Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-25924: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the post_backup_script field.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2021-04-01T18:15Z
Repository: https://github.com/gocd/gocd
Language: Java
Files changed: api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
Commit date: 2021-02-19 10:46:02 +0000
Commit message: #000 - Add missing Content-Type check

Diff: diff --git a/api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java b/api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
index e0f509a7cb..27b6c38f24 100644
--- a/api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
+++ b/api/api-backup-config-v1/src/main/java/com/thoughtworks/go/apiv1/backupconfig/BackupConfigControllerV1.java
@@ -63,11 +63,13 @@ public class BackupConfigControllerV1 extends ApiController implements SparkSpri
 
     @Override
     public void setupRoutes() {
         path(controllerBasePath(), () -> {
             before("", mimeType, this::setContentType);
-
+            before("/*", mimeType, this::setContentType);
+            before("", mimeType, this::verifyContentType);
+            before("/*", mimeType, this::verifyContentType);
 
             // change the line below to enable appropriate security
             before("", mimeType, this.apiAuthenticationHelper::checkAdminUserAnd403);
 
             get("", mimeType, this::show);

Fixed code:             before("/*", mimeType, this::setContentType);
            before("", mimeType, this::verifyContentType);
            before("/*", mimeType, this::verifyContentType);
CVE-2020-4072: Improper Output Neutralization for Logs (CWE-117)
value: In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.
CWE description: The product does not neutralize or incorrectly neutralizes output that is written to logs.
CVSS v3 base score: 5.3
Published: 2020-06-25T20:15Z
Repository: https://github.com/jhipster/jhipster-kotlin
Language: Other
Files changed: generators/server/templates/src/main/kotlin/package/web/rest/AccountResource.kt.ejs
Commit date: 2020-05-06 22:18:48 +0200
Commit message: prevent log forging when doing password reset init request

Diff: diff --git a/generators/server/templates/src/main/kotlin/package/web/rest/AccountResource.kt.ejs b/generators/server/templates/src/main/kotlin/package/web/rest/AccountResource.kt.ejs
index cd58f53..2864348 100644
--- a/generators/server/templates/src/main/kotlin/package/web/rest/AccountResource.kt.ejs
+++ b/generators/server/templates/src/main/kotlin/package/web/rest/AccountResource.kt.ejs
@@ -404,11 +404,11 @@ class AccountResource(
         if (user.isPresent()) {
             mailService.sendPasswordResetMail(user.get())
         } else {
             // Pretend the request has been successful to prevent checking which emails really exist
             // but log that an invalid attempt has been made
-            log.warn("Password reset requested for non existing mail '$mail'");
+            log.warn("Password reset requested for non existing mail");
         }
     }
     <%_ } else { _%>
     fun requestPasswordReset(@RequestBody mail: String): Mono<Void> =
         userService.requestPasswordReset(mail)
@@ -416,11 +416,11 @@ class AccountResource(
                 if (it != null)  {
                     mailService.sendPasswordResetMail(it)
                 } else {
                     // Pretend the request has been successful to prevent checking which emails really exist
                     // but log that an invalid attempt has been made
-                    log.warn("Password reset request for non existing email '$mail'")
+                    log.warn("Password reset request for non existing email")
                 }
             }.then()
     <%_ } _%>
 
     /**

Vulnerable code:             log.warn("Password reset requested for non existing mail '$mail'");
                    log.warn("Password reset request for non existing email '$mail'")
Fixed code:             log.warn("Password reset requested for non existing mail");
                    log.warn("Password reset request for non existing email")
CVE-2012-1836: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2012-03-22T03:28Z
Repository: https://github.com/inspircd/inspircd
Language: Unknown
Commit date: 2012-03-21 07:01:08 -0700
Commit message: Merge pull request #1 from nenolod/insp20

DNS resolver hardening (insp20 branch)
CVE-2012-6696: Improper Input Validation (CWE-20)
value: inspircd in Debian before 2.0.7 does not properly handle unsigned integers.  NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2017-09-25T21:29Z
Repository: https://github.com/inspircd/inspircd
Language: C++
Files changed: src/dns.cpp
Commit date: 2012-03-26 04:59:13 -0400
Commit message: Fixed out of bounds memory access from malformed DNS queries that have an invalid length label. Introduced in a6a07de0daa353bcd29056a4535a9c4784c113c8.

Diff: diff --git a/src/dns.cpp b/src/dns.cpp
index 2e1c751c4..be74e6aa3 100644
--- a/src/dns.cpp
+++ b/src/dns.cpp
@@ -758,11 +758,11 @@ DNSInfo DNSRequest::ResultIsReady(DNSHeader &header, unsigned length)
 					q = 1;
 				}
 				else i += header.payload[i] + 1; /* skip length and label */
 			}
 		}
-		if (length - i < 10)
+		if (static_cast<int>(length - i) < 10)
 			return std::make_pair((unsigned char*)NULL,"Incorrectly sized DNS reply");
 
 		/* XXX: We actually initialise 'rr' here including its ttl field */
 		DNS::FillResourceRecord(&rr,&header.payload[i]);
 

Vulnerable code: 		if (length - i < 10)
Fixed code: 		if (static_cast<int>(length - i) < 10)
CVE-2015-8702: Improper Input Validation (CWE-20)
value: The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.6
Published: 2016-04-12T14:59Z
Repository: https://github.com/inspircd/inspircd
Language: C++
Files changed: src/dns.cpp
Commit date: 2015-04-16 18:04:03 +0200
Commit message: Reject replies to DNS PTR requests that contain invalid characters

Fixes issue #1033 reported by @ping86

Diff: diff --git a/src/dns.cpp b/src/dns.cpp
index 75e5731fe..14305ccab 100644
--- a/src/dns.cpp
+++ b/src/dns.cpp
@@ -698,12 +698,20 @@ DNSResult DNS::GetResult()
 
 			case DNS_QUERY_CNAME:
 				/* Identical handling to PTR */
 
 			case DNS_QUERY_PTR:
+			{
 				/* Reverse lookups just come back as char* */
 				resultstr = std::string((const char*)data.first);
+				if (resultstr.find_first_not_of("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") != std::string::npos)
+				{
+					std::string ro = req->orig;
+					delete req;
+					return DNSResult(this_id | ERROR_MASK, "Invalid char(s) in reply", 0, ro);
+				}
+			}
 			break;
 
 			default:
 			break;
 		}

Fixed code: 			{
				if (resultstr.find_first_not_of("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") != std::string::npos)
				{
					std::string ro = req->orig;
					delete req;
					return DNSResult(this_id | ERROR_MASK, "Invalid char(s) in reply", 0, ro);
				}
			}
CVE-2016-7142: Permissions, Privileges, and Access Controls (CWE-264)
value: The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 5.9
Published: 2016-09-26T15:59Z
Repository: https://github.com/inspircd/inspircd
Language: C++
Files changed: src/modules/m_sasl.cpp
Commit date: 2016-09-03 10:51:21 -0400
Commit message: m_sasl: don't allow AUTHENTICATE with mechanisms with a space

Diff: diff --git a/src/modules/m_sasl.cpp b/src/modules/m_sasl.cpp
index 9cb5592d1f..16a15357f5 100644
--- a/src/modules/m_sasl.cpp
+++ b/src/modules/m_sasl.cpp
@@ -187,20 +187,24 @@ class CommandAuthenticate : public Command
 	GenericCap& cap;
 	CommandAuthenticate(Module* Creator, SimpleExtItem<SaslAuthenticator>& ext, GenericCap& Cap)
 		: Command(Creator, "AUTHENTICATE", 1), authExt(ext), cap(Cap)
 	{
 		works_before_reg = true;
+		allow_empty_last_param = false;
 	}
 
 	CmdResult Handle (const std::vector<std::string>& parameters, User *user)
 	{
 		/* Only allow AUTHENTICATE on unregistered clients */
 		if (user->registered != REG_ALL)
 		{
 			if (!cap.ext.get(user))
 				return CMD_FAILURE;
 
+			if (parameters[0].find(' ') != std::string::npos || parameters[0][0] == ':')
+				return CMD_FAILURE;
+
 			SaslAuthenticator *sasl = authExt.get(user);
 			if (!sasl)
 				authExt.set(user, new SaslAuthenticator(user, parameters[0]));
 			else if (sasl->SendClientMessage(parameters) == false)	// IAL abort extension --nenolod
 			{

Fixed code: 		allow_empty_last_param = false;
			if (parameters[0].find(' ') != std::string::npos || parameters[0][0] == ':')
				return CMD_FAILURE;
CVE-2019-20917: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2020-09-11T05:15Z
Repository: https://github.com/inspircd/inspircd
Language: C++
Files changed: src/modules/extra/m_mysql.cpp
Commit date: 2019-08-20 16:19:01 +0100
Commit message: Initialise and deallocate the MySQL library correctly.

Diff: diff --git a/src/modules/extra/m_mysql.cpp b/src/modules/extra/m_mysql.cpp
index c50d2abf5d..7b6e2906d3 100644
--- a/src/modules/extra/m_mysql.cpp
+++ b/src/modules/extra/m_mysql.cpp
@@ -410,10 +410,13 @@ ModuleSQL::ModuleSQL()
 	Dispatcher = NULL;
 }
 
 void ModuleSQL::init()
 {
+	if (mysql_library_init(0, NULL, NULL))
+		throw ModuleException("Unable to initialise the MySQL library!");
+
 	Dispatcher = new DispatcherThread(this);
 	ServerInstance->Threads.Start(Dispatcher);
 }
 
 ModuleSQL::~ModuleSQL()
@@ -422,14 +425,17 @@ ModuleSQL::~ModuleSQL()
 	{
 		Dispatcher->join();
 		Dispatcher->OnNotify();
 		delete Dispatcher;
 	}
+
 	for(ConnMap::iterator i = connections.begin(); i != connections.end(); i++)
 	{
 		delete i->second;
 	}
+
+	mysql_library_end();
 }
 
 void ModuleSQL::ReadConfig(ConfigStatus& status)
 {
 	ConnMap conns;

Fixed code: 	if (mysql_library_init(0, NULL, NULL))
		throw ModuleException("Unable to initialise the MySQL library!");



	mysql_library_end();
CVE-2019-20918: Use After Free (CWE-416)
value: An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crashing of an InspIRCd server by any user able to fully connect to a server.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 6.5
Published: 2020-09-11T05:15Z
Repository: https://github.com/inspircd/inspircd
Language: C++
Files changed: src/modules/m_silence.cpp
Commit date: 2019-05-17 09:50:54 +0100
Commit message: Copy the silence flags when sending update notifications.

This fixes a crash bug in the silence module on some versions of GCC.

Diff: diff --git a/src/modules/m_silence.cpp b/src/modules/m_silence.cpp
index 01f99ce7ee..87b70dfa46 100644
--- a/src/modules/m_silence.cpp
+++ b/src/modules/m_silence.cpp
@@ -185,11 +185,11 @@ class SilenceMessage : public ClientProtocol::Message
  public:
 	SilenceMessage(const std::string& mask, const std::string& flags)
 		: ClientProtocol::Message("SILENCE")
 	{
 		PushParam(mask);
-		PushParamRef(flags);
+		PushParam(flags);
 	}
 };
 
 class CommandSilence : public SplitCommand
 {

Vulnerable code: 		PushParamRef(flags);
Fixed code: 		PushParam(flags);
CVE-2021-33586: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 4.3
Published: 2021-05-27T05:15Z
Repository: https://github.com/inspircd/inspircd
Language: C++
Files changed: include/clientprotocolmsg.h, src/coremods/core_user/core_user.cpp
Commit date: 2021-05-14 13:56:32 +0100
Commit message: Fix sending malformed pong messages in some cases.

Diff: diff --git a/include/clientprotocolmsg.h b/include/clientprotocolmsg.h
index 53122cff99..144af9e44e 100644
--- a/include/clientprotocolmsg.h
+++ b/include/clientprotocolmsg.h
@@ -666,13 +666,14 @@ struct ClientProtocol::Messages::Pong : public ClientProtocol::Message
 	 * @param server Pinged server. Must remain valid as long as this object is alive if non-empty.
 	 */
 	Pong(const std::string& cookie, const std::string& server = "")
 		: ClientProtocol::Message("PONG", ServerInstance->Config->GetServerName())
 	{
-		PushParamRef(ServerInstance->Config->GetServerName());
-		if (!server.empty())
-			PushParamRef(server);
+		if (server.empty())
+			PushParamRef(ServerInstance->Config->GetServerName());
+		else
+			PushParam(server);
 		PushParamRef(cookie);
 	}
 };
 
 /** ERROR message.
diff --git a/src/coremods/core_user/core_user.cpp b/src/coremods/core_user/core_user.cpp
index 2431215f3c..622e82c758 100644
--- a/src/coremods/core_user/core_user.cpp
+++ b/src/coremods/core_user/core_user.cpp
@@ -81,11 +81,11 @@ class CommandPing : public SplitCommand
 		{
 			user->WriteNumeric(ERR_NOORIGIN, "No origin specified");
 			return CMD_FAILURE;
 		}
 
-		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : "");
+		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : ServerInstance->Config->GetServerName());
 		user->Send(ServerInstance->GetRFCEvents().pong, pong);
 		return CMD_SUCCESS;
 	}
 };
 

Vulnerable code: 		PushParamRef(ServerInstance->Config->GetServerName());
		if (!server.empty())
			PushParamRef(server);
		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : "");
Fixed code: 		if (server.empty())
			PushParamRef(ServerInstance->Config->GetServerName());
		else
			PushParam(server);
		ClientProtocol::Messages::Pong pong(parameters[0], origin ? parameters[1] : ServerInstance->Config->GetServerName());
CVE-2019-3877: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-03-27T13:29Z
Repository: https://github.com/Uninett/mod_auth_mellon
Language: C
Files changed: auth_mellon_util.c
Commit date: 2019-03-20 08:29:16 +0100
Commit message: Fix redirect URL validation bypass

It turns out that browsers silently convert backslash characters into
forward slashes, while apr_uri_parse() does not.

This mismatch allows an attacker to bypass the redirect URL validation
by using an URL like:

  https://sp.example.org/mellon/logout?ReturnTo=https:%5c%5cmalicious.example.org/

mod_auth_mellon will assume that it is a relative URL and allow the
request to pass through, while the browsers will use it as an absolute
url and redirect to https://malicious.example.org/ .

This patch fixes this issue by rejecting all redirect URLs with
backslashes.

Diff: diff --git a/auth_mellon_util.c b/auth_mellon_util.c
index 0fab309..fd442f9 100644
--- a/auth_mellon_util.c
+++ b/auth_mellon_util.c
@@ -925,10 +925,17 @@ int am_check_url(request_rec *r, const char *url)
             /* Deny all control-characters. */
             AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
                           "Control character detected in URL.");
             return HTTP_BAD_REQUEST;
         }
+        if (*i == '\\') {
+            /* Reject backslash character, as it can be used to bypass
+             * redirect URL validation. */
+            AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
+                          "Backslash character detected in URL.");
+            return HTTP_BAD_REQUEST;
+        }
     }
 
     return OK;
 }
 

Fixed code:         if (*i == '\\') {
            /* Reject backslash character, as it can be used to bypass
             * redirect URL validation. */
            AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
                          "Backslash character detected in URL.");
            return HTTP_BAD_REQUEST;
        }
CVE-2024-4128: Insufficient Information (NVD-CWE-noinfo)
value: This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0 

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-02T14:15Z
Repository: https://github.com/firebase/firebase-tools
Language: TypeScript
Files changed: src/emulator/hub.ts
Commit date: 2024-04-02 21:03:58 +0000
Commit message: Block web browser requests to export endpoint (#6944)

* Block web  browser requests to export endpoint

* Update src/emulator/hub.ts

Co-authored-by: Yuchen Shi <yuchenshi@google.com>

---------

Co-authored-by: Yuchen Shi <yuchenshi@google.com>
Diff: diff --git a/src/emulator/hub.ts b/src/emulator/hub.ts
index 77b97f67..136dfaac 100644
--- a/src/emulator/hub.ts
+++ b/src/emulator/hub.ts
@@ -96,10 +96,15 @@ export class EmulatorHub extends ExpressBasedEmulator {
       }
       res.json(body);
     });
 
     app.post(EmulatorHub.PATH_EXPORT, async (req, res) => {
+      if (req.headers.origin) {
+        res.status(403).json({
+          message: `Export cannot be triggered by external callers.`,
+        });
+      }
       const path: string = req.body.path;
       const initiatedBy: string = req.body.initiatedBy || "unknown";
       utils.logLabeledBullet("emulators", `Received export request. Exporting data to ${path}.`);
       try {
         await new HubExport(this.args.projectId, {

Fixed code:       if (req.headers.origin) {
        res.status(403).json({
          message: `Export cannot be triggered by external callers.`,
        });
      }
CVE-2015-2745: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-08-08T00:59Z
Repository: https://github.com/mozilla-b2g/gaia
Language: Unknown
Commit date: 2014-11-26 10:27:46 -0800
Commit message: Merge pull request #26459 from KevinGrandon/bug_1101158_use_tagged_template

Bug 1101158 - Use shared tagged template library for escaping card content
CVE-2016-4478: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2016-06-13T19:59Z
Repository: https://github.com/atheme/atheme
Language: C
Files changed: modules/transport/xmlrpc/xmlrpclib.c
Commit date: 2016-03-06 17:04:59 +0100
Commit message: Do not copy more bytes than were allocated

Diff: diff --git a/modules/transport/xmlrpc/xmlrpclib.c b/modules/transport/xmlrpc/xmlrpclib.c
index b67d21523..5fcde9e47 100644
--- a/modules/transport/xmlrpc/xmlrpclib.c
+++ b/modules/transport/xmlrpc/xmlrpclib.c
@@ -775,12 +775,13 @@ void xmlrpc_char_encode(char *outbuffer, const char *s1)
 		else
 		{
 			s->append_char(s, c);
 		}
 	}
+	s->append_char(s, 0);
 
-	memcpy(outbuffer, s->str, XMLRPC_BUFSIZE);
+	strncpy(outbuffer, s->str, XMLRPC_BUFSIZE);
 }
 
 static void xmlrpc_append_char_encode(mowgli_string_t *s, const char *s1)
 {
 	long unsigned int i;

Vulnerable code: 	memcpy(outbuffer, s->str, XMLRPC_BUFSIZE);
Fixed code: 	s->append_char(s, 0);
	strncpy(outbuffer, s->str, XMLRPC_BUFSIZE);
CVE-2022-1708: Allocation of Resources Without Limits or Throttling (CWE-770)
value: A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2022-06-07T18:15Z
Repository: https://github.com/cri-o/cri-o
Language: Unknown
Commit date: 2022-06-06 13:54:06 -0400
Commit message: Merge pull request from GHSA-fcm2-6c3h-pg6j

oci: add support for capping memory and disk usage from exec sync output
CVE-2014-0749: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-05-16T14:55Z
Repository: https://github.com/adaptivecomputing/torque
Language: C
Files changed: src/lib/Libdis/disrsi_.c
Commit date: 2013-08-23 15:53:09 -0600
Commit message: Merge pull request #171 into 2.5-fixes.

Diff: diff --git a/src/lib/Libdis/disrsi_.c b/src/lib/Libdis/disrsi_.c
index 69edd280..154514c2 100644
--- a/src/lib/Libdis/disrsi_.c
+++ b/src/lib/Libdis/disrsi_.c
@@ -110,10 +110,19 @@ int disrsi_(
 
   memset(scratch, 0, DIS_BUFSIZ+1);
   if (dis_umaxd == 0)
     disiui_();
 
+  if (count >= dis_umaxd)
+    {
+    if (count > dis_umaxd)
+      goto overflow;
+
+    if (memcmp(scratch, dis_umax, dis_umaxd) > 0)
+      goto overflow;
+    }
+
   switch (c = (*dis_getc)(stream))
     {
 
     case '-':
 

Fixed code:   if (count >= dis_umaxd)
    {
    if (count > dis_umaxd)
      goto overflow;

    if (memcmp(scratch, dis_umax, dis_umaxd) > 0)
      goto overflow;
    }
CVE-2023-5838: Insufficient Session Expiration (CWE-613)
value: Insufficient Session Expiration in GitHub repository linkstackorg/linkstack prior to v4.2.9.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2023-10-29T01:15Z
Repository: https://github.com/linkstackorg/linkstack
Language: PHP
Files changed: app/Http/Controllers/UserController.php
Commit date: 2023-09-29 15:37:08 +0200
Commit message: Session now expires after password change

Diff: diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php
index 26015cc..8fd0bad 100755
--- a/app/Http/Controllers/UserController.php
+++ b/app/Http/Controllers/UserController.php
@@ -928,10 +928,11 @@ class UserController extends Controller
             User::where('id', $userId)->update(['name' => $name]);
         } elseif ($request->email != '') {
             User::where('id', $userId)->update(['email' => $email]);
         } elseif ($request->password != '') {
             User::where('id', $userId)->update(['password' => $password]);
+            Auth::logout();
         }
         return back();
     }
 
     //Show user theme credit page

Fixed code:             Auth::logout();
CVE-2023-5840: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 8.8
Published: 2023-10-29T01:15Z
Repository: https://github.com/linkstackorg/linkstack
Language: PHP
Files changed: app/Http/Kernel.php
Commit date: 2023-09-29 15:23:43 +0200
Commit message: Now only allowing Trusted Hosts

Diff: diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 3b859f5..083e761 100755
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -12,11 +12,11 @@ class Kernel extends HttpKernel
      * These middleware are run during every request to your application.
      *
      * @var array
      */
     protected $middleware = [
-        // \App\Http\Middleware\TrustHosts::class,
+        \App\Http\Middleware\TrustHosts::class,
         \App\Http\Middleware\TrustProxies::class,
         \Illuminate\Http\Middleware\HandleCors::class,
         \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,

Vulnerable code:         // \App\Http\Middleware\TrustHosts::class,
Fixed code:         \App\Http\Middleware\TrustHosts::class,
CVE-2022-25643: Exposure of Resource to Wrong Sphere (CWE-668)
value: seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 9.8
Published: 2022-02-24T15:15Z
Repository: https://github.com/kennylevinsen/seatd
Language: C
Files changed: seatd-launch/seatd-launch.c
Commit date: 2022-02-21 12:02:31 +0100
Commit message: seatd-launch: Remove socket path command line arg

This should not need to be configured, so remove the argument. If
downstream prefers a different folder, the location can be made
compile-time configurable like for seatd itself.

Diff: diff --git a/seatd-launch/seatd-launch.c b/seatd-launch/seatd-launch.c
index 0075efb..4f15616 100644
--- a/seatd-launch/seatd-launch.c
+++ b/seatd-launch/seatd-launch.c
@@ -13,22 +13,17 @@
 int main(int argc, char *argv[]) {
 	(void)argc;
 
 	const char *usage = "Usage: seatd-launch [options] [--] command\n"
 			    "\n"
-			    "  -h		Show this help message\n"
-			    "  -s <path>	Where to create the seatd socket\n"
-			    "  -v		Show the version number\n"
+			    "  -h	Show this help message\n"
+			    "  -v	Show the version number\n"
 			    "\n";
 
 	int c;
-	char *sockpath = NULL;
-	while ((c = getopt(argc, argv, "vhs:")) != -1) {
+	while ((c = getopt(argc, argv, "vh")) != -1) {
 		switch (c) {
-		case 's':
-			sockpath = optarg;
-			break;
 		case 'v':
 			printf("seatd-launch version %s\n", SEATD_VERSION);
 			return 0;
 		case 'h':
 			printf("%s", usage);
@@ -45,15 +40,12 @@ int main(int argc, char *argv[]) {
 		fprintf(stderr, "A command must be specified\n\n%s", usage);
 		return 1;
 	}
 	char **command = &argv[optind];
 
-	char sockbuf[256];
-	if (sockpath == NULL) {
-		sprintf(sockbuf, "/tmp/seatd.%d.sock", getpid());
-		sockpath = sockbuf;
-	}
+	char sockpath[256];
+	sprintf(sockpath, "/tmp/seatd.%d.sock", getpid());
 
 	int fds[2];
 	if (pipe(fds) == -1) {
 		perror("Could not create pipe");
 		goto error;

Vulnerable code: 			    "  -h		Show this help message\n"
			    "  -s <path>	Where to create the seatd socket\n"
			    "  -v		Show the version number\n"
	char *sockpath = NULL;
	while ((c = getopt(argc, argv, "vhs:")) != -1) {
		case 's':
			sockpath = optarg;
			break;
	char sockbuf[256];
	if (sockpath == NULL) {
		sprintf(sockbuf, "/tmp/seatd.%d.sock", getpid());
		sockpath = sockbuf;
	}
Fixed code: 			    "  -h	Show this help message\n"
			    "  -v	Show the version number\n"
	while ((c = getopt(argc, argv, "vh")) != -1) {
	char sockpath[256];
	sprintf(sockpath, "/tmp/seatd.%d.sock", getpid());
CVE-2013-3524: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2013-05-10T21:55Z
Repository: https://github.com/DavidJClark/phpVMS-PopUpNews
Language: PHP
Files changed: core/modules/PopUpNews/PopUpNews.php
Commit date: 2013-04-16 12:14:35 -0400
Commit message: Update to controller

Diff: diff --git a/core/modules/PopUpNews/PopUpNews.php b/core/modules/PopUpNews/PopUpNews.php
index 241306d..a9f64d1 100644
--- a/core/modules/PopUpNews/PopUpNews.php
+++ b/core/modules/PopUpNews/PopUpNews.php
@@ -11,20 +11,22 @@
 
 class PopUpNews extends CodonModule
 {
     public function popupnewsitem($id) {
 
+                $id = intval($id);
                 if(!is_numeric($id)){header('Location: '.url('/'));}
         
                 $result = PopUpNewsData::popupnewsitem($id);
                 Template::Set('item', $result);
                 Template::Show('popupnews/popupnews_item.tpl');
         }
     
 
     public function PopUpNewsList($howmany = 5)
     {
+        $howmany = intval($howmany);
         if(!is_numeric($howmany)){exit;}
         
         $res = PopUpNewsData::get_news_list($howmany);
 
         if(!$res)

Fixed code:                 $id = intval($id);
        $howmany = intval($howmany);
CVE-2023-50727: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /"><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-12-22T21:15Z
Repository: https://github.com/resque/resque
Language: Ruby
Files changed: lib/resque/server/views/queues.erb
Commit date: 2023-03-07 20:56:39 -0500
Commit message: Fix reflected XSS in queue

Diff: diff --git a/lib/resque/server/views/queues.erb b/lib/resque/server/views/queues.erb
index 9b6c720a..1881b968 100644
--- a/lib/resque/server/views/queues.erb
+++ b/lib/resque/server/views/queues.erb
@@ -1,11 +1,11 @@
 <% @subtabs = resque.queues unless partial? || params[:id].nil? %>
 
 <% if current_queue = params[:id] %>
 
   <h1>Pending jobs on <span class='hl'><%= h escape_html(current_queue) %></span></h1>
-  <form method="POST" action="<%=u "/queues/#{current_queue}/remove" %>" class='remove-queue'>
+  <form method="POST" action="<%=u "/queues/#{escape_html(current_queue)}/remove" %>" class='remove-queue'>
     <input type='submit' name='' value='Remove Queue' class="confirmSubmission" />
   </form>
   <p class='sub'><%= page_entries_info start = params[:start].to_i, start + 19, size = resque.size(current_queue), 'job' %></p>
   <table class='jobs'>
     <tr>

Vulnerable code:   <form method="POST" action="<%=u "/queues/#{current_queue}/remove" %>" class='remove-queue'>
Fixed code:   <form method="POST" action="<%=u "/queues/#{escape_html(current_queue)}/remove" %>" class='remove-queue'>
CVE-2023-49062: Improper Initialization (CWE-665)
value: Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content of kernel memory in that field of IP header. The issue affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f
CWE description: The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CVSS v3 base score: 7.5
Published: 2023-11-28T16:15Z
Repository: https://github.com/facebookincubator/katran
Language: C
Files changed: katran/lib/bpf/encap_helpers.h, katran/lib/bpf/handle_icmp.h
Commit date: 2023-11-15 14:43:42 -0800
Commit message: initialize all iphdr/icmphdr fields when generating iphdr/icmphdr

Summary: as per title

Reviewed By: avasylev

Differential Revision: D51366550

fbshipit-source-id: 3a5ccf0ba21c2f53c4f336cd6df72c64d62b9cc7

Diff: diff --git a/katran/lib/bpf/encap_helpers.h b/katran/lib/bpf/encap_helpers.h
index 16e88a65..f79c4a77 100644
--- a/katran/lib/bpf/encap_helpers.h
+++ b/katran/lib/bpf/encap_helpers.h
@@ -46,10 +46,11 @@ __attribute__((__always_inline__)) static inline void create_v4_hdr(
   iph->tos = tos;
 #else
   iph->tos = DEFAULT_TOS;
 #endif
   iph->tot_len = bpf_htons(pkt_bytes + sizeof(struct iphdr));
+  iph->id = 0;
   iph->daddr = daddr;
   iph->saddr = saddr;
   iph->ttl = DEFAULT_TTL;
   ipv4_csum_inline(iph, &csum);
   iph->check = csum;
diff --git a/katran/lib/bpf/handle_icmp.h b/katran/lib/bpf/handle_icmp.h
index c2ef8071..7fe6dd47 100644
--- a/katran/lib/bpf/handle_icmp.h
+++ b/katran/lib/bpf/handle_icmp.h
@@ -143,10 +143,11 @@ __attribute__((__always_inline__)) static inline int send_icmp4_too_big(
   off += sizeof(struct icmphdr);
   orig_iph = data + off;
   icmp_hdr->type = ICMP_DEST_UNREACH;
   icmp_hdr->code = ICMP_FRAG_NEEDED;
   icmp_hdr->un.frag.mtu = bpf_htons(MAX_PCKT_SIZE - sizeof(struct ethhdr));
+  icmp_hdr->un.frag.__unused = 0;
   icmp_hdr->checksum = 0;
   ipv4_csum(icmp_hdr, ICMP_TOOBIG_PAYLOAD_SIZE, &csum);
   icmp_hdr->checksum = csum;
   iph->ttl = DEFAULT_TTL;
   iph->daddr = orig_iph->saddr;
@@ -155,10 +156,11 @@ __attribute__((__always_inline__)) static inline int send_icmp4_too_big(
   iph->version = 4;
   iph->ihl = 5;
   iph->protocol = IPPROTO_ICMP;
   iph->tos = 0;
   iph->tot_len = bpf_htons(ICMP_TOOBIG_SIZE + headroom - sizeof(struct ethhdr));
+  iph->id = 0;
   iph->check = 0;
   csum = 0;
   ipv4_csum(iph, sizeof(struct iphdr), &csum);
   iph->check = csum;
   return XDP_TX;

Fixed code:   iph->id = 0;
  icmp_hdr->un.frag.__unused = 0;
  iph->id = 0;
CVE-2019-20172: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2019-12-31T03:15Z
Repository: https://github.com/SerenityOS/serenity
Language: C++
Files changed: Kernel/VM/MemoryManager.cpp
Commit date: 2019-12-31 00:24:35 +0100
Commit message: Kernel: User pointer validation should reject kernel-only addresses

We were happily allowing syscalls with pointers into kernel-only
regions (virtual address >= 0xc0000000).

This patch fixes that by only considering user regions in the current
process, and also double-checking the Region::is_user_accessible() flag
before approving an access.

Thanks to Fire30 for finding the bug! :^)

Diff: diff --git a/Kernel/VM/MemoryManager.cpp b/Kernel/VM/MemoryManager.cpp
index 8f44ddc25..d6afdf0b9 100644
--- a/Kernel/VM/MemoryManager.cpp
+++ b/Kernel/VM/MemoryManager.cpp
@@ -590,18 +590,18 @@ bool MemoryManager::validate_user_stack(const Process& process, VirtualAddress v
     return region && region->is_stack();
 }
 
 bool MemoryManager::validate_user_read(const Process& process, VirtualAddress vaddr) const
 {
-    auto* region = region_from_vaddr(process, vaddr);
-    return region && region->is_readable();
+    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
+    return region && region->is_user_accessible() && region->is_readable();
 }
 
 bool MemoryManager::validate_user_write(const Process& process, VirtualAddress vaddr) const
 {
-    auto* region = region_from_vaddr(process, vaddr);
-    return region && region->is_writable();
+    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
+    return region && region->is_user_accessible() && region->is_writable();
 }
 
 void MemoryManager::register_vmobject(VMObject& vmobject)
 {
     InterruptDisabler disabler;

Vulnerable code:     auto* region = region_from_vaddr(process, vaddr);
    return region && region->is_readable();
    auto* region = region_from_vaddr(process, vaddr);
    return region && region->is_writable();
Fixed code:     auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
    return region && region->is_user_accessible() && region->is_readable();
    auto* region = user_region_from_vaddr(const_cast<Process&>(process), vaddr);
    return region && region->is_user_accessible() && region->is_writable();
CVE-2021-27343: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/LibCrypto/ASN1/DER.h Crypto::der_decode_sequence() function. The attack vector is: Parsing RSA Key ASN.1.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2021-04-06T13:15Z
Repository: https://github.com/SerenityOS/serenity
Language: C++
Files changed: Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp
Commit date: 2021-02-14 13:30:10 +0100
Commit message: LibCrypto: Don't copy the prime test candidates

This was copying a bunch of bigints for no reason.

Diff: diff --git a/Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp b/Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp
index 2bc744570..ecccd2c60 100644
--- a/Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp
+++ b/Userland/Libraries/LibCrypto/NumberTheory/ModularFunctions.cpp
@@ -256,11 +256,11 @@ static bool MR_primality_test(UnsignedBigInteger n, const Vector<UnsignedBigInte
     if (r == 0) {
         // n - 1 is odd, so n was even. But there is only one even prime:
         return n == 2;
     }
 
-    for (auto a : tests) {
+    for (auto& a : tests) {
         // Technically: ASSERT(2 <= a && a <= n - 2)
         ASSERT(a < n);
         auto x = ModularPower(a, d, n);
         if (x == 1 || x == predecessor)
             continue;

Vulnerable code:     for (auto a : tests) {
Fixed code:     for (auto& a : tests) {
CVE-2021-28874: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2021-04-06T13:15Z
Repository: https://github.com/SerenityOS/serenity
Language: C++
Files changed: Userland/Libraries/LibTextCodec/Decoder.cpp
Commit date: 2021-03-15 16:08:12 +0100
Commit message: LibTextCodec: Make UTF16BEDecoder read only up to an even offset

Reading up to the end of the input string of odd length results in
an out-of-bounds read

Diff: diff --git a/Userland/Libraries/LibTextCodec/Decoder.cpp b/Userland/Libraries/LibTextCodec/Decoder.cpp
index 26fced6524..b075a81870 100644
--- a/Userland/Libraries/LibTextCodec/Decoder.cpp
+++ b/Userland/Libraries/LibTextCodec/Decoder.cpp
@@ -181,11 +181,12 @@ String UTF8Decoder::to_utf8(const StringView& input)
 }
 
 String UTF16BEDecoder::to_utf8(const StringView& input)
 {
     StringBuilder builder(input.length() / 2);
-    for (size_t i = 0; i < input.length(); i += 2) {
+    size_t utf16_length = input.length() - (input.length() % 2);
+    for (size_t i = 0; i < utf16_length; i += 2) {
         u16 code_point = (input[i] << 8) | input[i + 1];
         builder.append_code_point(code_point);
     }
     return builder.to_string();
 }

Vulnerable code:     for (size_t i = 0; i < input.length(); i += 2) {
Fixed code:     size_t utf16_length = input.length() - (input.length() % 2);
    for (size_t i = 0; i < utf16_length; i += 2) {
CVE-2022-39246: Improper Authentication (CWE-287)
value: matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others. This attack is possible due to the key forwarding strategy implemented in the matrix-android-sdk2 that is too permissive. Starting with version 1.5.1, the default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices. The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages). As a workaroubnd, current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.3
Published: 2022-09-28T20:15Z
Repository: https://github.com/matrix-org/matrix-android-sdk2
Language: Unknown
Commit date: 2022-09-28 18:09:06 +0200
Commit message: Merge branch 'release/1.5.1' into develop