Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-3423: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0.
CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 8.8
Published: 2023-06-27T04:15Z
Repository: https://github.com/cloudexplorer-dev/cloudexplorer-lite
Language: Java
Files changed: framework/sdk/backend/src/main/java/com/fit2cloud/base/service/impl/BaseUserServiceImpl.java
Commit date: 2023-06-05 11:27:58 +0800
Commit message: fix: 用户修改密码增加后端接口校验

Diff: diff --git a/framework/sdk/backend/src/main/java/com/fit2cloud/base/service/impl/BaseUserServiceImpl.java b/framework/sdk/backend/src/main/java/com/fit2cloud/base/service/impl/BaseUserServiceImpl.java
index b1244c274..1e887b1d6 100644
--- a/framework/sdk/backend/src/main/java/com/fit2cloud/base/service/impl/BaseUserServiceImpl.java
+++ b/framework/sdk/backend/src/main/java/com/fit2cloud/base/service/impl/BaseUserServiceImpl.java
@@ -151,14 +151,21 @@ public class BaseUserServiceImpl extends ServiceImpl<BaseUserMapper, User> imple
 
         // 非本地创建用户不允许修改密码
         if (!"local".equalsIgnoreCase(user.getSource())) {
             throw new RuntimeException("非云管本地创建的用户无法修改密码");
         }
+        if (StringUtils.equals(request.getOldPassword(), request.getNewPassword())) {
+            throw new RuntimeException("新旧密码相同");
+        }
         if (!MD5Util.md5(request.getOldPassword()).equalsIgnoreCase(user.getPassword())) {
             throw new RuntimeException("旧密码错误");
         }
 
+        if (!request.getNewPassword().matches("^(?!.*\\s)(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[\\W_]).{8,30}$")) {
+            throw new RuntimeException("有效密码：8-30位，英文大小写字母+数字+特殊字符");
+        }
+
         user.setPassword(MD5Util.md5(request.getNewPassword()));
         user.setUpdateTime(null);
         this.updateById(user);
         return true;
     }

Fixed code:         if (StringUtils.equals(request.getOldPassword(), request.getNewPassword())) {
            throw new RuntimeException("新旧密码相同");
        }
        if (!request.getNewPassword().matches("^(?!.*\\s)(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[\\W_]).{8,30}$")) {
            throw new RuntimeException("有效密码：8-30位，英文大小写字母+数字+特殊字符");
        }
CVE-2014-125058: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in LearnMeSomeCodes project3 and classified as critical. This issue affects the function search_first_name of the file search.rb. The manipulation leads to sql injection. The patch is named d3efa17ae9f6b2fc25a6bbcf165cefed17c7035e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217607. NOTE: Maintainer is aware of this issue as remarked in the source code.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T11:15Z
Repository: https://github.com/LearnMeSomeCodes/project3
Language: Ruby
Files changed: search.rb
Commit date: 2014-11-22 20:24:06 -0500
Commit message: Recommended way to avoid SQL injection

Diff: diff --git a/search.rb b/search.rb
index 868a718..9bd7245 100644
--- a/search.rb
+++ b/search.rb
@@ -11,10 +11,23 @@
 	end
 
 	def search_last_name
 		print "Last name: "
 		last_name = gets.chomp 
+
+    ### FYI: This is vulnerable to SQL injection.
+    ###      Consider using the following form of
+    ###      the #where clause instead:
+    ###
+    ###        Person.where("last_name LIKE ?", "%#{last_name}%")
+    ###
+    ###      This will ensure that the data is
+    ###      properly escaped.  (BTW: I suspect the
+    ###      reason that this didn't work the other
+    ###      day was because you used 'single quotes'
+    ###      instead of "double quotes")
+    ###
 		people = Person.where("last_name LIKE '%#{last_name}%'")
 		return people
 	end
 
   ### TODO: Have this method return a collection

Fixed code: 
    ### FYI: This is vulnerable to SQL injection.
    ###      Consider using the following form of
    ###      the #where clause instead:
    ###
    ###        Person.where("last_name LIKE ?", "%#{last_name}%")
    ###
    ###      This will ensure that the data is
    ###      properly escaped.  (BTW: I suspect the
    ###      reason that this didn't work the other
    ###      day was because you used 'single quotes'
    ###      instead of "double quotes")
    ###
CVE-2018-21036: Improper Input Validation (CWE-20)
value: Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2020-07-21T14:15Z
Repository: https://github.com/balderdashy/sails-hook-sockets
Language: JavaScript
Files changed: lib/receive-incoming-sails-io-msg.js
Commit date: 2018-09-23 16:18:38 -0500
Commit message: Define req.path for socket requests.

Diff: diff --git a/lib/receive-incoming-sails-io-msg.js b/lib/receive-incoming-sails-io-msg.js
index 2ddca3b..5be5704 100644
--- a/lib/receive-incoming-sails-io-msg.js
+++ b/lib/receive-incoming-sails-io-msg.js
@@ -1,10 +1,11 @@
 /**
  * Module dependencies
  */
 
 var util = require('util');
+var url = require('url');
 var _ = require('@sailshq/lodash');
 var semver = require('semver');
 var parseSdkMetadata = require('./parse-sdk-metadata');
 var ERRORPACK = require('./errors');
 var proxyaddr = require('proxy-addr');
@@ -103,10 +104,12 @@ module.exports = function ToReceiveIncomingSailsIOMsg(app) {
       // Access to underlying SIO socket
       socket  : options.socket,
 
       url     : options.incomingSailsIOMsg.url,
 
+      path    : url.parse(options.incomingSailsIOMsg.url).pathname,
+
       method  : options.eventName,
 
       // Attached data becomes simulated HTTP body (`req.body`)
       // (allow `params` or `data` to be specified for backwards/sideways-compatibility)
       body    : _.isArray(options.incomingSailsIOMsg.data) ? options.incomingSailsIOMsg.data : _.extend({}, options.incomingSailsIOMsg.params || {}, options.incomingSailsIOMsg.data || {}),

Fixed code: var url = require('url');
      path    : url.parse(options.incomingSailsIOMsg.url).pathname,
CVE-2018-21036: Improper Input Validation (CWE-20)
value: Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2020-07-21T14:15Z
Repository: https://github.com/balderdashy/sails-hook-sockets
Language: JavaScript
Files changed: lib/receive-incoming-sails-io-msg.js
Commit date: 2018-09-23 16:38:55 -0500
Commit message: Follow up to ff02114eaec090ee51db48435cc32d451662606e to ensure req.path is good and stringy.

Diff: diff --git a/lib/receive-incoming-sails-io-msg.js b/lib/receive-incoming-sails-io-msg.js
index 5be5704..39ebccd 100644
--- a/lib/receive-incoming-sails-io-msg.js
+++ b/lib/receive-incoming-sails-io-msg.js
@@ -104,11 +104,14 @@ module.exports = function ToReceiveIncomingSailsIOMsg(app) {
       // Access to underlying SIO socket
       socket  : options.socket,
 
       url     : options.incomingSailsIOMsg.url,
 
-      path    : url.parse(options.incomingSailsIOMsg.url).pathname,
+      path    : url.parse(options.incomingSailsIOMsg.url).pathname || '/',
+      // ^^ Uses || '/' because otherwise url.parse returns `null`,
+      // which is not a string and thus bad when you try to check
+      // .match() of it.
 
       method  : options.eventName,
 
       // Attached data becomes simulated HTTP body (`req.body`)
       // (allow `params` or `data` to be specified for backwards/sideways-compatibility)

Vulnerable code:       path    : url.parse(options.incomingSailsIOMsg.url).pathname,
Fixed code:       path    : url.parse(options.incomingSailsIOMsg.url).pathname || '/',
      // ^^ Uses || '/' because otherwise url.parse returns `null`,
      // which is not a string and thus bad when you try to check
      // .match() of it.
CVE-2015-2831: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in das_watchdog 0.9.0 allows local users to execute arbitrary code with root privileges via a large string in the XAUTHORITY environment variable.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2015-04-14T18:59Z
Repository: https://github.com/kmatheussen/das_watchdog
Language: C
Files changed: das_watchdog.c
Commit date: 2015-04-01 16:06:48 +0200
Commit message: Fix memory overflow if the name of an environment is larger than 500 characters. Bug found by Adam Sampson.

Diff: diff --git a/das_watchdog.c b/das_watchdog.c
index c98bbea..8473fe8 100644
--- a/das_watchdog.c
+++ b/das_watchdog.c
@@ -304,11 +304,13 @@ static int checksoftirq(int force){
 #endif
 
 
 
 static char *get_pid_environ_val(pid_t pid,char *val){
-  char temp[500];
+  int temp_size = 500;
+  char *temp = malloc(temp_size);
+  
   int i=0;
   int foundit=0;
   FILE *fp;
 
   sprintf(temp,"/proc/%d/environ",pid);
@@ -317,10 +319,16 @@ static char *get_pid_environ_val(pid_t pid,char *val){
   if(fp==NULL)
     return NULL;
 
   
   for(;;){
+    
+    if (i >= temp_size) {
+      temp_size *= 2;
+      temp = realloc(temp, temp_size);
+    }
+      
     temp[i]=fgetc(fp);    
 
     if(foundit==1 && (temp[i]==0 || temp[i]=='\0' || temp[i]==EOF)){
       char *ret;
       temp[i]=0;

Vulnerable code:   char temp[500];
Fixed code:   int temp_size = 500;
  char *temp = malloc(temp_size);
  
    
    if (i >= temp_size) {
      temp_size *= 2;
      temp = realloc(temp, temp_size);
    }
CVE-2023-26302: Other (NVD-CWE-Other)
value: Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.

CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.5
Published: 2023-02-22T23:15Z
Repository: https://github.com/executablebooks/markdown-it-py
Language: Python
Files changed: markdown_it/cli/parse.py, tests/test_cli.py
Commit date: 2023-02-22 06:39:56 +0100
Commit message: 🐛 FIX: CLI crash on non-utf8 character (#247)

Addresses CVE-2023-26302
Diff: diff --git a/markdown_it/cli/parse.py b/markdown_it/cli/parse.py
index 2d74f55..890d5de 100644
--- a/markdown_it/cli/parse.py
+++ b/markdown_it/cli/parse.py
@@ -33,11 +33,11 @@ def convert(filenames: Iterable[str]) -> None:
 def convert_file(filename: str) -> None:
     """
     Parse a Markdown file and dump the output to stdout.
     """
     try:
-        with open(filename, "r") as fin:
+        with open(filename, "r", encoding="utf8", errors="ignore") as fin:
             rendered = MarkdownIt().render(fin.read())
             print(rendered, end="")
     except OSError:
         sys.stderr.write(f'Cannot open file "{filename}".\n')
         sys.exit(1)
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 57d6b93..c38e24f 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -18,10 +18,17 @@ def test_parse_fail():
     with pytest.raises(SystemExit) as exc_info:
         parse.main(["/tmp/nonexistant_path/for_cli_test.md"])
     assert exc_info.value.code == 1
 
 
+def test_non_utf8():
+    with tempfile.TemporaryDirectory() as tempdir:
+        path = pathlib.Path(tempdir).joinpath("test.md")
+        path.write_bytes(b"\x80abc")
+        assert parse.main([str(path)]) == 0
+
+
 def test_print_heading():
     with patch("builtins.print") as patched:
         parse.print_heading()
     patched.assert_called()
 

Vulnerable code:         with open(filename, "r") as fin:
Fixed code:         with open(filename, "r", encoding="utf8", errors="ignore") as fin:
def test_non_utf8():
    with tempfile.TemporaryDirectory() as tempdir:
        path = pathlib.Path(tempdir).joinpath("test.md")
        path.write_bytes(b"\x80abc")
        assert parse.main([str(path)]) == 0
CVE-2020-6019: Insufficient Information (NVD-CWE-noinfo)
value: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(), leading to an exception thrown from libprotobuf and resulting in a crash.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2020-11-13T16:15Z
Repository: https://github.com/ValveSoftware/GameNetworkingSockets
Language: C++
Files changed: src/steamnetworkingsockets/clientlib/steamnetworkingsockets_udp.cpp
Commit date: 2020-09-03 11:24:25 -0700
Commit message: Tweak pointer math to avoid possible integer overflow

Diff: diff --git a/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_udp.cpp b/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_udp.cpp
index d7bec73..070f928 100644
--- a/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_udp.cpp
+++ b/src/steamnetworkingsockets/clientlib/steamnetworkingsockets_udp.cpp
@@ -838,13 +838,13 @@ void CConnectionTransportUDPBase::Received_Data( const uint8 *pPkt, int cbPkt, S
 		if ( pIn == NULL )
 		{
 			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "Failed to varint decode size of stats blob" );
 			return;
 		}
-		if ( pIn + cbStatsMsgIn > pPktEnd )
+		if ( cbStatsMsgIn > pPktEnd - pIn )
 		{
-			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "stats message size doesn't make sense.  Stats message size %d, packet size %d", cbStatsMsgIn, cbPkt );
+			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "stats message size doesn't make sense.  Stats message size %u, packet size %d", cbStatsMsgIn, cbPkt );
 			return;
 		}
 
 		if ( !msgStats.ParseFromArray( pIn, cbStatsMsgIn ) )
 		{

Vulnerable code: 		if ( pIn + cbStatsMsgIn > pPktEnd )
			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "stats message size doesn't make sense.  Stats message size %d, packet size %d", cbStatsMsgIn, cbPkt );
Fixed code: 		if ( cbStatsMsgIn > pPktEnd - pIn )
			ReportBadUDPPacketFromConnectionPeer( "DataPacket", "stats message size doesn't make sense.  Stats message size %u, packet size %d", cbStatsMsgIn, cbPkt );
CVE-2021-43837: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix `!template!`, vault-cli interprets the rest of the contents of the secret as a Jinja2 template. Jinja2 is a powerful templating engine and is not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk. If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you. In 3.0.0, the code related to interpreting vault templated secrets has been removed entirely. Users are advised to upgrade as soon as possible. For users unable to upgrade a workaround does exist. Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand, e.g. `vault-cli --no-render get-all`) or adding `render: false` to the vault-cli configuration yaml file disables rendering and removes the vulnerability. Using the python library, you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.1
Published: 2021-12-16T19:15Z
Repository: https://github.com/peopledoc/vault-cli
Language: Unknown
Commit date: 2021-12-15 18:15:46 +0100
Commit message: Merge pull request #198 from peopledoc/templates
CVE-2015-8346: Information Management Errors (CWE-199)
value: app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
CWE description: Weaknesses in this category are related to improper handling of sensitive information.
CVSS v3 base score: 5.3
Published: 2016-04-12T14:59Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: app/views/timelog/_form.html.erb
Commit date: 2015-11-04 18:22:40 +0000
Commit message: Fixed that time logging form may disclose subjects of issues that are not visible (#21150).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@14795 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/app/views/timelog/_form.html.erb b/app/views/timelog/_form.html.erb
index 84fb94787..0dbff35a7 100644
--- a/app/views/timelog/_form.html.erb
+++ b/app/views/timelog/_form.html.erb
@@ -11,11 +11,11 @@
       <p><%= f.select :project_id, project_tree_options_for_select(Project.allowed_to(:log_time).to_a, :selected => @time_entry.project, :include_blank => true) %></p>
     <% end %>
   <% end %>
   <p>
     <%= f.text_field :issue_id, :size => 6 %>
-    <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue %></span>
+    <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue.try(:visible?) %></span>
   </p>
   <p><%= f.text_field :spent_on, :size => 10, :required => true %><%= calendar_for('time_entry_spent_on') %></p>
   <p><%= f.text_field :hours, :size => 6, :required => true %></p>
   <p><%= f.text_field :comments, :size => 100, :maxlength => 1024 %></p>
   <p><%= f.select :activity_id, activity_collection_for_select_options(@time_entry), :required => true %></p>

Vulnerable code:     <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue %></span>
Fixed code:     <span id="time_entry_issue"><%= "#{@time_entry.issue.tracker.name} ##{@time_entry.issue.id}: #{@time_entry.issue.subject}" if @time_entry.issue.try(:visible?) %></span>
CVE-2017-15568: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-18T02:29Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: app/helpers/application_helper.rb
Commit date: 2017-10-15 11:09:43 +0000
Commit message: Ensure that values of multi-value fields are HTML-escaped in issue history (#27186).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@16985 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/app/helpers/application_helper.rb b/app/helpers/application_helper.rb
index cb0c277156..ef229f9553 100644
--- a/app/helpers/application_helper.rb
+++ b/app/helpers/application_helper.rb
@@ -175,11 +175,12 @@ module ApplicationHelper
     if block_given?
       object = yield object
     end
     case object.class.name
     when 'Array'
-      object.map {|o| format_object(o, html)}.join(', ').html_safe
+      formatted_objects = object.map {|o| format_object(o, html)}
+      html ? safe_join(formatted_objects, ', ') : formatted_objects.join(', ')
     when 'Time'
       format_time(object)
     when 'Date'
       format_date(object)
     when 'Fixnum'

Vulnerable code:       object.map {|o| format_object(o, html)}.join(', ').html_safe
Fixed code:       formatted_objects = object.map {|o| format_object(o, html)}
      html ? safe_join(formatted_objects, ', ') : formatted_objects.join(', ')
CVE-2017-15569: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-18T02:29Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: app/helpers/queries_helper.rb
Commit date: 2017-10-15 11:08:46 +0000
Commit message: Ensure that values of multi-value fields are HTML-escaped in issue list (#27186).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@16984 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/app/helpers/queries_helper.rb b/app/helpers/queries_helper.rb
index acab44536c..a4c3c3e7b3 100644
--- a/app/helpers/queries_helper.rb
+++ b/app/helpers/queries_helper.rb
@@ -199,11 +199,12 @@ module QueriesHelper
   end
 
   def column_content(column, item)
     value = column.value_object(item)
     if value.is_a?(Array)
-      value.collect {|v| column_value(column, item, v)}.compact.join(', ').html_safe
+      values = value.collect {|v| column_value(column, item, v)}.compact
+      safe_join(values, ', ')
     else
       column_value(column, item, value)
     end
   end
 

Vulnerable code:       value.collect {|v| column_value(column, item, v)}.compact.join(', ').html_safe
Fixed code:       values = value.collect {|v| column_value(column, item, v)}.compact
      safe_join(values, ', ')
CVE-2017-15570: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-18T02:29Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: app/views/timelog/_list.html.erb
Commit date: 2017-10-15 11:06:20 +0000
Commit message: Don't use raw output in timelog (#27186).

git-svn-id: http://svn.redmine.org/redmine/trunk@16983 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/app/views/timelog/_list.html.erb b/app/views/timelog/_list.html.erb
index 21115dfde2..6f126b0f7a 100644
--- a/app/views/timelog/_list.html.erb
+++ b/app/views/timelog/_list.html.erb
@@ -31,11 +31,13 @@
       </td>
     </tr>
   <% end %>
   <tr id="time-entry-<%= entry.id %>" class="time-entry <%= cycle("odd", "even") %> hascontextmenu">
     <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", entry.id, false, :id => nil) %></td>
-    <%= raw @query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, entry)}</td>"}.join %>
+    <% @query.inline_columns.each do |column| %>
+    <%= content_tag('td', column_content(column, entry), :class => column.css_classes) %>
+    <% end %>
     <td class="buttons">
     <% if entry.editable_by?(User.current) -%>
         <%= link_to l(:button_edit), edit_time_entry_path(entry),
                     :title => l(:button_edit),
                     :class => 'icon-only icon-edit' %>

Vulnerable code:     <%= raw @query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, entry)}</td>"}.join %>
Fixed code:     <% @query.inline_columns.each do |column| %>
    <%= content_tag('td', column_content(column, entry), :class => column.css_classes) %>
    <% end %>
CVE-2017-15571: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/issues/_list.html.erb via crafted column data.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-18T02:29Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: app/views/issues/_list.html.erb
Commit date: 2017-10-12 17:36:21 +0000
Commit message: Don't use raw output (#27186).

git-svn-id: http://svn.redmine.org/redmine/trunk@16971 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/app/views/issues/_list.html.erb b/app/views/issues/_list.html.erb
index 5488fb2959..8024a69482 100644
--- a/app/views/issues/_list.html.erb
+++ b/app/views/issues/_list.html.erb
@@ -29,11 +29,13 @@
       </td>
     </tr>
   <% end %>
   <tr id="issue-<%= issue.id %>" class="hascontextmenu <%= cycle('odd', 'even') %> <%= issue.css_classes %> <%= level > 0 ? "idnt idnt-#{level}" : nil %>">
     <td class="checkbox hide-when-print"><%= check_box_tag("ids[]", issue.id, false, :id => nil) %></td>
-    <%= raw query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, issue)}</td>"}.join %>
+    <% query.inline_columns.each do |column| %>
+    <%= content_tag('td', column_content(column, issue), :class => column.css_classes) %>
+    <% end %>
   </tr>
   <% query.block_columns.each do |column|
        if (text = column_content(column, issue)) && text.present? -%>
   <tr class="<%= current_cycle %>">
     <td colspan="<%= query.inline_columns.size + 1 %>" class="<%= column.css_classes %>">

Vulnerable code:     <%= raw query.inline_columns.map {|column| "<td class=\"#{column.css_classes}\">#{column_content(column, issue)}</td>"}.join %>
Fixed code:     <% query.inline_columns.each do |column| %>
    <%= content_tag('td', column_content(column, issue), :class => column.css_classes) %>
    <% end %>
CVE-2018-25056: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The manipulation of the argument text leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a0fe129055a99f429133a5c40cb13b44611ff796. It is recommended to apply a patch to fix this issue. VDB-216966 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T12:15Z
Repository: https://github.com/yola/yolapi
Language: Other
Files changed: requirements.txt, yolapi/pypi/metadata.py
Commit date: 2018-12-07 15:02:13 +0200
Commit message: Sanitize HTML to avoid XSS attacks

Diff: diff --git a/requirements.txt b/requirements.txt
index c598624..1c89514 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,9 +1,11 @@
 Django==1.11.17
 Markdown==2.6.11
 Pygments==2.2.0
 boto==2.48.0
+bleach==2.1.4
+bleach-whitelist==0.0.9
 celery==4.1.1
 django-crispy-forms==1.6.1
 django-nose==1.4.5
 docutils==0.14
 packaging==16.8
diff --git a/yolapi/pypi/metadata.py b/yolapi/pypi/metadata.py
index d399443..5b2aace 100644
--- a/yolapi/pypi/metadata.py
+++ b/yolapi/pypi/metadata.py
@@ -1,10 +1,12 @@
 import re
 
 from django.utils.html import format_html
 from django.utils.safestring import mark_safe
 
+import bleach
+from bleach_whitelist import print_tags, print_attrs, all_styles
 from docutils.core import publish_parts
 from markdown import markdown
 from mdx_gfm import GithubFlavoredMarkdownExtension
 
 
@@ -142,6 +144,9 @@ def render_description(text, content_type):
     elif content_type == 'text/markdown':
         html = markdown(text, extensions=[GithubFlavoredMarkdownExtension()])
     else:
         html = format_html('<pre>{}</pre>', text)
 
+    html = bleach.clean(
+        html, print_tags + ['a', 'cite', 'pre'], print_attrs, all_styles)
+
     return mark_safe(html)

Fixed code: bleach==2.1.4
bleach-whitelist==0.0.9
import bleach
from bleach_whitelist import print_tags, print_attrs, all_styles
    html = bleach.clean(
        html, print_tags + ['a', 'cite', 'pre'], print_attrs, all_styles)
CVE-2020-26251: Origin Validation Error (CWE-346)
value: Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 4.7
Published: 2020-12-18T18:15Z
Repository: https://github.com/open-zaak/open-zaak
Language: Unknown
Commit date: 2020-12-17 14:04:43 +0100
Commit message: Merge pull request from GHSA-chhr-gxrg-64x7

Security/cors configuration
CVE-2014-3994: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-16T18:55Z
Repository: https://github.com/djblets/djblets
Language: Other
Files changed: NEWS
Commit date: 2014-06-07 22:13:38 -0700
Commit message: Update the 0.7.30 release notes with the CVEs.

Diff: diff --git a/NEWS b/NEWS
index 6099e5a..20c7df7 100644
--- a/NEWS
+++ b/NEWS
@@ -3,17 +3,21 @@ version 0.7.30 final (6-June-2014):
 		* Fixed a XSS issue in the gravatars code.
 
 		  Users could construct a name that would allow for injecting
 		  JavaScript in the page. That name is now properly escaped.
 
+		  This is CVE-2014-3995.
+
 		* Fixed a XSS issue in json_dumps.
 
 		  JSON payloads constructed based on user input and then injected into
 		  a page could result in custom JavaScript being injected into the
 		  page. Additional escaping is now performed to ensure this does not
 		  happen.
 
+		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
+
 
 version 0.7.29 final (9-April-2014):
 	* djblets.webapi:
 		* Add requested query parameters in pagination links. (Bug #3199)
 

Fixed code: 		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2014-3994: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-16T18:55Z
Repository: https://github.com/djblets/djblets
Language: Other
Files changed: NEWS
Commit date: 2014-06-07 22:14:45 -0700
Commit message: Update the 0.8.3 release notes with the CVEs.

Diff: diff --git a/NEWS b/NEWS
index 20b437c0..6805bd7b 100644
--- a/NEWS
+++ b/NEWS
@@ -3,17 +3,21 @@ version 0.8.3 (6-June-2014):
 		* Fixed a XSS issue in the gravatars code.
 
 		  Users could construct a name that would allow for injecting
 		  JavaScript in the page. That name is now properly escaped.
 
+		  This is CVE-2014-3995.
+
 		* Fixed a XSS issue in json_dumps.
 
 		  JSON payloads constructed based on user input and then injected into
 		  a page could result in custom JavaScript being injected into the
 		  page. Additional escaping is now performed to ensure this does not
 		  happen.
 
+		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
+
 
 version 0.8.2 (2-June-2014):
 	* Packaging:
 		* Added missing .less files to the build, which impacted packaging
 		  of the source tarball.

Fixed code: 		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2014-3995: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-16T18:55Z
Repository: https://github.com/djblets/djblets
Language: Other
Files changed: NEWS
Commit date: 2014-06-07 22:13:38 -0700
Commit message: Update the 0.7.30 release notes with the CVEs.

Diff: diff --git a/NEWS b/NEWS
index 6099e5aa..20c7df7f 100644
--- a/NEWS
+++ b/NEWS
@@ -3,17 +3,21 @@ version 0.7.30 final (6-June-2014):
 		* Fixed a XSS issue in the gravatars code.
 
 		  Users could construct a name that would allow for injecting
 		  JavaScript in the page. That name is now properly escaped.
 
+		  This is CVE-2014-3995.
+
 		* Fixed a XSS issue in json_dumps.
 
 		  JSON payloads constructed based on user input and then injected into
 		  a page could result in custom JavaScript being injected into the
 		  page. Additional escaping is now performed to ensure this does not
 		  happen.
 
+		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
+
 
 version 0.7.29 final (9-April-2014):
 	* djblets.webapi:
 		* Add requested query parameters in pagination links. (Bug #3199)
 

Fixed code: 		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2014-3995: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-06-16T18:55Z
Repository: https://github.com/djblets/djblets
Language: Other
Files changed: NEWS
Commit date: 2014-06-07 22:14:45 -0700
Commit message: Update the 0.8.3 release notes with the CVEs.

Diff: diff --git a/NEWS b/NEWS
index 20b437c0..6805bd7b 100644
--- a/NEWS
+++ b/NEWS
@@ -3,17 +3,21 @@ version 0.8.3 (6-June-2014):
 		* Fixed a XSS issue in the gravatars code.
 
 		  Users could construct a name that would allow for injecting
 		  JavaScript in the page. That name is now properly escaped.
 
+		  This is CVE-2014-3995.
+
 		* Fixed a XSS issue in json_dumps.
 
 		  JSON payloads constructed based on user input and then injected into
 		  a page could result in custom JavaScript being injected into the
 		  page. Additional escaping is now performed to ensure this does not
 		  happen.
 
+		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
+
 
 version 0.8.2 (2-June-2014):
 	* Packaging:
 		* Added missing .less files to the build, which impacted packaging
 		  of the source tarball.

Fixed code: 		  This is CVE-2014-3995.

		  This is CVE-2014-3994 (discovered by "uchida", bug #3406).
CVE-2024-29191: Insufficient Information (NVD-CWE-noinfo)
value: gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (`links.html`) appends the `src` GET parameter (`[0]`) in all of its links for 1-click previews. The context in which `src` is being appended is `innerHTML` (`[1]`), which will insert the text as HTML. Commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T15:15Z
Repository: https://github.com/AlexxIT/go2rtc
Language: HTML
Files changed: www/index.html, www/links.html
Commit date: 2024-01-11 14:13:52 +0300
Commit message: Add sanitize from XSS to WebUI


Diff: diff --git a/www/index.html b/www/index.html
index 69403e9..4e4f999 100644
--- a/www/index.html
+++ b/www/index.html
@@ -122,11 +122,12 @@
     function reload() {
         const url = new URL('api/streams', location.href);
         fetch(url, {cache: 'no-cache'}).then(r => r.json()).then(data => {
             tbody.innerHTML = '';
 
-            for (const [name, value] of Object.entries(data)) {
+            for (const [key, value] of Object.entries(data)) {
+                const name = key.replace(/[<">]/g, ''); // sanitize
                 const online = value && value.consumers ? value.consumers.length : 0;
                 const src = encodeURIComponent(name);
                 const links = templates.map(link => {
                     return link.replace('{name}', src);
                 }).join(' ');
diff --git a/www/links.html b/www/links.html
index 25f7780..bc9c08c 100644
--- a/www/links.html
+++ b/www/links.html
@@ -41,11 +41,11 @@
 </head>
 <body>
 <script src="main.js"></script>
 <div id="links"></div>
 <script>
-    const src = new URLSearchParams(location.search).get('src');
+    const src = new URLSearchParams(location.search).get('src').replace(/[<">]/g, ''); // sanitize
 
     document.getElementById('links').innerHTML = `
         <h2>Any codec in source</h2>
         <li><a href="stream.html?src=${src}">stream.html</a> with auto-select mode / browsers: all / codecs: H264, H265*, MJPEG, JPEG, AAC, PCMU, PCMA, OPUS</li>
         <li><a href="api/streams?src=${src}">info.json</a> page with active connections</li>

Vulnerable code:             for (const [name, value] of Object.entries(data)) {
    const src = new URLSearchParams(location.search).get('src');
Fixed code:             for (const [key, value] of Object.entries(data)) {
                const name = key.replace(/[<">]/g, ''); // sanitize
    const src = new URLSearchParams(location.search).get('src').replace(/[<">]/g, ''); // sanitize
CVE-2024-29192: Insufficient Information (NVD-CWE-noinfo)
value: gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The `/api/config` endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an attacker may be able to achieve that depending on how go2rtc is set up on the upstream application, and given that this endpoint is not protected against CSRF, it allows requests from any origin (e.g. a "drive-by" attack) . The `exec` handler allows for any stream to execute arbitrary commands. An attacker may add a custom stream through `api/config`, which may lead to arbitrary command execution. In the event of a victim visiting the server in question, their browser will execute the requests against the go2rtc instance. Commit 8793c3636493c5efdda08f3b5ed5c6e1ea594fd9 adds a warning about secure API access.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T18:15Z
Repository: https://github.com/AlexxIT/go2rtc
Language: Markdown
Files changed: README.md
Commit date: 2024-01-11 14:26:51 +0300
Commit message: Add warning about secure access for API to docs


Diff: diff --git a/README.md b/README.md
index 8ab5291..aaed941 100644
--- a/README.md
+++ b/README.md
@@ -788,10 +788,12 @@ streams:
 
 ### Module: API
 
 The HTTP API is the main part for interacting with the application. Default address: `http://localhost:1984/`.
 
+**Important!** go2rtc passes requests from localhost and from unix socket without HTTP authorisation, even if you have it configured! It is your responsibility to set up secure external access to API. If not properly configured, an attacker can gain access to your cameras and even your server.
+
 [API description](https://github.com/AlexxIT/go2rtc/tree/master/api).
 
 **Module config**
 
 - you can disable HTTP API with `listen: ""` and use, for example, only RTSP client/server protocol

Fixed code: **Important!** go2rtc passes requests from localhost and from unix socket without HTTP authorisation, even if you have it configured! It is your responsibility to set up secure external access to API. If not properly configured, an attacker can gain access to your cameras and even your server.
CVE-2020-23907: Out-of-bounds Write (CWE-787)
value: An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2021-04-21T18:15Z
Repository: https://github.com/avast/retdec
Language: C++
Files changed: src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
Commit date: 2019-09-10 15:21:16 +0200
Commit message: Try to fix issue #637

Reference: https://github.com/avast/retdec/issues/637
Diff: diff --git a/src/bin2llvmir/optimizations/decoder/ir_modifications.cpp b/src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
index 40118c3e..320c0aea 100644
--- a/src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
+++ b/src/bin2llvmir/optimizations/decoder/ir_modifications.cpp
@@ -421,10 +421,13 @@ bool Decoder::canSplitFunctionOn(
 			if (bAddr.isUndefined())
 			{
 				continue;
 			}
 			auto up = fncStarts.upper_bound(bAddr);
+			if (up == fncStarts.begin()) {
+				return false;
+			}	
 			--up;
 			Address bFnc = *up;
 
 			for (auto* p : predecessors(&b))
 			{
@@ -440,10 +443,13 @@ bool Decoder::canSplitFunctionOn(
 				if (pAddr.isUndefined())
 				{
 					continue;
 				}
 				auto up = fncStarts.upper_bound(pAddr);
+				if (up == fncStarts.begin()) {
+					return false;
+				}
 				--up;
 				Address pFnc = *up;
 
 				if (bFnc != pFnc)
 				{

Fixed code: 			if (up == fncStarts.begin()) {
				return false;
			}	
				if (up == fncStarts.begin()) {
					return false;
				}
CVE-2021-23327: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.3
Published: 2021-02-09T08:15Z
Repository: https://github.com/apexcharts/apexcharts.js
Language: Unknown
Commit date: 2021-01-14 13:01:14 +0530
Commit message: Merge pull request #2158 from 418sec/1-npm-apexcharts

Security Fix for Cross-Site Scripting (XSS) - huntr.dev
CVE-2023-38497: Insecure Preserved Inherited Permissions (CWE-278)
value: Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`.
CWE description: A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
CVSS v3 base score: 7.3
Published: 2023-08-04T16:15Z
Repository: https://github.com/rust-lang/cargo
Language: Unknown
Commit date: 2023-08-03 12:58:25 +0000
Commit message: Auto merge of #12443 - pietroalbini:pa-cve-2023-38497-nightly, r=weihanglo

Fix CVE-2023-38497 for master

Changes have been made by `@weihanglo` and reviewed by `@ehuss` in a private repository.
CVE-2023-46122: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.1
Published: 2023-10-23T16:15Z
Repository: https://github.com/sbt/io
Language: Unknown
Commit date: 2023-10-22 05:20:36 -0400
Commit message: Merge pull request #360 from eed3si9n/wip/zip_issue

Fixes zip-slip vulnerability