Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2016-6128: Improper Input Validation (CWE-20)
value: The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2016-08-07T10:59Z
Repository: https://github.com/libgd/libgd
Language: Other
Files changed: src/gd_crop.c, tests/CMakeLists.txt, tests/Makefile.am
Commit date: 2016-06-27 11:41:40 +0700
Commit message: fix php 72494, invalid color index not handled, can lead to crash

Diff: diff --git a/src/gd_crop.c b/src/gd_crop.c
index 02966336..532b49b3 100644
--- a/src/gd_crop.c
+++ b/src/gd_crop.c
@@ -134,10 +134,14 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c
 	/* Pierre: crop everything sounds bad */
 	if (threshold > 100.0) {
 		return NULL;
 	}
 
+	if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
+		return NULL;
+	}
+
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr
 	 */
 	match = 1;
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 6f5c7860..5093d526 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -29,10 +29,11 @@ if (BUILD_TEST)
 		gdimagecolorreplace
 		gdimagecolorresolve
 		gdimagecolortransparent
 		gdimagecopy
 		gdimagecopyrotated
+        gdimagecrop
 		gdimagefile
 		gdimagefill
 		gdimagefilledellipse
 		gdimagefilledpolygon
 		gdimagefilledrectangle
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 4f6e7569..5a0ebe81 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -23,10 +23,11 @@ include gdimagecolorexact/Makemodule.am
 include gdimagecolorreplace/Makemodule.am
 include gdimagecolorresolve/Makemodule.am
 include gdimagecolortransparent/Makemodule.am
 include gdimagecopy/Makemodule.am
 include gdimagecopyrotated/Makemodule.am
+include gdimagecrop/Makemodule.am
 include gdimagefile/Makemodule.am
 include gdimagefill/Makemodule.am
 include gdimagefilledellipse/Makemodule.am
 include gdimagefilledpolygon/Makemodule.am
 include gdimagefilledrectangle/Makemodule.am

Fixed code: 	if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
		return NULL;
	}

        gdimagecrop
include gdimagecrop/Makemodule.am
CVE-2016-7568: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2016-09-28T20:59Z
Repository: https://github.com/libgd/libgd
Language: Unknown
Commit date: 2016-09-16 10:54:34 +0200
Commit message: Merge branch 'pull-request/296'
CVE-2016-8670: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-01-04T20:59Z
Repository: https://github.com/libgd/libgd
Language: C
Files changed: src/gd_io_dp.c
Commit date: 2016-10-12 11:15:32 +0200
Commit message: Avoid potentially dangerous signed to unsigned conversion

We make sure to never pass a negative `rlen` as size to memcpy(). See
also <https://bugs.php.net/bug.php?id=73280>.

Patch provided by Emmanuel Law.

Diff: diff --git a/src/gd_io_dp.c b/src/gd_io_dp.c
index 135eda3f..228bfa5c 100644
--- a/src/gd_io_dp.c
+++ b/src/gd_io_dp.c
@@ -274,11 +274,11 @@ static int dynamicGetbuf(gdIOCtxPtr ctx, void *buf, int len)
 
 	remain = dp->logicalSize - dp->pos;
 	if(remain >= len) {
 		rlen = len;
 	} else {
-		if(remain == 0) {
+		if(remain <= 0) {
 			/* 2.0.34: EOF is incorrect. We use 0 for
 			 * errors and EOF, just like fileGetbuf,
 			 * which is a simple fread() wrapper.
 			 * TBB. Original bug report: Daniel Cowgill. */
 			return 0; /* NOT EOF */

Vulnerable code: 		if(remain == 0) {
Fixed code: 		if(remain <= 0) {
CVE-2016-9933: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.5
Published: 2017-01-04T20:59Z
Repository: https://github.com/libgd/libgd
Language: Other
Files changed: src/gd.c, tests/gdimagefilltoborder/.gitignore, tests/gdimagefilltoborder/CMakeLists.txt, tests/gdimagefilltoborder/Makemodule.am
Commit date: 2016-06-04 23:09:01 +0700
Commit message: fix #215 gdImageFillToBorder stack-overflow when invalid color is used

Diff: diff --git a/src/gd.c b/src/gd.c
index 06032475..704ce79a 100644
--- a/src/gd.c
+++ b/src/gd.c
@@ -1926,15 +1926,21 @@ BGD_DECLARE(void) gdImageFillToBorder (gdImagePtr im, int x, int y, int border,
 	/* Seek left */
 	int leftLimit, rightLimit;
 	int i;
 	int restoreAlphaBleding;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
 
+	if (!im->trueColor) {
+		if ((color > (im->colorsTotal - 1)) || (border > (im->colorsTotal - 1))) {
+			return;
+		}
+    }
+
 	leftLimit = (-1);
 
 	restoreAlphaBleding = im->alphaBlendingFlag;
 	im->alphaBlendingFlag = 0;
 
diff --git a/tests/gdimagefilltoborder/.gitignore b/tests/gdimagefilltoborder/.gitignore
index 65c314a8..384299c6 100644
--- a/tests/gdimagefilltoborder/.gitignore
+++ b/tests/gdimagefilltoborder/.gitignore
@@ -1 +1,2 @@
 /bug00037
+/github_bug_215
diff --git a/tests/gdimagefilltoborder/CMakeLists.txt b/tests/gdimagefilltoborder/CMakeLists.txt
index e6b95fd2..f03529a6 100644
--- a/tests/gdimagefilltoborder/CMakeLists.txt
+++ b/tests/gdimagefilltoborder/CMakeLists.txt
@@ -1,5 +1,6 @@
 SET(TESTS_FILES
 	bug00037
+	github_bug_215
 )
 
 ADD_GD_TESTS()
diff --git a/tests/gdimagefilltoborder/Makemodule.am b/tests/gdimagefilltoborder/Makemodule.am
index 15f4ddeb..fc7ed3d0 100644
--- a/tests/gdimagefilltoborder/Makemodule.am
+++ b/tests/gdimagefilltoborder/Makemodule.am
@@ -1,7 +1,8 @@
 if HAVE_LIBPNG
 libgd_test_programs += \
-	gdimagefilltoborder/bug00037
+	gdimagefilltoborder/bug00037 \
+	gdimagefilltoborder/github_bug_215
 endif
 
 EXTRA_DIST += \
 	gdimagefilltoborder/CMakeLists.txt

Vulnerable code: 	if (border < 0) {
	gdimagefilltoborder/bug00037
Fixed code: 	if (border < 0 || color < 0) {
	if (!im->trueColor) {
		if ((color > (im->colorsTotal - 1)) || (border > (im->colorsTotal - 1))) {
			return;
		}
    }

/github_bug_215
	github_bug_215
	gdimagefilltoborder/bug00037 \
	gdimagefilltoborder/github_bug_215
CVE-2021-40145: Double Free (CWE-415)
value: gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.5
Published: 2021-08-26T01:15Z
Repository: https://github.com/libgd/libgd
Language: Unknown
Commit date: 2021-08-24 16:34:59 +0700
Commit message: Merge pull request #713 from me22bee/_gdImageGd2

gdImageGd2Ptr memory leak
CVE-2021-40812: Out-of-bounds Read (CWE-125)
value: The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2021-09-08T21:15Z
Repository: https://github.com/libgd/libgd
Language: Unknown
Commit date: 2021-09-08 10:08:12 +0700
Commit message: Merge pull request #755 from libgd/bug/750

Partial fix for #750, BMP and WebP. Gif's usage of PutBuf needs too much refactoring for the actual gain here."
CVE-2024-34455: Insufficient Information (NVD-CWE-noinfo)
value: Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-03T19:15Z
Repository: https://github.com/buildroot/buildroot
Language: Other
Files changed: package/skeleton-init-sysv/skeleton/etc/fstab
Commit date: 2024-04-11 20:30:29 +0200
Commit message: package/skeleton-init-sysv: Set sticky bit on /dev/shm

/dev/shm is a world-writable directory, like /tmp, and should also
have the sticky bit set.  Without this, any user can delete and
replace another user's files in /dev/shm.

This bug has been present since /dev/shm was added to the skeleton
/etc/fstab, but appears to have been fixed for systems using systemd
by commit 76fc9275f14e "system: separate sysv and systemd parts of the
skeleton" which went into Buildroot 2017.08.

Signed-off-by: Ben Hutchings <ben.hutchings@mind.be>
Fixes: 22fde22e35f98f7830c2f8955465532328348cd1
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

Diff: diff --git a/package/skeleton-init-sysv/skeleton/etc/fstab b/package/skeleton-init-sysv/skeleton/etc/fstab
index 169054b74f..06c20fe9d5 100644
--- a/package/skeleton-init-sysv/skeleton/etc/fstab
+++ b/package/skeleton-init-sysv/skeleton/etc/fstab
@@ -1,8 +1,8 @@
 # <file system>	<mount pt>	<type>	<options>	<dump>	<pass>
 /dev/root	/		ext2	rw,noauto	0	1
 proc		/proc		proc	defaults	0	0
 devpts		/dev/pts	devpts	defaults,gid=5,mode=620,ptmxmode=0666	0	0
-tmpfs		/dev/shm	tmpfs	mode=0777	0	0
+tmpfs		/dev/shm	tmpfs	mode=1777	0	0
 tmpfs		/tmp		tmpfs	mode=1777	0	0
 tmpfs		/run		tmpfs	mode=0755,nosuid,nodev	0	0
 sysfs		/sys		sysfs	defaults	0	0

Vulnerable code: tmpfs		/dev/shm	tmpfs	mode=0777	0	0
Fixed code: tmpfs		/dev/shm	tmpfs	mode=1777	0	0
CVE-2020-27208: Inadequate Encryption Strength (CWE-326)
value: The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 6.8
Published: 2021-05-21T12:15Z
Repository: https://github.com/solokeys/solo
Language: C
Files changed: targets/stm32l432/src/device.c, targets/stm32l432/src/flash.c
Commit date: 2021-01-27 19:49:03 -0800
Commit message: patches to improve resistance to fault injection

Diff: diff --git a/targets/stm32l432/src/device.c b/targets/stm32l432/src/device.c
index c8f487b..f244388 100644
--- a/targets/stm32l432/src/device.c
+++ b/targets/stm32l432/src/device.c
@@ -302,10 +302,16 @@ static void device_migrate(){
 void device_init()
 {
 
     hw_init(LOW_FREQUENCY);
 
+#if BOOT_TO_DFU
+    flash_option_bytes_init(1);
+#else
+    flash_option_bytes_init(0);
+#endif
+
     if (! tsc_sensor_exists())
     {
         _NFC_status = nfc_init();
     }
 
@@ -327,16 +333,10 @@ void device_init()
     ctaphid_init();
     ctap_init();
 
     device_migrate();
 
-#if BOOT_TO_DFU
-    flash_option_bytes_init(1);
-#else
-    flash_option_bytes_init(0);
-#endif
-
 
 }
 
 int device_is_nfc(void)
 {
diff --git a/targets/stm32l432/src/flash.c b/targets/stm32l432/src/flash.c
index b25ca0b..3a5c8d6 100644
--- a/targets/stm32l432/src/flash.c
+++ b/targets/stm32l432/src/flash.c
@@ -68,11 +68,15 @@ void flash_option_bytes_init(int boot_from_dfu)
     while (FLASH->SR & (1<<16))
         ;
 
     flash_lock();
 
-    __enable_irq();
+
+    /* Perform option byte loading which triggers a device reset. */
+    FLASH->CR |= FLASH_CR_OBL_LAUNCH;
+
+    while (true);
 }
 
 void flash_erase_page(uint8_t page)
 {
     __disable_irq();

Vulnerable code: #if BOOT_TO_DFU
    flash_option_bytes_init(1);
#else
    flash_option_bytes_init(0);
#endif

    __enable_irq();
Fixed code: #if BOOT_TO_DFU
    flash_option_bytes_init(1);
#else
    flash_option_bytes_init(0);
#endif


    /* Perform option byte loading which triggers a device reset. */
    FLASH->CR |= FLASH_CR_OBL_LAUNCH;

    while (true);
CVE-2022-1586: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-05-16T21:15Z
Repository: https://github.com/PCRE2Project/pcre2
Language: C
Files changed: src/pcre2_jit_compile.c
Commit date: 2022-03-24 05:34:42 +0000
Commit message: Fix incorrect value reading in JIT.

Diff: diff --git a/src/pcre2_jit_compile.c b/src/pcre2_jit_compile.c
index 94f6a58..7fcdac8 100644
--- a/src/pcre2_jit_compile.c
+++ b/src/pcre2_jit_compile.c
@@ -7487,11 +7487,11 @@ while (*cc != XCL_END)
 #ifdef SUPPORT_UNICODE
   else
     {
     SLJIT_ASSERT(*cc == XCL_PROP || *cc == XCL_NOTPROP);
     cc++;
-    if (*cc == PT_CLIST && *cc == XCL_PROP)
+    if (*cc == PT_CLIST && cc[-1] == XCL_PROP)
       {
       other_cases = PRIV(ucd_caseless_sets) + cc[1];
       while (*other_cases != NOTACHAR)
         {
         if (*other_cases > max) max = *other_cases;

Vulnerable code:     if (*cc == PT_CLIST && *cc == XCL_PROP)
Fixed code:     if (*cc == PT_CLIST && cc[-1] == XCL_PROP)
CVE-2022-1586: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-05-16T21:15Z
Repository: https://github.com/PCRE2Project/pcre2
Language: C
Files changed: ChangeLog, src/pcre2_jit_compile.c, src/pcre2_jit_test.c
Commit date: 2022-03-23 07:53:58 +0000
Commit message: Fixed a unicode properrty matching issue in JIT

Diff: diff --git a/ChangeLog b/ChangeLog
index f0eab7b..ffb0880 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -90,10 +90,13 @@ debugger (PDB) files were incorrect - perhaps never tried for PCRE2?
 When this was quantified (e.g. [Aa]{2}) and was also the last literal item in a
 pattern, the optimizing "must be present for a match" character check was not
 being flagged as caseless, causing some matches that should have succeeded to
 fail.
 
+23. Fixed a unicode properrty matching issue in JIT. The character was not
+fully read in caseless matching.
+
 
 Version 10.39 29-October-2021
 -----------------------------
 
 1. Fix incorrect detection of alternatives in first character search in JIT.
diff --git a/src/pcre2_jit_compile.c b/src/pcre2_jit_compile.c
index e7dd26c..94f6a58 100644
--- a/src/pcre2_jit_compile.c
+++ b/src/pcre2_jit_compile.c
@@ -7487,11 +7487,11 @@ while (*cc != XCL_END)
 #ifdef SUPPORT_UNICODE
   else
     {
     SLJIT_ASSERT(*cc == XCL_PROP || *cc == XCL_NOTPROP);
     cc++;
-    if (*cc == PT_CLIST)
+    if (*cc == PT_CLIST && *cc == XCL_PROP)
       {
       other_cases = PRIV(ucd_caseless_sets) + cc[1];
       while (*other_cases != NOTACHAR)
         {
         if (*other_cases > max) max = *other_cases;
diff --git a/src/pcre2_jit_test.c b/src/pcre2_jit_test.c
index 3b57ce2..8450f0b 100644
--- a/src/pcre2_jit_test.c
+++ b/src/pcre2_jit_test.c
@@ -413,10 +413,11 @@ static struct regression_test_case regression_test_cases[] = {
 	{ MUP, A, 0, 0 | F_PROPERTY, "[\\P{L&}]{2}[^\xc2\x85-\xc2\x89\\p{Ll}\\p{Lu}]{2}", "\xc3\xa9\xe6\x92\xad.a\xe6\x92\xad|\xc2\x8a#" },
 	{ PCRE2_UCP, 0, 0, 0 | F_PROPERTY, "[a-b\\s]{2,5}[^a]", "AB  baaa" },
 	{ MUP, 0, 0, 0 | F_NOMATCH, "[^\\p{Hangul}\\p{Z}]", " " },
 	{ MUP, 0, 0, 0, "[\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
 	{ MUP, 0, 0, 0, "[\\x{a92e}\\p{Lu}\\P{Latin}]+", "c\xEA\xA4\xAE,A,b" },
+	{ CMUP, 0, 0, 0, "[^S]\\B", "\xe2\x80\x8a" },
 
 	/* Possible empty brackets. */
 	{ MU, A, 0, 0, "(?:|ab||bc|a)+d", "abcxabcabd" },
 	{ MU, A, 0, 0, "(|ab||bc|a)+d", "abcxabcabd" },
 	{ MU, A, 0, 0, "(?:|ab||bc|a)*d", "abcxabcabd" },

Vulnerable code:     if (*cc == PT_CLIST)
Fixed code: 23. Fixed a unicode properrty matching issue in JIT. The character was not
fully read in caseless matching.

    if (*cc == PT_CLIST && *cc == XCL_PROP)
	{ CMUP, 0, 0, 0, "[^S]\\B", "\xe2\x80\x8a" },
CVE-2023-6461: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-12-01T14:15Z
Repository: https://github.com/viliusle/minipaint
Language: JavaScript
Files changed: src/js/core/gui/gui-layers.js, src/js/modules/layer/rename.js
Commit date: 2023-12-01 15:05:05 +0200
Commit message: XSS fix (layers name)

Diff: diff --git a/src/js/core/gui/gui-layers.js b/src/js/core/gui/gui-layers.js
index 1328cda..87fb052 100644
--- a/src/js/core/gui/gui-layers.js
+++ b/src/js/core/gui/gui-layers.js
@@ -161,12 +161,14 @@ class GUI_layers_class {
 				html += '	<button class="delete trn" id="delete" data-id="' + value.id + '" title="Delete"></button>';
 				
 				if(value.composition === 'source-atop'){
 					html += '	<button class="arrow_down" data-id="' + value.id + '" ></button>';
 				}
+
+				var layer_title = this.Helper.escapeHtml(value.name);
 				
-				html += '	<button class="layer_name" id="layer_name" data-id="' + value.id + '">' + value.name + '</button>';
+				html += '	<button class="layer_name" id="layer_name" data-id="' + value.id + '">' + layer_title + '</button>';
 				html += '	<div class="clear"></div>';
 				html += '</div>';
 
 				//show filters
 				if (layers[i].filters.length > 0) {
diff --git a/src/js/modules/layer/rename.js b/src/js/modules/layer/rename.js
index 095d57d..dbf0b2b 100644
--- a/src/js/modules/layer/rename.js
+++ b/src/js/modules/layer/rename.js
@@ -1,24 +1,28 @@
 import app from './../../app.js';
 import config from './../../config.js';
 import Base_layers_class from './../../core/base-layers.js';
 import Dialog_class from './../../libs/popup.js';
+import Helper_class from './../../libs/helpers.js';
 
 class Layer_rename_class {
 
 	constructor() {
 		this.Base_layers = new Base_layers_class();
 		this.POP = new Dialog_class();
+		this.Helper = new Helper_class();
 	}
 
 	rename(id = null) {
 		var _this = this;
 
+		var name_ = this.Helper.escapeHtml(config.layer.name);
+
 		var settings = {
 			title: 'Rename',
 			params: [
-				{name: "name", title: "Name:", value: config.layer.name},
+				{name: "name", title: "Name:", value: name_},
 			],
 			on_load: function () {
 				document.querySelector('#pop_data_name').select();
 			},
 			on_finish: function (params) {

Vulnerable code: 				html += '	<button class="layer_name" id="layer_name" data-id="' + value.id + '">' + value.name + '</button>';
				{name: "name", title: "Name:", value: config.layer.name},
Fixed code: 
				var layer_title = this.Helper.escapeHtml(value.name);
				html += '	<button class="layer_name" id="layer_name" data-id="' + value.id + '">' + layer_title + '</button>';
import Helper_class from './../../libs/helpers.js';
		this.Helper = new Helper_class();
		var name_ = this.Helper.escapeHtml(config.layer.name);

				{name: "name", title: "Name:", value: name_},
CVE-2022-31101: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2022-06-27T23:15Z
Repository: https://github.com/PrestaShop/blockwishlist
Language: Unknown
Commit date: 2022-06-24 10:04:52 +0200
Commit message: Merge pull request from GHSA-2jx3-5j9v-prpp

Validate order by and order way
CVE-2024-2217: Improper Access Control (CWE-284)
value: gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Published: 2024-04-10T17:15Z
Repository: https://github.com/gaizhenbiao/chuanhuchatgpt
Language: Python
Files changed: ChuanhuChatbot.py
Commit date: 2024-03-10 13:47:15 +0800
Commit message: bugfix: added blocked paths to protect sensitive files

Diff: diff --git a/ChuanhuChatbot.py b/ChuanhuChatbot.py
index 50de51c..1ddeb22 100644
--- a/ChuanhuChatbot.py
+++ b/ChuanhuChatbot.py
@@ -820,10 +820,11 @@ demo.title = i18n("川虎Chat 🚀")
 if __name__ == "__main__":
     reload_javascript()
     setup_wizard()
     demo.queue(concurrency_count=CONCURRENT_COUNT).launch(
         allowed_paths=["history", "web_assets"],
+        blocked_paths=["config.json", "files", "models", "lora", "modules"],
         server_name=server_name,
         server_port=server_port,
         share=share,
         auth=auth_from_conf if authflag else None,
         favicon_path="./web_assets/favicon.ico",

Fixed code:         blocked_paths=["config.json", "files", "models", "lora", "modules"],
CVE-2016-2347: Integer Overflow or Wraparound (CWE-190)
value: Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.8
Published: 2017-04-21T20:59Z
Repository: https://github.com/fragglet/lhasa
Language: C
Files changed: lib/lha_file_header.c
Commit date: 2016-03-17 00:40:19 -0400
Commit message: Fix integer underflow vulnerability in L3 decode.

Marcin 'Icewall' Noga of Cisco TALOS discovered that the level 3 header
decoding routines were vulnerable to an integer underflow, if the 32-bit
header length was less than the base level 3 header length. This could
lead to an exploitable heap corruption condition.

Thanks go to Marcin Noga and Regina Wilson of Cisco TALOS for reporting
this vulnerability.

Diff: diff --git a/lib/lha_file_header.c b/lib/lha_file_header.c
index 2889eec..b06be91 100644
--- a/lib/lha_file_header.c
+++ b/lib/lha_file_header.c
@@ -349,10 +349,14 @@ static uint8_t *extend_raw_data(LHAFileHeader **header,
 {
 	LHAFileHeader *new_header;
 	size_t new_raw_len;
 	uint8_t *result;
 
+	if (nbytes > LEVEL_3_MAX_HEADER_LEN) {
+		return NULL;
+	}
+
 	// Reallocate the header and raw_data area to be larger.
 
 	new_raw_len = RAW_DATA_LEN(header) + nbytes;
 	new_header = realloc(*header, sizeof(LHAFileHeader) + new_raw_len);
 
@@ -795,11 +799,12 @@ static int decode_level3_header(LHAFileHeader **header, LHAInputStream *stream)
 	// we must place a sensible limit on the amount of data that will
 	// be read, to avoid possibly allocating gigabytes of memory.
 
 	header_len = lha_decode_uint32(&RAW_DATA(header, 24));
 
-	if (header_len > LEVEL_3_MAX_HEADER_LEN) {
+	if (header_len > LEVEL_3_MAX_HEADER_LEN
+	 || header_len < RAW_DATA_LEN(header)) {
 		return 0;
 	}
 
 	if (!extend_raw_data(header, stream,
 	                     header_len - RAW_DATA_LEN(header))) {

Vulnerable code: 	if (header_len > LEVEL_3_MAX_HEADER_LEN) {
Fixed code: 	if (nbytes > LEVEL_3_MAX_HEADER_LEN) {
		return NULL;
	}

	if (header_len > LEVEL_3_MAX_HEADER_LEN
	 || header_len < RAW_DATA_LEN(header)) {
CVE-2019-25091: Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004)
value: A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie without 'httponly' flag. It is possible to initiate the attack remotely. The name of the patch is 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. It is recommended to apply a patch to fix this issue. The identifier VDB-216909 was assigned to this vulnerability.
CWE description: The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
CVSS v3 base score: 5.3
Published: 2022-12-27T23:15Z
Repository: https://github.com/nsupdate-info/nsupdate.info
Language: Python
Files changed: src/nsupdate/settings/base.py
Commit date: 2019-05-16 11:31:09 +0200
Commit message: Set HTTPONLY to CSRF cookies

Diff: diff --git a/src/nsupdate/settings/base.py b/src/nsupdate/settings/base.py
index e8722a4..f5a4d28 100644
--- a/src/nsupdate/settings/base.py
+++ b/src/nsupdate/settings/base.py
@@ -281,11 +281,11 @@ REFERRER_POLICY = 'same-origin'
 CSRF_FAILURE_VIEW = 'nsupdate.main.views.csrf_failure_view'
 
 # Settings for CSRF cookie.
 CSRF_COOKIE_NAME = 'csrftoken'
 CSRF_COOKIE_PATH = '/'
-CSRF_COOKIE_HTTPONLY = False
+CSRF_COOKIE_HTTPONLY = True
 
 # Settings for session cookie.
 SESSION_COOKIE_NAME = 'sessionid'
 SESSION_COOKIE_PATH = '/'
 SESSION_COOKIE_HTTPONLY = True

Vulnerable code: CSRF_COOKIE_HTTPONLY = False
Fixed code: CSRF_COOKIE_HTTPONLY = True
CVE-2022-46180: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create graphs using the Mermaid syntax. Users of discourse-mermaid-theme-component version 1.0.0 who can create posts are able to inject arbitrary HTML on that post. The issue has been fixed on the `main` branch of the GitHub repository, with 1.1.0 named as a patched version. Admins can update the theme component through the admin UI. As a workaround, admins can temporarily disable discourse-mermaid-theme-component.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-04T17:15Z
Repository: https://github.com/discourse/discourse-mermaid-theme-component
Language: JSON
Files changed: javascripts/discourse/api-initializers/discourse-mermaid-theme-component.js, package.json
Commit date: 2023-01-04 15:36:39 +0100
Commit message: SECURITY: render errors as plain text (#14)


Diff: diff --git a/javascripts/discourse/api-initializers/discourse-mermaid-theme-component.js b/javascripts/discourse/api-initializers/discourse-mermaid-theme-component.js
index 8d86220..00fabf2 100644
--- a/javascripts/discourse/api-initializers/discourse-mermaid-theme-component.js
+++ b/javascripts/discourse/api-initializers/discourse-mermaid-theme-component.js
@@ -52,11 +52,11 @@ async function applyMermaid(element, key = "composer") {
             mermaid.innerHTML = svg;
           }
         );
       }
     } catch (e) {
-      mermaid.innerHTML = `<span class="mermaid-error">${e?.str || e}</span>`;
+      mermaid.innerText = e?.text || e;
     } finally {
       mermaid.dataset.processed = true;
       mermaid.querySelector(".spinner")?.remove();
     }
 
diff --git a/package.json b/package.json
index 8581ee7..9054b1d 100644
--- a/package.json
+++ b/package.json
@@ -1,9 +1,9 @@
 {
   "author": "joffreyjaffeux",
   "license": "MIT",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "repository": "https://github.com/discourse/discourse-mermaid-theme-component",
   "devDependencies": {
     "eslint-config-discourse": "^1.1.8"
   }
 }

Vulnerable code:       mermaid.innerHTML = `<span class="mermaid-error">${e?.str || e}</span>`;
  "version": "1.0.0",
Fixed code:       mermaid.innerText = e?.text || e;
  "version": "1.1.0",
CVE-2020-15904: Out-of-bounds Write (CWE-787)
value: A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2020-07-22T23:15Z
Repository: https://github.com/ilanschnell/bsdiff4
Language: C
Files changed: bsdiff4/core.c
Commit date: 2020-07-13 21:40:37 -0500
Commit message: apply patch from Robert Scott to fix - shifting some bounds checking

Diff: diff --git a/bsdiff4/core.c b/bsdiff4/core.c
index 91be7f8..11b6806 100644
--- a/bsdiff4/core.c
+++ b/bsdiff4/core.c
@@ -429,12 +429,11 @@ static PyObject* patch(PyObject* self, PyObject* args)
         }
         x = PyLong_AsLong(PyTuple_GET_ITEM(tuple, 0));
         y = PyLong_AsLong(PyTuple_GET_ITEM(tuple, 1));
         z = PyLong_AsLong(PyTuple_GET_ITEM(tuple, 2));
         if (newpos + x > newDataLength ||
-                diffPtr + x > diffBlock + diffBlockLength ||
-                extraPtr + y > extraBlock + extraBlockLength) {
+                diffPtr + x > diffBlock + diffBlockLength) {
             PyMem_Free(newData);
             PyErr_SetString(PyExc_ValueError, "corrupt patch (overflow)");
             return NULL;
         }
         memcpy(newData + newpos, diffPtr, x);
@@ -442,10 +441,16 @@ static PyObject* patch(PyObject* self, PyObject* args)
         for (j = 0; j < x; j++)
             if ((oldpos + j >= 0) && (oldpos + j < origDataLength))
                 newData[newpos + j] += origData[oldpos + j];
         newpos += x;
         oldpos += x;
+        if (newpos + y > newDataLength ||
+                extraPtr + y > extraBlock + extraBlockLength) {
+            PyMem_Free(newData);
+            PyErr_SetString(PyExc_ValueError, "corrupt patch (overflow)");
+            return NULL;
+        }
         memcpy(newData + newpos, extraPtr, y);
         extraPtr += y;
         newpos += y;
         oldpos += z;
     }

Vulnerable code:                 diffPtr + x > diffBlock + diffBlockLength ||
                extraPtr + y > extraBlock + extraBlockLength) {
Fixed code:                 diffPtr + x > diffBlock + diffBlockLength) {
        if (newpos + y > newDataLength ||
                extraPtr + y > extraBlock + extraBlockLength) {
            PyMem_Free(newData);
            PyErr_SetString(PyExc_ValueError, "corrupt patch (overflow)");
            return NULL;
        }
CVE-2022-4889: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T08:15Z
Repository: https://github.com/visegripped/stracker
Language: PHP
Files changed: doc_root/public_html/stracker/api.php
Commit date: 2022-04-09 08:42:35 -0700
Commit message: Fix date query and protect against sql injection

Diff: diff --git a/doc_root/public_html/stracker/api.php b/doc_root/public_html/stracker/api.php
index d3ff16f..dcda7c9 100644
--- a/doc_root/public_html/stracker/api.php
+++ b/doc_root/public_html/stracker/api.php
@@ -8,11 +8,11 @@ $symbol = $_GET['symbol'];
 $startDate = $_GET['startDate'];
 $endDate = $_GET['endDate'];
 
 function getHistory($symbol, $startDate, $endDate, $pdo) {
     $history = array();
-    $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $symbol where date >= $startDate and date <= $endDate order by date DESC";
+    $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $pdo->quote($symbol) where date between $pdo->quote($startDate) and $pdo->quote($endDate) order by date DESC";
     $stmt = $pdo->query($query);
     return $stmt->fetchAll(\PDO::FETCH_ASSOC);
 }
 
 

Vulnerable code:     $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $symbol where date >= $startDate and date <= $endDate order by date DESC";
Fixed code:     $query = "select date, EOD, MA20, MA50, delta, deltaMA5, deltaMA10, deltaMA20, P0, P1, P2, M1, M2, M3 from $pdo->quote($symbol) where date between $pdo->quote($startDate) and $pdo->quote($endDate) order by date DESC";
CVE-2024-37391: Insufficient Information (NVD-CWE-noinfo)
value: ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-22T07:15Z
Repository: https://github.com/ProtonVPN/win-app
Language: Other
Files changed: Setup/setup.iss
Commit date: 2024-01-30 12:32:43 +0200
Commit message: Fix drive installer path

Diff: diff --git a/Setup/setup.iss b/Setup/setup.iss
index 4eb2a944..5e204c4a 100644
--- a/Setup/setup.iss
+++ b/Setup/setup.iss
@@ -19,11 +19,11 @@
 #define InstallLogPath "{app}\Install.log.txt"
 
 #define Hash ""
 #define VersionFolder "v" + MyAppVersion
 #define AppFolder "Proton\VPN"
-#define SourcePath GetEnv("BUILD_PATH") 
+#define SourcePath GetEnv("BUILD_PATH")
 #define IsBTISource SourcePath == "src/bin/win-x64/BTI/publish"
 #if IsBTISource
 #define OutputBaseSuffix "_BTI"
 #else
 #define OutputBaseSuffix ""
@@ -138,11 +138,11 @@ Name: "{commondesktop}\Proton VPN"; Filename: "{app}\{#LauncherExeName}"; Tasks:
 [Tasks]
 Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; 
 Name: "installProtonDrive"; Description: "{cm:InstallProtonDriveTitle}"; Check: ShouldDisplayProtonDriveCheckbox;
 
 [Run]
-Filename: "{app}\{#VersionFolder}\{#ProtonDriveDownloaderName}"; Parameters: "{autopf}\Proton\Drive"; Tasks: installProtonDrive; Flags: postinstall nowait runascurrentuser skipifsilent;
+Filename: "{app}\{#VersionFolder}\{#ProtonDriveDownloaderName}"; Parameters: "{code:GetDriveInstallPath}"; Tasks: installProtonDrive; Flags: postinstall nowait runascurrentuser skipifsilent;
 
 [Languages]
 Name: "en_US"; MessagesFile: "compiler:Default.isl,Strings\Default.isl"
 Name: "cs_CZ"; MessagesFile: "compiler:Languages\Czech.isl,Strings\Czech.isl"
 Name: "ja_JP"; MessagesFile: "compiler:Languages\Japanese.isl,Strings\Japanese.isl"
@@ -477,9 +477,14 @@ begin
     res := RemoveWfpObjects();
     Log('RemoveWfpObjects returned: ' + IntToStr(res));
   end;
 end;
 
+function GetDriveInstallPath(value: String): String;
+begin
+    Result := '"' + ExpandConstant('{autopf}\Proton\Drive') + '"';
+end;
+
 function ShouldDisplayProtonDriveCheckbox: Boolean;
 begin
   Result := IsProductInstalled('{F3B95BD2-1311-4B82-8B4A-B9EB7C0500ED}') = 0;
 end;
\ No newline at end of file

Vulnerable code: #define SourcePath GetEnv("BUILD_PATH") 
Filename: "{app}\{#VersionFolder}\{#ProtonDriveDownloaderName}"; Parameters: "{autopf}\Proton\Drive"; Tasks: installProtonDrive; Flags: postinstall nowait runascurrentuser skipifsilent;
Fixed code: #define SourcePath GetEnv("BUILD_PATH")
Filename: "{app}\{#VersionFolder}\{#ProtonDriveDownloaderName}"; Parameters: "{code:GetDriveInstallPath}"; Tasks: installProtonDrive; Flags: postinstall nowait runascurrentuser skipifsilent;
function GetDriveInstallPath(value: String): String;
begin
    Result := '"' + ExpandConstant('{autopf}\Proton\Drive') + '"';
end;
CVE-2020-7750: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.6
Published: 2020-10-21T17:15Z
Repository: https://github.com/LLK/scratch-svg-renderer
Language: Unknown
Commit date: 2020-10-15 15:40:59 -0400
Commit message: Merge pull request #179 from LLK/hotfix/purify-just-in-time

[develop] Merge hotfix back into develop
CVE-2024-35195: Insufficient Information (NVD-CWE-noinfo)
value: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-20T21:15Z
Repository: https://github.com/psf/requests
Language: Unknown
Commit date: 2024-03-11 06:21:59 -0500
Commit message: Merge pull request #6655 from sigmavirus24/fix-tls-floppy

Use TLS settings in selecting connection pool
CVE-2023-43661: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-10-11T20:15Z
Repository: https://github.com/cachethq/cachet
Language: Unknown
Commit date: 2023-10-11 11:14:10 +0100
Commit message: Merge pull request from GHSA-hv79-p62r-wg3p

fix: Auth Remote Code execution
CVE-2021-4285: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-27T11:15Z
Repository: https://github.com/NagiosEnterprises/ncpa
Language: HTML
Files changed: agent/listener/templates/tail.html
Commit date: 2021-12-06 13:47:08 -0600
Commit message: fix XSS issue in log tailing

Diff: diff --git a/agent/listener/templates/tail.html b/agent/listener/templates/tail.html
index 91cfe73..d79fd2a 100644
--- a/agent/listener/templates/tail.html
+++ b/agent/listener/templates/tail.html
@@ -65,11 +65,11 @@ $(document).ready(function() {
     start_websocket();
 
     $('.btn-apply').click(function() {
         var name = $('input[name="name"]').val();
         query_string = "name=" + name;
-        $('.name').html(name);
+        $('.name').text(name);
 
         // Restart the websocket
         ws.close();
         logbody.html('<tr class="tbl-message"><td colspan="7">No logs have came in yet.</td></tr>');
         start_websocket();

Vulnerable code:         $('.name').html(name);
Fixed code:         $('.name').text(name);
CVE-2023-1625: Insufficient Information (NVD-CWE-noinfo)
value: An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5
Published: 2023-09-24T01:15Z
Repository: https://github.com/openstack/heat
Language: Unknown
Commit date: 2023-01-27 17:30:30 +0000
Commit message: Merge "Honor 'hidden' parameter in 'stack environment show' command"
CVE-2015-10086: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, was found in OpenCycleCompass server-php. Affected is an unknown function of the file api1/login.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is fa0d9bcf81c711a88172ad0d37a842f029ac3782. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221808.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-28T00:15Z
Repository: https://github.com/OpenCycleCompass/server-php
Language: PHP
Files changed: api1/login.php
Commit date: 2015-02-03 20:58:20 +0100
Commit message: login.php sql injection prevention

Diff: diff --git a/api1/login.php b/api1/login.php
index 7bb4cc9..ee88794 100644
--- a/api1/login.php
+++ b/api1/login.php
@@ -19,11 +19,11 @@ if(isset($_GET["login"]) && isset($_GET["user"]) && !empty($_GET["user"]) && (is
 		$pw = $my->real_escape_string($_POST["password"]);
 	} else {
 		$pw = $my->real_escape_string($_GET["password"]);
 	}
 	$success = false;
-	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$_GET["user"]."';";
+	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$my->real_escape_string($_GET["user"])."';";
 	$result = $my->query($query);
 	if($result->num_rows >= 1){
 		// possible multiple users with same name but different password -> multiple rows in MySQL db
 		while($row = $result->fetch_assoc()){
 			if(password_verify($pw, $row["password"])) {

Vulnerable code: 	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$_GET["user"]."';";
Fixed code: 	$query = "SELECT `password` FROM `admin_users` WHERE `name` = '".$my->real_escape_string($_GET["user"])."';";
CVE-2020-25820: Server-Side Request Forgery (SSRF) (CWE-918)
value: BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 6.5
Published: 2020-10-21T13:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: Unknown
Commit date: 2020-10-08 17:24:06 -0400
Commit message: Merge pull request #10619 from bigbluebutton/bbb-soffice-disable-update

Disable libreoffice document update ( speed up the conversion )