Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2014-2527: Other (NVD-CWE-Other)
value: kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " (double quote) character in the directory name, a different vulnerability than CVE-2014-2528.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-08-26T14:55Z
Repository: https://bitbucket.org/jeromerobert/k4dirstat
Language: C++
Files changed: src/kcleanup.cpp
Commit date: 2014-03-15 16:54:34 +0100
Commit message: Properly escape %p and %n in cleaning actions

Diff: diff --git a/src/kcleanup.cpp b/src/kcleanup.cpp
index 1ef72af..eceaa9f 100644
--- a/src/kcleanup.cpp
+++ b/src/kcleanup.cpp
@@ -316,15 +316,14 @@ KCleanup::cleanTitle() const
 QString
 KCleanup::expandVariables( const KFileInfo *	item,
 			   const QString &	unexpanded ) const
 {
     QString expanded = unexpanded;
-
-    expanded.replace( QRegExp( "%p" ),
-		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
-    expanded.replace( QRegExp( "%n" ),
-		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );
+    QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
+    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
 
    // if ( KDE::versionMajor() >= 3 && KDE::versionMinor() >= 4 )
 	expanded.replace( QRegExp( "%t" ), "trash:/" );
     //else
 	//expanded.replace( QRegExp( "%t" ), KGlobalSettings::trashPath() );

Vulnerable code: 
    expanded.replace( QRegExp( "%p" ),
		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
    expanded.replace( QRegExp( "%n" ),
		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );
Fixed code:     QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
CVE-2014-2528: Other (NVD-CWE-Other)
value: kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-08-26T14:55Z
Repository: https://bitbucket.org/jeromerobert/k4dirstat
Language: C++
Files changed: src/kcleanup.cpp
Commit date: 2014-03-15 16:54:34 +0100
Commit message: Properly escape %p and %n in cleaning actions

Diff: diff --git a/src/kcleanup.cpp b/src/kcleanup.cpp
index 1ef72af..eceaa9f 100644
--- a/src/kcleanup.cpp
+++ b/src/kcleanup.cpp
@@ -316,15 +316,14 @@ KCleanup::cleanTitle() const
 QString
 KCleanup::expandVariables( const KFileInfo *	item,
 			   const QString &	unexpanded ) const
 {
     QString expanded = unexpanded;
-
-    expanded.replace( QRegExp( "%p" ),
-		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
-    expanded.replace( QRegExp( "%n" ),
-		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );
+    QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
+    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
+    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
 
    // if ( KDE::versionMajor() >= 3 && KDE::versionMinor() >= 4 )
 	expanded.replace( QRegExp( "%t" ), "trash:/" );
     //else
 	//expanded.replace( QRegExp( "%t" ), KGlobalSettings::trashPath() );

Vulnerable code: 
    expanded.replace( QRegExp( "%p" ),
		      "'" + QString::fromLocal8Bit( item->url() )  + "'" );
    expanded.replace( QRegExp( "%n" ),
		      "'" + QString::fromLocal8Bit( item->name() ) + "'" );
Fixed code:     QString url = QString::fromLocal8Bit( item->url() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%p" ), "'" + url + "'" );
    QString name = QString::fromLocal8Bit( item->name() ).replace("'", "'\\''");
    expanded.replace( QRegExp( "%n" ), "'" + name + "'" );
CVE-2018-1000884: Observable Discrepancy (CWE-203)
value: Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password reset codes, attacker is able to change administrator password. This attack appear to be exploitable via Unauthenticated network connectivity. This vulnerability appears to have been fixed in After commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- release version 0.9.8-19.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 9.8
Published: 2018-12-20T21:29Z
Repository: https://github.com/serghey-rodin/vesta
Language: PHP
Files changed: web/reset/index.php
Commit date: 2018-10-17 23:28:37 +0300
Commit message: Timing attack fix from security experts https://arcturussecurity.com

Diff: diff --git a/web/reset/index.php b/web/reset/index.php
index abde3c14..0d90d15d 100644
--- a/web/reset/index.php
+++ b/web/reset/index.php
@@ -46,11 +46,11 @@ if ((!empty($_POST['user'])) && (!empty($_POST['code'])) && (!empty($_POST['pass
         $cmd="/usr/bin/sudo /usr/local/vesta/bin/v-list-user";
         exec ($cmd." ".$v_user." json", $output, $return_var);
         if ( $return_var == 0 ) {
             $data = json_decode(implode('', $output), true);
             $rkey = $data[$user]['RKEY'];
-            if ($rkey == $_POST['code']) {
+            if (hash_equals($rkey, $POST[‘code’])) {
                 $v_password = tempnam("/tmp","vst");
                 $fp = fopen($v_password, "w");
                 fwrite($fp, $_POST['password']."\n");
                 fclose($fp);
                 $cmd="/usr/bin/sudo /usr/local/vesta/bin/v-change-user-password";

Vulnerable code:             if ($rkey == $_POST['code']) {
Fixed code:             if (hash_equals($rkey, $POST[‘code’])) {
CVE-2019-9841: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-04-19T19:29Z
Repository: https://github.com/serghey-rodin/vesta
Language: PHP
Files changed: web/file_manager/fm_api.php
Commit date: 2019-04-12 17:21:28 +0300
Commit message: setting content type to fix possible XSS attack vector

Diff: diff --git a/web/file_manager/fm_api.php b/web/file_manager/fm_api.php
index ac5faa3a2..cf4eef82a 100644
--- a/web/file_manager/fm_api.php
+++ b/web/file_manager/fm_api.php
@@ -1,10 +1,10 @@
 <?php
-
 // Init
 //error_reporting(NULL);
 
+header('Content-Type: application/json');
 
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 include($_SERVER['DOCUMENT_ROOT']."/file_manager/fm_core.php");
 
 

Fixed code: header('Content-Type: application/json');
CVE-2020-10966: Other (NVD-CWE-Other)
value: In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.5
Published: 2020-03-25T23:15Z
Repository: https://github.com/serghey-rodin/vesta
Language: PHP
Files changed: web/reset/index.php
Commit date: 2020-03-23 17:28:55 +0100
Commit message: Preventing manipulation with $_SERVER['HTTP_HOST']
Diff: diff --git a/web/reset/index.php b/web/reset/index.php
index 842dd2f3b..0b8670908 100644
--- a/web/reset/index.php
+++ b/web/reset/index.php
@@ -28,11 +28,11 @@ if ((!empty($_POST['user'])) && (empty($_POST['code']))) {
         if (!empty($fname)) {
             $mailtext = __('GREETINGS_GORDON_FREEMAN',$fname,$lname);
         } else {
             $mailtext = __('GREETINGS');
         }
-        $mailtext .= __('PASSWORD_RESET_REQUEST',$_SERVER['HTTP_HOST'],$user,$rkey,$_SERVER['HTTP_HOST'],$user,$rkey);
+        $mailtext .= __('PASSWORD_RESET_REQUEST',$hostname,$user,$rkey,$hostname,$user,$rkey);
         if (!empty($rkey)) send_email($to, $subject, $mailtext, $from);
         unset($output);
     }
 
     header("Location: /reset/?action=code&user=".$_POST['user']);

Vulnerable code:         $mailtext .= __('PASSWORD_RESET_REQUEST',$_SERVER['HTTP_HOST'],$user,$rkey,$_SERVER['HTTP_HOST'],$user,$rkey);
Fixed code:         $mailtext .= __('PASSWORD_RESET_REQUEST',$hostname,$user,$rkey,$hostname,$user,$rkey);
CVE-2021-46850: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 7.2
Published: 2022-10-24T14:15Z
Repository: https://github.com/serghey-rodin/vesta
Language: Other
Files changed: bin/v-activate-vesta-license
Commit date: 2021-07-26 16:41:04 +0300
Commit message: Checking licence format
Diff: diff --git a/bin/v-activate-vesta-license b/bin/v-activate-vesta-license
index 6d5c875ec..9c2967d9c 100755
--- a/bin/v-activate-vesta-license
+++ b/bin/v-activate-vesta-license
@@ -26,10 +26,11 @@ source $VESTA/conf/vesta.conf
 #----------------------------------------------------------#
 
 # Checking arg number
 check_args '2' "$#" 'MODULE LICENSE'
 
+is_user_format_valid "$license" "license"
 
 #----------------------------------------------------------#
 #                       Action                             #
 #----------------------------------------------------------#
 

Fixed code: is_user_format_valid "$license" "license"
CVE-2022-3967: Improper Neutralization (CWE-707)
value: A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 7.8
Published: 2022-11-13T08:15Z
Repository: https://github.com/serghey-rodin/vesta
Language: Shell
Files changed: func/main.sh
Commit date: 2022-07-18 13:06:39 +0300
Commit message: Fix for Sed Injection Vulnerability

Thanks to @hestiacp and @jaapmarcus for fix.
Diff: diff --git a/func/main.sh b/func/main.sh
index 4ec7e7f1c..6f848a220 100644
--- a/func/main.sh
+++ b/func/main.sh
@@ -829,18 +829,36 @@ is_format_valid_shell() {
         echo "Error: shell $1 is not valid"	
         log_event "$E_INVALID" "$EVENT"	
         exit $E_INVALID	
     fi	
 }
+
+format_no_quotes() {
+    exclude="['|\"]"
+    if [[ "$1" =~ $exclude ]]; then
+       check_result "$E_INVALID" "Invalid $2 contains qoutes (\" or ') :: $1"
+    fi
+    is_no_new_line_format "$1"
+}
+
+is_no_new_line_format() {
+    test=$(echo "$1" | head -n1 );
+    if [[ "$test" != "$1" ]]; then
+      check_result "$E_INVALID" "invalid value :: $1"
+    fi
+}
+
+
 # Format validation controller
 is_format_valid() {
     for arg_name in $*; do
         eval arg=\$$arg_name
         if [ !  -z "$arg" ]; then
             case $arg_name in
                 account)        is_user_format_valid "$arg" "$arg_name";;
                 action)         is_fw_action_format_valid "$arg";;
+                alias)          is_alias_format_valid "$arg" ;;
                 aliases)        is_alias_format_valid "$arg" ;;
                 antispam)       is_boolean_format_valid "$arg" 'antispam' ;;
                 antivirus)      is_boolean_format_valid "$arg" 'antivirus' ;;
                 autoreply)      is_autoreply_format_valid "$arg" ;;
                 backup)         is_object_format_valid "$arg" 'backup' ;;

Fixed code: 
format_no_quotes() {
    exclude="['|\"]"
    if [[ "$1" =~ $exclude ]]; then
       check_result "$E_INVALID" "Invalid $2 contains qoutes (\" or ') :: $1"
    fi
    is_no_new_line_format "$1"
}

is_no_new_line_format() {
    test=$(echo "$1" | head -n1 );
    if [[ "$test" != "$1" ]]; then
      check_result "$E_INVALID" "invalid value :: $1"
    fi
}


                alias)          is_alias_format_valid "$arg" ;;
CVE-2017-15111: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 5.5
Published: 2018-01-20T00:29Z
Repository: https://github.com/jdennis/keycloak-httpd-client-install
Language: Python
Files changed: keycloak_httpd_client/keycloak_cli.py
Commit date: 2018-01-09 16:42:19 -0500
Commit message: CVE-2017-15111 unsafe /tmp log file in --log-file option in keycloak_cli.py

keycloak_cli.py is essentially a set of utilities used by the
keycloak-httpd-client-install tool. It can be invoked on it's own,
mostly for testing or to execute just one part of the Keycloak REST
API. It's log file defaulted to /tmp/{prog_name}.log where prog_name
is the name of the program that invoked it. That default was changed
to {prog_name}.log so the log file is created in the current directory
instead of under /tmp. Use of the /var/log directory was avoided
because that requires root privileges.

Diff: diff --git a/keycloak_httpd_client/keycloak_cli.py b/keycloak_httpd_client/keycloak_cli.py
index 3bd88f1..bcbf2be 100755
--- a/keycloak_httpd_client/keycloak_cli.py
+++ b/keycloak_httpd_client/keycloak_cli.py
@@ -861,11 +861,11 @@ def main():
     parser.add_argument('--show-traceback', action='store_true',
                         help='exceptions print traceback in addition to '
                              'error message')
 
     parser.add_argument('--log-file',
-                        default='/tmp/{prog_name}.log'.format(
+                        default='{prog_name}.log'.format(
                             prog_name=prog_name),
                         help='log file pathname')
 
     parser.add_argument('--permit-insecure-transport',  action='store_true',
                         help='Normally secure transport such as TLS '

Vulnerable code:                         default='/tmp/{prog_name}.log'.format(
Fixed code:                         default='{prog_name}.log'.format(
CVE-2019-7738: Cross-Site Request Forgery (CSRF) (CWE-352)
value: C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2019-02-11T21:29Z
Repository: https://github.com/cooltey/C.P.Sub
Language: Markdown
Files changed: README.md
Commit date: 2019-02-10 23:49:22 -0800
Commit message: Update README.md

Diff: diff --git a/README.md b/README.md
index 009d94e..b9a7cdd 100644
--- a/README.md
+++ b/README.md
@@ -47,14 +47,12 @@ PHP 公告系統，用 CSV 格式建構出來的小型 PHP 程式。
 
 =======
 
 <h4>版本更新</h4>
 
-<b>2016-11-30: v5.1</b><br>
-<li>1.加入最後瀏覽時間，以阻擋過度瀏覽而導致文章消失的問題</li>
-<li>2.修改一些小 Bug</li>
-<li>3.加入 IP Checker ，但好像沒什麼用</li>
+<b>2019-02-10: v5.3</b><br>
+<li>1.修正 CSRF 問題並新增開關 CSRF 防護的功能</li>
 
 
 
 =======
 
@@ -98,10 +96,13 @@ If you have any question or suggestion about this project, please contact with m
 
 =======
 
 <h4>Relsease Logs</h4>
 
+<b>2019-2-10: v5.3</b><br>
+<li>1. Added CSRF protection</li>
+
 <b>2017-4-6: v5.21</b><br>
 <li>1. Filter Update</li>
 
 <b>2017-3-27: v5.2</b><br>
 <li>1. XSS issues resolved</li>
@@ -116,11 +117,11 @@ If you have any question or suggestion about this project, please contact with m
 =======
 =======
 
 Demo 網址：http://cooltey.org/cpsub/
 
-目前程式版本 Current Version：v5.21
+目前程式版本 Current Version：v5.3
 
 作者 Author：Cooltey Feng
 
 E-mail：coolteygame@gmail.com
 

Vulnerable code: <b>2016-11-30: v5.1</b><br>
<li>1.加入最後瀏覽時間，以阻擋過度瀏覽而導致文章消失的問題</li>
<li>2.修改一些小 Bug</li>
<li>3.加入 IP Checker ，但好像沒什麼用</li>
目前程式版本 Current Version：v5.21
Fixed code: <b>2019-02-10: v5.3</b><br>
<li>1.修正 CSRF 問題並新增開關 CSRF 防護的功能</li>
<b>2019-2-10: v5.3</b><br>
<li>1. Added CSRF protection</li>

目前程式版本 Current Version：v5.3
CVE-2021-21244: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2021-01-15T20:15Z
Repository: https://github.com/theonedev/onedev
Language: Java
Files changed: server-core/src/main/java/io/onedev/server/CoreModule.java
Commit date: 2020-04-10 08:44:57 +0800
Commit message: fix issue #88: Users able to edit build spec can execute arbitrary java
code
Diff: diff --git a/server-core/src/main/java/io/onedev/server/CoreModule.java b/server-core/src/main/java/io/onedev/server/CoreModule.java
index 5216bd8616..81f2d0200a 100644
--- a/server-core/src/main/java/io/onedev/server/CoreModule.java
+++ b/server-core/src/main/java/io/onedev/server/CoreModule.java
@@ -58,10 +58,11 @@ import org.hibernate.SessionFactory;
 import org.hibernate.StaleStateException;
 import org.hibernate.boot.model.naming.PhysicalNamingStrategy;
 import org.hibernate.collection.internal.PersistentBag;
 import org.hibernate.exception.ConstraintViolationException;
 import org.hibernate.type.Type;
+import org.hibernate.validator.messageinterpolation.ParameterMessageInterpolator;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
 import com.google.inject.Provider;
@@ -307,11 +308,14 @@ public class CoreModule extends AbstractPluginModule {
 		
 		bind(ValidatorFactory.class).toProvider(new com.google.inject.Provider<ValidatorFactory>() {
 
 			@Override
 			public ValidatorFactory get() {
-				Configuration<?> configuration = Validation.byDefaultProvider().configure();
+				Configuration<?> configuration = Validation
+						.byDefaultProvider()
+						.configure()
+						.messageInterpolator(new ParameterMessageInterpolator());
 				return configuration.buildValidatorFactory();
 			}
 			
 		}).in(Singleton.class);
 		

Vulnerable code: 				Configuration<?> configuration = Validation.byDefaultProvider().configure();
Fixed code: import org.hibernate.validator.messageinterpolation.ParameterMessageInterpolator;
				Configuration<?> configuration = Validation
						.byDefaultProvider()
						.configure()
						.messageInterpolator(new ParameterMessageInterpolator());
CVE-2021-37232: Out-of-bounds Write (CWE-787)
value: A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar_read64() in src/util.cpp due to the lack of buffer size of uint32_buffer while reading more bytes in APar_read64.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-08-04T10:15Z
Repository: https://github.com/wez/atomicparsley
Language: YAML
Files changed: .github/workflows/ci.yml, src/extracts.cpp, tests/test.sh
Commit date: 2021-07-12 23:10:28 -0700
Commit message: Avoid stack overflow

refs: https://github.com/wez/atomicparsley/issues/32

Diff: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f68277..990dd2b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,5 +21,18 @@ jobs:
     - uses: actions/checkout@v2
     - name: configure
       run: cmake .
     - name: build
       run: cmake --build . --config Release
+
+  asan:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+    steps:
+    - uses: actions/checkout@v2
+    - name: configure
+      run: cmake -DASAN=on -DCMAKE_BUILD_TYPE=Debug .
+    - name: build
+      run: cmake --build .
+    - name: test
+      run: tests/test.sh
diff --git a/src/extracts.cpp b/src/extracts.cpp
index 4c09881..f5249c1 100644
--- a/src/extracts.cpp
+++ b/src/extracts.cpp
@@ -1586,11 +1586,11 @@ void APar_Print_TrackDetails(TrackInfo *track_info) {
   }
   return;
 }
 
 void APar_ExtractDetails(FILE *isofile, uint8_t optional_output) {
-  char uint32_buffer[5];
+  char uint32_buffer[8];
   Trackage track = {0};
 
   AtomicInfo *mvhdAtom = APar_FindAtom("moov.mvhd", false, VERSIONED_ATOM, 0);
   if (mvhdAtom != NULL) {
     APar_ExtractMovieDetails(uint32_buffer, isofile, mvhdAtom);
diff --git a/tests/issue-32.mp4 b/tests/issue-32.mp4
new file mode 100644
index 0000000..bae1839
Binary files /dev/null and b/tests/issue-32.mp4 differ
diff --git a/tests/test.sh b/tests/test.sh
new file mode 100755
index 0000000..ed8fd9c
--- /dev/null
+++ b/tests/test.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+set -xe
+./AtomicParsley ./tests/issue-32.mp4 -T 1 -t +

Vulnerable code:   char uint32_buffer[5];
Fixed code: 
  asan:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
    - uses: actions/checkout@v2
    - name: configure
      run: cmake -DASAN=on -DCMAKE_BUILD_TYPE=Debug .
    - name: build
      run: cmake --build .
    - name: test
      run: tests/test.sh
  char uint32_buffer[8];
#!/bin/bash
set -xe
./AtomicParsley ./tests/issue-32.mp4 -T 1 -t +
CVE-2021-21235: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 6.5
Published: 2021-01-06T02:15Z
Repository: https://github.com/kamadak/exif-rs
Language: Rust
Files changed: src/util.rs
Commit date: 2021-01-04 11:06:15 +0900
Commit message: Fix an infinite loop in reading PNG files.

Diff: diff --git a/src/util.rs b/src/util.rs
index e5dd0e4..a4cd6dc 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -54,10 +54,13 @@ pub trait BufReadExt {
 
 impl<T> BufReadExt for T where T: io::BufRead {
     fn discard_exact(&mut self, mut len: usize) -> io::Result<()> {
         while len > 0 {
             let consume_len = match self.fill_buf() {
+                Ok(buf) if buf.is_empty() =>
+                    return Err(io::Error::new(
+                        io::ErrorKind::UnexpectedEof, "unexpected EOF")),
                 Ok(buf) => buf.len().min(len),
                 Err(e) if e.kind() == io::ErrorKind::Interrupted => continue,
                 Err(e) => return Err(e),
             };
             self.consume(consume_len);
@@ -97,10 +100,20 @@ mod tests {
     use std::io::Cursor;
     use std::io::ErrorKind;
     use std::io::Read;
     use super::*;
 
+    #[test]
+    fn discard_exact() {
+        let mut buf = b"abc".as_ref();
+        buf.discard_exact(1).unwrap();
+        assert_eq!(buf, b"bc");
+        buf.discard_exact(2).unwrap();
+        assert_eq!(buf, b"");
+        buf.discard_exact(1).unwrap_err();
+    }
+
     #[test]
     fn read8_len() {
         let mut reader = Cursor::new([]);
         assert_err_kind!(read8(&mut reader), ErrorKind::UnexpectedEof);
         let mut reader = Cursor::new([0x01]);

Fixed code:                 Ok(buf) if buf.is_empty() =>
                    return Err(io::Error::new(
                        io::ErrorKind::UnexpectedEof, "unexpected EOF")),
    #[test]
    fn discard_exact() {
        let mut buf = b"abc".as_ref();
        buf.discard_exact(1).unwrap();
        assert_eq!(buf, b"bc");
        buf.discard_exact(2).unwrap();
        assert_eq!(buf, b"");
        buf.discard_exact(1).unwrap_err();
    }
CVE-2024-35545: Insufficient Information (NVD-CWE-noinfo)
value: MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-26T18:15Z
Repository: https://github.com/RamonSilva20/mapos
Language: PHP
Files changed: application/.env.example, application/config/config.php
Commit date: 2024-05-12 21:22:45 -0300
Commit message: fix: xss

Diff: diff --git a/application/.env.example b/application/.env.example
index c075766..40467bf 100644
--- a/application/.env.example
+++ b/application/.env.example
@@ -74,5 +74,7 @@ PAYMENT_GATEWAYS_ASAAS_CREDENTIAIS_API_KEY=
 PAYMENT_GATEWAYS_ASAAS_BOLETO_EXPIRATION=P3D
 
 API_ENABLED=api_enabled
 API_JWT_KEY="enter_jwt_key"
 API_TOKEN_EXPIRE_TIME=token_expire_time
+
+GLOBAL_XSS_FILTERING=true
diff --git a/application/config/config.php b/application/config/config.php
index 99cf3e8..9e9ebe8 100644
--- a/application/config/config.php
+++ b/application/config/config.php
@@ -499,5 +499,19 @@ $config['time_reference'] = $_ENV['APP_TIMEZONE'] ?? 'America/Sao_Paulo';
 |
 | Comma-separated:	'10.0.1.200,192.168.5.0/24'
 | Array:		array('10.0.1.200', '192.168.5.0/24')
 */
 $config['proxy_ips'] = $_ENV['APP_PROXY_IPS'] ?? '';
+
+/*
+|--------------------------------------------------------------------------
+| Global XSS Filtering
+|--------------------------------------------------------------------------
+|
+| Determines whether the XSS filter is always active when GET, POST or
+| COOKIE data is encountered
+|
+| WARNING: This feature is DEPRECATED and currently available only
+|          for backwards compatibility purposes!
+|
+*/
+$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;

Fixed code: 
GLOBAL_XSS_FILTERING=true

/*
|--------------------------------------------------------------------------
| Global XSS Filtering
|--------------------------------------------------------------------------
|
| Determines whether the XSS filter is always active when GET, POST or
| COOKIE data is encountered
|
| WARNING: This feature is DEPRECATED and currently available only
|          for backwards compatibility purposes!
|
*/
$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;
CVE-2024-36819: Insufficient Information (NVD-CWE-noinfo)
value: MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee dashboards, resulting in unauthorized script execution whenever the dashboard is loaded.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-25T19:15Z
Repository: https://github.com/RamonSilva20/mapos
Language: PHP
Files changed: application/.env.example, application/config/config.php
Commit date: 2024-05-12 21:22:45 -0300
Commit message: fix: xss

Diff: diff --git a/application/.env.example b/application/.env.example
index c075766..40467bf 100644
--- a/application/.env.example
+++ b/application/.env.example
@@ -74,5 +74,7 @@ PAYMENT_GATEWAYS_ASAAS_CREDENTIAIS_API_KEY=
 PAYMENT_GATEWAYS_ASAAS_BOLETO_EXPIRATION=P3D
 
 API_ENABLED=api_enabled
 API_JWT_KEY="enter_jwt_key"
 API_TOKEN_EXPIRE_TIME=token_expire_time
+
+GLOBAL_XSS_FILTERING=true
diff --git a/application/config/config.php b/application/config/config.php
index 99cf3e8..9e9ebe8 100644
--- a/application/config/config.php
+++ b/application/config/config.php
@@ -499,5 +499,19 @@ $config['time_reference'] = $_ENV['APP_TIMEZONE'] ?? 'America/Sao_Paulo';
 |
 | Comma-separated:	'10.0.1.200,192.168.5.0/24'
 | Array:		array('10.0.1.200', '192.168.5.0/24')
 */
 $config['proxy_ips'] = $_ENV['APP_PROXY_IPS'] ?? '';
+
+/*
+|--------------------------------------------------------------------------
+| Global XSS Filtering
+|--------------------------------------------------------------------------
+|
+| Determines whether the XSS filter is always active when GET, POST or
+| COOKIE data is encountered
+|
+| WARNING: This feature is DEPRECATED and currently available only
+|          for backwards compatibility purposes!
+|
+*/
+$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;

Fixed code: 
GLOBAL_XSS_FILTERING=true

/*
|--------------------------------------------------------------------------
| Global XSS Filtering
|--------------------------------------------------------------------------
|
| Determines whether the XSS filter is always active when GET, POST or
| COOKIE data is encountered
|
| WARNING: This feature is DEPRECATED and currently available only
|          for backwards compatibility purposes!
|
*/
$config['global_xss_filtering'] = $_ENV['GLOBAL_XSS_FILTERING'] ? filter_var($_ENV['GLOBAL_XSS_FILTERING'], FILTER_VALIDATE_BOOLEAN) : true;
CVE-2016-5009: Improper Input Validation (CWE-20)
value: The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2016-07-12T19:59Z
Repository: https://github.com/ceph/ceph
Language: Unknown
Commit date: 2016-06-29 23:12:30 -0400
Commit message: Merge pull request #9700 from JiYou/fix-monitor-crush

mon: Monitor: validate prefix on handle_command()

Reviewed-by: Sage Weil <sage@redhat.com>
Reviewed-by: Joao Eduardo Luis <joao@suse.de>
CVE-2018-10861: Improper Authentication (CWE-287)
value: A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2018-07-10T14:29Z
Repository: https://github.com/ceph/ceph
Language: Unknown
Commit date: 2018-07-09 08:29:32 -0500
Commit message: Merge remote-tracking branch 'private/wip-mon-snap-caps'
CVE-2023-6778: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository allegroai/clearml-server prior to 1.13.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-12-18T15:15Z
Repository: https://github.com/allegroai/clearml-server
Language: Python
Files changed: apiserver/version.py
Commit date: 2023-11-17 09:49:26 +0200
Commit message: Version bump to v1.13.0

Diff: diff --git a/apiserver/version.py b/apiserver/version.py
index b518f6e..9a34ccc 100644
--- a/apiserver/version.py
+++ b/apiserver/version.py
@@ -1 +1 @@
-__version__ = "1.12.0"
+__version__ = "1.13.0"

Vulnerable code: __version__ = "1.12.0"
Fixed code: __version__ = "1.13.0"
CVE-2015-4054: NULL Pointer Dereference (CWE-476)
value: PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2017-05-23T04:29Z
Repository: https://github.com/pgbouncer/pgbouncer
Language: C
Files changed: src/client.c
Commit date: 2015-04-08 09:22:55 +0300
Commit message: Check if auth_user is set.

Fixes a crash if password packet appears before startup packet (#42).

Diff: diff --git a/src/client.c b/src/client.c
index 275fd1a..49b2624 100644
--- a/src/client.c
+++ b/src/client.c
@@ -37,10 +37,16 @@ static bool check_client_passwd(PgSocket *client, const char *passwd)
 {
 	char md5[MD5_PASSWD_LEN + 1];
 	const char *correct;
 	PgUser *user = client->auth_user;
 
+	/* auth_user may be missing */
+	if (!user) {
+		slog_error(client, "Password packet before auth packet?");
+		return false;
+	}
+
 	/* disallow empty passwords */
 	if (!*passwd || !*user->passwd)
 		return false;
 
 	switch (cf_auth_type) {

Fixed code: 	/* auth_user may be missing */
	if (!user) {
		slog_error(client, "Password packet before auth packet?");
		return false;
	}
CVE-2015-6817: Improper Authentication (CWE-287)
value: PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2017-05-23T04:29Z
Repository: https://github.com/pgbouncer/pgbouncer
Language: C
Files changed: src/client.c
Commit date: 2015-09-03 15:25:48 +0300
Commit message: Remove too early set of auth_user

When query returns 0 rows (user not found),
this user stays as login user...

Should fix #69.

Diff: diff --git a/src/client.c b/src/client.c
index 99615a0..2b01ff2 100644
--- a/src/client.c
+++ b/src/client.c
@@ -81,11 +81,10 @@ static bool send_client_authreq(PgSocket *client)
 static void start_auth_request(PgSocket *client, const char *username)
 {
 	int res;
 	PktBuf *buf;
 
-	client->auth_user = client->db->auth_user;
 	/* have to fetch user info from db */
 	client->pool = get_pool(client->db, client->db->auth_user);
 	if (!find_server(client)) {
 		client->wait_for_user_conn = true;
 		return;

Vulnerable code: 	client->auth_user = client->db->auth_user;
CVE-2014-9905: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) title of an appointment or (2) contact fields.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-02-17T17:59Z
Repository: https://github.com/inverse-inc/sogo
Language: JavaScript
Files changed: UI/WebServerResources/SchedulerUI.js
Commit date: 2014-02-07 15:53:39 -0500
Commit message: Decode HTML entities in JSON of calendar module

Diff: diff --git a/UI/WebServerResources/SchedulerUI.js b/UI/WebServerResources/SchedulerUI.js
index 820f235b0..2d5557125 100644
--- a/UI/WebServerResources/SchedulerUI.js
+++ b/UI/WebServerResources/SchedulerUI.js
@@ -1013,27 +1013,27 @@ function eventsListCallback(http) {
                 span.update(data[i][4]); // title
 
                 td = createElement("td");
                 row.appendChild(td);
                 td.observe("mousedown", listRowMouseDownHandler, true);
-                td.appendChild(document.createTextNode(data[i][21])); // start date
+                td.update(data[i][21]); // start date
 
                 td = createElement("td");
                 row.appendChild(td);
                 td.observe("mousedown", listRowMouseDownHandler, true);
-                td.appendChild(document.createTextNode(data[i][22])); // end date
+                td.update(data[i][22]); // end date
 
                 td = createElement("td");
                 row.appendChild(td);
                 td.observe("mousedown", listRowMouseDownHandler, true);
                 if (data[i][7])
-                    td.appendChild(document.createTextNode(data[i][7])); // location
+                    td.update(data[i][7]); // location
 
                 td = createElement("td");
                 row.appendChild(td);
                 td.observe("mousedown", listRowMouseDownHandler, true);
-                td.appendChild(document.createTextNode(data[i][2])); // calendar
+                td.update(data[i][2]); // calendar
             }
 
             if (sorting["event-header"] && sorting["event-header"].length > 0) {
                 var sortHeader = $(sorting["event-header"]);
 

Vulnerable code:                 td.appendChild(document.createTextNode(data[i][21])); // start date
                td.appendChild(document.createTextNode(data[i][22])); // end date
                    td.appendChild(document.createTextNode(data[i][7])); // location
                td.appendChild(document.createTextNode(data[i][2])); // calendar
Fixed code:                 td.update(data[i][21]); // start date
                td.update(data[i][22]); // end date
                    td.update(data[i][7]); // location
                td.update(data[i][2]); // calendar
CVE-2020-11958: Out-of-bounds Write (CWE-787)
value: re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2020-04-21T01:15Z
Repository: https://github.com/skvadrik/re2c
Language: C++
Files changed: src/parse/scanner.cc
Commit date: 2020-04-17 22:47:14 +0100
Commit message: Fix crash in lexer refill (reported by Agostino Sarubbo).

The crash happened in a rare case of a very long lexeme that doen't fit
into the buffer, forcing buffer reallocation.

The crash was caused by an incorrect calculation of the shift offset
(it was smaller than necessary). As a consequence, the data from buffer
start and up to the beginning of the current lexeme was not discarded
(as it should have been), resulting in less free space for new data than
expected.

Diff: diff --git a/src/parse/scanner.cc b/src/parse/scanner.cc
index 1d6e9efa..bd651314 100644
--- a/src/parse/scanner.cc
+++ b/src/parse/scanner.cc
@@ -153,17 +153,18 @@ bool Scanner::fill(size_t need)
         BSIZE += std::max(BSIZE, need);
         char * buf = new char[BSIZE + YYMAXFILL];
         if (!buf) fatal("out of memory");
 
         memmove(buf, tok, copy);
-        shift_ptrs_and_fpos(buf - bot);
+        shift_ptrs_and_fpos(buf - tok);
         delete [] bot;
         bot = buf;
 
         free = BSIZE - copy;
     }
 
+    DASSERT(lim + free <= bot + BSIZE);
     if (!read(free)) {
         eof = lim;
         memset(lim, 0, YYMAXFILL);
         lim += YYMAXFILL;
     }

Vulnerable code:         shift_ptrs_and_fpos(buf - bot);
Fixed code:         shift_ptrs_and_fpos(buf - tok);
    DASSERT(lim + free <= bot + BSIZE);
CVE-2022-1812: Integer Overflow or Wraparound (CWE-190)
value: Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2023-01-14T14:15Z
Repository: https://github.com/publify/publify
Language: Ruby
Files changed: publify_core/app/models/user.rb, publify_core/spec/models/user_spec.rb
Commit date: 2022-08-14 14:02:31 +0200
Commit message: Validate length of user's name attribute

This attribute is a text column, so it could be very long even in a
MySQL database. Limit it to a generous length.

Diff: diff --git a/publify_core/app/models/user.rb b/publify_core/app/models/user.rb
index c9555abc18..226183e3c9 100644
--- a/publify_core/app/models/user.rb
+++ b/publify_core/app/models/user.rb
@@ -20,10 +20,11 @@ class User < ApplicationRecord
 
   validates :login, uniqueness: true
   validates :email, :login, presence: true
   validates :login, length: { in: 3..40 }
   validates_default_string_length :email, :text_filter_name
+  validates :name, length: { maximum: 2048 }
 
   belongs_to :resource, optional: true
   has_many :notifications, foreign_key: "notify_user_id"
   has_many :notify_contents, -> { uniq }, through: :notifications,
                                           source: "notify_content"
diff --git a/publify_core/spec/models/user_spec.rb b/publify_core/spec/models/user_spec.rb
index a8457ef283..54ea166556 100644
--- a/publify_core/spec/models/user_spec.rb
+++ b/publify_core/spec/models/user_spec.rb
@@ -47,10 +47,14 @@ describe User, type: :model do
 
     it "requires email to not be too long" do
       expect(user).to validate_length_of(:email).is_at_most(255)
     end
 
+    it "requires name to not be too long" do
+      expect(user).to validate_length_of(:name).is_at_most(2048)
+    end
+
     it "requires first name to not be too long" do
       expect(user).to validate_length_of(:firstname).is_at_most(256)
     end
 
     it "requires last name to not be too long" do

Fixed code:   validates :name, length: { maximum: 2048 }
    it "requires name to not be too long" do
      expect(user).to validate_length_of(:name).is_at_most(2048)
    end
CVE-2018-20433: Improper Restriction of XML External Entity Reference (CWE-611)
value: c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2018-12-24T13:29Z
Repository: https://github.com/zhutougg/c3p0
Language: Java
Files changed: src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
Commit date: 2018-12-20 21:11:13 +0800
Commit message: Repair XXE vulnerability at initialization
Diff: diff --git a/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java b/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
index 7a0cad0..bab251e 100644
--- a/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
+++ b/src/java/com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java
@@ -142,10 +142,11 @@ public final class C3P0ConfigXmlUtils
     }
 
     public static C3P0Config extractXmlConfigFromInputStream(InputStream is) throws Exception
     {
         DocumentBuilderFactory fact = DocumentBuilderFactory.newInstance();
+	fact.setExpandEntityReferences(false);
         DocumentBuilder db = fact.newDocumentBuilder();
         Document doc = db.parse( is );
 
         return extractConfigFromXmlDoc(doc);
     }

Fixed code: 	fact.setExpandEntityReferences(false);
CVE-2021-25915: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-03-09T15:15Z
Repository: https://github.com/eugeneware/changeset
Language: JavaScript
Files changed: index.js, test/index.js
Commit date: 2021-03-05 15:54:18 +1100
Commit message: Fix against prototype pollution

Diff: diff --git a/index.js b/index.js
index ce55325..96b49f0 100644
--- a/index.js
+++ b/index.js
@@ -73,13 +73,13 @@ function apply(changes, target, modify) {
           keys.forEach(function (prop, i) {
             if (!(prop in ptr)) {
               ptr[prop] = {};
             }
 
-            if (i < len - 1) {
+            if (i < len - 1 && ptr.hasOwnProperty(prop)) {
               ptr = ptr[prop];
-            } else {
+            } else if (prop !== '__proto__') {
               ptr[prop] = ch.value;
             }
           });
         } else {
           obj = ch.value;
@@ -99,11 +99,11 @@ function apply(changes, target, modify) {
             if (i < len - 1) {
               ptr = ptr[prop];
             } else {
               if (Array.isArray(ptr)) {
                 ptr.splice(parseInt(prop, 10), 1);
-              } else {
+              } else if (ptr.hasOwnProperty(prop)) {
                 delete ptr[prop];
               }
             }
           });
         } else {
diff --git a/test/index.js b/test/index.js
index df6dc9e..0bd8585 100644
--- a/test/index.js
+++ b/test/index.js
@@ -241,6 +241,15 @@ describe('changeset', function () {
       { make: 'Toyota', model: 'Camry' },
       { make: 'Toyota', model: 'Corolla' }
     ]);
     done();
   });
+
+  it('should not allow prototype pollution', function(done) {
+    var changeset = [
+      { type: 'put', key: ['__proto__','polluted'], value: 'Yes! Its Polluted'}
+    ];
+    diff.apply(changeset, {}, true);
+    expect({}.polluted).to.not.equal('Yes! Its Polluted');
+    done();
+  })
 });

Vulnerable code:             if (i < len - 1) {
            } else {
              } else {
Fixed code:             if (i < len - 1 && ptr.hasOwnProperty(prop)) {
            } else if (prop !== '__proto__') {
              } else if (ptr.hasOwnProperty(prop)) {

  it('should not allow prototype pollution', function(done) {
    var changeset = [
      { type: 'put', key: ['__proto__','polluted'], value: 'Yes! Its Polluted'}
    ];
    diff.apply(changeset, {}, true);
    expect({}.polluted).to.not.equal('Yes! Its Polluted');
    done();
  })