Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-29007: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 7.8
Published: 2023-04-25T21:15Z
Repository: https://github.com/git/git
Language: Unknown
Commit date: 2023-04-17 21:15:42 +0200
Commit message: Merge branch 'tb/config-copy-or-rename-in-file-injection'

Avoids issues with renaming or deleting sections with long lines, where
configuration values may be interpreted as sections, leading to
configuration injection. Addresses CVE-2023-29007.

* tb/config-copy-or-rename-in-file-injection:
  config.c: disallow overly-long lines in `copy_or_rename_section_in_file()`
  config.c: avoid integer truncation in `copy_or_rename_section_in_file()`
  config: avoid fixed-sized buffer when renaming/deleting a section
  t1300: demonstrate failure when renaming sections with long lines

Signed-off-by: Taylor Blau <me@ttaylorr.com>
CVE-2024-32020: Insufficient Information (NVD-CWE-noinfo)
value: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a "proper" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T19:15Z
Repository: https://github.com/git/git
Language: Unknown
Commit date: 2024-04-19 12:38:32 +0200
Commit message: Merge branch 'ownership-checks-in-local-clones'

This topic addresses two CVEs:

- CVE-2024-32020:

  Local clones may end up hardlinking files into the target repository's
  object database when source and target repository reside on the same
  disk. If the source repository is owned by a different user, then
  those hardlinked files may be rewritten at any point in time by the
  untrusted user.

- CVE-2024-32021:

  When cloning a local source repository that contains symlinks via the
  filesystem, Git may create hardlinks to arbitrary user-readable files
  on the same filesystem as the target repository in the objects/
  directory.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
CVE-2016-15007: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: A vulnerability was found in Centralized-Salesforce-Dev-Framework. It has been declared as problematic. Affected by this vulnerability is the function SObjectService of the file src/classes/SObjectService.cls of the component SOQL Handler. The manipulation of the argument orderDirection leads to injection. The patch is named db03ac5b8a9d830095991b529c067a030a0ccf7b. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217195.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-01-02T19:15Z
Repository: https://github.com/scottbcovert/Centralized-Salesforce-Dev-Framework
Language: Other
Files changed: src/classes/SObjectService.cls
Commit date: 2016-06-20 15:21:51 -0700
Commit message: Removed potential SOQL injection vulnerability from orderDirection parameter in SObjectService.BuildSoqlString

Diff: diff --git a/src/classes/SObjectService.cls b/src/classes/SObjectService.cls
index d47c6e1..88b4e72 100644
--- a/src/classes/SObjectService.cls
+++ b/src/classes/SObjectService.cls
@@ -142,11 +142,11 @@ public with sharing class SObjectService {
 			soql += ' ORDER BY ' + String.escapeSingleQuotes(String.join(new list<String>(orderByFieldSet),','));
 			if (!ASC_DIR_ORDER.equalsIgnoreCase(orderDirection) && !DESC_DIR_ORDER.equalsIgnoreCase(orderDirection)){
 				soql += ' ' + DEFAULT_DIR_ORDER;
 			}
 			else{
-				soql += ' ' + orderDirection.toUpperCase();
+				soql += ' ' + String.escapeSingleQuotes(orderDirection.toUpperCase());
 			}
 		}
 		if (limitTo!=null && limitTo>0){
 			if (limitTo > SOQL_ROW_GOV_LIMIT){
 				limitTo = SOQL_ROW_GOV_LIMIT;

Vulnerable code: 				soql += ' ' + orderDirection.toUpperCase();
Fixed code: 				soql += ' ' + String.escapeSingleQuotes(orderDirection.toUpperCase());
CVE-2023-25569: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.

CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 5.7
Published: 2023-02-20T16:15Z
Repository: https://github.com/apolloconfig/apollo
Language: YAML
Files changed: apollo-portal/src/main/resources/application.yml
Commit date: 2022-11-29 08:48:04 +0800
Commit message: config cookie same site to lax

Diff: diff --git a/apollo-portal/src/main/resources/application.yml b/apollo-portal/src/main/resources/application.yml
index d8c88cd9..451440de 100644
--- a/apollo-portal/src/main/resources/application.yml
+++ b/apollo-portal/src/main/resources/application.yml
@@ -36,10 +36,15 @@ server:
   port: 8070
   compression:
     enabled: true
   tomcat:
     use-relative-redirects: true
+  servlet:
+    session:
+      cookie:
+        # prevent csrf
+        same-site: Lax
 
 logging:
   file:
     name: /opt/logs/100003173/apollo-portal.log
 

Fixed code:   servlet:
    session:
      cookie:
        # prevent csrf
        same-site: Lax
CVE-2020-15151: Cross-Site Request Forgery (CSRF) (CWE-352)
value: OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8
Published: 2020-08-20T01:17Z
Repository: https://github.com/OpenMage/magento-lts
Language: PHP
Files changed: app/code/core/Mage/Adminhtml/Controller/Action.php
Commit date: 2020-08-18 19:19:54 +0200
Commit message: Merge pull request from GHSA-crf2-xm6x-46p6


Diff: diff --git a/app/code/core/Mage/Adminhtml/Controller/Action.php b/app/code/core/Mage/Adminhtml/Controller/Action.php
index 0e26a8a47d..c236779d1e 100644
--- a/app/code/core/Mage/Adminhtml/Controller/Action.php
+++ b/app/code/core/Mage/Adminhtml/Controller/Action.php
@@ -387,11 +387,11 @@ class Mage_Adminhtml_Controller_Action extends Mage_Core_Controller_Varien_Actio
         if (is_array($this->_publicActions) && in_array($this->getRequest()->getActionName(), $this->_publicActions)) {
             return true;
         }
 
         if (!($secretKey = $this->getRequest()->getParam(Mage_Adminhtml_Model_Url::SECRET_KEY_PARAM_NAME, null))
-            || $secretKey != Mage::getSingleton('adminhtml/url')->getSecretKey()) {
+            || !hash_equals(Mage::getSingleton('adminhtml/url')->getSecretKey(), $secretKey)) {
             return false;
         }
         return true;
     }
 

Vulnerable code:             || $secretKey != Mage::getSingleton('adminhtml/url')->getSecretKey()) {
Fixed code:             || !hash_equals(Mage::getSingleton('adminhtml/url')->getSecretKey(), $secretKey)) {
CVE-2020-15244: Deserialization of Untrusted Data (CWE-502)
value: In Magento (rubygems openmage/magento-lts package) before versions 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.2
Published: 2020-10-21T20:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: PHP
Files changed: app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php, app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php
Commit date: 2020-10-20 23:19:07 +0200
Commit message: Merge pull request from GHSA-jrgf-vfw2-hj26


Diff: diff --git a/app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php b/app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php
index cf813a83cb..bfbddaad7f 100644
--- a/app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php
+++ b/app/code/core/Mage/Catalog/Model/Product/Attribute/Api.php
@@ -234,10 +234,14 @@ class Mage_Catalog_Model_Product_Attribute_Api extends Mage_Catalog_Model_Api_Re
 
         if ($model->getEntityTypeId() != $this->_entityTypeId) {
             $this->_fault('can_not_delete');
         }
 
+        if (!$model->getIsUserDefined()) {
+            $this->_fault('can_not_delete');
+        }
+
         try {
             $model->delete();
             return true;
         } catch (Exception $e) {
             $this->_fault('can_not_delete', $e->getMessage());
diff --git a/app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php b/app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php
index 2e0aa1ffe7..02ccd87167 100644
--- a/app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php
+++ b/app/code/core/Mage/Catalog/Model/Resource/Product/Collection.php
@@ -540,11 +540,11 @@ class Mage_Catalog_Model_Resource_Product_Collection extends Mage_Catalog_Model_
             Mage::dispatchEvent('catalog_product_collection_load_after', array('collection' => $this));
         }
 
         foreach ($this as $product) {
             if ($product->isRecurring() && $profile = $product->getRecurringProfile()) {
-                $product->setRecurringProfile(unserialize($profile));
+                $product->setRecurringProfile(Mage::helper('core/unserializeArray')->unserialize($profile));
             }
         }
 
         return $this;
     }

Vulnerable code:                 $product->setRecurringProfile(unserialize($profile));
Fixed code:         if (!$model->getIsUserDefined()) {
            $this->_fault('can_not_delete');
        }

                $product->setRecurringProfile(Mage::helper('core/unserializeArray')->unserialize($profile));
CVE-2020-26252: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2021-01-20T22:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: Unknown
Commit date: 2021-01-19 10:17:49 -0500
Commit message: Merge pull request from GHSA-99m6-r53j-4hh2

Fix for Layout XML RCE Vulnerability
CVE-2020-26252: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2021-01-20T22:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: Unknown
Commit date: 2021-01-19 10:17:49 -0500
Commit message: Merge pull request from GHSA-99m6-r53j-4hh2

Fix for Layout XML RCE Vulnerability
CVE-2020-26285: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2021-01-21T14:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: Unknown
Commit date: 2021-01-19 10:19:01 -0500
Commit message: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9
CVE-2020-26285: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2021-01-21T14:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: Unknown
Commit date: 2021-01-19 10:19:01 -0500
Commit message: Merge pull request from GHSA-hj6w-xrv3-wjj9

Security fix for GHSA-hj6w-xrv3-wjj9
CVE-2020-26295: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.2
Published: 2021-01-21T14:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: Unknown
Commit date: 2021-01-19 10:32:06 -0500
Commit message: Merge pull request from GHSA-52c6-6v3v-f3fg

CMS Editor code execution update
CVE-2020-26295: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.2
Published: 2021-01-21T14:15Z
Repository: https://github.com/OpenMage/magento-lts
Language: Unknown
Commit date: 2021-01-19 10:32:06 -0500
Commit message: Merge pull request from GHSA-52c6-6v3v-f3fg

CMS Editor code execution update
CVE-2023-36811: Improper Verification of Cryptographic Signature (CWE-347)
value: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any "borg check --repair" and before "borg prune". There are no known workarounds for this vulnerability.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 4.7
Published: 2023-08-30T18:15Z
Repository: https://github.com/borgbackup/borg
Language: Unknown
Commit date: 2023-08-30 18:29:05 +0200
Commit message: Merge pull request #7789 from ThomasWaldmann/archive-tam-verify-master

Archive tam verify security fix (master)
CVE-2017-20175: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.4.3 is able to address this issue. The patch is named 681324e4f518a8af4bd1f93867074c728eb9923d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220203.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-05T20:15Z
Repository: https://github.com/DaSchTour/matomo-mediawiki-extension
Language: PHP
Files changed: Piwik.hooks.php
Commit date: 2017-11-15 19:29:25 +0100
Commit message: SECURITY: XSS when $wgPiwikTrackUsernames is true

With a specially-crafted username like 0'+(window.alert('You have been hacked'))+'0
the user receives the alert "You have been hacked". This commit escapes the
username.

Diff: diff --git a/Piwik.hooks.php b/Piwik.hooks.php
index ee4e593..5272004 100644
--- a/Piwik.hooks.php
+++ b/Piwik.hooks.php
@@ -80,12 +80,12 @@ class PiwikHooks {
 
         // Track username based on https://piwik.org/docs/user-id/ The user
         // name for anonymous visitors is their IP address which Piwik already
         // records.
         if ($wgPiwikTrackUsernames && $wgUser->isLoggedIn()) {
-            $username = $wgUser->getName();
-            $customJs .= PHP_EOL . "  _paq.push(['setUserId','{$username}']);";
+            $username = Xml::encodeJsVar( $wgUser->getName() );
+            $customJs .= PHP_EOL . "  _paq.push([\"setUserId\",{$username}]);";
         }
 
 		// Check if server uses https
 		if ($wgPiwikProtocol == 'auto') {
 			

Vulnerable code:             $username = $wgUser->getName();
            $customJs .= PHP_EOL . "  _paq.push(['setUserId','{$username}']);";
Fixed code:             $username = Xml::encodeJsVar( $wgUser->getName() );
            $customJs .= PHP_EOL . "  _paq.push([\"setUserId\",{$username}]);";
CVE-2023-0327: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-16T19:15Z
Repository: https://github.com/saemorris/TheRadSystem
Language: PHP
Files changed: _login.php, setup.sql, users.php
Commit date: 2015-04-03 18:10:40 -0600
Commit message: Fixed some bugs and SQL injection.

Diff: diff --git a/_login.php b/_login.php
index a91e251..108fedd 100644
--- a/_login.php
+++ b/_login.php
@@ -22,15 +22,16 @@ if (isset($_POST['login'])) {
 	} else {
 		// Require a connection to the database.
 		require ('_database.php');
 		$user = $_POST['user'];
 		$pass = $_POST['pass'];
-		// <-- Bad.
 
-		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = '$user' AND password = '$pass'";
+		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = :username AND password = :password";
 		
 		$statement = oci_parse($connection, $query);
+		oci_bind_by_name($statement, ':username', $user);
+		oci_bind_by_name($statement, ':password', $pass);
 		$results = oci_execute($statement);
 
 		// Did we get a valid result?
 		if ($results) {
 			// Are credentials valid?
diff --git a/setup.sql b/setup.sql
index 3f7f09a..c5c22ef 100644
--- a/setup.sql
+++ b/setup.sql
@@ -9,10 +9,11 @@ DROP TABLE pacs_images;
 DROP TABLE radiology_record;
 DROP TABLE users;
 DROP TABLE persons;
 DROP SEQUENCE record_id_seq;
 DROP SEQUENCE image_id_seq;
+DROP SEQUENCE person_id_seq;
 
 /*
  *  To store the personal information
  */
 CREATE TABLE persons (
diff --git a/users.php b/users.php
index 2247285..39a7cce 100644
--- a/users.php
+++ b/users.php
@@ -10,11 +10,11 @@ requireUserClass('a');
 		<p>
 			<a href="register.php">Add Account</a>
 		</p>
 		<div>
 			<form id="searchform" required="1" name="search_users" method="get" action="<?php $PHP_SELF ?>" >
-				<input type="text" name="q" />
+				<input type="text" name="q" value="<?php echo $_GET['q']; ?>" />
 				<input type="submit" value="Search"  />
 			</form>
 		</div>
 		<div>
 			<?php

Vulnerable code: 		// <-- Bad.
		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = '$user' AND password = '$pass'";
				<input type="text" name="q" />
Fixed code: 		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = :username AND password = :password";
		oci_bind_by_name($statement, ':username', $user);
		oci_bind_by_name($statement, ':password', $pass);
DROP SEQUENCE person_id_seq;
				<input type="text" name="q" value="<?php echo $_GET['q']; ?>" />
CVE-2019-25211: Insufficient Information (NVD-CWE-noinfo)
value: parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-29T00:15Z
Repository: https://github.com/gin-contrib/cors
Language: Go
Files changed: cors.go
Commit date: 2024-03-06 13:28:12 +0800
Commit message: fixe(domain): wildcard parse bug (#106)


Diff: diff --git a/cors.go b/cors.go
index b325222..1ad4b2e 100644
--- a/cors.go
+++ b/cors.go
@@ -136,11 +136,11 @@ func (c Config) parseWildcardRules() [][]string {
 		if i == 0 {
 			wRules = append(wRules, []string{"*", o[1:]})
 			continue
 		}
 		if i == (len(o) - 1) {
-			wRules = append(wRules, []string{o[:i-1], "*"})
+			wRules = append(wRules, []string{o[:i], "*"})
 			continue
 		}
 
 		wRules = append(wRules, []string{o[:i], o[i+1:]})
 	}

Vulnerable code: 			wRules = append(wRules, []string{o[:i-1], "*"})
Fixed code: 			wRules = append(wRules, []string{o[:i], "*"})
CVE-2021-32825: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee43806126012066aad4 there is a "zipslip" vulnerability. The unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, he may be able to read arbitrary system files the parent process has permissions to read. For more details including a PoC see the referenced GHSL-2020-258.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 9.1
Published: 2021-08-16T19:15Z
Repository: https://github.com/bblfsh/bblfshd
Language: Other
Files changed: .gitignore, runtime/unpack.go
Commit date: 2021-08-11 15:09:24 +0000
Commit message: untar: add check on link

Diff: diff --git a/.gitignore b/.gitignore
index 492276e..dcbe550 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,8 @@
+.idea/
+
+
 build
 coverage.txt
 /ostree
 
 # Compiled Object files, Static and Dynamic libs (Shared Objects)
diff --git a/runtime/unpack.go b/runtime/unpack.go
index e4d94ee..8f48c51 100644
--- a/runtime/unpack.go
+++ b/runtime/unpack.go
@@ -134,10 +134,18 @@ loop:
 			f.Close()
 
 		case tar.TypeLink:
 			target := filepath.Join(dest, hdr.Linkname)
 
+			trueTarget, err := filepath.EvalSymlinks(target)
+			if err != nil {
+				return err
+			}
+			if !strings.HasPrefix(trueTarget, dest) {
+				return fmt.Errorf("hardlink %q -> %q outside destination", target, hdr.Linkname)
+			}
+
 			if !strings.HasPrefix(target, dest) {
 				return fmt.Errorf("invalid hardlink %q -> %q", target, hdr.Linkname)
 			}
 
 			if err := os.Link(target, path); err != nil {
@@ -145,10 +153,17 @@ loop:
 			}
 
 		case tar.TypeSymlink:
 			target := filepath.Join(filepath.Dir(path), hdr.Linkname)
 
+			trueTarget, err := filepath.EvalSymlinks(target)
+			if err != nil {
+				return err
+			}
+			if !strings.HasPrefix(trueTarget, dest) {
+				return fmt.Errorf("hardlink %q -> %q outside destination", target, hdr.Linkname)
+			}
 			if !strings.HasPrefix(target, dest) {
 				return fmt.Errorf("invalid symlink %q -> %q", path, hdr.Linkname)
 			}
 
 			err := os.Symlink(hdr.Linkname, path)

Fixed code: .idea/


			trueTarget, err := filepath.EvalSymlinks(target)
			if err != nil {
				return err
			}
			if !strings.HasPrefix(trueTarget, dest) {
				return fmt.Errorf("hardlink %q -> %q outside destination", target, hdr.Linkname)
			}

			trueTarget, err := filepath.EvalSymlinks(target)
			if err != nil {
				return err
			}
			if !strings.HasPrefix(trueTarget, dest) {
				return fmt.Errorf("hardlink %q -> %q outside destination", target, hdr.Linkname)
			}
CVE-2023-26054: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2023-03-06T19:15Z
Repository: https://github.com/moby/buildkit
Language: Unknown
Commit date: 2023-03-06 14:39:19 +0000
Commit message: Merge pull request from GHSA-gc89-7gcr-jxqc

provenance: ensure URLs are redacted before written
CVE-2024-34342: Insufficient Information (NVD-CWE-noinfo)
value: react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-07T15:15Z
Repository: https://github.com/wojtekmaj/react-pdf
Language: Other
Files changed: packages/react-pdf/src/Document.tsx
Commit date: 2024-05-07 15:38:29 +0200
Commit message: Force isEvalSupported to false

Fixes [GHSA-wgrm-67xf-hhpq](https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq)

Diff: diff --git a/packages/react-pdf/src/Document.tsx b/packages/react-pdf/src/Document.tsx
index 59dcfa4..0dd7999 100644
--- a/packages/react-pdf/src/Document.tsx
+++ b/packages/react-pdf/src/Document.tsx
@@ -503,11 +503,11 @@ const Document = forwardRef(function Document(
   function loadDocument() {
     if (!source) {
       return;
     }
 
-    const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: true };
+    const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: false };
 
     const documentInitParams: Source = {
       ...source,
       ...optionsWithModifiedIsEvalSupported,
     };

Vulnerable code:     const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: true };
Fixed code:     const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: false };
CVE-2017-8807: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFP_GetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore transient objects.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.1
Published: 2017-11-16T02:29Z
Repository: https://github.com/varnishcache/varnish-cache
Language: C
Files changed: bin/varnishd/cache/cache_fetch.c
Commit date: 2017-09-19 10:59:16 +0200
Commit message: Avoid buffer read overflow on vcl_error and -sfile

The file stevedore may return a buffer larger than asked for when
requesting storage. Due to lack of check for this condition, the code
to copy the synthetic error memory buffer from vcl_error would overrun
the buffer.

Patch by @shamger

Fixes: #2429

Diff: diff --git a/bin/varnishd/cache/cache_fetch.c b/bin/varnishd/cache/cache_fetch.c
index 20b359601..883964239 100644
--- a/bin/varnishd/cache/cache_fetch.c
+++ b/bin/varnishd/cache/cache_fetch.c
@@ -897,10 +897,12 @@ vbf_stp_error(struct worker *wrk, struct busyobj *bo)
 	o = 0;
 	while (ll > 0) {
 		l = ll;
 		if (VFP_GetStorage(bo->vfc, &l, &ptr) != VFP_OK)
 			break;
+		if (l > ll)
+			l = ll;
 		memcpy(ptr, VSB_data(synth_body) + o, l);
 		VFP_Extend(bo->vfc, l);
 		ll -= l;
 		o += l;
 	}

Fixed code: 		if (l > ll)
			l = ll;
CVE-2022-23603: Improper Encoding or Escaping of Output (CWE-116)
value: iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.1
Published: 2022-02-01T11:15Z
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Language: Unknown
Commit date: 2022-01-29 20:07:29 +0000
Commit message: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix
CVE-2022-23603: Improper Encoding or Escaping of Output (CWE-116)
value: iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 6.1
Published: 2022-02-01T11:15Z
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Language: Unknown
Commit date: 2022-01-29 20:20:01 +0000
Commit message: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix 2
CVE-2022-23609: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2022-02-04T23:15Z
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Language: Python
Files changed: upload/server.py
Commit date: 2022-02-02 19:27:04 +0000
Commit message: quick security fix

Diff: diff --git a/upload/server.py b/upload/server.py
index 8d68d39..2ac1967 100644
--- a/upload/server.py
+++ b/upload/server.py
@@ -3,11 +3,11 @@ import base64
 import io
 import logging
 import random
 from html import escape
 from os import remove
-
+import werkzeug.utils
 import magic
 from flask import Flask, abort, request
 from PIL import Image
 
 app = Flask(__name__)
@@ -187,11 +187,11 @@ def uploadimage():
     while (
         length > cache
     ):  # if it is not over the limit, it will skip. if it is, it does this.
         # if we have gone over our cache limit, let's delete the first entry.
         filename = all_files[0][1] + all_files[0][2]
-        remove(filename)
+        remove(werkzeug.utils.secure_filename(filename))
         del all_files[0]
         length = len(all_files)
 
     f = open("all_files", "w")
     f.write(str(all_files))

Vulnerable code: 
        remove(filename)
Fixed code: import werkzeug.utils
        remove(werkzeug.utils.secure_filename(filename))
CVE-2022-23611: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-02-04T23:15Z
Repository: https://github.com/bildsben/iTunesRPC-Remastered
Language: Python
Files changed: module/connect_to_server.py
Commit date: 2022-02-02 20:06:56 +0000
Commit message: small fix

Diff: diff --git a/module/connect_to_server.py b/module/connect_to_server.py
index b4c4b9f..eede571 100644
--- a/module/connect_to_server.py
+++ b/module/connect_to_server.py
@@ -22,13 +22,15 @@ def get(image_file, domain, title, singer, album):
     import ast
     import base64
     import json
     import os
     from html import unescape
-
+    import werkzeug.utils
     import requests
 
+    image_file = werkzeug.utils.secure_filename(ast.literal_eval(image_file))
+
     api = f"http://{domain}:7873/bGVhdmVfcmlnaHRfbm93"
 
     with open(image_file, "rb") as f:
         im_bytes = f.read()
         f.close()

Fixed code:     import werkzeug.utils
    image_file = werkzeug.utils.secure_filename(ast.literal_eval(image_file))
CVE-2022-1341: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2022-04-18T17:15Z
Repository: https://github.com/vgropp/bwm-ng
Language: C
Files changed: src/options.c
Commit date: 2020-07-27 09:25:09 +0200
Commit message: Fix https://github.com/vgropp/bwm-ng/issues/26

Diff: diff --git a/src/options.c b/src/options.c
index 78e1c2d..c3610c3 100644
--- a/src/options.c
+++ b/src/options.c
@@ -333,10 +333,14 @@ void get_cmdln_options(int argc, char *argv[]) {
         read_config("/etc/bwm-ng.conf");
 #ifdef HAVE_GETPWUID    
         pwd_entry=getpwuid(getuid());
         if (pwd_entry!=NULL) {
             str=(char*)malloc(strlen(pwd_entry->pw_dir)+14);
+            if(!str) {
+              printf("Fatal: failed to allocate %zu bytes.\n", strlen(pwd_entry->pw_dir)+14);
+              exit(EXIT_FAILURE);
+            }
             snprintf(str,strlen(pwd_entry->pw_dir)+14,"%s/.bwm-ng.conf",pwd_entry->pw_dir);
             read_config(str);
             free(str);
         }
 #endif    

Fixed code:             if(!str) {
              printf("Fatal: failed to allocate %zu bytes.\n", strlen(pwd_entry->pw_dir)+14);
              exit(EXIT_FAILURE);
            }
CVE-2016-7452: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.5
Published: 2016-11-03T10:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/pixidou/controllers/pixidouController.php
Commit date: 2016-09-14 17:50:30 -0400
Commit message: security fix to pixidou editor

Diff: diff --git a/framework/modules/pixidou/controllers/pixidouController.php b/framework/modules/pixidou/controllers/pixidouController.php
index f6bf2b8a8c..14afb2284a 100755
--- a/framework/modules/pixidou/controllers/pixidouController.php
+++ b/framework/modules/pixidou/controllers/pixidouController.php
@@ -56,12 +56,15 @@ class pixidouController extends expController {
 		    redirect_to(array("controller"=>'file',"action"=>'picker',"ajax_action"=>1,"update"=>$this->params['update'],"filter"=>$this->params['filter']));
 	    }
     }
     
     public function exitEditor() {
-
-        //eDebug($this->params,true);
+        // clean up parameters
+        $this->params['fid'] = intval($this->params['fid']);
+        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
+            $this->params['exitType'] = 'error';
+        }
         switch ($this->params['exitType']) {
             case 'saveAsCopy':
                 $oldimage = new expFile($this->params['fid']);                
                 $copyname = expFile::resolveDuplicateFilename($oldimage->path); 
                 copy(BASE.$this->cacheDir."/".$this->params['cpi'],$oldimage->directory.$copyname); //copy the edited file over to the files dir

Vulnerable code: 
        //eDebug($this->params,true);
Fixed code:         // clean up parameters
        $this->params['fid'] = intval($this->params['fid']);
        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
            $this->params['exitType'] = 'error';
        }
CVE-2016-7453: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2016-11-03T10:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/pixidou/controllers/pixidouController.php
Commit date: 2016-09-14 17:50:30 -0400
Commit message: security fix to pixidou editor

Diff: diff --git a/framework/modules/pixidou/controllers/pixidouController.php b/framework/modules/pixidou/controllers/pixidouController.php
index f6bf2b8a8c..14afb2284a 100755
--- a/framework/modules/pixidou/controllers/pixidouController.php
+++ b/framework/modules/pixidou/controllers/pixidouController.php
@@ -56,12 +56,15 @@ class pixidouController extends expController {
 		    redirect_to(array("controller"=>'file',"action"=>'picker',"ajax_action"=>1,"update"=>$this->params['update'],"filter"=>$this->params['filter']));
 	    }
     }
     
     public function exitEditor() {
-
-        //eDebug($this->params,true);
+        // clean up parameters
+        $this->params['fid'] = intval($this->params['fid']);
+        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
+            $this->params['exitType'] = 'error';
+        }
         switch ($this->params['exitType']) {
             case 'saveAsCopy':
                 $oldimage = new expFile($this->params['fid']);                
                 $copyname = expFile::resolveDuplicateFilename($oldimage->path); 
                 copy(BASE.$this->cacheDir."/".$this->params['cpi'],$oldimage->directory.$copyname); //copy the edited file over to the files dir

Vulnerable code: 
        //eDebug($this->params,true);
Fixed code:         // clean up parameters
        $this->params['fid'] = intval($this->params['fid']);
        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
            $this->params['exitType'] = 'error';
        }