Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-4171: Insufficient Information (NVD-CWE-noinfo)
value: calibre-web is vulnerable to Business Logic Errors
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2022-01-17T10:15Z
Repository: https://github.com/janeczku/calibre-web
Language: Python
Files changed: cps/shelf.py
Commit date: 2021-12-30 14:45:31 +0100
Commit message: Prevent 2 public shelfs with same names due to changing public property

Diff: diff --git a/cps/shelf.py b/cps/shelf.py
index 19c2d68ec..b1fbdd046 100644
--- a/cps/shelf.py
+++ b/cps/shelf.py
@@ -246,16 +246,17 @@ def create_edit_shelf(shelf, page_title, page, shelf_id=False):
     if request.method == "POST":
         to_save = request.form.to_dict()
         if not current_user.role_edit_shelfs() and to_save.get("is_public") == "on":
             flash(_(u"Sorry you are not allowed to create a public shelf"), category="error")
             return redirect(url_for('web.index'))
-        shelf.is_public = 1 if to_save.get("is_public") else 0
+        is_public = 1 if to_save.get("is_public") else 0
         if config.config_kobo_sync:
             shelf.kobo_sync = True if to_save.get("kobo_sync") else False
         shelf_title = to_save.get("title", "")
-        if check_shelf_is_unique(shelf, shelf_title, shelf_id):
+        if check_shelf_is_unique(shelf, shelf_title, is_public, shelf_id):
             shelf.name = shelf_title
+            shelf.is_public = is_public
             if not shelf_id:
                 shelf.user_id = int(current_user.id)
                 ub.session.add(shelf)
                 shelf_action = "created"
                 flash_text = _(u"Shelf %(title)s created", title=shelf_title)
@@ -282,16 +283,16 @@ def create_edit_shelf(shelf, page_title, page, shelf_id=False):
                                  page=page,
                                  kobo_sync_enabled=config.config_kobo_sync,
                                  sync_only_selected_shelves=sync_only_selected_shelves)
 
 
-def check_shelf_is_unique(shelf, title, shelf_id=False):
+def check_shelf_is_unique(shelf, title, is_public, shelf_id=False):
     if shelf_id:
         ident = ub.Shelf.id != shelf_id
     else:
         ident = true()
-    if shelf.is_public == 1:
+    if is_public == 1:
         is_shelf_name_unique = ub.session.query(ub.Shelf) \
                                    .filter((ub.Shelf.name == title) & (ub.Shelf.is_public == 1)) \
                                    .filter(ident) \
                                    .first() is None
 

Vulnerable code:         shelf.is_public = 1 if to_save.get("is_public") else 0
        if check_shelf_is_unique(shelf, shelf_title, shelf_id):
def check_shelf_is_unique(shelf, title, shelf_id=False):
    if shelf.is_public == 1:
Fixed code:         is_public = 1 if to_save.get("is_public") else 0
        if check_shelf_is_unique(shelf, shelf_title, is_public, shelf_id):
            shelf.is_public = is_public
def check_shelf_is_unique(shelf, title, is_public, shelf_id=False):
    if is_public == 1:
CVE-2022-0273: Improper Access Control (CWE-284)
value: Improper Access Control in Pypi calibreweb prior to 0.6.16.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 6.5
Published: 2022-01-30T14:15Z
Repository: https://github.com/janeczku/calibre-web
Language: Python
Files changed: cps/shelf.py
Commit date: 2022-01-18 17:55:10 +0100
Commit message: Prevent creating a public shelf without permission

Diff: diff --git a/cps/shelf.py b/cps/shelf.py
index 29a4fe99d..ad6a2665a 100644
--- a/cps/shelf.py
+++ b/cps/shelf.py
@@ -246,11 +246,11 @@ def create_edit_shelf(shelf, page_title, page, shelf_id=False):
     if request.method == "POST":
         to_save = request.form.to_dict()
         if not current_user.role_edit_shelfs() and to_save.get("is_public") == "on":
             flash(_(u"Sorry you are not allowed to create a public shelf"), category="error")
             return redirect(url_for('web.index'))
-        is_public = 1 if to_save.get("is_public") else 0
+        is_public = 1 if to_save.get("is_public") == "on" else 0
         if config.config_kobo_sync:
             shelf.kobo_sync = True if to_save.get("kobo_sync") else False
             if shelf.kobo_sync:
                 ub.session.query(ub.ShelfArchive).filter(ub.ShelfArchive.user_id == current_user.id).filter(
                     ub.ShelfArchive.uuid == shelf.uuid).delete()

Vulnerable code:         is_public = 1 if to_save.get("is_public") else 0
Fixed code:         is_public = 1 if to_save.get("is_public") == "on" else 0
CVE-2022-0766: Server-Side Request Forgery (SSRF) (CWE-918)
value: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2022-03-07T07:15Z
Repository: https://github.com/janeczku/calibre-web
Language: Python
Files changed: cps/helper.py
Commit date: 2022-02-26 08:05:35 +0100
Commit message: Don't allow redirects on cover uploads, catch more addresses which resolve to localhost

Diff: diff --git a/cps/helper.py b/cps/helper.py
index b5495930b..c162f7eef 100644
--- a/cps/helper.py
+++ b/cps/helper.py
@@ -732,14 +732,14 @@ def get_book_cover_internal(book, use_generic_cover_on_failure):
 def save_cover_from_url(url, book_path):
     try:
         if not cli.allow_localhost:
             # 127.0.x.x, localhost, [::1], [::ffff:7f00:1]
             ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0]
-            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
+            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
                 log.error("Localhost was accessed for cover upload")
                 return False, _("You are not allowed to access localhost for cover uploads")
-        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
+        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling
         img.raise_for_status()
         return save_cover(img, book_path)
     except (socket.gaierror,
             requests.exceptions.HTTPError,
             requests.exceptions.ConnectionError,

Vulnerable code:             if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
Fixed code:             if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling
CVE-2022-0767: Server-Side Request Forgery (SSRF) (CWE-918)
value: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.9
Published: 2022-03-07T07:15Z
Repository: https://github.com/janeczku/calibre-web
Language: Python
Files changed: cps/helper.py
Commit date: 2022-02-26 08:05:35 +0100
Commit message: Don't allow redirects on cover uploads, catch more addresses which resolve to localhost

Diff: diff --git a/cps/helper.py b/cps/helper.py
index b5495930b..c162f7eef 100644
--- a/cps/helper.py
+++ b/cps/helper.py
@@ -732,14 +732,14 @@ def get_book_cover_internal(book, use_generic_cover_on_failure):
 def save_cover_from_url(url, book_path):
     try:
         if not cli.allow_localhost:
             # 127.0.x.x, localhost, [::1], [::ffff:7f00:1]
             ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0]
-            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
+            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
                 log.error("Localhost was accessed for cover upload")
                 return False, _("You are not allowed to access localhost for cover uploads")
-        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
+        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling
         img.raise_for_status()
         return save_cover(img, book_path)
     except (socket.gaierror,
             requests.exceptions.HTTPError,
             requests.exceptions.ConnectionError,

Vulnerable code:             if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
Fixed code:             if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling
CVE-2015-1431: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-02-10T17:59Z
Repository: https://github.com/phpbb/phpbb
Language: Unknown
Commit date: 2015-01-21 01:05:13 +0100
Commit message: Merge pull request #3316 from bantu/ticket/13531

[ticket/13531] Explicitly disallow trailing paths (e.g. PATH_INFO).
CVE-2015-1432: Cross-Site Request Forgery (CSRF) (CWE-352)
value: The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2015-02-10T17:59Z
Repository: https://github.com/phpbb/phpbb
Language: PHP
Files changed: phpBB/includes/ucp/ucp_pm_options.php
Commit date: 2015-01-20 22:16:24 +0100
Commit message: [ticket/13526] Correctly validate the ucp_pm_options form key.

PHPBB3-13526

Diff: diff --git a/phpBB/includes/ucp/ucp_pm_options.php b/phpBB/includes/ucp/ucp_pm_options.php
index efa390ed8..1d5c0ecce 100644
--- a/phpBB/includes/ucp/ucp_pm_options.php
+++ b/phpBB/includes/ucp/ucp_pm_options.php
@@ -27,11 +27,15 @@ function message_options($id, $mode, $global_privmsgs_rules, $global_rule_condit
 
 	add_form_key('ucp_pm_options');
 	// Change "full folder" setting - what to do if folder is full
 	if (isset($_POST['fullfolder']))
 	{
-		check_form_key('ucp_pm_options', $config['form_token_lifetime'], $redirect_url);
+		if (!check_form_key('ucp_pm_options'))
+		{
+			trigger_error('FORM_INVALID');
+		}
+
 		$full_action = request_var('full_action', 0);
 
 		$set_folder_id = 0;
 		switch ($full_action)
 		{

Vulnerable code: 		check_form_key('ucp_pm_options', $config['form_token_lifetime'], $redirect_url);
Fixed code: 		if (!check_form_key('ucp_pm_options'))
		{
			trigger_error('FORM_INVALID');
		}
CVE-2015-3880: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2017-09-19T15:29Z
Repository: https://github.com/phpbb/phpbb
Language: Unknown
Commit date: 2015-04-28 21:54:50 +0200
Commit message: Merge remote-tracking branch 'phpbb-security/ticket/security-180' into prep-release-3.0.14

* phpbb-security/ticket/security-180:
  [ticket/security-180] Add tests for redirecting to main URL
  [ticket/security-180] Always fail when redirecting to an insecure URL
  [ticket/security-180] Make sure that redirect goes to full URL plus slash
  [ticket/security-180] Check if redirect URL contains board URL
CVE-2019-16993: Cross-Site Request Forgery (CSRF) (CWE-352)
value: In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2019-09-30T12:15Z
Repository: https://github.com/phpbb/phpbb
Language: PHP
Files changed: phpBB/includes/acp/acp_bbcodes.php
Commit date: 2015-12-23 17:31:43 +0100
Commit message: [ticket/security-188] Check form key in acp_bbcodes

SECURITY-188

Diff: diff --git a/phpBB/includes/acp/acp_bbcodes.php b/phpBB/includes/acp/acp_bbcodes.php
index e245eea069..35ac33882e 100644
--- a/phpBB/includes/acp/acp_bbcodes.php
+++ b/phpBB/includes/acp/acp_bbcodes.php
@@ -31,17 +31,23 @@ class acp_bbcodes
 		$user->add_lang('acp/posting');
 
 		// Set up general vars
 		$action	= request_var('action', '');
 		$bbcode_id = request_var('bbcode', 0);
+		$submit = $request->is_set_post('submit');
 
 		$this->tpl_name = 'acp_bbcodes';
 		$this->page_title = 'ACP_BBCODES';
 		$form_key = 'acp_bbcodes';
 
 		add_form_key($form_key);
 
+		if ($submit && !check_form_key($form_key))
+		{
+			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+		}
+
 		// Set up mode-specific vars
 		switch ($action)
 		{
 			case 'add':
 				$bbcode_match = $bbcode_tpl = $bbcode_helpline = '';

Fixed code: 		$submit = $request->is_set_post('submit');
		if ($submit && !check_form_key($form_key))
		{
			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
		}
CVE-2023-5917: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-11-02T11:15Z
Repository: https://github.com/phpbb/phpbb
Language: Unknown
Commit date: 2023-10-15 13:50:41 +0200
Commit message: Merge pull request #69 from phpbb/ticket/security-279

[ticket/security/279] Escape smilies URL and prevent paths in .pak filename
CVE-2020-36628: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2022-12-25T11:15Z
Repository: https://github.com/Calsign/APDE
Language: Other
Files changed: APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java, build.gradle
Commit date: 2020-05-18 14:46:46 -0400
Commit message: fix zip path traversal vulnerability

Diff: diff --git a/APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java b/APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java
index 341755a..d93de60 100644
--- a/APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java
+++ b/APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java
@@ -269,10 +269,14 @@ public class CopyBuildTask extends BuildTask {
 			zipIn = new ZipInputStream(inputStream);
 			
 			ZipEntry zipEntry;
 			while ((zipEntry = zipIn.getNextEntry()) != null) {
 				File file = new File(folder, zipEntry.getName());
+				if (file.getCanonicalPath().startsWith(folder.getCanonicalPath())) {
+					System.err.println("Aborted zip! Attempted zip path traversal attack extracting to: " + folder.getAbsolutePath());
+					return false;
+				}
 				
 				if (zipEntry.isDirectory()) {
 					if (!file.exists() && !file.mkdirs()) return false;
 				} else {
 					if (!file.getParentFile().exists() && !file.getParentFile().mkdirs()) return false;
diff --git a/build.gradle b/build.gradle
index 7220987..77a5a2e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -3,11 +3,11 @@ buildscript {
     repositories {
         jcenter()
         google()
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:3.6.2'
+        classpath 'com.android.tools.build:gradle:3.6.3'
     }
 }
 
 allprojects {
     repositories {

Vulnerable code:         classpath 'com.android.tools.build:gradle:3.6.2'
Fixed code: 				if (file.getCanonicalPath().startsWith(folder.getCanonicalPath())) {
					System.err.println("Aborted zip! Attempted zip path traversal attack extracting to: " + folder.getAbsolutePath());
					return false;
				}
        classpath 'com.android.tools.build:gradle:3.6.3'
CVE-2008-10004: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in Email Registration 5.x-2.1 on Drupal. It has been declared as critical. This vulnerability affects the function email_registration_user of the file email_registration.module. The manipulation of the argument namenew leads to sql injection. The attack can be initiated remotely. Upgrading to version 6.x-1.0 is able to address this issue. The patch is identified as 126c141b7db038c778a2dc931d38766aad8d1112. It is recommended to upgrade the affected component. VDB-222334 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-03-06T23:15Z
Repository: https://github.com/drupalprojects/email_registration
Language: Other
Files changed: email_registration.module
Commit date: 2008-02-17 04:04:49 +0000
Commit message: fixed a protential source of SQL injection

Diff: diff --git a/email_registration.module b/email_registration.module
index 35fb930..61a97a2 100644
--- a/email_registration.module
+++ b/email_registration.module
@@ -11,12 +11,12 @@ function email_registration_user($op, &$edit, &$account, $category = NULL) {
     case 'insert':
     $namenew = preg_replace('/@.*$/', '', $edit['mail']);
     // if username generated from email record already exists, append underscore and number eg:(chris_123)
     if (db_result(db_query("SELECT count(*) FROM {users} WHERE uid <> %d AND LOWER(name) = LOWER('%s')", $account->uid, $namenew)) > 0) {
       // find the next number available to append to the name
-      $sql = "SELECT SUBSTRING_INDEX(name,'_',-1) FROM {users} WHERE name REGEXP '^%s_[0-9]+$' ORDER BY CAST(SUBSTRING_INDEX(name,'_',-1) AS UNSIGNED) DESC LIMIT 1";
-      $nameidx = db_result(db_query($sql, $namenew));
+      $sql = "SELECT SUBSTRING_INDEX(name,'_',-1) FROM {users} WHERE name REGEXP '%s' ORDER BY CAST(SUBSTRING_INDEX(name,'_',-1) AS UNSIGNED) DESC LIMIT 1";
+      $nameidx = db_result(db_query($sql, '^'. $namenew .'_[0-9]+$'));
       $namenew .= '_'. ($nameidx + 1);
     }
     // replace with generated username
     db_query("UPDATE {users} SET name = '%s' WHERE uid = '%s'", $namenew, $account->uid);
   break;

Vulnerable code:       $sql = "SELECT SUBSTRING_INDEX(name,'_',-1) FROM {users} WHERE name REGEXP '^%s_[0-9]+$' ORDER BY CAST(SUBSTRING_INDEX(name,'_',-1) AS UNSIGNED) DESC LIMIT 1";
      $nameidx = db_result(db_query($sql, $namenew));
Fixed code:       $sql = "SELECT SUBSTRING_INDEX(name,'_',-1) FROM {users} WHERE name REGEXP '%s' ORDER BY CAST(SUBSTRING_INDEX(name,'_',-1) AS UNSIGNED) DESC LIMIT 1";
      $nameidx = db_result(db_query($sql, '^'. $namenew .'_[0-9]+$'));
CVE-2023-22478: Missing Authorization (CWE-862)
value: KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 7.5
Published: 2023-01-14T01:15Z
Repository: https://github.com/KubeOperator/KubePi
Language: Go
Files changed: internal/api/v1/v1.go
Commit date: 2023-01-09 14:04:13 +0800
Commit message: fix: 解决系统登陆日志泄漏-未授权访问

Diff: diff --git a/internal/api/v1/v1.go b/internal/api/v1/v1.go
index 176e366f..9b5608b5 100644
--- a/internal/api/v1/v1.go
+++ b/internal/api/v1/v1.go
@@ -417,15 +417,16 @@ func WarpedJwtHandler() iris.Handler {
 }
 
 func AddV1Route(app iris.Party) {
 
 	v1Party := app.Party("/v1")
-	v1Party.Use(langHandler())
-	v1Party.Use(pageHandler())
+
 	session.Install(v1Party)
 	mfa.Install(v1Party)
 	authParty := v1Party.Party("")
+	v1Party.Use(langHandler())
+	v1Party.Use(pageHandler())
 
 	authParty.Use(WarpedJwtHandler())
 	authParty.Use(authHandler())
 	authParty.Use(resourceExtractHandler())
 	authParty.Use(roleHandler())
@@ -434,11 +435,11 @@ func AddV1Route(app iris.Party) {
 	authParty.Use(logHandler())
 	authParty.Get("/", apiResourceHandler(authParty))
 	user.Install(authParty)
 	cluster.Install(authParty)
 	role.Install(authParty)
-	system.Install(v1Party)
+	system.Install(authParty)
 	proxy.Install(authParty)
 	ws.Install(authParty)
 	chart.Install(authParty)
 	webkubectl.Install(authParty, v1Party)
 	ldap.Install(authParty)

Vulnerable code: 	v1Party.Use(langHandler())
	v1Party.Use(pageHandler())
	system.Install(v1Party)
Fixed code: 
	v1Party.Use(langHandler())
	v1Party.Use(pageHandler())
	system.Install(authParty)
CVE-2023-43771: Uncontrolled Resource Consumption (CWE-400)
value: In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.5
Published: 2023-09-22T06:15Z
Repository: https://github.com/mikebrady/nqptp
Language: Other
Files changed: configure.ac
Commit date: 2023-09-04 17:17:36 +0100
Commit message: Fix a bug whereby a maliciously-crafted packet received on the control port could crash the program.

Diff: diff --cc configure.ac
index 4c4f673,e245519..6609fe5
--- a/configure.ac
+++ b/configure.ac
@@@ -1,10 -1,10 +1,10 @@@
  #                                               -*- Autoconf -*-
  # Process this file with autoconf to produce a configure script.
  
  AC_PREREQ([2.68])
- AC_INIT([nqptp], [1.2.1], [4265913+mikebrady@users.noreply.github.com])
 -AC_INIT([nqptp], [1.2.2d0], [4265913+mikebrady@users.noreply.github.com])
++AC_INIT([nqptp], [1.2.3], [4265913+mikebrady@users.noreply.github.com])
  AM_INIT_AUTOMAKE
  AC_CANONICAL_HOST
  
  build_linux=no
  build_freebsd=no

Vulnerable code:  AC_INIT([nqptp], [1.2.1], [4265913+mikebrady@users.noreply.github.com])
Fixed code: +AC_INIT([nqptp], [1.2.3], [4265913+mikebrady@users.noreply.github.com])
CVE-2021-21283: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted. The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension. Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-01-26T21:15Z
Repository: https://github.com/flarum/sticky
Language: JavaScript
Files changed: js/src/forum/addStickyExcerpt.js
Commit date: 2021-01-22 13:53:11 -0500
Commit message: Fix evaluation of post content by m.trust() (#24)


Diff: diff --git a/js/src/forum/addStickyExcerpt.js b/js/src/forum/addStickyExcerpt.js
index 817e626..05e6954 100644
--- a/js/src/forum/addStickyExcerpt.js
+++ b/js/src/forum/addStickyExcerpt.js
@@ -19,10 +19,11 @@ export default function addStickyControl() {
       const firstPost = discussion.firstPost();
 
       if (firstPost) {
         const excerpt = truncate(firstPost.contentPlain(), 175);
 
-        items.add('excerpt', m.trust(excerpt), -100);
+        // Wrapping in <div> because ItemList entries need to be vnodes
+        items.add('excerpt', <div>{excerpt}</div>, -100);
       }
     }
   });
 }

Vulnerable code:         items.add('excerpt', m.trust(excerpt), -100);
Fixed code:         // Wrapping in <div> because ItemList entries need to be vnodes
        items.add('excerpt', <div>{excerpt}</div>, -100);
CVE-2021-29469: Other (NVD-CWE-Other)
value: Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2021-04-23T18:15Z
Repository: https://github.com/NodeRedis/node-redis
Language: JavaScript
Files changed: lib/utils.js
Commit date: 2021-04-08 18:04:34 -0400
Commit message: fix #1569 - improve monitor_regex (#1595)

Co-authored-by: Guy Korland <gkorland@gmail.com>
Diff: diff --git a/lib/utils.js b/lib/utils.js
index 52e58ec..d0336ae 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -125,10 +125,10 @@ function replyInOrder (self, callback, err, res, queue) {
 module.exports = {
     reply_to_strings: replyToStrings,
     reply_to_object: replyToObject,
     print: print,
     err_code: /^([A-Z]+)\s+(.+)$/,
-    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\]( ".+?")+$/,
+    monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\].*"$/,
     clone: convenienceClone,
     callback_or_emit: callbackOrEmit,
     reply_in_order: replyInOrder
 };

Vulnerable code:     monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\]( ".+?")+$/,
Fixed code:     monitor_regex: /^[0-9]{10,11}\.[0-9]+ \[[0-9]+ .+\].*"$/,
CVE-2022-41442: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-10-07T22:15Z
Repository: https://github.com/xiebruce/PicUploader
Language: PHP
Files changed: settings/SettingController.php
Commit date: 2022-07-24 14:18:51 +0800
Commit message: fix: possible XSS vulnerability of $_POST

Diff: diff --git a/settings/SettingController.php b/settings/SettingController.php
index 4d9b78fe..b83f6fca 100644
--- a/settings/SettingController.php
+++ b/settings/SettingController.php
@@ -101,11 +101,15 @@ class SettingController extends Controller {
 			$arr = explode('/', $_POST['repo']);
 			$_POST['repo'] = rtrim($arr[0]) . '/' . ltrim($arr[1]);
 		}
 		!is_dir($this->storagesDir) && mkdir($this->storagesDir, 0777);
 		$jsonFile = $this->storagesDir.'/storage-'.$key.'.json';
-        $config = json_encode($_POST, JSON_UNESCAPED_SLASHES);
+		$post = [];
+		foreach($_POST as $key=>$val){
+			$post[$key] = htmlspecialchars($val);
+		}
+        $config = json_encode($post, JSON_UNESCAPED_SLASHES);
         //在Win中，如果从"文件→属性→安全→对象名称"中复制路径，会多出一个你看不见的字符"\u202a"，只有变成
         //json后才看的见它的unicode，这样会导致路径明明存在程序却说不存在的情况，所以要把这个字符在json中去掉
         $config = str_replace('\u202a', '', $config);
 		file_put_contents($jsonFile, $config);
 		return json_encode([

Vulnerable code:         $config = json_encode($_POST, JSON_UNESCAPED_SLASHES);
Fixed code: 		$post = [];
		foreach($_POST as $key=>$val){
			$post[$key] = htmlspecialchars($val);
		}
        $config = json_encode($post, JSON_UNESCAPED_SLASHES);
CVE-2022-21699: Execution with Unnecessary Privileges (CWE-250)
value: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
CWE description: The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
CVSS v3 base score: 8.8
Published: 2022-01-19T22:15Z
Repository: https://github.com/ipython/ipython
Language: Unknown
Commit date: 2022-01-19 14:21:24 +0100
Commit message: Merge pull request from GHSA-pq7m-3gw7-gq5x

FIX CVE-2022-21699
CVE-2022-21699: Incorrect Execution-Assigned Permissions (CWE-279)
value: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
CWE description: While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
CVSS v3 base score: 8.8
Published: 2022-01-19T22:15Z
Repository: https://github.com/ipython/ipython
Language: Unknown
Commit date: 2022-01-19 14:21:24 +0100
Commit message: Merge pull request from GHSA-pq7m-3gw7-gq5x

FIX CVE-2022-21699
CVE-2023-24816: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requires that the function `IPython.utils.terminal.set_term_title` be called on Windows in a Python environment where ctypes is not available. The dependency on `ctypes` in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached in the ipython binary. However, as a library that could be used by another tool `set_term_title` could be called and hence introduce a vulnerability. Should an attacker get untrusted input to an instance of this function they would be able to inject shell commands as current process and limited to the scope of the current process. Users of ipython as a library are advised to upgrade. Users unable to upgrade should ensure that any calls to the `IPython.utils.terminal.set_term_title` function are done with trusted or filtered input.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7
Published: 2023-02-10T20:15Z
Repository: https://github.com/ipython/ipython
Language: Unknown
Commit date: 2023-02-10 10:21:06 +0100
Commit message: Merge pull request from GHSA-29gw-9793-fvw7

Fix CVE-2023-24816
CVE-2016-7444: Permissions, Privileges, and Access Controls (CWE-264)
value: The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 7.5
Published: 2016-09-27T15:59Z
Repository: https://gitlab.com/gnutls/gnutls
Language: C
Files changed: lib/x509/ocsp.c
Commit date: 2016-08-27 17:01:56 +0200
Commit message: ocsp: corrected the comparison of the serial size in OCSP response

Previously the OCSP certificate check wouldn't verify the serial length
and could succeed in cases it shouldn't.

Reported by Stefan Buehler.

Diff: diff --git a/lib/x509/ocsp.c b/lib/x509/ocsp.c
index 92db9b6aa..8181f2e07 100644
--- a/lib/x509/ocsp.c
+++ b/lib/x509/ocsp.c
@@ -1316,10 +1316,11 @@ gnutls_ocsp_resp_check_crt(gnutls_ocsp_resp_t resp,
 	ret = gnutls_x509_crt_get_serial(crt, cserial.data, &t);
 	if (ret < 0) {
 		gnutls_assert();
 		goto cleanup;
 	}
+	cserial.size = t;
 
 	if (rserial.size != cserial.size
 	    || memcmp(cserial.data, rserial.data, rserial.size) != 0) {
 		ret = GNUTLS_E_OCSP_RESPONSE_ERROR;
 		gnutls_assert();

Fixed code: 	cserial.size = t;
CVE-2017-5336: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-03-24T15:59Z
Repository: https://gitlab.com/gnutls/gnutls
Language: C
Files changed: lib/opencdk/pubkey.c
Commit date: 2017-01-04 15:24:57 +0100
Commit message: opencdk: cdk_pk_get_keyid: fix stack overflow

Issue found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Diff: diff --git a/lib/opencdk/pubkey.c b/lib/opencdk/pubkey.c
index 72e7d77b7e..1c73433fd6 100644
--- a/lib/opencdk/pubkey.c
+++ b/lib/opencdk/pubkey.c
@@ -516,18 +516,24 @@ cdk_pk_fingerprint_get_keyid(const byte * fpr, size_t fprlen, u32 * keyid)
  **/
 u32 cdk_pk_get_keyid(cdk_pubkey_t pk, u32 * keyid)
 {
 	u32 lowbits = 0;
 	byte buf[24];
+	int rc;
 
 	if (pk && (!pk->keyid[0] || !pk->keyid[1])) {
 		if (pk->version < 4 && is_RSA(pk->pubkey_algo)) {
 			byte p[MAX_MPI_BYTES];
 			size_t n;
 
 			n = MAX_MPI_BYTES;
-			_gnutls_mpi_print(pk->mpi[0], p, &n);
+			rc = _gnutls_mpi_print(pk->mpi[0], p, &n);
+			if (rc < 0 || n < 8) {
+				keyid[0] = keyid[1] = (u32)-1;
+				return (u32)-1;
+			}
+
 			pk->keyid[0] =
 			    p[n - 8] << 24 | p[n - 7] << 16 | p[n -
 								6] << 8 |
 			    p[n - 5];
 			pk->keyid[1] =

Vulnerable code: 			_gnutls_mpi_print(pk->mpi[0], p, &n);
Fixed code: 	int rc;
			rc = _gnutls_mpi_print(pk->mpi[0], p, &n);
			if (rc < 0 || n < 8) {
				keyid[0] = keyid[1] = (u32)-1;
				return (u32)-1;
			}
CVE-2017-7869: Out-of-bounds Write (CWE-787)
value: GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-04-14T04:59Z
Repository: https://gitlab.com/gnutls/gnutls
Language: C
Files changed: lib/opencdk/read-packet.c
Commit date: 2017-02-20 11:20:11 +0100
Commit message: cdk_pkt_read: enforce packet limits

That ensures that there are no overflows in the subsequent
calculations.

Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420

Relates: #159

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

Diff: diff --git a/lib/opencdk/read-packet.c b/lib/opencdk/read-packet.c
index 8055a63ed5..ead6480459 100644
--- a/lib/opencdk/read-packet.c
+++ b/lib/opencdk/read-packet.c
@@ -948,10 +948,11 @@ static cdk_error_t skip_packet(cdk_stream_t inp, size_t pktlen)
 
 	assert(pktlen == 0);
 	return 0;
 }
 
+#define MAX_PACKET_LEN (1<<24)
 
 /**
  * cdk_pkt_read:
  * @inp: the input stream
  * @pkt: allocated packet handle to store the packet
@@ -1000,10 +1001,17 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
 	if (is_newctb)
 		read_new_length(inp, &pktlen, &pktsize, &is_partial);
 	else
 		read_old_length(inp, ctb, &pktlen, &pktsize);
 
+	/* enforce limits to ensure that the following calculations
+	 * do not overflow */
+	if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
+		_cdk_log_info("cdk_pkt_read: too long packet\n");
+		return gnutls_assert_val(CDK_Inv_Packet);
+	}
+
 	pkt->pkttype = pkttype;
 	pkt->pktlen = pktlen;
 	pkt->pktsize = pktsize + pktlen;
 	pkt->old_ctb = is_newctb ? 0 : 1;
 
@@ -1024,10 +1032,11 @@ cdk_error_t cdk_pkt_read(cdk_stream_t inp, cdk_packet_t pkt)
 		if (rc)
 			return gnutls_assert_val(rc);
 		break;
 
 	case CDK_PKT_USER_ID:
+
 		pkt->pkt.user_id = cdk_calloc(1, sizeof *pkt->pkt.user_id
 					      + pkt->pktlen + 1);
 		if (!pkt->pkt.user_id)
 			return gnutls_assert_val(CDK_Out_Of_Core);
 		pkt->pkt.user_id->name =

Fixed code: #define MAX_PACKET_LEN (1<<24)
	/* enforce limits to ensure that the following calculations
	 * do not overflow */
	if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
		_cdk_log_info("cdk_pkt_read: too long packet\n");
		return gnutls_assert_val(CDK_Inv_Packet);
	}
CVE-2021-23362: Inefficient Regular Expression Complexity (CWE-1333)
value: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 5.3
Published: 2021-03-23T17:15Z
Repository: https://github.com/npm/hosted-git-info
Language: JavaScript
Files changed: index.js
Commit date: 2021-01-28 10:19:22 -0800
Commit message: fix: simplify the regular expression for shortcut matching

PR-URL: https://github.com/npm/hosted-git-info/pull/76
Credit: @nlf
Close: #76
Reviewed-by: @isaacs

Diff: diff --git a/index.js b/index.js
index 0b08be1..8b3eaba 100644
--- a/index.js
+++ b/index.js
@@ -39,11 +39,11 @@ function fromUrl (giturl, opts) {
   if (giturl == null || giturl === '') return
   var url = fixupUnqualifiedGist(
     isGitHubShorthand(giturl) ? 'github:' + giturl : giturl
   )
   var parsed = parseGitUrl(url)
-  var shortcutMatch = url.match(new RegExp('^([^:]+):(?:(?:[^@:]+(?:[^@]+)?@)?([^/]*))[/](.+?)(?:[.]git)?($|#)'))
+  var shortcutMatch = url.match(/^([^:]+):(?:[^@]+@)?(?:([^/]*)\/)?([^#]+)/)
   var matches = Object.keys(gitHosts).map(function (gitHostName) {
     try {
       var gitHostInfo = gitHosts[gitHostName]
       var auth = null
       if (parsed.auth && authProtocols[parsed.protocol]) {
@@ -53,11 +53,11 @@ function fromUrl (giturl, opts) {
       var user = null
       var project = null
       var defaultRepresentation = null
       if (shortcutMatch && shortcutMatch[1] === gitHostName) {
         user = shortcutMatch[2] && decodeURIComponent(shortcutMatch[2])
-        project = decodeURIComponent(shortcutMatch[3])
+        project = decodeURIComponent(shortcutMatch[3].replace(/\.git$/, ''))
         defaultRepresentation = 'shortcut'
       } else {
         if (parsed.host && parsed.host !== gitHostInfo.domain && parsed.host.replace(/^www[.]/, '') !== gitHostInfo.domain) return
         if (!gitHostInfo.protocols_re.test(parsed.protocol)) return
         if (!parsed.path) return

Vulnerable code:   var shortcutMatch = url.match(new RegExp('^([^:]+):(?:(?:[^@:]+(?:[^@]+)?@)?([^/]*))[/](.+?)(?:[.]git)?($|#)'))
        project = decodeURIComponent(shortcutMatch[3])
Fixed code:   var shortcutMatch = url.match(/^([^:]+):(?:[^@]+@)?(?:([^/]*)\/)?([^#]+)/)
        project = decodeURIComponent(shortcutMatch[3].replace(/\.git$/, ''))
CVE-2020-7733: Uncontrolled Resource Consumption (CWE-400)
value: The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2020-09-16T14:15Z
Repository: https://github.com/faisalman/ua-parser-js
Language: JavaScript
Files changed: src/ua-parser.js
Commit date: 2020-09-12 15:47:15 +0700
Commit message: Fix potential ReDoS vulnerability

Diff: diff --git a/src/ua-parser.js b/src/ua-parser.js
index d89312c..3d807e1 100755
--- a/src/ua-parser.js
+++ b/src/ua-parser.js
@@ -583,13 +583,13 @@
 
             /android.+;\s(\w+)\s+build\/hm\1/i,                                 // Xiaomi Hongmi 'numeric' models
             /android.+(hm[\s\-_]*note?[\s_]*(?:\d\w)?)\s+build/i,               // Xiaomi Hongmi
             /android.+(mi[\s\-_]*(?:a\d|one|one[\s_]plus|note lte)?[\s_]*(?:\d?\w?)[\s_]*(?:plus)?)\s+build/i,    
                                                                                 // Xiaomi Mi
-            /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]*[\w\s]+))\s+build/i       // Redmi Phones
+            /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]?[\w\s]+))\s+build/i       // Redmi Phones
             ], [[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, MOBILE]], [
-            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]*[\w\s]+))\s+build/i            // Mi Pad tablets
+            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]?[\w\s]+))\s+build/i            // Mi Pad tablets
             ],[[MODEL, /_/g, ' '], [VENDOR, 'Xiaomi'], [TYPE, TABLET]], [
             /android.+;\s(m[1-5]\snote)\sbuild/i                                // Meizu
             ], [MODEL, [VENDOR, 'Meizu'], [TYPE, MOBILE]], [
             /(mz)-([\w-]{2,})/i
             ], [[VENDOR, 'Meizu'], MODEL, [TYPE, MOBILE]], [

Vulnerable code:             /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]*[\w\s]+))\s+build/i       // Redmi Phones
            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]*[\w\s]+))\s+build/i            // Mi Pad tablets
Fixed code:             /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]?[\w\s]+))\s+build/i       // Redmi Phones
            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]?[\w\s]+))\s+build/i            // Mi Pad tablets
CVE-2021-27292: Other (NVD-CWE-Other)
value: ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2021-03-17T13:15Z
Repository: https://github.com/faisalman/ua-parser-js
Language: JavaScript
Files changed: src/ua-parser.js
Commit date: 2021-02-12 09:53:26 +0700
Commit message: Fix potential ReDoS vulnerability as reported by Doyensec

Diff: diff --git a/src/ua-parser.js b/src/ua-parser.js
index e6a7114..63a9f68 100755
--- a/src/ua-parser.js
+++ b/src/ua-parser.js
@@ -618,11 +618,11 @@
             ], [MODEL, [VENDOR, 'Dell'], [TYPE, TABLET]], [
 
             /android.+[;\/]\s*(Q[T|M][\d\w]+)\s+build/i                         // Verizon Tablet
             ], [MODEL, [VENDOR, 'Verizon'], [TYPE, TABLET]], [
 
-            /android.+[;\/]\s+(Barnes[&\s]+Noble\s+|BN[RT])(V?.*)\s+build/i     // Barnes & Noble Tablet
+            /android.+[;\/]\s+(Barnes[&\s]+Noble\s+|BN[RT])(\S(?:.*\S)?)\s+build/i     // Barnes & Noble Tablet
             ], [[VENDOR, 'Barnes & Noble'], MODEL, [TYPE, TABLET]], [
 
             /android.+[;\/]\s+(TM\d{3}.*\b)\s+build/i                           // Barnes & Noble Tablet
             ], [MODEL, [VENDOR, 'NuVision'], [TYPE, TABLET]], [
 
@@ -692,11 +692,11 @@
             ], [[TYPE, SMARTTV]], [
 
             /(android[\w\.\s\-]{0,9});.+build/i                                 // Generic Android Device
             ], [MODEL, [VENDOR, 'Generic']], [
 
-            /(phone)/i,
+            /(phone)/i
             ], [[TYPE, MOBILE]]
         ],
 
         engine : [[
 

Vulnerable code:             /android.+[;\/]\s+(Barnes[&\s]+Noble\s+|BN[RT])(V?.*)\s+build/i     // Barnes & Noble Tablet
            /(phone)/i,
Fixed code:             /android.+[;\/]\s+(Barnes[&\s]+Noble\s+|BN[RT])(\S(?:.*\S)?)\s+build/i     // Barnes & Noble Tablet
            /(phone)/i