Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2015-4335: DEPRECATED: Code (CWE-17)
value: Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
CWE description: This entry has been deprecated.  It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Published: 2015-06-09T14:59Z
Repository: https://github.com/antirez/redis
Language: C
Files changed: deps/lua/src/ldo.c
Commit date: 2015-06-03 13:33:28 +0200
Commit message: disable loading lua bytecode

Diff: diff --git a/deps/lua/src/ldo.c b/deps/lua/src/ldo.c
index d1bf786c..514f7a2a 100644
--- a/deps/lua/src/ldo.c
+++ b/deps/lua/src/ldo.c
@@ -493,11 +493,11 @@ static void f_parser (lua_State *L, void *ud) {
   Proto *tf;
   Closure *cl;
   struct SParser *p = cast(struct SParser *, ud);
   int c = luaZ_lookahead(p->z);
   luaC_checkGC(L);
-  tf = ((c == LUA_SIGNATURE[0]) ? luaU_undump : luaY_parser)(L, p->z,
+  tf = (luaY_parser)(L, p->z,
                                                              &p->buff, p->name);
   cl = luaF_newLclosure(L, tf->nups, hvalue(gt(L)));
   cl->l.p = tf;
   for (i = 0; i < tf->nups; i++)  /* initialize eventual upvalues */
     cl->l.upvals[i] = luaF_newupval(L);

Vulnerable code:   tf = ((c == LUA_SIGNATURE[0]) ? luaU_undump : luaY_parser)(L, p->z,
Fixed code:   tf = (luaY_parser)(L, p->z,
CVE-2018-11219: Integer Overflow or Wraparound (CWE-190)
value: An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-06-17T17:29Z
Repository: https://github.com/antirez/redis
Language: C
Files changed: deps/lua/src/lua_struct.c
Commit date: 2018-06-13 12:40:33 +0200
Commit message: Security: fix Lua struct package offset handling.

After the first fix to the struct package I found another similar
problem, which is fixed by this patch. It could be reproduced easily by
running the following script:

    return struct.unpack('f', "xxxxxxxxxxxxx",-3)

The above will access bytes before the 'data' pointer.

Diff: diff --git a/deps/lua/src/lua_struct.c b/deps/lua/src/lua_struct.c
index b03a002da..4d5f027b8 100644
--- a/deps/lua/src/lua_struct.c
+++ b/deps/lua/src/lua_struct.c
@@ -291,18 +291,22 @@ static lua_Number getinteger (const char *buff, int endian,
 static int b_unpack (lua_State *L) {
   Header h;
   const char *fmt = luaL_checkstring(L, 1);
   size_t ld;
   const char *data = luaL_checklstring(L, 2, &ld);
-  size_t pos = luaL_optinteger(L, 3, 1) - 1;
+  size_t pos = luaL_optinteger(L, 3, 1);
+  luaL_argcheck(L, pos > 0, 3, "offset must be 1 or greater");
+  pos--; /* Lua indexes are 1-based, but here we want 0-based for C
+          * pointer math. */
   int n = 0;  /* number of results */
   defaultoptions(&h);
   while (*fmt) {
     int opt = *fmt++;
     size_t size = optsize(L, opt, &fmt);
     pos += gettoalign(pos, &h, opt, size);
-    luaL_argcheck(L, pos+size <= ld, 2, "data string too short");
+    luaL_argcheck(L, size <= ld && pos <= ld - size,
+                   2, "data string too short");
     /* stack space for item + next position */
     luaL_checkstack(L, 2, "too many results");
     switch (opt) {
       case 'b': case 'B': case 'h': case 'H':
       case 'l': case 'L': case 'T': case 'i':  case 'I': {  /* integer types */

Vulnerable code:   size_t pos = luaL_optinteger(L, 3, 1) - 1;
    luaL_argcheck(L, pos+size <= ld, 2, "data string too short");
Fixed code:   size_t pos = luaL_optinteger(L, 3, 1);
  luaL_argcheck(L, pos > 0, 3, "offset must be 1 or greater");
  pos--; /* Lua indexes are 1-based, but here we want 0-based for C
          * pointer math. */
    luaL_argcheck(L, size <= ld && pos <= ld - size,
                   2, "data string too short");
CVE-2018-12453: Incorrect Type Conversion or Cast (CWE-704)
value: Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.
CWE description: The product does not correctly convert an object, resource, or structure from one type to a different type.
CVSS v3 base score: 7.5
Published: 2018-06-16T17:29Z
Repository: https://github.com/antirez/redis
Language: C
Files changed: src/t_stream.c
Commit date: 2018-06-10 08:55:58 -0700
Commit message: Abort in XGROUP if the key is not a stream

Diff: diff --git a/src/t_stream.c b/src/t_stream.c
index 075386dd3..c48928018 100644
--- a/src/t_stream.c
+++ b/src/t_stream.c
@@ -1574,11 +1574,11 @@ NULL
     char *opt = c->argv[1]->ptr; /* Subcommand name. */
 
     /* Lookup the key now, this is common for all the subcommands but HELP. */
     if (c->argc >= 4) {
         robj *o = lookupKeyWriteOrReply(c,c->argv[2],shared.nokeyerr);
-        if (o == NULL) return;
+        if (o == NULL || checkType(c,o,OBJ_STREAM)) return;
         s = o->ptr;
         grpname = c->argv[3]->ptr;
 
         /* Certain subcommands require the group to exist. */
         if ((cg = streamLookupCG(s,grpname)) == NULL &&

Vulnerable code:         if (o == NULL) return;
Fixed code:         if (o == NULL || checkType(c,o,OBJ_STREAM)) return;
CVE-2020-14147: Out-of-bounds Write (CWE-787)
value: An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.7
Published: 2020-06-15T18:15Z
Repository: https://github.com/antirez/redis
Language: C
Files changed: deps/lua/src/lua_struct.c
Commit date: 2020-02-10 16:32:46 +0900
Commit message: [FIX] revisit CVE-2015-8080 vulnerability

Diff: diff --git a/deps/lua/src/lua_struct.c b/deps/lua/src/lua_struct.c
index 4d5f027b8..c58c8e72b 100644
--- a/deps/lua/src/lua_struct.c
+++ b/deps/lua/src/lua_struct.c
@@ -87,16 +87,18 @@ typedef struct Header {
   int endian;
   int align;
 } Header;
 
 
-static int getnum (const char **fmt, int df) {
+static int getnum (lua_State *L, const char **fmt, int df) {
   if (!isdigit(**fmt))  /* no number? */
     return df;  /* return default value */
   else {
     int a = 0;
     do {
+      if (a > (INT_MAX / 10) || a * 10 > (INT_MAX - (**fmt - '0')))
+        luaL_error(L, "integral size overflow");
       a = a*10 + *((*fmt)++) - '0';
     } while (isdigit(**fmt));
     return a;
   }
 }
@@ -113,13 +115,13 @@ static size_t optsize (lua_State *L, char opt, const char **fmt) {
     case 'L': case 'l': return sizeof(long);
     case 'T': return sizeof(size_t);
     case 'f':  return sizeof(float);
     case 'd':  return sizeof(double);
     case 'x': return 1;
-    case 'c': return getnum(fmt, 1);
+    case 'c': return getnum(L, fmt, 1);
     case 'i': case 'I': {
-      int sz = getnum(fmt, sizeof(int));
+      int sz = getnum(L, fmt, sizeof(int));
       if (sz > MAXINTSIZE)
         luaL_error(L, "integral size %d is larger than limit of %d",
                        sz, MAXINTSIZE);
       return sz;
     }
@@ -148,11 +150,11 @@ static void controloptions (lua_State *L, int opt, const char **fmt,
   switch (opt) {
     case  ' ': return;  /* ignore white spaces */
     case '>': h->endian = BIG; return;
     case '<': h->endian = LITTLE; return;
     case '!': {
-      int a = getnum(fmt, MAXALIGN);
+      int a = getnum(L, fmt, MAXALIGN);
       if (!isp2(a))
         luaL_error(L, "alignment %d is not a power of 2", a);
       h->align = a;
       return;
     }

Vulnerable code: static int getnum (const char **fmt, int df) {
    case 'c': return getnum(fmt, 1);
      int sz = getnum(fmt, sizeof(int));
      int a = getnum(fmt, MAXALIGN);
Fixed code: static int getnum (lua_State *L, const char **fmt, int df) {
      if (a > (INT_MAX / 10) || a * 10 > (INT_MAX - (**fmt - '0')))
        luaL_error(L, "integral size overflow");
    case 'c': return getnum(L, fmt, 1);
      int sz = getnum(L, fmt, sizeof(int));
      int a = getnum(L, fmt, MAXALIGN);
CVE-2019-18466: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 5.5
Published: 2019-10-28T13:15Z
Repository: https://github.com/containers/libpod
Language: Unknown
Commit date: 2019-09-13 16:36:21 +0200
Commit message: Merge pull request #3942 from jwhonce/issue/3829

Stop glob'ing on podman cp
CVE-2018-3728: Modification of Assumed-Immutable Data (MAID) (CWE-471)
value: hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CWE description: The product does not properly protect an assumed-immutable element from being modified by an attacker.
CVSS v3 base score: 8.8
Published: 2018-03-30T19:29Z
Repository: https://github.com/hapijs/hoek
Language: JavaScript
Files changed: lib/index.js, test/index.js
Commit date: 2018-02-06 09:55:01 -0800
Commit message: skip assignment to __proto__

Diff: diff --git a/lib/index.js b/lib/index.js
index 4498598..5da4f33 100755
--- a/lib/index.js
+++ b/lib/index.js
@@ -113,10 +113,14 @@ exports.merge = function (target, source, isNullOverride /* = true */, isMergeAr
     }
 
     const keys = Object.keys(source);
     for (let i = 0; i < keys.length; ++i) {
         const key = keys[i];
+        if (key === '__proto__') {
+            continue;
+        }
+
         const value = source[key];
         if (value &&
             typeof value === 'object') {
 
             if (!target[key] ||
diff --git a/test/index.js b/test/index.js
index 45464be..5714025 100755
--- a/test/index.js
+++ b/test/index.js
@@ -583,10 +583,19 @@ describe('merge()', () => {
         const a = { x: Buffer.from('abc') };
 
         Hoek.merge({ x: {} }, a);
         expect(a.x.toString()).to.equal('abc');
     });
+
+    it('skips __proto__', () => {
+
+        const a = '{ "ok": "value", "__proto__": { "test": "value" } }';
+
+        const b = Hoek.merge({}, JSON.parse(a));
+        expect(b).to.equal({ ok: 'value' });
+        expect(b.test).to.equal(undefined);
+    });
 });
 
 describe('applyToDefaults()', () => {
 
     const defaults = {

Fixed code:         if (key === '__proto__') {
            continue;
        }


    it('skips __proto__', () => {

        const a = '{ "ok": "value", "__proto__": { "test": "value" } }';

        const b = Hoek.merge({}, JSON.parse(a));
        expect(b).to.equal({ ok: 'value' });
        expect(b.test).to.equal(undefined);
    });
CVE-2013-0211: Numeric Errors (CWE-189)
value: Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2013-09-30T22:55Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_write.c
Commit date: 2013-03-22 23:48:41 -0700
Commit message: Limit write requests to at most INT_MAX.
This prevents a certain common programming error (passing -1 to write)
from leading to other problems deeper in the library.

Diff: diff --git a/libarchive/archive_write.c b/libarchive/archive_write.c
index eede5e05..be856215 100644
--- a/libarchive/archive_write.c
+++ b/libarchive/archive_write.c
@@ -671,12 +671,17 @@ _archive_write_finish_entry(struct archive *_a)
  */
 static ssize_t
 _archive_write_data(struct archive *_a, const void *buff, size_t s)
 {
 	struct archive_write *a = (struct archive_write *)_a;
+	const size_t max_write = INT_MAX;
+
 	archive_check_magic(&a->archive, ARCHIVE_WRITE_MAGIC,
 	    ARCHIVE_STATE_DATA, "archive_write_data");
+	/* In particular, this catches attempts to pass negative values. */
+	if (s > max_write)
+		s = max_write;
 	archive_clear_error(&a->archive);
 	return ((a->format_write_data)(a, buff, s));
 }
 
 static struct archive_write_filter *

Fixed code: 	const size_t max_write = INT_MAX;

	/* In particular, this catches attempts to pass negative values. */
	if (s > max_write)
		s = max_write;
CVE-2016-4300: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2016-09-21T14:25Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_7zip.c
Commit date: 2016-06-19 14:14:09 -0700
Commit message: Issue #718: Fix TALOS-CAN-152

If a 7-Zip archive declares a rediculously large number of substreams,
it can overflow an internal counter, leading a subsequent memory
allocation to be too small for the substream data.

Thanks to the Open Source and Threat Intelligence project at Cisco
for reporting this issue.

Diff: diff --git a/libarchive/archive_read_support_format_7zip.c b/libarchive/archive_read_support_format_7zip.c
index 90901acb7..1dfe52b85 100644
--- a/libarchive/archive_read_support_format_7zip.c
+++ b/libarchive/archive_read_support_format_7zip.c
@@ -2151,10 +2151,13 @@ read_SubStreamsInfo(struct archive_read *a, struct _7z_substream_info *ss,
 		for (i = 0; i < numFolders; i++) {
 			if (parse_7zip_uint64(a, &(f[i].numUnpackStreams)) < 0)
 				return (-1);
 			if (UMAX_ENTRY < f[i].numUnpackStreams)
 				return (-1);
+			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
+				return (-1);
+			}
 			unpack_streams += (size_t)f[i].numUnpackStreams;
 		}
 		if ((p = header_bytes(a, 1)) == NULL)
 			return (-1);
 		type = *p;

Fixed code: 			if (unpack_streams > SIZE_MAX - UMAX_ENTRY) {
				return (-1);
			}
CVE-2016-4301: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2016-09-21T14:25Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_mtree.c
Commit date: 2016-06-10 16:54:43 +0200
Commit message: Fix libarchive/archive_read_support_format_mtree.c:1388:11: error: array subscript is above array bounds

Diff: diff --git a/libarchive/archive_read_support_format_mtree.c b/libarchive/archive_read_support_format_mtree.c
index 3efcc3783..8c3be9a29 100644
--- a/libarchive/archive_read_support_format_mtree.c
+++ b/libarchive/archive_read_support_format_mtree.c
@@ -1383,16 +1383,16 @@ parse_device(dev_t *pdev, struct archive *a, char *val)
 			if (*p == '\0') {
 				archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,
 				    "Missing number");
 				return ARCHIVE_WARN;
 			}
-			numbers[argc++] = (unsigned long)mtree_atol(&p);
-			if (argc > MAX_PACK_ARGS) {
+			if (argc >= MAX_PACK_ARGS) {
 				archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,
 				    "Too many arguments");
 				return ARCHIVE_WARN;
 			}
+			numbers[argc++] = (unsigned long)mtree_atol(&p);
 		}
 		if (argc < 2) {
 			archive_set_error(a, ARCHIVE_ERRNO_FILE_FORMAT,
 			    "Not enough arguments");
 			return ARCHIVE_WARN;

Vulnerable code: 			numbers[argc++] = (unsigned long)mtree_atol(&p);
			if (argc > MAX_PACK_ARGS) {
Fixed code: 			if (argc >= MAX_PACK_ARGS) {
			numbers[argc++] = (unsigned long)mtree_atol(&p);
CVE-2016-4302: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2016-09-21T14:25Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_rar.c
Commit date: 2016-06-19 14:21:42 -0700
Commit message: Issue 719:  Fix for TALOS-CAN-154

A RAR file with an invalid zero dictionary size was not being
rejected, leading to a zero-sized allocation for the dictionary
storage which was then overwritten during the dictionary initialization.

Thanks to the Open Source and Threat Intelligence project at Cisco for
reporting this.

Diff: diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index 6450aac82..6c49f1a15 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -2125,10 +2125,16 @@ parse_codes(struct archive_read *a)
       rar->bytein.Read = &ppmd_read;
       __archive_ppmd7_functions.PpmdRAR_RangeDec_CreateVTable(&rar->range_dec);
       rar->range_dec.Stream = &rar->bytein;
       __archive_ppmd7_functions.Ppmd7_Construct(&rar->ppmd7_context);
 
+      if (rar->dictionary_size == 0) {
+	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
+                          "Invalid zero dictionary size");
+	      return (ARCHIVE_FATAL);
+      }
+
       if (!__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,
         rar->dictionary_size, &g_szalloc))
       {
         archive_set_error(&a->archive, ENOMEM,
                           "Out of memory");

Fixed code:       if (rar->dictionary_size == 0) {
	      archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
                          "Invalid zero dictionary size");
	      return (ARCHIVE_FATAL);
      }
CVE-2016-5844: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2016-09-21T14:25Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_iso9660.c
Commit date: 2016-06-19 14:34:37 -0700
Commit message: Issue 717:  Fix integer overflow when computing location of volume descriptor

The multiplication here defaulted to 'int' but calculations
of file positions should always use int64_t.  A simple cast
suffices to fix this since the base location is always 32 bits
for ISO, so multiplying by the sector size will never overflow
a 64-bit integer.

Diff: diff --git a/libarchive/archive_read_support_format_iso9660.c b/libarchive/archive_read_support_format_iso9660.c
index 6934ceefe..f41ba3865 100644
--- a/libarchive/archive_read_support_format_iso9660.c
+++ b/libarchive/archive_read_support_format_iso9660.c
@@ -1089,11 +1089,11 @@ choose_volume(struct archive_read *a, struct iso9660 *iso9660)
 	if (iso9660->seenJoliet &&
 		vd->location > iso9660->joliet.location)
 		/* This condition is unlikely; by way of caution. */
 		vd = &(iso9660->joliet);
 
-	skipsize = LOGICAL_BLOCK_SIZE * vd->location;
+	skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location;
 	skipsize = __archive_read_consume(a, skipsize);
 	if (skipsize < 0)
 		return ((int)skipsize);
 	iso9660->current_position = skipsize;
 
@@ -1127,11 +1127,11 @@ choose_volume(struct archive_read *a, struct iso9660 *iso9660)
 
 	if (vd == &(iso9660->primary) && !iso9660->seenRockridge
 	    && iso9660->seenJoliet) {
 		/* Switch reading data from primary to joliet. */
 		vd = &(iso9660->joliet);
-		skipsize = LOGICAL_BLOCK_SIZE * vd->location;
+		skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location;
 		skipsize -= iso9660->current_position;
 		skipsize = __archive_read_consume(a, skipsize);
 		if (skipsize < 0)
 			return ((int)skipsize);
 		iso9660->current_position += skipsize;

Vulnerable code: 	skipsize = LOGICAL_BLOCK_SIZE * vd->location;
		skipsize = LOGICAL_BLOCK_SIZE * vd->location;
Fixed code: 	skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location;
		skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location;
CVE-2016-8687: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the safe_fprintf function in tar/util.c in libarchive 3.2.1 allows remote attackers to cause a denial of service via a crafted non-printable multibyte character in a filename.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2017-02-15T19:59Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: tar/util.c
Commit date: 2016-08-21 10:57:20 -0700
Commit message: Issue #767:  Buffer overflow printing a filename

The safe_fprintf function attempts to ensure clean output for an
arbitrary sequence of bytes by doing a trial conversion of the
multibyte characters to wide characters -- if the resulting wide
character is printable then we pass through the corresponding bytes
unaltered, otherwise, we convert them to C-style ASCII escapes.

The stack trace in Issue #767 suggest that the 20-byte buffer
was getting overflowed trying to format a non-printable multibyte
character.  This should only happen if there is a valid multibyte
character of more than 5 bytes that was unprintable.  (Each byte
would get expanded to a four-charcter octal-style escape of the form
"\123" resulting in >20 characters for the >5 byte multibyte character.)

I've not been able to reproduce this, but have expanded the conversion
buffer to 128 bytes on the belief that no multibyte character set
has a single character of more than 32 bytes.

Diff: diff --git a/tar/util.c b/tar/util.c
index 9ff22f2b6..2b4aebe8e 100644
--- a/tar/util.c
+++ b/tar/util.c
@@ -180,11 +180,11 @@ safe_fprintf(FILE *f, const char *fmt, ...)
 			i += (unsigned)bsdtar_expand_char(outbuff, i, *p++);
 			try_wc = 0;
 		}
 
 		/* If our output buffer is full, dump it and keep going. */
-		if (i > (sizeof(outbuff) - 20)) {
+		if (i > (sizeof(outbuff) - 128)) {
 			outbuff[i] = '\0';
 			fprintf(f, "%s", outbuff);
 			i = 0;
 		}
 	}

Vulnerable code: 		if (i > (sizeof(outbuff) - 20)) {
Fixed code: 		if (i > (sizeof(outbuff) - 128)) {
CVE-2017-14166: Out-of-bounds Read (CWE-125)
value: libarchive 3.3.2 allows remote attackers to cause a denial of service (xml_data heap-based buffer over-read and application crash) via a crafted xar archive, related to the mishandling of empty strings in the atol8 function in archive_read_support_format_xar.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2017-09-06T18:29Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_xar.c
Commit date: 2017-09-05 18:12:19 +0200
Commit message: Do something sensible for empty strings to make fuzzers happy.

Diff: diff --git a/libarchive/archive_read_support_format_xar.c b/libarchive/archive_read_support_format_xar.c
index 7a22beb9d..93eeacc5e 100644
--- a/libarchive/archive_read_support_format_xar.c
+++ b/libarchive/archive_read_support_format_xar.c
@@ -1038,10 +1038,13 @@ static uint64_t
 atol10(const char *p, size_t char_cnt)
 {
 	uint64_t l;
 	int digit;
 
+	if (char_cnt == 0)
+		return (0);
+
 	l = 0;
 	digit = *p - '0';
 	while (digit >= 0 && digit < 10  && char_cnt-- > 0) {
 		l = (l * 10) + digit;
 		digit = *++p - '0';
@@ -1052,11 +1055,14 @@ atol10(const char *p, size_t char_cnt)
 static int64_t
 atol8(const char *p, size_t char_cnt)
 {
 	int64_t l;
 	int digit;
-        
+
+	if (char_cnt == 0)
+		return (0);
+
 	l = 0;
 	while (char_cnt-- > 0) {
 		if (*p >= '0' && *p <= '7')
 			digit = *p - '0';
 		else

Fixed code: 	if (char_cnt == 0)
		return (0);


	if (char_cnt == 0)
		return (0);
CVE-2017-14502: Out-of-bounds Read (CWE-125)
value: read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-09-17T18:29Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_rar.c
Commit date: 2017-09-09 17:47:32 +0200
Commit message: Avoid a read off-by-one error for UTF16 names in RAR archives.

Reported-By: OSS-Fuzz issue 573

Diff: diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index cbb14c32dc..751de6979b 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -1494,11 +1494,15 @@ read_header(struct archive_read *a, struct archive_entry *entry,
         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
           "Invalid filename");
         return (ARCHIVE_FATAL);
       }
       filename[filename_size++] = '\0';
-      filename[filename_size++] = '\0';
+      /*
+       * Do not increment filename_size here as the computations below
+       * add the space for the terminating NUL explicitly.
+       */
+      filename[filename_size] = '\0';
 
       /* Decoded unicode form is UTF-16BE, so we have to update a string
        * conversion object for it. */
       if (rar->sconv_utf16be == NULL) {
         rar->sconv_utf16be = archive_string_conversion_from_charset(

Vulnerable code:       filename[filename_size++] = '\0';
Fixed code:       /*
       * Do not increment filename_size here as the computations below
       * add the space for the terminating NUL explicitly.
       */
      filename[filename_size] = '\0';
CVE-2017-14502: Off-by-one Error (CWE-193)
value: read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.5
Published: 2017-09-17T18:29Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_rar.c
Commit date: 2017-09-09 17:47:32 +0200
Commit message: Avoid a read off-by-one error for UTF16 names in RAR archives.

Reported-By: OSS-Fuzz issue 573

Diff: diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index cbb14c32dc..751de6979b 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -1494,11 +1494,15 @@ read_header(struct archive_read *a, struct archive_entry *entry,
         archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
           "Invalid filename");
         return (ARCHIVE_FATAL);
       }
       filename[filename_size++] = '\0';
-      filename[filename_size++] = '\0';
+      /*
+       * Do not increment filename_size here as the computations below
+       * add the space for the terminating NUL explicitly.
+       */
+      filename[filename_size] = '\0';
 
       /* Decoded unicode form is UTF-16BE, so we have to update a string
        * conversion object for it. */
       if (rar->sconv_utf16be == NULL) {
         rar->sconv_utf16be = archive_string_conversion_from_charset(

Vulnerable code:       filename[filename_size++] = '\0';
Fixed code:       /*
       * Do not increment filename_size here as the computations below
       * add the space for the terminating NUL explicitly.
       */
      filename[filename_size] = '\0';
CVE-2017-5601: Out-of-bounds Read (CWE-125)
value: An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-01-27T22:59Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_lha.c
Commit date: 2017-01-19 22:00:18 +0100
Commit message: Fail with negative lha->compsize in lha_read_file_header_1()
Fixes a heap buffer overflow reported in Secunia SA74169

Diff: diff --git a/libarchive/archive_read_support_format_lha.c b/libarchive/archive_read_support_format_lha.c
index 52a5531b0f..d77a7c2e47 100644
--- a/libarchive/archive_read_support_format_lha.c
+++ b/libarchive/archive_read_support_format_lha.c
@@ -922,10 +922,13 @@ lha_read_file_header_1(struct archive_read *a, struct lha *lha)
 	if (err2 < err)
 		err = err2;
 	/* Get a real compressed file size. */
 	lha->compsize -= extdsize - 2;
 
+	if (lha->compsize < 0)
+		goto invalid;	/* Invalid compressed file size */
+
 	if (sum_calculated != headersum) {
 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
 		    "LHa header sum error");
 		return (ARCHIVE_FATAL);
 	}

Fixed code: 	if (lha->compsize < 0)
		goto invalid;	/* Invalid compressed file size */
CVE-2019-11463: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows remote attackers to cause a denial of service via a crafted ZIP file because of a HAVE_LZMA_H typo. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 5.5
Published: 2019-04-23T03:29Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_zip.c
Commit date: 2019-04-21 00:53:02 +0200
Commit message: Fix typo in preprocessor macro in archive_read_format_zip_cleanup()

Frees lzma_stream on cleanup()

Fixes #1165

Diff: diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c
index 677c437095..6937969c16 100644
--- a/libarchive/archive_read_support_format_zip.c
+++ b/libarchive/archive_read_support_format_zip.c
@@ -2749,11 +2749,11 @@ archive_read_format_zip_cleanup(struct archive_read *a)
 #ifdef HAVE_ZLIB_H
 	if (zip->stream_valid)
 		inflateEnd(&zip->stream);
 #endif
 
-#if HAVA_LZMA_H && HAVE_LIBLZMA
+#if HAVE_LZMA_H && HAVE_LIBLZMA
     if (zip->zipx_lzma_valid) {
 		lzma_end(&zip->zipx_lzma_stream);
 	}
 #endif
 

Vulnerable code: #if HAVA_LZMA_H && HAVE_LIBLZMA
Fixed code: #if HAVE_LZMA_H && HAVE_LIBLZMA
CVE-2019-18408: Use After Free (CWE-416)
value: archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2019-10-24T14:15Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_rar.c
Commit date: 2019-05-11 02:36:53 +0200
Commit message: RAR reader: fix use after free

If read_data_compressed() returns ARCHIVE_FAILED, the caller is allowed
to continue with next archive headers. We need to set rar->start_new_table
after the ppmd7_context got freed, otherwise it won't be allocated again.

Reported by: OSS-Fuzz issue 2582

Diff: diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index a8cc5c94d8..49360876c2 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -1022,12 +1022,14 @@ archive_read_format_rar_read_data(struct archive_read *a, const void **buff,
   case COMPRESS_METHOD_FAST:
   case COMPRESS_METHOD_NORMAL:
   case COMPRESS_METHOD_GOOD:
   case COMPRESS_METHOD_BEST:
     ret = read_data_compressed(a, buff, size, offset);
-    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
+    if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
       __archive_ppmd7_functions.Ppmd7_Free(&rar->ppmd7_context);
+      rar->start_new_table = 1;
+    }
     break;
 
   default:
     archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
                       "Unsupported compression method for RAR file.");

Vulnerable code:     if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN)
Fixed code:     if (ret != ARCHIVE_OK && ret != ARCHIVE_WARN) {
      rar->start_new_table = 1;
    }
CVE-2020-21674: Out-of-bounds Write (CWE-787)
value: Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (out-of-bounds write in heap memory resulting into a crash) via a crafted archive file. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2020-10-15T15:15Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_string.c
Commit date: 2019-12-28 23:48:57 +0100
Commit message: Fix a possible heap-buffer-overflow in archive_string_append_from_wcs()

When we grow the archive_string buffer, we have to make sure it fits
at least one maximum-sized multibyte character in the current locale
and the null character.

Fixes #1298

Diff: diff --git a/libarchive/archive_string.c b/libarchive/archive_string.c
index bd39c96f10..399299ea63 100644
--- a/libarchive/archive_string.c
+++ b/libarchive/archive_string.c
@@ -73,10 +73,13 @@ __FBSDID("$FreeBSD: head/lib/libarchive/archive_string.c 201095 2009-12-28 02:33
 
 #if !defined(HAVE_WMEMMOVE) && !defined(wmemmove)
 #define wmemmove(a,b,i)  (wchar_t *)memmove((a), (b), (i) * sizeof(wchar_t))
 #endif
 
+#undef max
+#define max(a, b)       ((a)>(b)?(a):(b))
+
 struct archive_string_conv {
 	struct archive_string_conv	*next;
 	char				*from_charset;
 	char				*to_charset;
 	unsigned			 from_cp;
@@ -802,11 +805,12 @@ archive_string_append_from_wcs(struct archive_string *as,
 		if (p >= end) {
 			as->length = p - as->s;
 			as->s[as->length] = '\0';
 			/* Re-allocate buffer for MBS. */
 			if (archive_string_ensure(as,
-			    as->length + len * 2 + 1) == NULL)
+			    as->length + max(len * 2,
+			    (size_t)MB_CUR_MAX) + 1) == NULL)
 				return (-1);
 			p = as->s + as->length;
 			end = as->s + as->buffer_length - MB_CUR_MAX -1;
 		}
 #if HAVE_WCRTOMB
@@ -3444,11 +3448,12 @@ strncat_from_utf8_libarchive2(struct archive_string *as,
 
 		if (p >= end) {
 			as->length = p - as->s;
 			/* Re-allocate buffer for MBS. */
 			if (archive_string_ensure(as,
-			    as->length + len * 2 + 1) == NULL)
+			    as->length + max(len * 2,
+			    (size_t)MB_CUR_MAX) + 1) == NULL)
 				return (-1);
 			p = as->s + as->length;
 			end = as->s + as->buffer_length - MB_CUR_MAX -1;
 		}
 

Vulnerable code: 			    as->length + len * 2 + 1) == NULL)
			    as->length + len * 2 + 1) == NULL)
Fixed code: #undef max
#define max(a, b)       ((a)>(b)?(a):(b))

			    as->length + max(len * 2,
			    (size_t)MB_CUR_MAX) + 1) == NULL)
			    as->length + max(len * 2,
			    (size_t)MB_CUR_MAX) + 1) == NULL)
CVE-2024-26256: Insufficient Information (NVD-CWE-noinfo)
value: libarchive Remote Code Execution Vulnerability
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2024-04-09T17:15Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_rar.c
Commit date: 2024-04-21 09:55:41 -0700
Commit message: fix: OOB in rar e8 filter (#2135)

This patch fixes an out-of-bound error in rar e8 filter.
Diff: diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c
index 99a11d1700..266d0ee995 100644
--- a/libarchive/archive_read_support_format_rar.c
+++ b/libarchive/archive_read_support_format_rar.c
@@ -3613,11 +3613,11 @@ execute_filter_e8(struct rar_filter *filter, struct rar_virtual_machine *vm, siz
 {
   uint32_t length = filter->initialregisters[4];
   uint32_t filesize = 0x1000000;
   uint32_t i;
 
-  if (length > PROGRAM_WORK_SIZE || length < 4)
+  if (length > PROGRAM_WORK_SIZE || length <= 4)
     return 0;
 
   for (i = 0; i <= length - 5; i++)
   {
     if (vm->memory[i] == 0xE8 || (e9also && vm->memory[i] == 0xE9))

Vulnerable code:   if (length > PROGRAM_WORK_SIZE || length < 4)
Fixed code:   if (length > PROGRAM_WORK_SIZE || length <= 4)
CVE-2024-37407: Out-of-bounds Read (CWE-125)
value: Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2024-06-08T13:15Z
Repository: https://github.com/libarchive/libarchive
Language: C
Files changed: libarchive/archive_read_support_format_zip.c
Commit date: 2024-04-25 11:18:30 +0200
Commit message: zip: Fix out of boundary access (#2145)

If a ZIP file contains a file with an empty name and mac-ext option is
set, then a check accesses memory out of bound of `name`.
Diff: diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c
index d7b6f082ee..7552a1a1a2 100644
--- a/libarchive/archive_read_support_format_zip.c
+++ b/libarchive/archive_read_support_format_zip.c
@@ -4087,11 +4087,11 @@ slurp_central_directory(struct archive_read *a, struct archive_entry* entry,
 				/* If this is an entry ending with slash,
 				 * make the resource for name slash-less
 				 * as the actual resource fork doesn't end with '/'.
 				 */
 				size_t tmp_length = filename_length;
-				if (name[tmp_length - 1] == '/') {
+				if (tmp_length > 0 && name[tmp_length - 1] == '/') {
 					tmp_length--;
 					r = rsrc_basename(name, tmp_length);
 				}
 
 				archive_strcpy(&(zip_entry->rsrcname),

Vulnerable code: 				if (name[tmp_length - 1] == '/') {
Fixed code: 				if (tmp_length > 0 && name[tmp_length - 1] == '/') {
CVE-2021-41123: Other (NVD-CWE-Other)
value: Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endpoint available to any user. None of the survey answers are ever exposed, only the aggregate counters, including count of interviews, or count of assignments. Starting from version 21.09.1 the endpoint is turned off by default.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2021-10-04T23:15Z
Repository: https://github.com/surveysolutions/surveysolutions
Language: Other
Files changed: src/UI/WB.UI.Headquarters.Core/appsettings.ini
Commit date: 2021-10-04 16:34:23 -0400
Commit message: hide metrics endpoint by default

Diff: diff --git a/src/UI/WB.UI.Headquarters.Core/appsettings.ini b/src/UI/WB.UI.Headquarters.Core/appsettings.ini
index 3851503816..0302e746f3 100644
--- a/src/UI/WB.UI.Headquarters.Core/appsettings.ini
+++ b/src/UI/WB.UI.Headquarters.Core/appsettings.ini
@@ -49,11 +49,11 @@ WebInterviewPauseResumeGraceTimespan="00:00:10"
 # Pushgateway endpoint location where HQ should report metrics data
 PushGatewayEndpoint = http://localhost:9091/metrics
 # Should HQ use Pushgateway to report metrics data
 UsePushGateway = false
 # Should HQ expose metrics data via '/metrics' endpoint
-UseMetricsEndpoint = true
+UseMetricsEndpoint = false
 
 [ConnectionStrings]
 DefaultConnection=
 
 [VersionCheck]

Vulnerable code: UseMetricsEndpoint = true
Fixed code: UseMetricsEndpoint = false
CVE-2023-26491: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: RSSHub is an open source and extensible RSS feed generator. When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version, there are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-03T23:15Z
Repository: https://github.com/DIYgod/RSSHub
Language: JavaScript
Files changed: lib/middleware/parameter.js
Commit date: 2023-02-28 10:52:32 +0000
Commit message: fix: brief parameter xss vulnerability

Diff: diff --git a/lib/middleware/parameter.js b/lib/middleware/parameter.js
index 1a89e63e0..446433e39 100644
--- a/lib/middleware/parameter.js
+++ b/lib/middleware/parameter.js
@@ -311,11 +311,11 @@ module.exports = async (ctx, next) => {
                                 item.description = `<p>${text}</p>`;
                             }
                         }
                     });
                 } else {
-                    throw Error(`Invalid parameter <code>brief=${ctx.query.brief}</code>. Please check the doc https://docs.rsshub.app/parameter.html#shu-chu-jian-xun`);
+                    throw Error(`Invalid parameter brief. Please check the doc https://docs.rsshub.app/parameter.html#shu-chu-jian-xun`);
                 }
             }
 
             // some parameters are processed in `anti-hotlink.js`
         }

Vulnerable code:                     throw Error(`Invalid parameter <code>brief=${ctx.query.brief}</code>. Please check the doc https://docs.rsshub.app/parameter.html#shu-chu-jian-xun`);
Fixed code:                     throw Error(`Invalid parameter brief. Please check the doc https://docs.rsshub.app/parameter.html#shu-chu-jian-xun`);
CVE-2023-2844: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 4.9
Published: 2023-05-23T04:15Z
Repository: https://github.com/cloudexplorer-dev/cloudexplorer-lite
Language: Unknown
Commit date: 2023-05-22 20:57:01 +0800
Commit message: Merge pull request #176 from CloudExplorer-Dev/pr@main@fix_huawei_monitoring_bug

fix(vm-service): 华为云同步监控数据数据粒度调整为300
CVE-2023-2845: Insufficient Information (NVD-CWE-noinfo)
value: Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2023-05-23T05:15Z
Repository: https://github.com/cloudexplorer-dev/cloudexplorer-lite
Language: Unknown
Commit date: 2023-05-22 20:57:01 +0800
Commit message: Merge pull request #176 from CloudExplorer-Dev/pr@main@fix_huawei_monitoring_bug

fix(vm-service): 华为云同步监控数据数据粒度调整为300