Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-11411: Out-of-bounds Write (CWE-787)
value: An issue was discovered in Artifex MuJS 1.0.5. The Number#toFixed() and numtostr implementations in jsnumber.c have a stack-based buffer overflow.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-04-22T11:29Z
Repository: https://github.com/ccxvii/mujs
Language: C
Files changed: jsnumber.c
Commit date: 2019-04-02 10:55:22 +0200
Commit message: Bug 700938: Fix stack overflow in numtostr as used by Number#toFixed().

32 is not enough to fit sprintf("%.20f", 1e20).
We need at least 43 bytes to fit that format.
Bump the static buffer size.

Diff: diff --git a/jsnumber.c b/jsnumber.c
index 15c26e8..7050ff3 100644
--- a/jsnumber.c
+++ b/jsnumber.c
@@ -25,11 +25,11 @@ static void Np_valueOf(js_State *J)
 	js_pushnumber(J, self->u.number);
 }
 
 static void Np_toString(js_State *J)
 {
-	char buf[32];
+	char buf[100];
 	js_Object *self = js_toobject(J, 0);
 	int radix = js_isundefined(J, 1) ? 10 : js_tointeger(J, 1);
 	if (self->type != JS_CNUMBER)
 		js_typeerror(J, "not a number");
 	if (radix == 10) {
@@ -40,11 +40,10 @@ static void Np_toString(js_State *J)
 		js_rangeerror(J, "invalid radix");
 
 	/* lame number to string conversion for any radix from 2 to 36 */
 	{
 		static const char digits[] = "0123456789abcdefghijklmnopqrstuvwxyz";
-		char buf[100];
 		double number = self->u.number;
 		int sign = self->u.number < 0;
 		js_Buffer *sb = NULL;
 		uint64_t u, limit = ((uint64_t)1<<52);
 
@@ -113,11 +112,12 @@ static void Np_toString(js_State *J)
 }
 
 /* Customized ToString() on a number */
 static void numtostr(js_State *J, const char *fmt, int w, double n)
 {
-	char buf[32], *e;
+	/* buf needs to fit printf("%.20f", 1e20) */
+	char buf[50], *e;
 	sprintf(buf, fmt, w, n);
 	e = strchr(buf, 'e');
 	if (e) {
 		int exp = atoi(e+1);
 		sprintf(e, "e%+d", exp);

Vulnerable code: 	char buf[32];
		char buf[100];
	char buf[32], *e;
Fixed code: 	char buf[100];
	/* buf needs to fit printf("%.20f", 1e20) */
	char buf[50], *e;
CVE-2019-11412: Always-Incorrect Control Flow Implementation (CWE-670)
value: An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) because it lacks an ENDTRY opcode call.
CWE description: The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CVSS v3 base score: 7.5
Published: 2019-04-22T11:29Z
Repository: https://github.com/ccxvii/mujs
Language: C
Files changed: jscompile.c
Commit date: 2019-04-04 12:41:02 +0200
Commit message: Bug 700947: Add missing ENDTRY opcode in try/catch/finally byte code.

In one of the code branches in handling exceptions in the catch block
we forgot to call the ENDTRY opcode to pop the inner hidden try.
This leads to an unbalanced exception stack which can cause a crash
due to us jumping to a stack frame that has already been exited.

Diff: diff --git a/jscompile.c b/jscompile.c
index b37776b..a0b276a 100644
--- a/jscompile.c
+++ b/jscompile.c
@@ -1021,10 +1021,11 @@ static void ctrycatchfinally(JF, js_Ast *trystm, js_Ast *catchvar, js_Ast *catch
 		}
 		emitline(J, F, catchvar);
 		emitstring(J, F, OP_CATCH, catchvar->string);
 		cstm(J, F, catchstm);
 		emit(J, F, OP_ENDCATCH);
+		emit(J, F, OP_ENDTRY);
 		L3 = emitjump(J, F, OP_JUMP); /* skip past the try block to the finally block */
 	}
 	label(J, F, L1);
 	cstm(J, F, trystm);
 	emit(J, F, OP_ENDTRY);

Fixed code: 		emit(J, F, OP_ENDTRY);
CVE-2021-33796: Use After Free (CWE-416)
value: In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.


CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2023-07-07T18:15Z
Repository: https://github.com/ccxvii/mujs
Language: C
Files changed: jsrun.c
Commit date: 2021-04-23 11:13:50 +0200
Commit message: Fix use-after-free in regexp source property access.

The underlying string of the "source" property of a regular expression
object can be freed if the regexp is garbage collected.

This could lead to a use-after-free, because the accessor incorrectly
assumed that the regexp source was an interned (thus never freed) string.
Fix this by calling js_pushstring instead of the faster but unsafe
js_pushliteral.

Many thanks to Connor Nelson for spotting this!

Diff: diff --git a/jsrun.c b/jsrun.c
index 2809979..c6b2066 100644
--- a/jsrun.c
+++ b/jsrun.c
@@ -520,11 +520,11 @@ static int jsR_hasproperty(js_State *J, js_Object *obj, const char *name)
 		}
 	}
 
 	else if (obj->type == JS_CREGEXP) {
 		if (!strcmp(name, "source")) {
-			js_pushliteral(J, obj->u.r.source);
+			js_pushstring(J, obj->u.r.source);
 			return 1;
 		}
 		if (!strcmp(name, "global")) {
 			js_pushboolean(J, obj->u.r.flags & JS_REGEXP_G);
 			return 1;

Vulnerable code: 			js_pushliteral(J, obj->u.r.source);
Fixed code: 			js_pushstring(J, obj->u.r.source);
CVE-2021-33797: Integer Overflow or Wraparound (CWE-190)
value: Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow happens when js_strtod() reads in floating point exponent, which leads to a buffer overflow in the pointer *d.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2023-04-17T22:15Z
Repository: https://github.com/ccxvii/mujs
Language: C
Files changed: jsdtoa.c
Commit date: 2021-04-21 12:25:48 +0200
Commit message: Issue #148: Check for overflow when reading floating point exponent.

GCC with -O2 optimizes away the if(exp<-maxExponent) branch completely,
so we don't end up with the expected '512' value for overflowing
exponents. Limit the exponent parsing to MAX_INT instead to prevent
signed overflow from tripping up over-eager optimizing compilers.

Diff: diff --git a/jsdtoa.c b/jsdtoa.c
index 858017d..97cac11 100644
--- a/jsdtoa.c
+++ b/jsdtoa.c
@@ -689,14 +689,16 @@ js_strtod(const char *string, char **endPtr)
 			if (*p == '+') {
 				p += 1;
 			}
 			expSign = FALSE;
 		}
-		while ((*p >= '0') && (*p <= '9')) {
+		while ((*p >= '0') && (*p <= '9') && exp < INT_MAX/10) {
 			exp = exp * 10 + (*p - '0');
 			p += 1;
 		}
+		while ((*p >= '0') && (*p <= '9'))
+			p += 1;
 	}
 	if (expSign) {
 		exp = fracExp - exp;
 	} else {
 		exp = fracExp + exp;

Vulnerable code: 		while ((*p >= '0') && (*p <= '9')) {
Fixed code: 		while ((*p >= '0') && (*p <= '9') && exp < INT_MAX/10) {
		while ((*p >= '0') && (*p <= '9'))
			p += 1;
CVE-2014-4908: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-11T11:08Z
Repository: https://github.com/lingej/pnp4nagios
Language: PHP
Files changed: share/pnp/application/views/template.php
Commit date: 2014-06-13 14:14:30 +0200
Commit message: Plug potential XSS hole in views/template.php

REQUEST_URI needs to be sanitized if used. Since we want to refresh
to the same page there is no need to set the URI.

Signed-off-by: Mikael Falkvidd <mfalkvidd@op5.com>

Diff: diff --git a/share/pnp/application/views/template.php b/share/pnp/application/views/template.php
index 109902f..0cce888 100644
--- a/share/pnp/application/views/template.php
+++ b/share/pnp/application/views/template.php
@@ -2,11 +2,11 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-<meta http-equiv="refresh" content="<?php echo $this->config->conf['refresh'] ?>; url=<?php echo $_SERVER['REQUEST_URI'] ?>" />
+<meta http-equiv="refresh" content="<?php echo $this->config->conf['refresh'] ?>" />
 <title><?php if (isset($this->title)) echo html::specialchars($this->title) ?></title>
 <?php echo html::stylesheet('media/css/common.css') ?>
 <?php echo html::stylesheet('media/css/imgareaselect-default.css') ?>
 <?php echo html::stylesheet('media/css/ui-'.$this->theme.'/jquery-ui.css') ?>
 <?php echo html::link('media/images/favicon.ico','icon','image/ico') ?>

Vulnerable code: <meta http-equiv="refresh" content="<?php echo $this->config->conf['refresh'] ?>; url=<?php echo $_SERVER['REQUEST_URI'] ?>" />
Fixed code: <meta http-equiv="refresh" content="<?php echo $this->config->conf['refresh'] ?>" />
CVE-2014-4908: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-11T11:08Z
Repository: https://github.com/lingej/pnp4nagios
Language: PHP
Files changed: share/pnp/application/views/kohana_error_page.php
Commit date: 2014-06-13 10:25:22 +0200
Commit message: pnp/views/kohana_error_page: plug another XSS hole

By issuing the request
GET pnp/$item?996fb"><script>alert(1)</script><"951e1=1
an alert is triggered in the meta refresh tag.

The hole is plugged by not setting the URL of the meta refresh.
The default behavior is to refresh the current page, which is what
we want anyway.

Change-Id: I6af0b15c929f95d651a576d46b99d2e1a88fe601

Signed-off-by: Mikael Falkvidd <mfalkvidd@op5.com>

Diff: diff --git a/share/pnp/application/views/kohana_error_page.php b/share/pnp/application/views/kohana_error_page.php
index a950616..490ed62 100644
--- a/share/pnp/application/views/kohana_error_page.php
+++ b/share/pnp/application/views/kohana_error_page.php
@@ -2,11 +2,11 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 <?php if(isset ( $_SERVER['REQUEST_URI'])):?> 
-<meta http-equiv="refresh" content="60; url=<?php echo $_SERVER['REQUEST_URI'] ?>">
+<meta http-equiv="refresh" content="60">
 <?php endif ?>
 <title><?php echo $error ?></title>
 <?php echo html::stylesheet('media/css/common.css') ?>
 <?php echo html::stylesheet('media/css/ui-'.Kohana::config('core.theme').'/jquery-ui.css') ?>
 <?php echo html::link('media/images/favicon.ico','icon','image/ico') ?>

Vulnerable code: <meta http-equiv="refresh" content="60; url=<?php echo $_SERVER['REQUEST_URI'] ?>">
Fixed code: <meta http-equiv="refresh" content="60">
CVE-2024-32650: Insufficient Information (NVD-CWE-noinfo)
value: Rustls is a modern TLS library written in Rust. `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input. When using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server's `complete_io` will get in an infinite loop. This vulnerability is fixed in 0.23.5, 0.22.4, and 0.21.11.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T16:15Z
Repository: https://github.com/rustls/rustls
Language: Rust
Files changed: rustls/src/common_state.rs
Commit date: 2024-04-19 15:01:19 +0000
Commit message: Don't specially handle unauthenticated close_notify alerts

Diff: diff --git a/rustls/src/common_state.rs b/rustls/src/common_state.rs
index a1afbb3e..19589cf6 100644
--- a/rustls/src/common_state.rs
+++ b/rustls/src/common_state.rs
@@ -429,12 +429,12 @@ impl CommonState {
                 Error::AlertReceived(alert.description),
             ));
         }
 
         // If we get a CloseNotify, make a note to declare EOF to our
-        // caller.
-        if alert.description == AlertDescription::CloseNotify {
+        // caller.  But do not treat unauthenticated alerts like this.
+        if self.may_receive_application_data && alert.description == AlertDescription::CloseNotify {
             self.has_received_close_notify = true;
             return Ok(());
         }
 
         // Warnings are nonfatal for TLS1.2, but outlawed in TLS1.3

Vulnerable code:         // caller.
        if alert.description == AlertDescription::CloseNotify {
Fixed code:         // caller.  But do not treat unauthenticated alerts like this.
        if self.may_receive_application_data && alert.description == AlertDescription::CloseNotify {
CVE-2021-21363: Creation of Temporary File With Insecure Permissions (CWE-378)
value: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
CWE description: Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
CVSS v3 base score: 7
Published: 2021-03-11T03:15Z
Repository: https://github.com/swagger-api/swagger-codegen
Language: Unknown
Commit date: 2021-03-02 11:05:49 +0100
Commit message: Merge pull request from GHSA-pc22-3g76-gm6j

 security: use java.nio.files in Generator.
CVE-2021-21363: Creation of Temporary File in Directory with Insecure Permissions (CWE-379)
value: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
CWE description: The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
CVSS v3 base score: 7
Published: 2021-03-11T03:15Z
Repository: https://github.com/swagger-api/swagger-codegen
Language: Unknown
Commit date: 2021-03-02 11:05:49 +0100
Commit message: Merge pull request from GHSA-pc22-3g76-gm6j

 security: use java.nio.files in Generator.
CVE-2021-21364: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 5.5
Published: 2021-03-11T03:15Z
Repository: https://github.com/swagger-api/swagger-codegen
Language: Unknown
Commit date: 2021-03-02 11:35:11 +0100
Commit message: Merge pull request from GHSA-hpv8-9rq5-hq7w

security: fix CWE-378 CWE-200 CWE-732 - use java.nio.files
CVE-2012-10005: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-12T16:15Z
Repository: https://github.com/manikandan170890/php-form-builder-class
Language: PHP
Files changed: PFBC/Base.php, PFBC/Element/Textarea.php
Commit date: 2012-11-23 03:23:42 +0000
Commit message: Updated Base class' filter method to use htmlspecialchars, which should help in preventing XSS vulnerabilities.  This change was in response to http://code.google.com/p/php-form-builder-class/issues/detail?id=184.

Diff: diff --git a/PFBC/Base.php b/PFBC/Base.php
index 766069e..fdbeaaa 100644
--- a/PFBC/Base.php
+++ b/PFBC/Base.php
@@ -46,11 +46,11 @@ abstract class Base {
 		echo "<pre>", print_r($this, true), "</pre>";
 	}
 
 	/*This method prevents double/single quotes in html attributes from breaking the markup.*/
 	protected function filter($str) {
-		return str_replace('"', '&quot;', $str);
+		return htmlspecialchars($str);
 	}
 
 	/*This method is used by the Form class and all Element classes to return a string of html
 	attributes.  There is an ignore parameter that allows special attributes from being included.*/
 	public function getAttributes($ignore = "") {
diff --git a/PFBC/Element/Textarea.php b/PFBC/Element/Textarea.php
index 30ecb69..813d685 100644
--- a/PFBC/Element/Textarea.php
+++ b/PFBC/Element/Textarea.php
@@ -5,9 +5,9 @@ class Textarea extends \PFBC\Element {
 	protected $attributes = array("rows" => "5");
 
 	public function render() {
         echo "<textarea", $this->getAttributes("value"), ">";
         if(!empty($this->attributes["value"]))
-            echo $this->attributes["value"];
+            echo $this->filter($this->attributes["value"]);
         echo "</textarea>";
     }
 }

Vulnerable code: 		return str_replace('"', '&quot;', $str);
            echo $this->attributes["value"];
Fixed code: 		return htmlspecialchars($str);
            echo $this->filter($this->attributes["value"]);
CVE-2022-0323: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2022-01-21T18:15Z
Repository: https://github.com/bobthecow/mustache.php
Language: PHP
Files changed: src/Mustache/Compiler.php
Commit date: 2022-01-21 01:08:36 -0500
Commit message: Fix CVE-2022-0323 (improper neutralization of section names) 

- Fixes possible RCE when rendering untrusted user templates.
- Remove unnecessary comments in generated source.

Diff: diff --git a/src/Mustache/Compiler.php b/src/Mustache/Compiler.php
index 2fa1a73..93a295a 100644
--- a/src/Mustache/Compiler.php
+++ b/src/Mustache/Compiler.php
@@ -318,11 +318,10 @@ class Mustache_Compiler
 
         return $key;
     }
 
     const SECTION_CALL = '
-        // %s section
         $value = $context->%s(%s);%s
         $buffer .= $this->section%s($context, $indent, $value);
     ';
 
     const SECTION = '
@@ -389,15 +388,14 @@ class Mustache_Compiler
 
         $method  = $this->getFindMethod($id);
         $id      = var_export($id, true);
         $filters = $this->getFilters($filters, $level);
 
-        return sprintf($this->prepare(self::SECTION_CALL, $level), $id, $method, $id, $filters, $key);
+        return sprintf($this->prepare(self::SECTION_CALL, $level), $method, $id, $filters, $key);
     }
 
     const INVERTED_SECTION = '
-        // %s inverted section
         $value = $context->%s(%s);%s
         if (empty($value)) {
             %s
         }
     ';
@@ -416,11 +414,11 @@ class Mustache_Compiler
     {
         $method  = $this->getFindMethod($id);
         $id      = var_export($id, true);
         $filters = $this->getFilters($filters, $level);
 
-        return sprintf($this->prepare(self::INVERTED_SECTION, $level), $id, $method, $id, $filters, $this->walk($nodes, $level));
+        return sprintf($this->prepare(self::INVERTED_SECTION, $level), $method, $id, $filters, $this->walk($nodes, $level));
     }
 
     const PARTIAL_INDENT = ', $indent . %s';
     const PARTIAL = '
         if ($partial = $this->mustache->loadPartial(%s)) {

Vulnerable code:         // %s section
        return sprintf($this->prepare(self::SECTION_CALL, $level), $id, $method, $id, $filters, $key);
        // %s inverted section
        return sprintf($this->prepare(self::INVERTED_SECTION, $level), $id, $method, $id, $filters, $this->walk($nodes, $level));
Fixed code:         return sprintf($this->prepare(self::SECTION_CALL, $level), $method, $id, $filters, $key);
        return sprintf($this->prepare(self::INVERTED_SECTION, $level), $method, $id, $filters, $this->walk($nodes, $level));
CVE-2022-3988: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includes/navbar/navbar_search.html of the component Search. The manipulation of the argument q leads to cross site scripting. The attack may be launched remotely. The name of the patch is bfab7191543961c6cb77fe267063877c31b616ce. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213560.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-11-14T11:15Z
Repository: https://github.com/frappe/frappe
Language: HTML
Files changed: frappe/templates/includes/navbar/navbar_search.html
Commit date: 2022-11-11 18:11:45 +0530
Commit message: fix(security): prevent xss attack in search (#18847)


Diff: diff --git a/frappe/templates/includes/navbar/navbar_search.html b/frappe/templates/includes/navbar/navbar_search.html
index 67b4d6505a..2602fe1f8c 100644
--- a/frappe/templates/includes/navbar/navbar_search.html
+++ b/frappe/templates/includes/navbar/navbar_search.html
@@ -1,9 +1,9 @@
 {% if navbar_search %}
 	<li>
 		<form action='/search'>
 		<input name='q' class='form-control navbar-search' type='text'
-			value='{{ frappe.form_dict.q or ''}}'
+			value='{{ frappe.form_dict.q|e or ''}}'
 			{% if not frappe.form_dict.q%}placeholder="{{ _("Search...") }}"{% endif %}>
 		</form>
 	</li>
-{% endif %}
\ No newline at end of file
+{% endif %}

Vulnerable code: 			value='{{ frappe.form_dict.q or ''}}'
{% endif %}
Fixed code: 			value='{{ frappe.form_dict.q|e or ''}}'
{% endif %}
CVE-2021-36977: Out-of-bounds Write (CWE-787)
value: matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2021-07-20T07:15Z
Repository: https://github.com/google/oss-fuzz-vulns
Language: YAML
Files changed: vulns/matio/OSV-2021-440.yaml
Commit date: 2021-11-23 20:59:10 +0100
Commit message: [matio] Fix 2021-440

CVE-2021-36977 was fixed en-passant when the libhdf5 dependency was updated from v1.12.0 to v.12.1 by https://github.com/google/oss-fuzz/commit/19ea576614a569893a1d8ed30d313d1cc25ac2cb. See also https://github.com/google/oss-fuzz/issues/4999 and https://github.com/HDFGroup/hdf5/issues/272.

FYI @inferno-chromium
Diff: diff --git a/vulns/matio/OSV-2021-440.yaml b/vulns/matio/OSV-2021-440.yaml
index d6c888f8..ef36741d 100644
--- a/vulns/matio/OSV-2021-440.yaml
+++ b/vulns/matio/OSV-2021-440.yaml
@@ -20,10 +20,11 @@ affected:
   ranges:
   - type: GIT
     repo: git://git.code.sf.net/p/matio/matio
     events:
     - introduced: 1ce8f2d1845ecdde19a35605cabdbb884776d52d
+    - fixed: cddcdad17864c4b95ead23581047b41636f180a3
   versions:
   - v1.5.20
   - v1.5.21
   ecosystem_specific:
     severity: HIGH

Fixed code:     - fixed: cddcdad17864c4b95ead23581047b41636f180a3
CVE-2020-12629: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-05-04T13:15Z
Repository: https://github.com/osticket/osticket
Language: PHP
Files changed: include/class.sla.php
Commit date: 2020-04-28 13:34:06 -0500
Commit message: xss: SLA Name

This mitigates an issue discovered by Gais Cyber Security where the SLA Name
can be exploited via XSS to execute code. This sanitizes the content for
`create()` and `update()` with `Format::htmlchars()` so we are safe from any
XSS attempts.

Diff: diff --git a/include/class.sla.php b/include/class.sla.php
index 12d7beab..af30a7b5 100644
--- a/include/class.sla.php
+++ b/include/class.sla.php
@@ -104,11 +104,11 @@ implements TemplateVariable {
             'graceperiod' => __("Grace Period (hrs)"),
         );
     }
 
     function update($vars, &$errors) {
-
+        $vars = Format::htmlchars($vars);
         if (!$vars['grace_period'])
             $errors['grace_period'] = __('Grace period required');
         elseif (!is_numeric($vars['grace_period']))
             $errors['grace_period'] = __('Numeric value required (in hours)');
         elseif ($vars['grace_period'] > 8760)
@@ -206,10 +206,11 @@ implements TemplateVariable {
 
         return $row ? $row[0] : 0;
     }
 
     static function create($vars=false, &$errors=array()) {
+        $vars = Format::htmlchars($vars);
         $sla = new static($vars);
         $sla->created = SqlFunction::NOW();
         return $sla;
     }
 

Fixed code:         $vars = Format::htmlchars($vars);
        $vars = Format::htmlchars($vars);
CVE-2023-1315: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-10T16:15Z
Repository: https://github.com/osticket/osticket
Language: PHP
Files changed: include/ajax.search.php, include/staff/templates/advanced-search.tmpl.php
Commit date: 2023-03-08 10:35:56 -0600
Commit message: xss: Search parent_id

This mitigates a vulnerability reported by @indevi0us where XSS is
possible via the parent_id parameter. This forces the parameter to an
INT so that there is no chance of XSS.

Diff: diff --git a/include/ajax.search.php b/include/ajax.search.php
index 56c0f3323..257564142 100644
--- a/include/ajax.search.php
+++ b/include/ajax.search.php
@@ -29,11 +29,11 @@ class SearchAjaxAPI extends AjaxController {
             Http::response(403, 'Agent login required');
 
         $search = new AdhocSearch(array(
             'root' => 'T',
             'staff_id' => $thisstaff->getId(),
-            'parent_id' => @$_GET['parent_id'] ?: 0,
+            'parent_id' => (int) @$_GET['parent_id'] ?: 0,
         ));
         if ($search->parent_id) {
             $search->flags |= SavedSearch::FLAG_INHERIT_COLUMNS;
         }
 
@@ -166,11 +166,11 @@ class SearchAjaxAPI extends AjaxController {
 
         $search = SavedSearch::create(array(
                     'title' => __('Add Queue'),
                     'root' => 'T',
                     'staff_id' => $thisstaff->getId(),
-                    'parent_id' =>  $_GET['pid'],
+                    'parent_id' => (int) $_GET['pid'],
                     ));
         $this->_tryAgain($search);
     }
 
     function saveSearch($id=0) {
diff --git a/include/staff/templates/advanced-search.tmpl.php b/include/staff/templates/advanced-search.tmpl.php
index 7bfc8bc2d..a9b3167e0 100644
--- a/include/staff/templates/advanced-search.tmpl.php
+++ b/include/staff/templates/advanced-search.tmpl.php
@@ -1,11 +1,11 @@
 <?php
 global $thisstaff;
 
-$parent_id = (isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
+$parent_id = (int) ((isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
         ? $_REQUEST['parent_id']
-        : $search->parent_id;
+        : $search->parent_id);
 if ($parent_id
     && is_numeric($parent_id)
     && (!($parent = SavedQueue::lookup($parent_id)))
 ) {
     $parent_id = 0;

Vulnerable code:             'parent_id' => @$_GET['parent_id'] ?: 0,
                    'parent_id' =>  $_GET['pid'],
$parent_id = (isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
        : $search->parent_id;
Fixed code:             'parent_id' => (int) @$_GET['parent_id'] ?: 0,
                    'parent_id' => (int) $_GET['pid'],
$parent_id = (int) ((isset($_REQUEST['parent_id']) && is_numeric($_REQUEST['parent_id']))
        : $search->parent_id);
CVE-2023-1316: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-10T16:15Z
Repository: https://github.com/osticket/osticket
Language: PHP
Files changed: include/class.email.php
Commit date: 2023-03-08 10:35:10 -0600
Commit message: xss: System Email

This mitigates a vulnerability reported by @edr4 where XSS is possible
via System Email. This adds sanitization to the email before
saving/displaying. This also forces the other options (topic,
department, etc.) to int so there is no chance of XSS.

Diff: diff --git a/include/class.email.php b/include/class.email.php
index 51d034ce8..c7464258c 100644
--- a/include/class.email.php
+++ b/include/class.email.php
@@ -406,16 +406,16 @@ class Email extends VerySimpleModel {
 
         if($errors) return false;
 
         $this->mail_errors = 0;
         $this->mail_lastfetch = null;
-        $this->email = $vars['email'];
+        $this->email = Format::sanitize($vars['email']);
         $this->name = Format::striptags($vars['name']);
-        $this->dept_id = $vars['dept_id'];
-        $this->priority_id = $vars['priority_id'];
-        $this->topic_id = $vars['topic_id'];
-        $this->noautoresp = $vars['noautoresp'];
+        $this->dept_id = (int) $vars['dept_id'];
+        $this->priority_id = (int) (isset($vars['priority_id']) ? $vars['priority_id'] : 0);
+        $this->topic_id = (int) $vars['topic_id'];
+        $this->noautoresp = (int) $vars['noautoresp'];
         $this->userid = $vars['userid'];
         $this->mail_active = $vars['mail_active'];
         $this->mail_host = $vars['mail_host'];
         $this->mail_folder = $vars['mail_folder'] ?: null;
         $this->mail_protocol = $vars['mail_protocol'] ?: 'POP';

Vulnerable code:         $this->email = $vars['email'];
        $this->dept_id = $vars['dept_id'];
        $this->priority_id = $vars['priority_id'];
        $this->topic_id = $vars['topic_id'];
        $this->noautoresp = $vars['noautoresp'];
Fixed code:         $this->email = Format::sanitize($vars['email']);
        $this->dept_id = (int) $vars['dept_id'];
        $this->priority_id = (int) (isset($vars['priority_id']) ? $vars['priority_id'] : 0);
        $this->topic_id = (int) $vars['topic_id'];
        $this->noautoresp = (int) $vars['noautoresp'];
CVE-2023-1317: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-10T16:15Z
Repository: https://github.com/osticket/osticket
Language: PHP
Files changed: include/ajax.orgs.php
Commit date: 2023-03-08 10:36:28 -0600
Commit message: xss: Organization Search q

This mitigates a vulnerability reported by @indevi0us where XSS is
possible via the `q` parameter in organization lookups. This sanitizes
the parameter value before use as well as htmlchars it before adding to
JSON output.

Diff: diff --git a/include/ajax.orgs.php b/include/ajax.orgs.php
index 4ba07cc12..6255d9479 100644
--- a/include/ajax.orgs.php
+++ b/include/ajax.orgs.php
@@ -28,11 +28,11 @@ class OrgsAjaxAPI extends AjaxController {
         }
 
         if (!$_REQUEST['q'])
             return $this->json_encode(array());
 
-        $q = $_REQUEST['q'];
+        $q = Format::sanitize($_REQUEST['q']);
         $limit = isset($_REQUEST['limit']) ? (int) $_REQUEST['limit']:25;
 
         if (strlen(Format::searchable($q)) < 3)
             return $this->encode(array());
 
@@ -53,11 +53,11 @@ class OrgsAjaxAPI extends AjaxController {
 
         $matched = array();
         foreach ($orgs as $O) {
             list($id, $name) = $O;
             $matched[] = array('name' => Format::htmlchars($name), 'info' => $name,
-                'id' => $id, '/bin/true' => $_REQUEST['q']);
+                'id' => $id, '/bin/true' => Format::htmlchars($q));
         }
 
         return $this->json_encode(array_values($matched));
 
     }

Vulnerable code:         $q = $_REQUEST['q'];
                'id' => $id, '/bin/true' => $_REQUEST['q']);
Fixed code:         $q = Format::sanitize($_REQUEST['q']);
                'id' => $id, '/bin/true' => Format::htmlchars($q));
CVE-2023-1318: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-10T16:15Z
Repository: https://github.com/osticket/osticket
Language: PHP
Files changed: include/class.osticket.php
Commit date: 2023-03-08 10:53:55 -0600
Commit message: xss: AJAX Paths

This mitigates a vulnerability reported by indevi0us where XSS is
possible via some AJAX paths.

Diff: diff --git a/include/class.osticket.php b/include/class.osticket.php
index 98e660e18..2835f6dbf 100644
--- a/include/class.osticket.php
+++ b/include/class.osticket.php
@@ -364,14 +364,14 @@ class osTicket {
         return db_input($this->get_var($index, $vars), $quote);
     }
 
     static function get_path_info() {
         if(isset($_SERVER['PATH_INFO']))
-            return $_SERVER['PATH_INFO'];
+            return htmlentities($_SERVER['PATH_INFO']);
 
         if(isset($_SERVER['ORIG_PATH_INFO']))
-            return $_SERVER['ORIG_PATH_INFO'];
+            return htmlentities($_SERVER['ORIG_PATH_INFO']);
 
         //TODO: conruct possible path info.
 
         return null;
     }

Vulnerable code:             return $_SERVER['PATH_INFO'];
            return $_SERVER['ORIG_PATH_INFO'];
Fixed code:             return htmlentities($_SERVER['PATH_INFO']);
            return htmlentities($_SERVER['ORIG_PATH_INFO']);
CVE-2023-1319: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-10T16:15Z
Repository: https://github.com/osticket/osticket
Language: PHP
Files changed: include/class.role.php
Commit date: 2023-03-08 10:50:07 -0600
Commit message: xss: Roles

This mitigates a vulnerability reported by indevi0us where XSS is
possible via the `name` parameter for Roles.

Diff: diff --git a/include/class.role.php b/include/class.role.php
index b4a8723bf..f2d07057d 100644
--- a/include/class.role.php
+++ b/include/class.role.php
@@ -154,23 +154,24 @@ class Role extends RoleModel {
         }
         $this->permissions = $permissions->toJson();
     }
 
     function update($vars, &$errors) {
-        if (!$vars['name'])
+        $name = Format::sanitize($vars['name']);
+        if (!$name)
             $errors['name'] = __('Name required');
-        elseif (($r=Role::lookup(array('name'=>$vars['name'])))
+        elseif (($r=Role::lookup(array('name'=>$name)))
                 && $r->getId() != $vars['id'])
             $errors['name'] = __('Name already in use');
         elseif (!$vars['perms'] || !count($vars['perms']))
             $errors['err'] = __('Must check at least one permission for the role');
 
         if ($errors)
             return false;
 
-        $this->name = $vars['name'];
-        $this->notes = $vars['notes'];
+        $this->name = $name;
+        $this->notes = Format::sanitize($vars['notes']);
 
         $this->updatePerms($vars['perms'], $errors);
 
         if (!$this->save(true))
             return false;

Vulnerable code:         if (!$vars['name'])
        elseif (($r=Role::lookup(array('name'=>$vars['name'])))
        $this->name = $vars['name'];
        $this->notes = $vars['notes'];
Fixed code:         $name = Format::sanitize($vars['name']);
        if (!$name)
        elseif (($r=Role::lookup(array('name'=>$name)))
        $this->name = $name;
        $this->notes = Format::sanitize($vars['notes']);
CVE-2024-23636: Deserialization of Untrusted Data (CWE-502)
value: SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But, prior to version 5.12.0, there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components. Version 5.12.0 fixed this issue by adding a blacklist. SOFARPC also provides a way to add additional blacklists. Users can add a class like `-Drpc_serialize_blacklist_override=org.apache.xpath.` to avoid this issue.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2024-01-23T18:15Z
Repository: https://github.com/sofastack/sofa-rpc
Language: Other
Files changed: codec/codec-api/src/main/resources/sofa-rpc/serialize_blacklist.txt
Commit date: 2024-01-09 16:22:48 +0800
Commit message: Merge pull request from GHSA-7q8p-9953-pxvr

Co-authored-by: liujianjun.ljj <liujianjun.ljj@antgroup.com>
Diff: diff --git a/codec/codec-api/src/main/resources/sofa-rpc/serialize_blacklist.txt b/codec/codec-api/src/main/resources/sofa-rpc/serialize_blacklist.txt
index 58269f89..ba6c18ce 100644
--- a/codec/codec-api/src/main/resources/sofa-rpc/serialize_blacklist.txt
+++ b/codec/codec-api/src/main/resources/sofa-rpc/serialize_blacklist.txt
@@ -33,17 +33,15 @@ groovy.lang.
 java.awt.
 java.beans.
 java.io.Closeable
 java.io.Serializable
 java.lang.AutoCloseable
-java.lang.Class
 java.lang.Cloneable
 java.lang.Iterable
 java.lang.ProcessBuilder
 java.lang.Readable
 java.lang.Runnable
-java.lang.Runtime
 java.lang.Thread
 java.lang.UNIXProcess
 java.net.InetAddress
 java.net.Socket
 java.net.URL

Vulnerable code: java.lang.Class
java.lang.Runtime
CVE-2018-15836: Improper Verification of Cryptographic Signature (CWE-347)
value: In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2018-09-26T21:29Z
Repository: https://github.com/xelerance/Openswan
Language: C
Files changed: lib/liboswkeys/signatures.c
Commit date: 2018-08-22 12:32:49 -0400
Commit message: wo#7449 . verify padding contents for IKEv2 RSA sig check

Special thanks to Sze Yiu Chau of Purdue University (schau@purdue.edu)
who reported the issue.

Diff: diff --git a/lib/liboswkeys/signatures.c b/lib/liboswkeys/signatures.c
index 27fd77e22..7f0fb90fb 100644
--- a/lib/liboswkeys/signatures.c
+++ b/lib/liboswkeys/signatures.c
@@ -155,12 +155,25 @@ err_t verify_signed_hash(const struct RSA_public_key *k
        || s[1] != 0x01
        || s[padlen+2] != 0x00) {
 	return "3""SIG padding does not check out";
     }
 
-    s += padlen + 3;
-    (*psig) = s;
+    /* signature starts after ASN wrapped padding [00,01,FF..FF,00] */
+    (*psig) = s + padlen + 3;
+
+    /* verify padding contents */
+    {
+        const u_char *p;
+        size_t cnt_ffs = 0;
+
+        for (p = s+2; p < s+padlen+2; p++)
+            if (*p == 0xFF)
+                cnt_ffs ++;
+
+        if (cnt_ffs != padlen)
+            return "4" "invalid Padding String";
+    }
 
     /* return SUCCESS */
     return NULL;
 }
 

Vulnerable code:     s += padlen + 3;
    (*psig) = s;
Fixed code:     /* signature starts after ASN wrapped padding [00,01,FF..FF,00] */
    (*psig) = s + padlen + 3;

    /* verify padding contents */
    {
        const u_char *p;
        size_t cnt_ffs = 0;

        for (p = s+2; p < s+padlen+2; p++)
            if (*p == 0xFF)
                cnt_ffs ++;

        if (cnt_ffs != padlen)
            return "4" "invalid Padding String";
    }
CVE-2021-3815: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-12-08T17:15Z
Repository: https://github.com/fabiocaccamo/utils.js
Language: JavaScript
Files changed: src/utils/ObjectUtil.js, test/test_object.js
Commit date: 2021-12-06 11:45:54 +0100
Commit message: Fixed prototype pollution. #6

Diff: diff --git a/src/utils/ObjectUtil.js b/src/utils/ObjectUtil.js
index e082be4..14c553f 100644
--- a/src/utils/ObjectUtil.js
+++ b/src/utils/ObjectUtil.js
@@ -215,10 +215,13 @@ ObjectUtil = {
             var keys = path.split('.');
             var key;
             var cursor = obj;
             for (var i = 0, j = keys.length; i < j; i++) {
                 key = keys[i];
+                if (key === '__proto__') {
+                    break;
+                }
                 if (!TypeUtil.isObject(cursor[key])) {
                     cursor[key] = {};
                 }
                 if (i < (j - 1)) {
                     cursor = cursor[key];
diff --git a/test/test_object.js b/test/test_object.js
index 4bf50e1..3d4f0cf 100644
--- a/test/test_object.js
+++ b/test/test_object.js
@@ -302,10 +302,15 @@ describe('object', function() {
         });
         it('test on 3 existing keys', function() {
             f(o, 'e.f.g', 'ok 2');
             test.assertEqual(o['e']['f']['g'], 'ok 2');
         });
+        it('test prototype pollution', function() {
+            f(o, '__proto__.polluted', true);
+            test.assertUndefined(o['polluted']);
+            test.assertUndefined({}.polluted);
+        });
     });
     describe('length', function() {
         var f = obj.length;
         it('test empty object', function() {
             var o1 = {};

Fixed code:                 if (key === '__proto__') {
                    break;
                }
        it('test prototype pollution', function() {
            f(o, '__proto__.polluted', true);
            test.assertUndefined(o['polluted']);
            test.assertUndefined({}.polluted);
        });
CVE-2014-10068: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden` is false.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-05-29T20:29Z
Repository: https://github.com/hapijs/inert
Language: Unknown
Commit date: 2014-12-04 13:13:55 -0800
Commit message: Merge pull request #15 from kanongil/hide-fix-1.1

Don't allow files in hidden directories to be served