/moby/hyperkit
Language: C
Files changed: src/lib/pci_virtio_rnd.c
Commit date: 2021-06-24 18:14:05 +0200
Commit message: Fix vtrnd pci_vtrnd_notify uninitialized memory use (GHSL-2021-056)

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>

Diff: diff --git a/src/lib/pci_virtio_rnd.c b/src/lib/pci_virtio_rnd.c
index 2b77dde..24ba08e 100644
--- a/src/lib/pci_virtio_rnd.c
+++ b/src/lib/pci_virtio_rnd.c
@@ -98,22 +98,26 @@ pci_vtrnd_reset(void *vsc)
 static void
 pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
 {
 	struct iovec iov;
 	struct pci_vtrnd_softc *sc;
-	int len;
+	int len, n;
 	uint16_t idx;
 
 	sc = vsc;
 
 	if (sc->vrsc_fd < 0) {
 		vq_endchains(vq, 0);
 		return;
 	}
 
 	while (vq_has_descs(vq)) {
-		vq_getchain(vq, &idx, &iov, 1, NULL);
+		n = vq_getchain(vq, &idx, &iov, 1, NULL);
+		if (n < 0) {
+			fprintf(stderr, "vtrnd: vtrnd_notify(): n %d\r\n", n);
+			return;
+		}
 
 		len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len);
 
 		DPRINTF(("vtrnd: vtrnd_notify(): %d\r\n", len));
 

Vulnerable code: 	int len;
		vq_getchain(vq, &idx, &iov, 1, NULL);
Fixed code: 	int len, n;
		n = vq_getchain(vq, &idx, &iov, 1, NULL);
		if (n < 0) {
			fprintf(stderr, "vtrnd: vtrnd_notify(): n %d\r\n", n);
			return;
		}
CVE-2021-32846: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.8
Published: 2023-02-17T23:15Z
Repository: https://github.com/moby/hyperkit
Language: C
Files changed: src/lib/pci_virtio_sock.c
Commit date: 2021-06-24 18:44:45 +0200
Commit message: Fix virtio-sock pci_vtsock_proc_tx uninitialized memory use (GHSL-2021-057)

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>

Diff: diff --git a/src/lib/pci_virtio_sock.c b/src/lib/pci_virtio_sock.c
index f66d295..7a03c8d 100644
--- a/src/lib/pci_virtio_sock.c
+++ b/src/lib/pci_virtio_sock.c
@@ -1119,10 +1119,15 @@ static void pci_vtsock_proc_tx(struct pci_vtsock_softc *sc,
 	struct virtio_sock_hdr hdr;
 	int iovec_len;
 	size_t pulled;
 
 	iovec_len = vq_getchain(vq, &idx, iov, VTSOCK_MAXSEGS, flags);
+	if (iovec_len < 0) {
+		fprintf(stderr, "TX: failed to get chain at idx %"PRIx16"\n", idx);
+		return;
+	}
+
 	assert(iovec_len <= VTSOCK_MAXSEGS);
 
 	DPRINTF(("TX: chain with %d buffers at idx %"PRIx16"\n",
 		 iovec_len, idx));
 	dprint_chain(iov, iovec_len, "TX");

Fixed code: 	if (iovec_len < 0) {
		fprintf(stderr, "TX: failed to get chain at idx %"PRIx16"\n", idx);
		return;
	}
CVE-2021-32847: Out-of-bounds Read (CWE-125)
value: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior, a malicious guest can trigger a vulnerability in the host by abusing the disk driver that may lead to the disclosure of the host memory into the virtualized guest. This issue is fixed in commit cf60095a4d8c3cb2e182a14415467afd356e982f.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2023-02-20T17:15Z
Repository: https://github.com/moby/hyperkit
Language: C
Files changed: src/lib/pci_virtio_block.c
Commit date: 2021-09-14 18:35:55 +0200
Commit message: Fix assertion turned into assignment

The qassertion is supposed to check the value but the typo makes it
an assignment. Hence it is always true,

Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>

Diff: diff --git a/src/lib/pci_virtio_block.c b/src/lib/pci_virtio_block.c
index d2145ac6..1118e628 100644
--- a/src/lib/pci_virtio_block.c
+++ b/src/lib/pci_virtio_block.c
@@ -314,11 +314,11 @@ pci_vtblk_proc(struct pci_vtblk_softc *sc, struct vqueue_info *vq)
 		err = blockif_write(sc->bc, &io->io_req);
 		break;
 	case VBH_OP_DISCARD:
 		/* We currently limit the discard to one segment in the initial negotiation
 		   so expect exactly one correctly-sized payload descriptor. */
-		assert(iov[1].iov_len = sizeof(struct virtio_blk_discard_write_zeroes));
+		assert(iov[1].iov_len == sizeof(struct virtio_blk_discard_write_zeroes));
 		assert(n == 2);
 		vbdiscard = iov[1].iov_base;
 		io->io_req.br_offset = (off_t) vbdiscard->sector * DEV_BSIZE;
 		io->io_req.br_resid = vbdiscard->num_sectors * DEV_BSIZE;
 		err = blockif_delete(sc->bc, &io->io_req);

Vulnerable code: 		assert(iov[1].iov_len = sizeof(struct virtio_blk_discard_write_zeroes));
Fixed code: 		assert(iov[1].iov_len == sizeof(struct virtio_blk_discard_write_zeroes));
CVE-2021-37700: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-08-12T21:15Z
Repository: https://github.com/github/paste-markdown
Language: Unknown
Commit date: 2021-08-12 13:24:46 +0100
Commit message: Merge pull request from GHSA-gpfj-4j6g-c4w9

Fix Clipboard-based DOM XSS
CVE-2020-12066: Improper Input Validation (CWE-20)
value: CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2020-04-22T17:15Z
Repository: https://github.com/teeworlds/teeworlds
Language: C++
Files changed: src/engine/server/server.cpp
Commit date: 2020-04-10 18:58:44 +0200
Commit message: changed a check

Diff: diff --git a/src/engine/server/server.cpp b/src/engine/server/server.cpp
index e3ac6cb2..f01f7cc6 100644
--- a/src/engine/server/server.cpp
+++ b/src/engine/server/server.cpp
@@ -494,12 +494,12 @@ int CServer::SendMsg(CMsgPacker *pMsg, int Flags, int ClientID)
 {
 	CNetChunk Packet;
 	if(!pMsg)
 		return -1;
 
-	// drop packet to dummy client
-	if(0 <= ClientID && ClientID < MAX_CLIENTS && GameServer()->IsClientBot(ClientID))
+	// drop invalid packet
+	if(ClientID != -1 && (ClientID < 0 || ClientID >= MAX_CLIENTS || m_aClients[ClientID].m_State == CClient::STATE_EMPTY || m_aClients[ClientID].m_Quitting))
 		return 0;
 
 	mem_zero(&Packet, sizeof(CNetChunk));
 	Packet.m_ClientID = ClientID;
 	Packet.m_pData = pMsg->Data();

Vulnerable code: 	// drop packet to dummy client
	if(0 <= ClientID && ClientID < MAX_CLIENTS && GameServer()->IsClientBot(ClientID))
Fixed code: 	// drop invalid packet
	if(ClientID != -1 && (ClientID < 0 || ClientID >= MAX_CLIENTS || m_aClients[ClientID].m_State == CClient::STATE_EMPTY || m_aClients[ClientID].m_Quitting))
CVE-2022-21164: Insufficient Information (NVD-CWE-noinfo)
value: The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-03-16T16:15Z
Repository: https://github.com/Venemo/node-lmdb
Language: C++
Files changed: src/txn.cpp
Commit date: 2022-03-12 07:24:20 -0700
Commit message: Perform argument check for putString

Diff: diff --git a/src/txn.cpp b/src/txn.cpp
index 081f4d9..59acdff 100644
--- a/src/txn.cpp
+++ b/src/txn.cpp
@@ -293,10 +293,12 @@ Nan::NAN_METHOD_RETURN_TYPE TxnWrap::putCommon(Nan::NAN_METHOD_ARGS_TYPE info, v
         return throwLmdbError(rc);
     }
 }
 
 NAN_METHOD(TxnWrap::putString) {
+    if (!info[2]->IsString())
+        return Nan::ThrowError("Value must be a string.");
     return putCommon(info, [](Nan::NAN_METHOD_ARGS_TYPE info, MDB_val &data) -> void {
         CustomExternalStringResource::writeTo(Local<String>::Cast(info[2]), &data);
     }, [](MDB_val &data) -> void {
         delete[] (uint16_t*)data.mv_data;
     });

Fixed code:     if (!info[2]->IsString())
        return Nan::ThrowError("Value must be a string.");
CVE-2023-49297: Deserialization of Untrusted Data (CWE-502)
value: PyDrive2 is a wrapper library of google-api-python-client that simplifies many common Google Drive API V2 tasks. Unsafe YAML deserilization will result in arbitrary code execution. A maliciously crafted YAML file can cause arbitrary code execution if PyDrive2 is run in the same directory as it, or if it is loaded in via `LoadSettingsFile`. This is a deserilization attack that will affect any user who initializes GoogleAuth from this package while a malicious yaml file is present in the same directory. This vulnerability does not require the file to be directly loaded through the code, only present. This issue has been addressed in commit `c57355dc` which is included in release version `1.16.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.8
Published: 2023-12-05T21:15Z
Repository: https://github.com/iterative/PyDrive2
Language: Python
Files changed: pydrive2/settings.py
Commit date: 2023-11-28 17:05:14 +0200
Commit message: Merge pull request from GHSA-v5f6-hjmf-9mc5


Diff: diff --git a/pydrive2/settings.py b/pydrive2/settings.py
index 15ff567..a7d1230 100644
--- a/pydrive2/settings.py
+++ b/pydrive2/settings.py
@@ -1,12 +1,12 @@
 from yaml import load
 from yaml import YAMLError
 
 try:
-    from yaml import CLoader as Loader
+    from yaml import CSafeLoader as SafeLoader
 except ImportError:
-    from yaml import Loader
+    from yaml import SafeLoader
 
 SETTINGS_FILE = "settings.yaml"
 SETTINGS_STRUCT = {
     "client_config_backend": {
         "type": str,
@@ -112,11 +112,11 @@ def LoadSettingsFile(filename=SETTINGS_FILE):
     :type filename: str.
     :raises: SettingsError
     """
     try:
         with open(filename) as stream:
-            data = load(stream, Loader=Loader)
+            data = load(stream, Loader=SafeLoader)
     except (YAMLError, OSError) as e:
         raise SettingsError(e)
     return data
 
 

Vulnerable code:     from yaml import CLoader as Loader
    from yaml import Loader
            data = load(stream, Loader=Loader)
Fixed code:     from yaml import CSafeLoader as SafeLoader
    from yaml import SafeLoader
            data = load(stream, Loader=SafeLoader)
CVE-2019-9199: NULL Pointer Dereference (CWE-476)
value: PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 8.8
Published: 2019-02-26T23:29Z
Repository: https://github.com/mksdev/podofo
Language: C++
Files changed: tools/podofoimpose/pdftranslator.cpp
Commit date: 2019-03-09 18:29:29 +0000
Commit message: Fixed CVE-2019-9199, issue #40 (raises PdfError with PageNotFound code on error)

The error is the page 0 (0-based) not being found, before this fix that led to
a null pointer dereference (method call on a null pointer, undefined behavior),
now just a PdfError exception is raised.


git-svn-id: http://svn.code.sf.net/p/podofo/code/podofo/trunk@1971 e6e4d1b7-ffb3-4f57-9d89-6d52b3892af5

Diff: diff --git a/tools/podofoimpose/pdftranslator.cpp b/tools/podofoimpose/pdftranslator.cpp
index 835d18f..cce4843 100644
--- a/tools/podofoimpose/pdftranslator.cpp
+++ b/tools/podofoimpose/pdftranslator.cpp
@@ -146,11 +146,16 @@ namespace PoDoFo
 
 			pcount = sourceDoc->GetPageCount();
 // 	std::cerr << "Document has "<< pcount << " page(s) " << endl;
 			if ( pcount > 0 ) // only here to avoid possible segfault, but PDF without page is not conform IIRC
 			{
-				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );
+                PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
+                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
+                {
+                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
+                }
+                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
 				// keep in mind it’s just a hint since PDF can have different page sizes in a same doc
 				sourceWidth =  rect.GetWidth() - rect.GetLeft();
 				sourceHeight =  rect.GetHeight() - rect.GetBottom() ;
 			}
 		}

Vulnerable code: 				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );
Fixed code:                 PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
                {
                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
                }
                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
CVE-2023-2972: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2023-05-30T11:15Z
Repository: https://github.com/antfu/utils
Language: TypeScript
Files changed: src/object.test.ts, src/object.ts
Commit date: 2023-05-30 11:22:40 +0200
Commit message: fix(deepMerge): prototype pollution

Diff: diff --git a/src/object.test.ts b/src/object.test.ts
index 7cc6968..de532fe 100644
--- a/src/object.test.ts
+++ b/src/object.test.ts
@@ -49,6 +49,18 @@ describe('deepMerge', () => {
   it('should not merge array values, just override', () => {
     const obj1 = { a: ['A', 'B'] }
     const obj2 = { a: ['C'], b: ['D'] }
     expect(deepMerge({}, obj1, obj2)).toEqual({ a: ['C'], b: ['D'] })
   })
+
+  it('prototype pollution 1', () => {
+    const obj = {} as any
+    const obj2 = {} as any
+    const payload = JSON.parse('{"__proto__":{"polluted":"Polluted!"}}')
+
+    expect(obj.polluted).toBeUndefined()
+    expect(obj2.polluted).toBeUndefined()
+    deepMerge(obj, payload)
+    expect(obj.polluted).toBeUndefined()
+    expect(obj2.polluted).toBeUndefined()
+  })
 })
diff --git a/src/object.ts b/src/object.ts
index 71c4313..089e0e1 100644
--- a/src/object.ts
+++ b/src/object.ts
@@ -80,10 +80,13 @@ export function deepMerge<T extends object = object, S extends object = T>(targe
   if (source === undefined)
     return target as any
 
   if (isMergableObject(target) && isMergableObject(source)) {
     objectKeys(source).forEach((key) => {
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+        return
+
       // @ts-expect-error
       if (isMergableObject(source[key])) {
         // @ts-expect-error
         if (!target[key])
           // @ts-expect-error

Fixed code: 
  it('prototype pollution 1', () => {
    const obj = {} as any
    const obj2 = {} as any
    const payload = JSON.parse('{"__proto__":{"polluted":"Polluted!"}}')

    expect(obj.polluted).toBeUndefined()
    expect(obj2.polluted).toBeUndefined()
    deepMerge(obj, payload)
    expect(obj.polluted).toBeUndefined()
    expect(obj2.polluted).toBeUndefined()
  })
      if (key === '__proto__' || key === 'constructor' || key === 'prototype')
        return