Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2011-0530: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request.  NOTE: this issue exists because of a CVE-2005-3534 regression.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2011-02-22T19:00Z
Repository: https://github.com/yoe/nbd
Language: C
Files changed: nbd-server.c
Commit date: 2011-01-27 22:32:53 +0100
Commit message: Fix buffer size checking

Yes, this means we've re-introduced CVE-2005-3534. Sigh.

Diff: diff --git a/nbd-server.c b/nbd-server.c
index 820458c..b47da86 100644
--- a/nbd-server.c
+++ b/nbd-server.c
@@ -148,11 +148,11 @@ gboolean do_oldstyle=FALSE;
  * integer, so set all bits except for the leftmost one.
  **/
 #define OFFT_MAX ~((off_t)1<<(sizeof(off_t)*8-1))
 #define LINELEN 256	  /**< Size of static buffer used to read the
 			       authorization file (yuck) */
-#define BUFSIZE (1024*1024) /**< Size of buffer that can hold requests */
+#define BUFSIZE ((1024*1024)+sizeof(struct nbd_reply)) /**< Size of buffer that can hold requests */
 #define DIFFPAGESIZE 4096 /**< diff file uses those chunks */
 #define F_READONLY 1      /**< flag to tell us a file is readonly */
 #define F_MULTIFILE 2	  /**< flag to tell us a file is exported using -m */
 #define F_COPYONWRITE 4	  /**< flag to tell us a file is exported using
 			    copyonwrite */
@@ -1387,11 +1387,11 @@ int mainloop(CLIENT *client) {
 
 		len = ntohl(request.len);
 
 		if (request.magic != htonl(NBD_REQUEST_MAGIC))
 			err("Not enough magic.");
-		if (len > BUFSIZE + sizeof(struct nbd_reply))
+		if (len > BUFSIZE - sizeof(struct nbd_reply))
 			err("Request too big!");
 #ifdef DODBG
 		printf("%s from %llu (%llu) len %d, ", request.type ? "WRITE" :
 				"READ", (unsigned long long)request.from,
 				(unsigned long long)request.from / 512, len);

Vulnerable code: #define BUFSIZE (1024*1024) /**< Size of buffer that can hold requests */
		if (len > BUFSIZE + sizeof(struct nbd_reply))
Fixed code: #define BUFSIZE ((1024*1024)+sizeof(struct nbd_reply)) /**< Size of buffer that can hold requests */
		if (len > BUFSIZE - sizeof(struct nbd_reply))
CVE-2023-41910: Out-of-bounds Read (CWE-125)
value: An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2023-09-05T07:15Z
Repository: https://github.com/lldpd/lldpd
Language: Other
Files changed: NEWS, src/daemon/protocols/cdp.c
Commit date: 2023-04-12 20:42:02 +0200
Commit message: daemon: fix read overflow when parsing CDP addresses

Diff: diff --git a/NEWS b/NEWS
index 003325ae..ffc8e804 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,9 @@
+lldpd (1.0.17)
+ * Fix:
+   + Read overflow when parsing CDP addresses. Thanks to Matteo Memelli.
+
 lldpd (1.0.16)
  * Fix:
    + Do not use 00:00:00:00:00:00 as chassis ID.
    + Do not busy loop when an interface with a neighbor disappears.
 
diff --git a/src/daemon/protocols/cdp.c b/src/daemon/protocols/cdp.c
index 8a1be863..42861c0e 100644
--- a/src/daemon/protocols/cdp.c
+++ b/src/daemon/protocols/cdp.c
@@ -464,10 +464,11 @@ cdp_decode(struct lldpd *cfg, char *frame, int s, struct lldpd_hardware *hardwar
 					    "received on %s",
 					    hardware->h_ifname);
 					goto malformed;
 				}
 				PEEK_DISCARD(address_len);
+				addresses_len -= address_len;
 				(void)PEEK_SAVE(pos_next_address);
 				/* Next, we go back and try to extract
 				   IPv4 address */
 				PEEK_RESTORE(pos_address);
 				if ((PEEK_UINT8 == 1) && (PEEK_UINT8 == 1) &&

Fixed code: lldpd (1.0.17)
 * Fix:
   + Read overflow when parsing CDP addresses. Thanks to Matteo Memelli.

				addresses_len -= address_len;
CVE-2018-3726: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-06-07T02:29Z
Repository: https://github.com/omphalos/crud-file-server
Language: JavaScript
Files changed: crud-file-server.js
Commit date: 2018-02-14 17:29:21 -0600
Commit message: Fix not sanitizing file names rendered in html

Diff: diff --git a/crud-file-server.js b/crud-file-server.js
index ad8ae00..c6147c2 100644
--- a/crud-file-server.js
+++ b/crud-file-server.js
@@ -138,11 +138,13 @@ exports.handleRequest = function(vpath, path, req, res, readOnly, logHeadRequest
 														res.write('<html><body>');
 														for(var f = 0; f < results.length; f++) {
 															var name = results[f].name;
 															var normalized = url + '/' + name;
 															while(normalized[0] == '/') { normalized = normalized.slice(1, normalized.length); }
-															res.write('\r\n<p><a href="/' + normalized + '">' + name + '</a></p>');
+															if(normalized.indexOf('"') >= 0) throw new Error('unsupported file name')
+															name = name.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+															res.write('\r\n<p><a href="/' + normalized + '"><span>' + name + '</span></a></p>');
 														}
 														res.end('\r\n</body></html>');
 													}
 												}
 											};

Vulnerable code: 															res.write('\r\n<p><a href="/' + normalized + '">' + name + '</a></p>');
Fixed code: 															if(normalized.indexOf('"') >= 0) throw new Error('unsupported file name')
															name = name.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
															res.write('\r\n<p><a href="/' + normalized + '"><span>' + name + '</span></a></p>');
CVE-2018-3733: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malicious user to read content of any file with known path.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-05-29T20:29Z
Repository: https://github.com/omphalos/crud-file-server
Language: JSON
Files changed: crud-file-server.js, package.json
Commit date: 2018-02-15 18:31:49 -0600
Commit message: Fix canonicalization of directories

Diff: diff --git a/crud-file-server.js b/crud-file-server.js
index c6147c2..2aa4ea7 100644
--- a/crud-file-server.js
+++ b/crud-file-server.js
@@ -1,11 +1,11 @@
 var fs = require('fs');
 
 // don't let users crawl up the folder structure by using a/../../../c/d
 var cleanUrl = function(url) { 
 	url = decodeURIComponent(url);
-	while(url.indexOf('..').length > 0) { url = url.replace('..', ''); }
+	while(url.indexOf('..') >= 0) { url = url.replace('..', ''); }
 	return url;
 };
 
 /*  
 example usage:
diff --git a/package.json b/package.json
index 35ee0d3..0ad39f3 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "crud-file-server",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "file server supporting basic create, read, update, & delete for any kind of file",
   "bin": {
     "crud-file-server": "./bin/crud-file-server"
   },
   "main": "./crud-file-server.js",

Vulnerable code: 	while(url.indexOf('..').length > 0) { url = url.replace('..', ''); }
  "version": "0.8.0",
Fixed code: 	while(url.indexOf('..') >= 0) { url = url.replace('..', ''); }
  "version": "0.9.0",
CVE-2022-36028: Insufficient Information (NVD-CWE-noinfo)
value: Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-25T21:15Z
Repository: https://github.com/bigbluebutton/greenlight
Language: Ruby
Files changed: app/controllers/concerns/authenticator.rb, spec/controllers/sessions_controller_spec.rb
Commit date: 2022-07-11 14:29:35 -0400
Commit message: Added additional check when redirecting with return_to (#3631)

* Added additional check when redirecting with return_to

* Fixed test
Diff: diff --git a/app/controllers/concerns/authenticator.rb b/app/controllers/concerns/authenticator.rb
index 88e5e3d..64ad144 100644
--- a/app/controllers/concerns/authenticator.rb
+++ b/app/controllers/concerns/authenticator.rb
@@ -48,11 +48,13 @@ module Authenticator
 
       unless ENV['OAUTH2_REDIRECT'].nil?
         dont_redirect_to.push(File.join(ENV['OAUTH2_REDIRECT'], "auth", "openid_connect", "callback"))
       end
 
-      url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
+      valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host
+
+      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
         cookies[:return_to]
       elsif user.role.get_permission("can_create_rooms")
         user.main_room
       else
         cant_create_rooms_path
diff --git a/spec/controllers/sessions_controller_spec.rb b/spec/controllers/sessions_controller_spec.rb
index 366428c..ae3e971 100644
--- a/spec/controllers/sessions_controller_spec.rb
+++ b/spec/controllers/sessions_controller_spec.rb
@@ -169,11 +169,11 @@ describe SessionsController, type: :controller do
 
     it "redirects the user to the page they clicked sign in from" do
       user = create(:user, provider: "greenlight",
         password: "Example1!", password_confirmation: 'example')
 
-      url = Faker::Internet.domain_name
+      url = "http://test.host/test"
 
       @request.cookies[:return_to] = url
 
       post :create, params: {
         session: {

Vulnerable code:       url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
      url = Faker::Internet.domain_name
Fixed code:       valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host

      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
      url = "http://test.host/test"
CVE-2022-36029: Insufficient Information (NVD-CWE-noinfo)
value: Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-25T21:15Z
Repository: https://github.com/bigbluebutton/greenlight
Language: Ruby
Files changed: app/controllers/concerns/authenticator.rb, spec/controllers/sessions_controller_spec.rb
Commit date: 2022-07-11 14:29:35 -0400
Commit message: Added additional check when redirecting with return_to (#3631)

* Added additional check when redirecting with return_to

* Fixed test
Diff: diff --git a/app/controllers/concerns/authenticator.rb b/app/controllers/concerns/authenticator.rb
index 88e5e3d..64ad144 100644
--- a/app/controllers/concerns/authenticator.rb
+++ b/app/controllers/concerns/authenticator.rb
@@ -48,11 +48,13 @@ module Authenticator
 
       unless ENV['OAUTH2_REDIRECT'].nil?
         dont_redirect_to.push(File.join(ENV['OAUTH2_REDIRECT'], "auth", "openid_connect", "callback"))
       end
 
-      url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
+      valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host
+
+      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
         cookies[:return_to]
       elsif user.role.get_permission("can_create_rooms")
         user.main_room
       else
         cant_create_rooms_path
diff --git a/spec/controllers/sessions_controller_spec.rb b/spec/controllers/sessions_controller_spec.rb
index 366428c..ae3e971 100644
--- a/spec/controllers/sessions_controller_spec.rb
+++ b/spec/controllers/sessions_controller_spec.rb
@@ -169,11 +169,11 @@ describe SessionsController, type: :controller do
 
     it "redirects the user to the page they clicked sign in from" do
       user = create(:user, provider: "greenlight",
         password: "Example1!", password_confirmation: 'example')
 
-      url = Faker::Internet.domain_name
+      url = "http://test.host/test"
 
       @request.cookies[:return_to] = url
 
       post :create, params: {
         session: {

Vulnerable code:       url = if cookies[:return_to] && !dont_redirect_to.include?(cookies[:return_to])
      url = Faker::Internet.domain_name
Fixed code:       valid_url = cookies[:return_to] && URI.parse(cookies[:return_to]).host == URI.parse(request.original_url).host

      url = if cookies[:return_to] && valid_url && !dont_redirect_to.include?(cookies[:return_to])
      url = "http://test.host/test"
CVE-2017-9841: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2017-06-27T17:29Z
Repository: https://github.com/sebastianbergmann/phpunit
Language: PHP
Files changed: src/Util/PHP/Template/TestCaseMethod.tpl.dist, src/Util/PHP/eval-stdin.php
Commit date: 2016-11-13 18:52:50 +0100
Commit message: Correct fix for #1956

Diff: diff --git a/src/Util/PHP/Template/TestCaseMethod.tpl.dist b/src/Util/PHP/Template/TestCaseMethod.tpl.dist
index c1d14ddc..b48f354c 100644
--- a/src/Util/PHP/Template/TestCaseMethod.tpl.dist
+++ b/src/Util/PHP/Template/TestCaseMethod.tpl.dist
@@ -53,11 +53,11 @@ function __phpunit_run_isolated_test()
     $output = '';
     if (!$test->hasExpectationOnOutput()) {
         $output = $test->getActualOutput();
     }
 
-    rewind(STDOUT);
+    @rewind(STDOUT); /* @ as not every STDOUT target stream is rewindable */
     if ($stdout = stream_get_contents(STDOUT)) {
         $output = $stdout . $output;
     }
 
     print serialize(
diff --git a/src/Util/PHP/eval-stdin.php b/src/Util/PHP/eval-stdin.php
index fe1b8bd3..3b3a6d03 100644
--- a/src/Util/PHP/eval-stdin.php
+++ b/src/Util/PHP/eval-stdin.php
@@ -1,3 +1,3 @@
 <?php
 
-eval('?>' . file_get_contents('php://input'));
+eval('?>' . file_get_contents('php://stdin'));

Vulnerable code:     rewind(STDOUT);
eval('?>' . file_get_contents('php://input'));
Fixed code:     @rewind(STDOUT); /* @ as not every STDOUT target stream is rewindable */
eval('?>' . file_get_contents('php://stdin'));
CVE-2023-46237: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10, an endpoint intended to offer limited enumeration abilities to authenticated users was accessible to unauthenticated users. This enabled unauthenticated users to discover files and their respective paths that were visible to the Apache user group. Version 1.5.10 contains a patch for this issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-10-31T15:15Z
Repository: https://github.com/FOGProject/fogproject
Language: PHP
Files changed: packages/web/status/getfiles.php
Commit date: 2023-01-29 02:32:41 +0100
Commit message: Add authentication check in getfiles to prevent file enumeration, thanks to @0x41c


Diff: diff --git a/packages/web/status/getfiles.php b/packages/web/status/getfiles.php
index 285d2bd695..30f9c6daeb 100644
--- a/packages/web/status/getfiles.php
+++ b/packages/web/status/getfiles.php
@@ -20,10 +20,20 @@
  * @author   Tom Elliott <tommygunsster@gmail.com>
  * @license  http://opensource.org/licenses/gpl-3.0 GPLv3
  * @link     https://fogproject.org
  */
 require '../commons/base.inc.php';
+
+// Prevent file enumeration by an unauthenticated user
+$unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
+    || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';
+
+if ($unauthorized) {
+    echo _('Unauthorized');
+    exit;
+}
+
 if (!is_string($_GET['path'])) {
     echo json_encode(
         _('Invalid')
     );
     exit;

Fixed code: 
// Prevent file enumeration by an unauthenticated user
$unauthorized = !$currentUser->isValid() || empty($_SERVER['HTTP_X_REQUESTED_WITH'])
    || strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) !== 'xmlhttprequest';

if ($unauthorized) {
    echo _('Unauthorized');
    exit;
}
CVE-2021-28280: Cross-Site Request Forgery (CSRF) (CWE-352)
value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.1
Published: 2021-04-29T15:15Z
Repository: https://github.com/PHPFusion/PHPFusion
Language: PHP
Files changed: includes/classes/PHPFusion/Search/Search_Engine.php
Commit date: 2021-03-10 17:19:02 +0800
Commit message: Fixes broken rendering trying to parse against <script> input values.

Diff: diff --git a/includes/classes/PHPFusion/Search/Search_Engine.php b/includes/classes/PHPFusion/Search/Search_Engine.php
index d0af9993d..0ad12eac9 100644
--- a/includes/classes/PHPFusion/Search/Search_Engine.php
+++ b/includes/classes/PHPFusion/Search/Search_Engine.php
@@ -306,11 +306,11 @@ class Search_Engine extends Search_Model {
             'order'        => self::$search_order,
             'forum_id'     => self::$forum_id,
             'memory_limit' => self::$memory_limit,
             'composevars'  => self::$composevars,
             'rowstart'     => self::$rowstart,
-            'search_param' => htmlentities(self::$search_param),
+            'search_param' => self::$search_param,
         ];
 
         return $key === NULL ? $info : (isset($info[$key]) ? $info[$key] : NULL);
     }
 

Vulnerable code:             'search_param' => htmlentities(self::$search_param),
Fixed code:             'search_param' => self::$search_param,
CVE-2021-28280: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-04-29T15:15Z
Repository: https://github.com/PHPFusion/PHPFusion
Language: PHP
Files changed: includes/classes/PHPFusion/Search/Search_Engine.php
Commit date: 2021-03-10 17:19:02 +0800
Commit message: Fixes broken rendering trying to parse against <script> input values.

Diff: diff --git a/includes/classes/PHPFusion/Search/Search_Engine.php b/includes/classes/PHPFusion/Search/Search_Engine.php
index d0af9993d..0ad12eac9 100644
--- a/includes/classes/PHPFusion/Search/Search_Engine.php
+++ b/includes/classes/PHPFusion/Search/Search_Engine.php
@@ -306,11 +306,11 @@ class Search_Engine extends Search_Model {
             'order'        => self::$search_order,
             'forum_id'     => self::$forum_id,
             'memory_limit' => self::$memory_limit,
             'composevars'  => self::$composevars,
             'rowstart'     => self::$rowstart,
-            'search_param' => htmlentities(self::$search_param),
+            'search_param' => self::$search_param,
         ];
 
         return $key === NULL ? $info : (isset($info[$key]) ? $info[$key] : NULL);
     }
 

Vulnerable code:             'search_param' => htmlentities(self::$search_param),
Fixed code:             'search_param' => self::$search_param,
CVE-2019-25086: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in IET-OU Open Media Player up to 1.5.0. It has been declared as problematic. This vulnerability affects the function webvtt of the file application/controllers/timedtext.php. The manipulation of the argument ttml_url leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.5.1 is able to address this issue. The name of the patch is 3f39f2d68d11895929c04f7b49b97a734ae7cd1f. It is recommended to upgrade the affected component. VDB-216862 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-12-27T09:15Z
Repository: https://github.com/IET-OU/open-media-player
Language: PHP
Files changed: application/controllers/timedtext.php
Commit date: 2019-07-12 12:44:42 +0100
Commit message: Bug #93, fix for security vulnerability in `Timedtext` controller

* https://iet.eu.teamwork.com/desk/#/tickets/366419

Diff: diff --git a/application/controllers/timedtext.php b/application/controllers/timedtext.php
index 3c196de..7523bc2 100644
--- a/application/controllers/timedtext.php
+++ b/application/controllers/timedtext.php
@@ -37,10 +37,16 @@ class Timedtext extends MY_Controller { #CI_Controller {
 
     if (! $ttml_url) {
       $this->_error("Error, 'url' is a required parameter.", 400);
     }
 
+    // Security.
+    if (! preg_match('@^https?:\/\/podcast.open.ac.uk\/@', $ttml_url)) {
+      $this->_error("Error, bad 'url' parameter.", 400);
+      return;
+    }
+
     $p = parse_url($ttml_url);
 
 
     // A naive check for SRT captions, from VLE etc.
     $is_srt = 'srt' == pathinfo($p['path'], PATHINFO_EXTENSION);

Fixed code:     // Security.
    if (! preg_match('@^https?:\/\/podcast.open.ac.uk\/@', $ttml_url)) {
      $this->_error("Error, bad 'url' parameter.", 400);
      return;
    }
CVE-2020-5205: Session Fixation (CWE-384)
value: In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 5.4
Published: 2020-01-09T02:15Z
Repository: https://github.com/danschultzer/pow
Language: Unknown
Commit date: 2020-01-07 20:13:06 -0800
Commit message: Merge pull request from GHSA-v2wf-c3j6-wpvw

Renew plug session when pow session is rolled
CVE-2019-9734: Insertion of Sensitive Information into Log File (CWE-532)
value: Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration parameters under certain circumstances.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 7.5
Published: 2019-04-24T15:29Z
Repository: https://github.com/aquaverde/aquarius-core
Language: PHP
Files changed: lib/log.php
Commit date: 2019-03-15 21:00:06 +0100
Commit message: Fix CVE-2019-9734
Diff: diff --git a/lib/log.php b/lib/log.php
index a1cc77a3..ee071a6e 100644
--- a/lib/log.php
+++ b/lib/log.php
@@ -164,17 +164,15 @@ class Logger {
             $showrequest = false; // Maybe show _REQUEST array
             // Process exceptions
             if ($msg instanceof Exception || $msg instanceof Error) {
                 $excmessage = method_exists($msg, 'getDetailMessage') ? $msg->getDetailMessage() : $msg->getMessage();
                 $logmessage = $leveltext.": ".$excmessage."\n".Log::prettybacktrace($msg->getTrace());
-                $showrequest = true;
             } else {
                 $logmessage = $leveltext.": ". print_r($msg,true)."\n";
                 // Generate a backtrace if it was requested or in severe cases
                 if ($level == Log::BACKTRACE || $level >= Log::FAIL) {
                     $backtrace = "\n".Log::prettybacktrace();
-                    $showrequest = true;
                 }
             }
 
             if (!headers_sent() && $level >= $this->firelevel) {
                 $this->log_firephp($msg,$level);

Vulnerable code:                 $showrequest = true;
                    $showrequest = true;
CVE-2024-32478: Insufficient Information (NVD-CWE-noinfo)
value: Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privileges. This vulnerability is fixed in 2.5.0.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T15:15Z
Repository: https://github.com/git-ecosystem/git-credential-manager
Language: Unknown
Commit date: 2024-04-18 15:48:44 -0700
Commit message: Merge pull request from GHSA-3c3g-h9rx-f7vq

linux: ensure Debian package files are owned by root
CVE-2022-0711: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2022-03-02T22:15Z
Repository: https://github.com/haproxy/haproxy
Language: C
Files changed: src/http_ana.c
Commit date: 2022-02-16 14:42:13 +0100
Commit message: BUG/MAJOR: http/htx: prevent unbounded loop in http_manage_server_side_cookies

Ensure calls to http_find_header() terminate. If a "Set-Cookie2"
header is found then the while(1) loop in
http_manage_server_side_cookies() will never terminate, resulting in
the watchdog firing and the process terminating via SIGABRT.

The while(1) loop becomes unbounded because an unmatched call to
http_find_header("Set-Cookie") will leave ctx->blk=NULL. Subsequent
calls to check for "Set-Cookie2" will now enumerate from the beginning
of all the blocks and will once again match on subsequent
passes (assuming a match first time around), hence the loop becoming
unbounded.

This issue was introduced with HTX and this fix should be backported
to all versions supporting HTX.

Many thanks to Grant Spence (gspence@redhat.com) for working through
this issue with me.

Diff: diff --git a/src/http_ana.c b/src/http_ana.c
index 715dd3a5c..c2d9d9b43 100644
--- a/src/http_ana.c
+++ b/src/http_ana.c
@@ -3416,11 +3416,11 @@ static void http_manage_server_side_cookies(struct stream *s, struct channel *re
 
 	ctx.blk = NULL;
 	while (1) {
 		int is_first = 1;
 
-		if (!http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
+		if (is_cookie2 || !http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
 			if (!http_find_header(htx, ist("Set-Cookie2"), &ctx, 1))
 				break;
 			is_cookie2 = 1;
 		}
 

Vulnerable code: 		if (!http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
Fixed code: 		if (is_cookie2 || !http_find_header(htx, ist("Set-Cookie"), &ctx, 1)) {
CVE-2018-25082: Improper Restriction of XML External Entity Reference (CWE-611)
value: A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2023-03-21T18:15Z
Repository: https://github.com/zwczou/weixin-python
Language: Python
Files changed: weixin/msg.py, weixin/pay.py
Commit date: 2018-07-04 11:58:08 +0800
Commit message: 安全修复：防范XML外部实体注入漏洞（XXE）
参考：https://pay.weixin.qq.com/wiki/doc/api/jsapi.php?chapter=23_5

Diff: diff --git a/weixin/msg.py b/weixin/msg.py
index cb4e74a..89806b0 100644
--- a/weixin/msg.py
+++ b/weixin/msg.py
@@ -62,11 +62,12 @@ class WeixinMsg(object):
         hsh = hashlib.sha1(s.encode("utf-8")).hexdigest()
         return signature == hsh
 
     def parse(self, content):
         raw = {}
-        root = etree.fromstring(content)
+        root = etree.fromstring(content,
+                                parser=etree.XMLParser(resolve_entities=False))
         for child in root:
             raw[child.tag] = child.text
 
         formatted = self.format(raw)
         msg_type = formatted['type']
diff --git a/weixin/pay.py b/weixin/pay.py
index 4ab8cfb..1f8e231 100644
--- a/weixin/pay.py
+++ b/weixin/pay.py
@@ -77,11 +77,12 @@ class WeixinPay(object):
         s = "<xml>{0}</xml>".format(s)
         return s.encode("utf-8")
 
     def to_dict(self, content):
         raw = {}
-        root = etree.fromstring(content.encode("utf-8"))
+        root = etree.fromstring(content.encode("utf-8"),
+                                parser=etree.XMLParser(resolve_entities=False))
         for child in root:
             raw[child.tag] = child.text
         return raw
 
     def _fetch(self, url, data, use_cert=False):

Vulnerable code:         root = etree.fromstring(content)
        root = etree.fromstring(content.encode("utf-8"))
Fixed code:         root = etree.fromstring(content,
                                parser=etree.XMLParser(resolve_entities=False))
        root = etree.fromstring(content.encode("utf-8"),
                                parser=etree.XMLParser(resolve_entities=False))
CVE-2011-4969: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-03-08T22:55Z
Repository: https://github.com/jquery/jquery
Language: Unknown
Commit date: 2011-08-25 12:16:46 -0700
Commit message: Merge pull request #474 from dmethvin/fix-9521-xss-hash

Fixes #9521. Prioritize #id over <tag> to avoid XSS via location.hash.
CVE-2019-11358: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 6.1
Published: 2019-04-20T00:29Z
Repository: https://github.com/jquery/jquery
Language: JavaScript
Files changed: src/core.js, test/unit/core.js
Commit date: 2019-03-25 17:57:30 +0100
Commit message: Core: Prevent Object.prototype pollution for $.extend( true, ... )

Closes gh-4333
Diff: diff --git a/src/core.js b/src/core.js
index d9c7e988..3ef92d48 100644
--- a/src/core.js
+++ b/src/core.js
@@ -156,12 +156,13 @@ jQuery.extend = jQuery.fn.extend = function() {
 
 			// Extend the base object
 			for ( name in options ) {
 				copy = options[ name ];
 
+				// Prevent Object.prototype pollution
 				// Prevent never-ending loop
-				if ( target === copy ) {
+				if ( name === "__proto__" || target === copy ) {
 					continue;
 				}
 
 				// Recurse if we're merging plain objects or arrays
 				if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
diff --git a/test/unit/core.js b/test/unit/core.js
index 8205aa24..28f40ab5 100644
--- a/test/unit/core.js
+++ b/test/unit/core.js
@@ -1060,10 +1060,17 @@ QUnit.test( "jQuery.extend(true,{},{a:[], o:{}}); deep copy with array, followed
 
 	assert.deepEqual( result, initial, "The [result] and [initial] have equal shape and values" );
 	assert.ok( !Array.isArray( result.object ), "result.object wasn't paved with an empty array" );
 } );
 
+QUnit.test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
+	assert.expect( 1 );
+
+	jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
+	assert.ok( !( "devMode" in {} ), "Object.prototype not polluted" );
+} );
+
 QUnit.test( "jQuery.each(Object,Function)", function( assert ) {
 	assert.expect( 23 );
 
 	var i, label, seen, callback;
 

Vulnerable code: 				if ( target === copy ) {
Fixed code: 				// Prevent Object.prototype pollution
				if ( name === "__proto__" || target === copy ) {
QUnit.test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
	assert.expect( 1 );

	jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
	assert.ok( !( "devMode" in {} ), "Object.prototype not polluted" );
} );
CVE-2020-19611: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-07T16:15Z
Repository: https://github.com/RackTables/racktables
Language: Other
Files changed: ChangeLog, wwwroot/index.php
Commit date: 2019-06-11 15:46:27 +0100
Commit message: fix an XSS issue in an error message

The issue was reported by Diego Di Nardo.

Diff: diff --git a/ChangeLog b/ChangeLog
index 0004e358..3585f430 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,8 @@
 0.21.3
 	update: add a log entry limit to the object page (Mantis#769)
+	bugfix: fix an XSS issue in an error message
 0.21.2 2019-03-25
 	update: enable CSS and JavaScript from external URLs (GH#231)
 	update: 802.1Q: do permission check for changing native vlan while keeping the allowed vlans list unchanged
 	update: 802.1Q: foreign VLANs (missing from the vlan domain list) are not propagated to uplinks
 	update: ability to extend supported device breed list via plug-in
diff --git a/wwwroot/index.php b/wwwroot/index.php
index 95ec6251..ca360b40 100644
--- a/wwwroot/index.php
+++ b/wwwroot/index.php
@@ -217,16 +217,18 @@ try {
 			$location = buildRedirectURL();
 			// FIXME: find a better way to handle this error
 			if ($op == 'addFile' && !isset($_FILES['file']['error']))
 				throw new RackTablesError ('File upload error, check upload_max_filesize in php.ini', RackTablesError::MISCONFIGURED);
 			fixContext();
+			// This could be a malformed request rather than an internal error, but spelling
+			// that in proper detail would require finer checks.
 			if
 			(
 				! isset ($ophandler[$pageno][$tabno][$op]) ||
 				! is_callable ($ophandler[$pageno][$tabno][$op])
 			)
-				throw new RackTablesError ("Invalid navigation data for '${pageno}-${tabno}-${op}'", RackTablesError::INTERNAL);
+				throw new RackTablesError ('This request has no ophandler function.', RackTablesError::INTERNAL);
 			// We have a chance to handle an error before starting HTTP header.
 			if (!isset ($delayauth["${pageno}-${tabno}-${op}"]))
 				assertPermission();
 			# Call below does the job of bypass argument assertion, if such is required,
 			# so the ophandler function doesn't have to re-assert this portion of its

Vulnerable code: 				throw new RackTablesError ("Invalid navigation data for '${pageno}-${tabno}-${op}'", RackTablesError::INTERNAL);
Fixed code: 	bugfix: fix an XSS issue in an error message
			// This could be a malformed request rather than an internal error, but spelling
			// that in proper detail would require finer checks.
				throw new RackTablesError ('This request has no ophandler function.', RackTablesError::INTERNAL);
CVE-2021-23419: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-08-08T08:15Z
Repository: https://github.com/samholmes/node-open-graph
Language: JavaScript
Files changed: index.js
Commit date: 2021-08-03 09:31:10 -0700
Commit message: Patch: Filter out blacklisted keys in og property name

Diff: diff --git a/index.js b/index.js
index 50a6020..be75277 100644
--- a/index.js
+++ b/index.js
@@ -8,10 +8,15 @@ var shorthandProperties = {
 	"image": "image:url",
 	"video": "video:url",
 	"audio": "audio:url"
 }
 
+var keyBlacklist = [
+	'__proto__',
+	'constructor',
+	'prototype'
+]
 
 exports = module.exports = function(url, cb, options){
   var userAgent = (options || {}).userAgent || 'NodeOpenGraphCrawler (https://github.com/samholmes/node-open-graph)'
 	exports.getHTML(url, userAgent, function(err, html){
 		if (err) return cb(err);
@@ -120,10 +125,12 @@ exports.parse = function($, options){
 		// as long as there's one key left, we're dealing with a sub-node and not a value
 
 		while (keys.length > 1) {
 			key = keys.shift();
 
+			if (keyBlacklist.includes(key)) continue
+
 			if (Array.isArray(ptr[key])) {
 				// the last index of ptr[key] should become
 				// the object we are examining.
 				tmp = ptr[key].length-1;
 				ptr = ptr[key];

Fixed code: var keyBlacklist = [
	'__proto__',
	'constructor',
	'prototype'
]
			if (keyBlacklist.includes(key)) continue
CVE-2019-13240: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 5.9
Published: 2019-07-10T14:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: inc/user.class.php
Commit date: 2019-03-12 11:26:26 +0100
Commit message: Password token date was not removed

Diff: diff --git a/inc/user.class.php b/inc/user.class.php
index b96f845cc..4f482e3ad 100755
--- a/inc/user.class.php
+++ b/inc/user.class.php
@@ -4513,11 +4513,11 @@ class User extends CommonDBTM {
                if (!$this->update($input)) {
                   return false;
                }
                $input2 = [
                   'password_forget_token'      => '',
-                  'password_forget_token_date' => null,
+                  'password_forget_token_date' => 'NULL',
                   'id'                         => $this->fields['id']
                ];
                $this->update($input2);
                return true;
 

Vulnerable code:                   'password_forget_token_date' => null,
Fixed code:                   'password_forget_token_date' => 'NULL',
CVE-2019-13240: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 5.9
Published: 2019-07-10T14:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: inc/user.class.php
Commit date: 2019-02-15 14:22:08 +0100
Commit message: Fix password forget token check; fixes #5386
Diff: diff --git a/inc/user.class.php b/inc/user.class.php
index f5e86039f..b4ca2a9ec 100755
--- a/inc/user.class.php
+++ b/inc/user.class.php
@@ -4390,11 +4390,11 @@ class User extends CommonDBTM {
       $token_ok = false;
       $iterator = $DB->request([
          'FROM'   => self::getTable(),
          'WHERE'  => [
             'password_forget_token'       => $token,
-            new \QueryExpression('NOW() < ADDDATE(password_forget_token_date, INTERVAL 1 DAY))')
+            new \QueryExpression('NOW() < ADDDATE(' . $DB->quoteName('password_forget_token_date') . ', INTERVAL 1 DAY)')
          ]
       ]);
 
       if (count($iterator) == 1) {
          $token_ok = true;

Vulnerable code:             new \QueryExpression('NOW() < ADDDATE(password_forget_token_date, INTERVAL 1 DAY))')
Fixed code:             new \QueryExpression('NOW() < ADDDATE(' . $DB->quoteName('password_forget_token_date') . ', INTERVAL 1 DAY)')
CVE-2020-15177: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-10-07T19:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: install/install.php
Commit date: 2020-10-06 13:58:15 +0200
Commit message: Merge pull request from GHSA-prvh-9m4h-4m79


Diff: diff --git a/install/install.php b/install/install.php
index 8c7cc5a80b6..f10834b58ba 100644
--- a/install/install.php
+++ b/install/install.php
@@ -596,14 +596,21 @@ function checkConfigFile() {
       Html::redirect($CFG_GLPI['root_doc'] ."/index.php");
       die();
    }
 }
 
-if (!isset($_POST["install"])) {
+if (!isset($_SESSION['can_process_install']) || !isset($_POST["install"])) {
    $_SESSION = [];
 
    checkConfigFile();
+
+   // Add a flag that will be used to validate that installation can be processed.
+   // This flag is put here just after checking that DB config file does not exist yet.
+   // It is mandatory to validate that `Etape_4` to `Etape_6` are not used outside installation process
+   // to change GLPI base URL without even being authenticated.
+   $_SESSION['can_process_install'] = true;
+
    header_html("Select your language");
    choose_language();
 
 } else {
    // Check valid Referer :

Vulnerable code: if (!isset($_POST["install"])) {
Fixed code: if (!isset($_SESSION['can_process_install']) || !isset($_POST["install"])) {

   // Add a flag that will be used to validate that installation can be processed.
   // This flag is put here just after checking that DB config file does not exist yet.
   // It is mandatory to validate that `Etape_4` to `Etape_6` are not used outside installation process
   // to change GLPI base URL without even being authenticated.
   $_SESSION['can_process_install'] = true;
CVE-2020-15217: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.3
Published: 2020-10-07T19:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: inc/knowbaseitem.class.php
Commit date: 2020-10-06 13:58:51 +0200
Commit message: Merge pull request from GHSA-x9hg-j29f-wvvv


Diff: diff --git a/inc/knowbaseitem.class.php b/inc/knowbaseitem.class.php
index e9e3365dd13..5399aa2b663 100644
--- a/inc/knowbaseitem.class.php
+++ b/inc/knowbaseitem.class.php
@@ -1290,11 +1290,13 @@ class KnowbaseItem extends CommonDBVisible implements ExtraVisibilityCriteria {
                      ];
                   }
 
                }
 
-               $search_where = ['OR' => $ors];
+               $search_where =  $criteria['WHERE']; // Visibility restrict criteria
+
+               $search_where[] = ['OR' => $ors];
 
                // Add visibility date
                $visibility_crit = [
                   [
                      'OR'  => [

Vulnerable code:                $search_where = ['OR' => $ors];
Fixed code:                $search_where =  $criteria['WHERE']; // Visibility restrict criteria

               $search_where[] = ['OR' => $ors];