Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2012-1600: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-05-14T00:55Z
Repository: https://github.com/phppgadmin/phppgadmin
Language: PHP
Files changed: functions.php
Commit date: 2012-02-27 23:45:55 +0100
Commit message: Fix XSS in function.php, reported by Mateusz Goik.

I'm not sure why the name and the type the functions were not escaped
*on purpose* here. There's no more reason here than in any other place
with other PostgreSQL objects to not escape the name or the type...

Diff: diff --git a/functions.php b/functions.php
index 7f0a7d38..4a043cf6 100644
--- a/functions.php
+++ b/functions.php
@@ -771,18 +771,16 @@
 
 		$columns = array(
 			'function' => array(
 				'title' => $lang['strfunction'],
 				'field' => field('proproto'),
-				'type'  => 'verbatim',
 				'url'   => "redirect.php?subject=function&amp;action=properties&amp;{$misc->href}&amp;",
 				'vars'  => array('function' => 'proproto', 'function_oid' => 'prooid'),
 			),
 			'returns' => array(
 				'title' => $lang['strreturns'],
 				'field' => field('proreturns'),
-				'type'  => 'verbatim',
 			),
 			'owner' => array(
 				'title' => $lang['strowner'],
 				'field' => field('proowner'),
 			),

Vulnerable code: 				'type'  => 'verbatim',
				'type'  => 'verbatim',
CVE-2017-7962: Divide By Zero (CWE-369)
value: The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2017-04-19T15:59Z
Repository: https://github.com/jsummers/imageworsener
Language: C
Files changed: src/imagew-gif.c
Commit date: 2017-04-14 11:30:33 -0400
Commit message: Fixed a GIF decoding bug (divide by zero)

Fixes issue #15

Diff: diff --git a/src/imagew-gif.c b/src/imagew-gif.c
index 7847c55..671fd4c 100644
--- a/src/imagew-gif.c
+++ b/src/imagew-gif.c
@@ -612,10 +612,14 @@ static int iwgif_read_image(struct iwgifrcontext *rctx)
 	rctx->image_top = (int)iw_get_ui16le(&rctx->rbuf[2]);
 	// image_left and _top may be updated in iwgif_init_screen().
 
 	rctx->image_width = (int)iw_get_ui16le(&rctx->rbuf[4]);
 	rctx->image_height = (int)iw_get_ui16le(&rctx->rbuf[6]);
+	if(rctx->image_width<1 || rctx->image_height<1) {
+		iw_set_error(rctx->ctx, "Invalid image dimensions");
+		goto done;
+	}
 
 	rctx->interlaced = (int)((rctx->rbuf[8]>>6)&0x01);
 
 	has_local_ct = (int)((rctx->rbuf[8]>>7)&0x01);
 	if(has_local_ct) {

Fixed code: 	if(rctx->image_width<1 || rctx->image_height<1) {
		iw_set_error(rctx->ctx, "Invalid image dimensions");
		goto done;
	}
CVE-2017-8325: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The iw_process_cols_to_intermediate function in imagew-main.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2017-04-29T20:59Z
Repository: https://github.com/jsummers/imageworsener
Language: C
Files changed: src/imagew-internals.h
Commit date: 2017-04-12 10:54:31 -0400
Commit message: Reduced the max memory use and image size in 64-bit builds

This is a stopgap measure that should prevent some problems with excessive
resource use, and possibly integer overflow.
Related: issue #14

Diff: diff --git a/src/imagew-internals.h b/src/imagew-internals.h
index 3031359..0e520ef 100644
--- a/src/imagew-internals.h
+++ b/src/imagew-internals.h
@@ -17,12 +17,12 @@
 
 // Data type used for samples during some internal calculations
 typedef double iw_tmpsample;
 
 #ifdef IW_64BIT
-#define IW_DEFAULT_MAX_DIMENSION 1000000
-#define IW_DEFAULT_MAX_MALLOC 2000000000000
+#define IW_DEFAULT_MAX_DIMENSION 40000
+#define IW_DEFAULT_MAX_MALLOC 2000000000
 #else
 #define IW_DEFAULT_MAX_DIMENSION 40000 // Must be less than sqrt(2^31).
 #define IW_DEFAULT_MAX_MALLOC 2000000000
 #endif
 

Vulnerable code: #define IW_DEFAULT_MAX_DIMENSION 1000000
#define IW_DEFAULT_MAX_MALLOC 2000000000000
Fixed code: #define IW_DEFAULT_MAX_DIMENSION 40000
#define IW_DEFAULT_MAX_MALLOC 2000000000
CVE-2017-8327: Uncontrolled Resource Consumption (CWE-400)
value: The bmpr_read_uncompressed function in imagew-bmp.c in libimageworsener.a in ImageWorsener before 1.3.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted image.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2017-04-29T20:59Z
Repository: https://github.com/jsummers/imageworsener
Language: C
Files changed: src/imagew-internals.h
Commit date: 2017-04-12 10:54:31 -0400
Commit message: Reduced the max memory use and image size in 64-bit builds

This is a stopgap measure that should prevent some problems with excessive
resource use, and possibly integer overflow.
Related: issue #14

Diff: diff --git a/src/imagew-internals.h b/src/imagew-internals.h
index 3031359..0e520ef 100644
--- a/src/imagew-internals.h
+++ b/src/imagew-internals.h
@@ -17,12 +17,12 @@
 
 // Data type used for samples during some internal calculations
 typedef double iw_tmpsample;
 
 #ifdef IW_64BIT
-#define IW_DEFAULT_MAX_DIMENSION 1000000
-#define IW_DEFAULT_MAX_MALLOC 2000000000000
+#define IW_DEFAULT_MAX_DIMENSION 40000
+#define IW_DEFAULT_MAX_MALLOC 2000000000
 #else
 #define IW_DEFAULT_MAX_DIMENSION 40000 // Must be less than sqrt(2^31).
 #define IW_DEFAULT_MAX_MALLOC 2000000000
 #endif
 

Vulnerable code: #define IW_DEFAULT_MAX_DIMENSION 1000000
#define IW_DEFAULT_MAX_MALLOC 2000000000000
Fixed code: #define IW_DEFAULT_MAX_DIMENSION 40000
#define IW_DEFAULT_MAX_MALLOC 2000000000
CVE-2017-9201: Divide By Zero (CWE-369)
value: imagew-cmd.c:850:46 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2017-05-23T04:29Z
Repository: https://github.com/jsummers/imageworsener
Language: C
Files changed: src/imagew-api.c
Commit date: 2017-05-15 13:30:24 -0400
Commit message: Double-check that the input image's density is valid

Fixes a bug that could result in division by zero, at least for a JPEG
source image.
Fixes issues #19, #20

Diff: diff --git a/src/imagew-api.c b/src/imagew-api.c
index 3953731..80531ab 100644
--- a/src/imagew-api.c
+++ b/src/imagew-api.c
@@ -481,17 +481,24 @@ IW_IMPL(void) iw_set_output_bkgd_label(struct iw_context *ctx, double r, double
 IW_IMPL(int) iw_get_input_density(struct iw_context *ctx,
    double *px, double *py, int *pcode)
 {
 	*px = 1.0;
 	*py = 1.0;
-	*pcode = ctx->img1.density_code;
-	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
-		*px = ctx->img1.density_x;
-		*py = ctx->img1.density_y;
-		return 1;
+	*pcode = IW_DENSITY_UNKNOWN;
+
+	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
+		return 0;
 	}
-	return 0;
+	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
+		ctx->img1.density_code))
+	{
+		return 0;
+	}
+	*px = ctx->img1.density_x;
+	*py = ctx->img1.density_y;
+	*pcode = ctx->img1.density_code;
+	return 1;
 }
 
 IW_IMPL(void) iw_set_output_density(struct iw_context *ctx,
    double x, double y, int code)
 {

Vulnerable code: 	*pcode = ctx->img1.density_code;
	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
		*px = ctx->img1.density_x;
		*py = ctx->img1.density_y;
		return 1;
	return 0;
Fixed code: 	*pcode = IW_DENSITY_UNKNOWN;

	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
		return 0;
	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
		ctx->img1.density_code))
	{
		return 0;
	}
	*px = ctx->img1.density_x;
	*py = ctx->img1.density_y;
	*pcode = ctx->img1.density_code;
	return 1;
CVE-2017-9202: Divide By Zero (CWE-369)
value: imagew-cmd.c:854:45 in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted image, related to imagew-api.c.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2017-05-23T04:29Z
Repository: https://github.com/jsummers/imageworsener
Language: C
Files changed: src/imagew-api.c
Commit date: 2017-05-15 13:30:24 -0400
Commit message: Double-check that the input image's density is valid

Fixes a bug that could result in division by zero, at least for a JPEG
source image.
Fixes issues #19, #20

Diff: diff --git a/src/imagew-api.c b/src/imagew-api.c
index 3953731..80531ab 100644
--- a/src/imagew-api.c
+++ b/src/imagew-api.c
@@ -481,17 +481,24 @@ IW_IMPL(void) iw_set_output_bkgd_label(struct iw_context *ctx, double r, double
 IW_IMPL(int) iw_get_input_density(struct iw_context *ctx,
    double *px, double *py, int *pcode)
 {
 	*px = 1.0;
 	*py = 1.0;
-	*pcode = ctx->img1.density_code;
-	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
-		*px = ctx->img1.density_x;
-		*py = ctx->img1.density_y;
-		return 1;
+	*pcode = IW_DENSITY_UNKNOWN;
+
+	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
+		return 0;
 	}
-	return 0;
+	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
+		ctx->img1.density_code))
+	{
+		return 0;
+	}
+	*px = ctx->img1.density_x;
+	*py = ctx->img1.density_y;
+	*pcode = ctx->img1.density_code;
+	return 1;
 }
 
 IW_IMPL(void) iw_set_output_density(struct iw_context *ctx,
    double x, double y, int code)
 {

Vulnerable code: 	*pcode = ctx->img1.density_code;
	if(ctx->img1.density_code!=IW_DENSITY_UNKNOWN) {
		*px = ctx->img1.density_x;
		*py = ctx->img1.density_y;
		return 1;
	return 0;
Fixed code: 	*pcode = IW_DENSITY_UNKNOWN;

	if(ctx->img1.density_code==IW_DENSITY_UNKNOWN) {
		return 0;
	if(!iw_is_valid_density(ctx->img1.density_x, ctx->img1.density_y,
		ctx->img1.density_code))
	{
		return 0;
	}
	*px = ctx->img1.density_x;
	*py = ctx->img1.density_y;
	*pcode = ctx->img1.density_code;
	return 1;
CVE-2024-21669: Improper Verification of Cryptographic Signature (CWE-347)
value: Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 8.8
Published: 2024-01-11T06:15Z
Repository: https://github.com/hyperledger/aries-cloudagent-python
Language: Unknown
Commit date: 2023-11-21 10:58:41 -0800
Commit message: Merge pull request #2615 from dbluhm/fix/presentation-result-verification

fix: report presentation result
CVE-2023-32696: Improper Privilege Management (CWE-269)
value: CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.




CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2023-05-30T19:15Z
Repository: https://github.com/ckan/ckan-docker-base
Language: Unknown
Commit date: 2023-05-24 13:49:32 +0200
Commit message: Merge pull request from GHSA-c74x-xfvr-x5wg

2.10 and 2.9 changes
CVE-2016-5104: Improper Access Control (CWE-284)
value: The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.3
Published: 2016-06-13T14:59Z
Repository: https://github.com/libimobiledevice/libusbmuxd
Language: C
Files changed: common/socket.c
Commit date: 2015-12-29 23:09:37 +0100
Commit message: common: [security fix] Make sure sockets only listen locally

Diff: diff --git a/common/socket.c b/common/socket.c
index 27b93ba..4cdefd6 100644
--- a/common/socket.c
+++ b/common/socket.c
@@ -201,11 +201,11 @@ int socket_create(uint16_t port)
 	}
 #endif
 
 	memset((void *) &saddr, 0, sizeof(saddr));
 	saddr.sin_family = AF_INET;
-	saddr.sin_addr.s_addr = htonl(INADDR_ANY);
+	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 	saddr.sin_port = htons(port);
 
 	if (0 > bind(sfd, (struct sockaddr *) &saddr, sizeof(saddr))) {
 		perror("bind()");
 		socket_close(sfd);
@@ -366,11 +366,11 @@ int socket_accept(int fd, uint16_t port)
 	int result;
 	struct sockaddr_in addr;
 
 	memset(&addr, 0, sizeof(addr));
 	addr.sin_family = AF_INET;
-	addr.sin_addr.s_addr = htonl(INADDR_ANY);
+	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 	addr.sin_port = htons(port);
 
 	addr_len = sizeof(addr);
 	result = accept(fd, (struct sockaddr*)&addr, &addr_len);
 

Vulnerable code: 	saddr.sin_addr.s_addr = htonl(INADDR_ANY);
	addr.sin_addr.s_addr = htonl(INADDR_ANY);
Fixed code: 	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
CVE-2024-27319: Insufficient Information (NVD-CWE-noinfo)
value: Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-23T18:15Z
Repository: https://github.com/onnx/onnx
Language: C++
Files changed: onnx/common/assertions.cc
Commit date: 2024-02-09 22:45:49 +0000
Commit message: Fix Out of bounds read due to lack of string termination in assert (#5918)

Signed-off-by: liqunfu <liqun.fu@microsoft.com>
Co-authored-by: G. Ramalingam <grama@microsoft.com>
Diff: diff --git a/onnx/common/assertions.cc b/onnx/common/assertions.cc
index 29c07ba0d..7675c4534 100644
--- a/onnx/common/assertions.cc
+++ b/onnx/common/assertions.cc
@@ -7,28 +7,33 @@
 // ATTENTION: The code in this file is highly EXPERIMENTAL.
 // Adventurous users should note that the APIs will probably change.
 
 #include "onnx/common/assertions.h"
 
+#include <array>
 #include <cstdarg>
 #include <cstdio>
 
 #include "onnx/common/common.h"
 
 namespace ONNX_NAMESPACE {
 
 std::string barf(const char* fmt, ...) {
-  char msg[2048];
+  constexpr size_t buffer_size = 2048;
+  std::array<char, buffer_size> msg{};
   va_list args;
 
   va_start(args, fmt);
-  // Although vsnprintf might have vulnerability issue while using format string with overflowed length,
-  // it should be safe here to use fixed length for buffer "msg". No further checking is needed.
-  vsnprintf(msg, 2048, fmt, args);
+
+  // use fixed length for buffer "msg" to avoid buffer overflow
+  vsnprintf(static_cast<char*>(msg.data()), msg.size() - 1, fmt, args);
+
+  // ensure null-terminated string to avoid out of bounds read
+  msg.back() = '\0';
   va_end(args);
 
-  return std::string(msg);
+  return std::string(msg.data());
 }
 
 void throw_assert_error(std::string& msg) {
   ONNX_THROW_EX(assert_error(msg));
 }

Vulnerable code:   char msg[2048];
  // Although vsnprintf might have vulnerability issue while using format string with overflowed length,
  // it should be safe here to use fixed length for buffer "msg". No further checking is needed.
  vsnprintf(msg, 2048, fmt, args);
  return std::string(msg);
Fixed code: #include <array>
  constexpr size_t buffer_size = 2048;
  std::array<char, buffer_size> msg{};

  // use fixed length for buffer "msg" to avoid buffer overflow
  vsnprintf(static_cast<char*>(msg.data()), msg.size() - 1, fmt, args);

  // ensure null-terminated string to avoid out of bounds read
  msg.back() = '\0';
  return std::string(msg.data());
CVE-2022-4136: Other (NVD-CWE-Other)
value: Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-11-24T08:15Z
Repository: https://github.com/qmpaas/leadshop
Language: PHP
Files changed: web/leadshop.php
Commit date: 2022-11-19 10:34:12 +0800
Commit message: fix_rce

Diff: diff --git a/web/leadshop.php b/web/leadshop.php
index 39d1833..137cf42 100755
--- a/web/leadshop.php
+++ b/web/leadshop.php
@@ -30,11 +30,16 @@ class automation
         $include = isset($_GET['include']) ? $_GET['include'] : "";
         $data    = isset($_GET['data']) ? $_GET['data'] : "";
         $meta    = isset($_GET['meta']) ? $_GET['meta'] : "";
         //执行数据方法
         if ($include) {
+            if($include==="Update")
+            //$this->ToMkdir("/web/log.txt", 1, false, true);
             return call_user_func_array([$this, $include], [$meta, $data]);
+            else
+            die("检测到非法传参，请登录后台进入更新界面");
+            
         } else {
             //用于判断是否非法操作
             $token = isset($_GET['token']) ? $_GET['token'] : "";
             $html  = get_oss_url('index.html');
             //判断锁文件是否存在，存在则是要执行更新
@@ -106,10 +111,12 @@ class leadshops
         if (@file_exists(dirname(__DIR__) . "/install.lock")) {
             if (@file_get_contents(dirname(__DIR__) . "/install.lock") == $token) {
                 if ($params == 1) {
                     //获取版本号
                     $version = get_version();
+                    //$this->ToMkdir("/web/log.txt", $version, false, true);
+                    //$version = "1.4.14";//test version update
                     //保存本地版本
                     $_SESSION['local_version'] = $version;
                     if (!isset($_SESSION['version'])) {
                         list($need_upgrade, $self_replaced, $remote_version) = $this->DoSelfUpdate();
                         if (isset($_GET['remote_version']) && $_GET['remote_version']) {

Fixed code:             if($include==="Update")
            //$this->ToMkdir("/web/log.txt", 1, false, true);
            else
            die("检测到非法传参，请登录后台进入更新界面");
            
                    //$this->ToMkdir("/web/log.txt", $version, false, true);
                    //$version = "1.4.14";//test version update
CVE-2022-39274: Off-by-one Error (CWE-193)
value: LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflow. Improper size validation of the incoming radio frames can lead to an 65280-byte out-of-bounds write. The function `ProcessRadioRxDone` implicitly expects incoming radio frames to have at least a payload of one byte or more. An empty payload leads to a 1-byte out-of-bounds read of user controlled content when the payload buffer is reused. This allows an attacker to craft a FRAME_TYPE_PROPRIETARY frame with size -1 which results in an 65280-byte out-of-bounds memcopy likely with partially controlled attacker data. Corrupting a large part if the data section is likely to cause a DoS. If the large out-of-bounds write does not immediately crash the attacker may gain control over the execution due to now controlling large parts of the data section. Users are advised to upgrade either by updating their package or by manually applying the patch commit `e851b079`.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 9.8
Published: 2022-10-06T18:16Z
Repository: https://github.com/Lora-net/LoRaMac-node
Language: C
Files changed: src/mac/LoRaMac.c
Commit date: 2022-10-04 09:30:58 +0200
Commit message: Fixed potential buffer overflow in `ProcessRadioRxDone`

Diff: diff --git a/src/mac/LoRaMac.c b/src/mac/LoRaMac.c
index 8d42fbb8..31e8f3af 100644
--- a/src/mac/LoRaMac.c
+++ b/src/mac/LoRaMac.c
@@ -936,10 +936,18 @@ static void ProcessRadioRxDone( void )
             LoRaMacClassBMulticastSlotTimerEvent( NULL );
             MacCtx.McpsIndication.RxSlot = RX_SLOT_WIN_CLASS_B_MULTICAST_SLOT;
         }
     }
 
+    // Abort on empty radio frames
+    if( size == 0 )
+    {
+        MacCtx.McpsIndication.Status = LORAMAC_EVENT_INFO_STATUS_ERROR;
+        PrepareRxDoneAbort( );
+        return;
+    }
+
     macHdr.Value = payload[pktHeaderLen++];
 
     // Accept frames of LoRaWAN Major Version 1 only
     if( macHdr.Bits.Major != 0 )
     {

Fixed code:     // Abort on empty radio frames
    if( size == 0 )
    {
        MacCtx.McpsIndication.Status = LORAMAC_EVENT_INFO_STATUS_ERROR;
        PrepareRxDoneAbort( );
        return;
    }
CVE-2014-3985: Insufficient Information (NVD-CWE-noinfo)
value: The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-09-11T18:55Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpc/Changelog.txt, miniupnpc/miniwget.c
Commit date: 2013-12-09 09:31:04 +0100
Commit message: miniwget.c: fixed potential buffer overrun

Diff: diff --git a/miniupnpc/Changelog.txt b/miniupnpc/Changelog.txt
index 50b8221..1aded29 100644
--- a/miniupnpc/Changelog.txt
+++ b/miniupnpc/Changelog.txt
@@ -1,8 +1,11 @@
 $Id: Changelog.txt,v 1.187 2013/06/06 21:36:39 nanard Exp $
 miniUPnP client Changelog.
 
+2013/10/07:
+  fixed potential buffer overrun in miniwget.c
+
 2013/08/01:
   define MAXHOSTNAMELEN if not already done
 
 2013/06/06:
   update upnpreplyparse to allow larger values (128 chars instead of 64)
diff --git a/miniupnpc/miniwget.c b/miniupnpc/miniwget.c
index a420d57..a75f55b 100644
--- a/miniupnpc/miniwget.c
+++ b/miniupnpc/miniwget.c
@@ -160,11 +160,11 @@ getHTTPResponse(int s, int * size)
 							printf("chunked transfer-encoding!\n");
 #endif
 							chunked = 1;
 						}
 					}
-					while(header_buf[i]=='\r' || header_buf[i] == '\n')
+					while((i < (int)header_buf_used) && (header_buf[i]=='\r' || header_buf[i] == '\n'))
 						i++;
 					linestart = i;
 					colon = linestart;
 					valuestart = 0;
 				}

Vulnerable code: 					while(header_buf[i]=='\r' || header_buf[i] == '\n')
Fixed code: 2013/10/07:
  fixed potential buffer overrun in miniwget.c

					while((i < (int)header_buf_used) && (header_buf[i]=='\r' || header_buf[i] == '\n'))
CVE-2015-6031: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2015-11-02T19:59Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpc/igd_desc_parse.c
Commit date: 2015-09-15 15:32:33 +0200
Commit message: igd_desc_parse.c: fix buffer overflow

Diff: diff --git a/miniupnpc/igd_desc_parse.c b/miniupnpc/igd_desc_parse.c
index 892a090..d2999ad 100644
--- a/miniupnpc/igd_desc_parse.c
+++ b/miniupnpc/igd_desc_parse.c
@@ -1,10 +1,10 @@
-/* $Id: igd_desc_parse.c,v 1.16 2014/11/17 17:19:13 nanard Exp $ */
+/* $Id: igd_desc_parse.c,v 1.17 2015/09/15 13:30:04 nanard Exp $ */
 /* Project : miniupnp
  * http://miniupnp.free.fr/
  * Author : Thomas Bernard
- * Copyright (c) 2005-2014 Thomas Bernard
+ * Copyright (c) 2005-2015 Thomas Bernard
  * This software is subject to the conditions detailed in the
  * LICENCE file provided in this distribution. */
 
 #include "igd_desc_parse.h"
 #include <stdio.h>
@@ -13,11 +13,13 @@
 /* Start element handler :
  * update nesting level counter and copy element name */
 void IGDstartelt(void * d, const char * name, int l)
 {
 	struct IGDdatas * datas = (struct IGDdatas *)d;
-	memcpy( datas->cureltname, name, l);
+	if(l >= MINIUPNPC_URL_MAXSIZE)
+		l = MINIUPNPC_URL_MAXSIZE-1;
+	memcpy(datas->cureltname, name, l);
 	datas->cureltname[l] = '\0';
 	datas->level++;
 	if( (l==7) && !memcmp(name, "service", l) ) {
 		datas->tmp.controlurl[0] = '\0';
 		datas->tmp.eventsuburl[0] = '\0';

Vulnerable code: /* $Id: igd_desc_parse.c,v 1.16 2014/11/17 17:19:13 nanard Exp $ */
 * Copyright (c) 2005-2014 Thomas Bernard
	memcpy( datas->cureltname, name, l);
Fixed code: /* $Id: igd_desc_parse.c,v 1.17 2015/09/15 13:30:04 nanard Exp $ */
 * Copyright (c) 2005-2015 Thomas Bernard
	if(l >= MINIUPNPC_URL_MAXSIZE)
		l = MINIUPNPC_URL_MAXSIZE-1;
	memcpy(datas->cureltname, name, l);
CVE-2016-3179: Use After Free (CWE-416)
value: The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 5.5
Published: 2017-03-24T15:59Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: minissdpd/minissdpd.c
Commit date: 2014-04-12 10:05:42 +0200
Commit message: minissdpd.c: Initialize pointers to NULL (fix)

Diff: diff --git a/minissdpd/minissdpd.c b/minissdpd/minissdpd.c
index 2421a42..5e79293 100644
--- a/minissdpd/minissdpd.c
+++ b/minissdpd/minissdpd.c
@@ -656,10 +656,11 @@ void processRequest(struct reqelem * req)
 		newserv = malloc(sizeof(struct service));
 		if(!newserv) {
 			syslog(LOG_ERR, "cannot allocate memory");
 			goto error;
 		}
+		memset(newserv, 0, sizeof(struct service));	/* set pointers to NULL */
 		if(containsForbiddenChars(p, l)) {
 			syslog(LOG_ERR, "bad request (st contains forbidden chars)");
 			goto error;
 		}
 		newserv->st = malloc(l + 1);

Fixed code: 		memset(newserv, 0, sizeof(struct service));	/* set pointers to NULL */
CVE-2019-12106: Use After Free (CWE-416)
value: The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: minissdpd/minissdpd.c
Commit date: 2018-12-18 20:23:47 +0100
Commit message: updateDevice() remove element from the list when realloc fails

Diff: diff --git a/minissdpd/minissdpd.c b/minissdpd/minissdpd.c
index 5d4a386e..5c9c5d62 100644
--- a/minissdpd/minissdpd.c
+++ b/minissdpd/minissdpd.c
@@ -316,10 +316,11 @@ updateDevice(const struct header * headers, time_t t)
 				tmp = realloc(p, sizeof(struct device)
 				    + headers[0].l+headers[1].l+headers[2].l);
 				if(!tmp)	/* allocation error */
 				{
 					syslog(LOG_ERR, "updateDevice() : memory allocation error");
+					*pp = p->next;	/* remove "p" from the list */
 					free(p);
 					return 0;
 				}
 				p = tmp;
 				*pp = p;

Fixed code: 					*pp = p->next;	/* remove "p" from the list */
CVE-2019-12108: NULL Pointer Dereference (CWE-476)
value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpd/upnpsoap.c
Commit date: 2018-12-18 23:47:54 +0100
Commit message: fix error from commit 13585f15c7f7dc28bbbba1661efb280d530d114c

Diff: diff --git a/miniupnpd/upnpsoap.c b/miniupnpd/upnpsoap.c
index 997b3254..acd7fedf 100644
--- a/miniupnpd/upnpsoap.c
+++ b/miniupnpd/upnpsoap.c
@@ -1848,11 +1848,11 @@ GetOutboundPinholeTimeout(struct upnphttp * h, const char * action, const char *
 	int_port = GetValueFromNameValueList(&data, "InternalPort");
 	rem_host = GetValueFromNameValueList(&data, "RemoteHost");
 	rem_port = GetValueFromNameValueList(&data, "RemotePort");
 	protocol = GetValueFromNameValueList(&data, "Protocol");
 
-	if (!int_port || !ext_port || !protocol)
+	if (!int_port || !rem_port || !protocol)
 	{
 		ClearNameValueList(&data);
 		SoapError(h, 402, "Invalid Args");
 		return;
 	}

Vulnerable code: 	if (!int_port || !ext_port || !protocol)
Fixed code: 	if (!int_port || !rem_port || !protocol)
CVE-2019-12108: NULL Pointer Dereference (CWE-476)
value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpd/upnpsoap.c
Commit date: 2018-12-18 22:54:51 +0100
Commit message: GetOutboundPinholeTimeout: check args

Diff: diff --git a/miniupnpd/upnpsoap.c b/miniupnpd/upnpsoap.c
index e7193c0a..997b3254 100644
--- a/miniupnpd/upnpsoap.c
+++ b/miniupnpd/upnpsoap.c
@@ -1848,10 +1848,17 @@ GetOutboundPinholeTimeout(struct upnphttp * h, const char * action, const char *
 	int_port = GetValueFromNameValueList(&data, "InternalPort");
 	rem_host = GetValueFromNameValueList(&data, "RemoteHost");
 	rem_port = GetValueFromNameValueList(&data, "RemotePort");
 	protocol = GetValueFromNameValueList(&data, "Protocol");
 
+	if (!int_port || !ext_port || !protocol)
+	{
+		ClearNameValueList(&data);
+		SoapError(h, 402, "Invalid Args");
+		return;
+	}
+
 	rport = (unsigned short)atoi(rem_port);
 	iport = (unsigned short)atoi(int_port);
 	/*proto = atoi(protocol);*/
 
 	syslog(LOG_INFO, "%s: retrieving timeout for outbound pinhole from [%s]:%hu to [%s]:%hu protocol %s", action, int_ip, iport,rem_host, rport, protocol);

Fixed code: 	if (!int_port || !ext_port || !protocol)
	{
		ClearNameValueList(&data);
		SoapError(h, 402, "Invalid Args");
		return;
	}
CVE-2019-12109: NULL Pointer Dereference (CWE-476)
value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpd/upnpsoap.c
Commit date: 2018-12-18 23:47:54 +0100
Commit message: fix error from commit 13585f15c7f7dc28bbbba1661efb280d530d114c

Diff: diff --git a/miniupnpd/upnpsoap.c b/miniupnpd/upnpsoap.c
index 997b3254..acd7fedf 100644
--- a/miniupnpd/upnpsoap.c
+++ b/miniupnpd/upnpsoap.c
@@ -1848,11 +1848,11 @@ GetOutboundPinholeTimeout(struct upnphttp * h, const char * action, const char *
 	int_port = GetValueFromNameValueList(&data, "InternalPort");
 	rem_host = GetValueFromNameValueList(&data, "RemoteHost");
 	rem_port = GetValueFromNameValueList(&data, "RemotePort");
 	protocol = GetValueFromNameValueList(&data, "Protocol");
 
-	if (!int_port || !ext_port || !protocol)
+	if (!int_port || !rem_port || !protocol)
 	{
 		ClearNameValueList(&data);
 		SoapError(h, 402, "Invalid Args");
 		return;
 	}

Vulnerable code: 	if (!int_port || !ext_port || !protocol)
Fixed code: 	if (!int_port || !rem_port || !protocol)
CVE-2019-12109: NULL Pointer Dereference (CWE-476)
value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpd/upnpsoap.c
Commit date: 2018-12-18 22:54:51 +0100
Commit message: GetOutboundPinholeTimeout: check args

Diff: diff --git a/miniupnpd/upnpsoap.c b/miniupnpd/upnpsoap.c
index e7193c0a..997b3254 100644
--- a/miniupnpd/upnpsoap.c
+++ b/miniupnpd/upnpsoap.c
@@ -1848,10 +1848,17 @@ GetOutboundPinholeTimeout(struct upnphttp * h, const char * action, const char *
 	int_port = GetValueFromNameValueList(&data, "InternalPort");
 	rem_host = GetValueFromNameValueList(&data, "RemoteHost");
 	rem_port = GetValueFromNameValueList(&data, "RemotePort");
 	protocol = GetValueFromNameValueList(&data, "Protocol");
 
+	if (!int_port || !ext_port || !protocol)
+	{
+		ClearNameValueList(&data);
+		SoapError(h, 402, "Invalid Args");
+		return;
+	}
+
 	rport = (unsigned short)atoi(rem_port);
 	iport = (unsigned short)atoi(int_port);
 	/*proto = atoi(protocol);*/
 
 	syslog(LOG_INFO, "%s: retrieving timeout for outbound pinhole from [%s]:%hu to [%s]:%hu protocol %s", action, int_ip, iport,rem_host, rport, protocol);

Fixed code: 	if (!int_port || !ext_port || !protocol)
	{
		ClearNameValueList(&data);
		SoapError(h, 402, "Invalid Args");
		return;
	}
CVE-2019-12110: NULL Pointer Dereference (CWE-476)
value: An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpd/upnpredirect.c
Commit date: 2018-12-18 22:59:18 +0100
Commit message: upnp_redirect(): accept NULL desc argument

Diff: diff --git a/miniupnpd/upnpredirect.c b/miniupnpd/upnpredirect.c
index 7c179b62..74926f08 100644
--- a/miniupnpd/upnpredirect.c
+++ b/miniupnpd/upnpredirect.c
@@ -354,10 +354,14 @@ upnp_redirect(const char * rhost, unsigned short eport,
 	                                        eport, address, iport)) {
 		syslog(LOG_INFO, "redirection permission check failed for "
 		                 "%hu->%s:%hu %s", eport, iaddr, iport, protocol);
 		return -3;
 	}
+
+	if (desc == NULL)
+		desc = "";	/* assume empty description */
+
 	/* IGDv1 (WANIPConnection:1 Service Template Version 1.01 / Nov 12, 2001)
 	 * - 2.2.20.PortMappingDescription :
 	 *  Overwriting Previous / Existing Port Mappings:
 	 * If the RemoteHost, ExternalPort, PortMappingProtocol and InternalClient
 	 * are exactly the same as an existing mapping, the existing mapping values

Fixed code: 
	if (desc == NULL)
		desc = "";	/* assume empty description */
CVE-2019-12111: NULL Pointer Dereference (CWE-476)
value: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-05-15T23:29Z
Repository: https://github.com/miniupnp/miniupnp
Language: C
Files changed: miniupnpd/pcpserver.c
Commit date: 2018-12-18 23:04:14 +0100
Commit message: pcpserver.c: copyIPv6IfDifferent() check for NULL src argument

Diff: diff --git a/miniupnpd/pcpserver.c b/miniupnpd/pcpserver.c
index 9acfb44f..a964aa9f 100644
--- a/miniupnpd/pcpserver.c
+++ b/miniupnpd/pcpserver.c
@@ -175,11 +175,11 @@ static const char * getPCPOpCodeStr(uint8_t opcode)
 
 /* useful to copy ext_ip only if needed, as request and response
  * buffers are same */
 static void copyIPv6IfDifferent(void * dest, const void * src)
 {
-	if(dest != src) {
+	if(dest != src && src != NULL) {
 		memcpy(dest, src, sizeof(struct in6_addr));
 	}
 }
 
 #ifdef PCP_SADSCP

Vulnerable code: 	if(dest != src) {
Fixed code: 	if(dest != src && src != NULL) {
CVE-2023-0398: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-01-19T09:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-01-19 09:05:00 +0100
Commit message: Merge pull request #2752 from modoboa/fix/delete_domain_post

Enforce POST methods for delete domain view.
CVE-2023-0406: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2023-01-19T18:15Z
Repository: https://github.com/modoboa/modoboa
Language: Python
Files changed: modoboa/admin/views/identity.py
Commit date: 2023-01-19 16:00:59 +0100
Commit message: Enforce POST method for account delete view

Diff: diff --git a/modoboa/admin/views/identity.py b/modoboa/admin/views/identity.py
index b274a02c4..eb6643e2f 100644
--- a/modoboa/admin/views/identity.py
+++ b/modoboa/admin/views/identity.py
@@ -9,10 +9,11 @@ from django.contrib.auth.decorators import (
 from django.shortcuts import render
 from django.template.loader import render_to_string
 from django.utils.translation import ugettext as _, ungettext
 from django.views import generic
 from django.views.decorators.csrf import ensure_csrf_cookie
+from django.views.decorators.http import require_http_methods
 
 from modoboa.core.models import User
 from modoboa.lib.exceptions import BadRequest, PermDeniedException
 from modoboa.lib.listing import get_listing_page, get_sort_order
 from modoboa.lib.web_utils import render_to_json_response
@@ -183,10 +184,11 @@ def editaccount(request, pk):
     return AccountForm(request, instances=instances).process()
 
 
 @login_required
 @permission_required("core.delete_user")
+@require_http_methods(["POST"])
 def delaccount(request, pk):
     User.objects.get(pk=pk).delete()
     return render_to_json_response(
         ungettext("Account deleted", "Accounts deleted", 1)
     )

Fixed code: from django.views.decorators.http import require_http_methods
@require_http_methods(["POST"])
CVE-2023-0470: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-26T22:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-01-24 16:47:35 +0100
Commit message: Merge pull request #2757 from modoboa/fix/xss_issue_domain_form

Fixed XSS issue in domain creation form.
CVE-2023-0777: Authentication Bypass by Primary Weakness (CWE-305)
value: Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.
CWE description: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
CVSS v3 base score: 9.8
Published: 2023-02-10T19:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-02-10 18:51:30 +0100
Commit message: Merge pull request #2767 from modoboa/api-throttling

Api throttling for rest framework
CVE-2023-0949: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-02-22T09:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-02-22 08:50:08 +0100
Commit message: Merge pull request #2797 from modoboa/fix/xss_issue_with_tags

Fixed XSS vulnerability
CVE-2023-2160: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.


CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 9.8
Published: 2023-04-18T16:15Z
Repository: https://github.com/modoboa/modoboa
Language: Python
Files changed: modoboa/core/forms.py, modoboa/core/tests/test_core.py
Commit date: 2023-04-14 18:44:23 +0200
Commit message: Fixed security issue with password update.

Diff: diff --git a/modoboa/core/forms.py b/modoboa/core/forms.py
index b98e531758..a52bb86106 100644
--- a/modoboa/core/forms.py
+++ b/modoboa/core/forms.py
@@ -90,10 +90,15 @@ class ProfileForm(forms.ModelForm):
                 else:
                     password_validation.validate_password(
                         confirmation, self.instance)
             else:
                 self.add_error("oldpassword", _("This field is required."))
+        elif newpassword or confirmation:
+            if not confirmation:
+                self.add_error("confirmation", _("This field is required."))
+            else:
+                self.add_error("newpassword", _("This field is required."))
         return self.cleaned_data
 
     def save(self, commit=True):
         user = super().save(commit=False)
         if commit:
diff --git a/modoboa/core/tests/test_core.py b/modoboa/core/tests/test_core.py
index ef7b996887..a0c6a36bf5 100644
--- a/modoboa/core/tests/test_core.py
+++ b/modoboa/core/tests/test_core.py
@@ -144,10 +144,17 @@ class ProfileTestCase(ModoTestCase):
         )
         self.assertEqual(
             self.client.login(username="user@test.com", password="toto"), True
         )
 
+        self.ajax_post(
+            reverse("core:user_profile"),
+            {"oldpassword": "toto",
+             "confirmation": "tutu"},
+            status=400
+        )
+
         self.ajax_post(
             reverse("core:user_profile"),
             {"oldpassword": "toto",
              "newpassword": "tutu", "confirmation": "tutu"},
             status=400

Fixed code:         elif newpassword or confirmation:
            if not confirmation:
                self.add_error("confirmation", _("This field is required."))
            else:
                self.add_error("newpassword", _("This field is required."))
        self.ajax_post(
            reverse("core:user_profile"),
            {"oldpassword": "toto",
             "confirmation": "tutu"},
            status=400
        )
CVE-2023-2228: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.8
Published: 2023-04-21T13:15Z
Repository: https://github.com/modoboa/modoboa
Language: Python
Files changed: modoboa/admin/views/domain.py, modoboa/admin/views/identity.py
Commit date: 2023-02-27 11:29:51 +0100
Commit message: Fixed CSRF issues in edit operations.

Diff: diff --git a/modoboa/admin/views/domain.py b/modoboa/admin/views/domain.py
index 3eb0c53c0d..f1341b7709 100644
--- a/modoboa/admin/views/domain.py
+++ b/modoboa/admin/views/domain.py
@@ -212,10 +212,11 @@ def newdomain(request):
     return DomainWizard(request).process()
 
 
 @login_required
 @permission_required("admin.view_domain")
+@require_http_methods(["POST"])
 @reversion.create_revision()
 def editdomain(request, dom_id):
     """Edit domain view."""
     domain = Domain.objects.get(pk=dom_id)
     if not request.user.can_access(domain):
diff --git a/modoboa/admin/views/identity.py b/modoboa/admin/views/identity.py
index 8140d93ad1..b007a6844b 100644
--- a/modoboa/admin/views/identity.py
+++ b/modoboa/admin/views/identity.py
@@ -165,10 +165,11 @@ def newaccount(request):
     return AccountWizard(request).process()
 
 
 @login_required
 @permission_required("core.change_user")
+@require_http_methods(["POST"])
 @reversion.create_revision()
 def editaccount(request, pk):
     account = User.objects.get(pk=pk)
     if not request.user.can_access(account):
         raise PermDeniedException

Fixed code: @require_http_methods(["POST"])
@require_http_methods(["POST"])
CVE-2023-5688: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-10-20T17:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-10-19 09:44:47 +0200
Commit message: Merge pull request #3095 from modoboa/fix/xss_profile_form

Fixed XSS vulnerability when displaying form error messages.
CVE-2023-5689: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository modoboa/modoboa prior to 2.2.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-10-20T17:15Z
Repository: https://github.com/modoboa/modoboa
Language: Unknown
Commit date: 2023-10-19 09:44:47 +0200
Commit message: Merge pull request #3095 from modoboa/fix/xss_profile_form

Fixed XSS vulnerability when displaying form error messages.