Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2012-1910: Other (NVD-CWE-Other)
value: Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2012-08-06T16:55Z
Repository: https://github.com/bitcoin/bitcoin
Language: YAML
Files changed: bitcoin-qt.pro, contrib/gitian-descriptors/qt-win32.yml
Commit date: 2012-03-16 14:28:54 -0400
Commit message: Fix Win32 RPC Crashes.

Diff: diff --git a/bitcoin-qt.pro b/bitcoin-qt.pro
index e757310..9fb92af 100644
--- a/bitcoin-qt.pro
+++ b/bitcoin-qt.pro
@@ -289,12 +289,12 @@ isEmpty(BOOST_LIB_PATH) {
 
 isEmpty(BOOST_INCLUDE_PATH) {
     macx:BOOST_INCLUDE_PATH = /opt/local/include
 }
 
-windows:LIBS += -lws2_32 -lshlwapi
-windows:DEFINES += WIN32
+windows:LIBS += -lmingwthrd -lws2_32 -lshlwapi
+windows:DEFINES += _MT WIN32
 windows:RC_FILE = src/qt/res/bitcoin-qt.rc
 
 !windows:!mac {
     DEFINES += LINUX
     LIBS += -lrt
diff --git a/contrib/gitian-descriptors/qt-win32.yml b/contrib/gitian-descriptors/qt-win32.yml
index 6eb76b2..adccebb 100644
--- a/contrib/gitian-descriptors/qt-win32.yml
+++ b/contrib/gitian-descriptors/qt-win32.yml
@@ -45,10 +45,11 @@ script: |
   find . -name *.prl | xargs -l sed 's|/$||' -i
   make $MAKEOPTS install
   cp -a bin $SRCDIR/
   cd $INSTDIR
   find . -name *.prl | xargs -l sed 's|/$||' -i
+  sed 's/QMAKE_LIBS_QT_ENTRY     = -lmingw32 -lqtmain/QMAKE_LIBS_QT_ENTRY     = -lqtmain/' -i mkspecs/unsupported/win32-g++-cross/qmake.conf
   #sed 's|QMAKE_PRL_LIBS.*|QMAKE_PRL_LIBS = -lQtDeclarative -lQtScript -lQtSvg -lQtSql -lQtXmlPatterns -lQtGui -lgdi32 -lcomdlg32 -loleaut32 -limm32 -lwinmm -lwinspool -lmsimg32 -lQtNetwork -lQtCore -lole32 -luuid -lws2_32 -ladvapi32 -lshell32 -luser32 -lkernel32|' -i imports/Qt/labs/particles/qmlparticlesplugin.prl
 
   # as zip stores file timestamps, use faketime to intercept stat calls to set dates for all files to reference date
   export LD_PRELOAD=/usr/lib/faketime/libfaketime.so.1
   zip -r $OUTDIR/qt-win32-4.7.4-gitian.zip *

Vulnerable code: windows:LIBS += -lws2_32 -lshlwapi
windows:DEFINES += WIN32
Fixed code: windows:LIBS += -lmingwthrd -lws2_32 -lshlwapi
windows:DEFINES += _MT WIN32
  sed 's/QMAKE_LIBS_QT_ENTRY     = -lmingw32 -lqtmain/QMAKE_LIBS_QT_ENTRY     = -lqtmain/' -i mkspecs/unsupported/win32-g++-cross/qmake.conf
CVE-2023-36823: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-06T16:15Z
Repository: https://github.com/rgrove/sanitize
Language: Unknown
Commit date: 2023-07-06 07:54:00 -0700
Commit message: Merge pull request from GHSA-f5ww-cq3m-q3g7

Escape `</` to prevent a style element from being closed prematurely
CVE-2021-41280: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2021-11-19T20:15Z
Repository: https://github.com/sharetribe/sharetribe
Language: Unknown
Commit date: 2021-11-19 11:20:04 +0200
Commit message: Merge pull request #82 from sharetribe/fix-insecure-open

Fix insecure open
CVE-2012-2395: Other (NVD-CWE-Other)
value: Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2012-06-16T00:55Z
Repository: https://github.com/cobbler/cobbler
Language: Unknown
Commit date: 2012-05-06 21:15:27 -0700
Commit message: Merge pull request #164 from jimi1283/powerpipe

Reworking of power commands to use STDIN
CVE-2021-40323: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2021-10-04T06:15Z
Repository: https://github.com/cobbler/cobbler
Language: Unknown
Commit date: 2021-09-20 16:55:41 +0200
Commit message: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites
CVE-2021-40324: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.5
Published: 2021-10-04T06:15Z
Repository: https://github.com/cobbler/cobbler
Language: Unknown
Commit date: 2021-09-20 16:55:41 +0200
Commit message: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites
CVE-2021-40325: Insufficient Information (NVD-CWE-noinfo)
value: Cobbler before 3.3.0 allows authorization bypass for modification of settings.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-10-04T06:15Z
Repository: https://github.com/cobbler/cobbler
Language: Unknown
Commit date: 2021-09-20 16:55:41 +0200
Commit message: Merge pull request #2794 from cobbler/fix/file-rce

Fix multiple security vulnerabilites
CVE-2022-0860: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.1
Published: 2022-03-11T13:15Z
Repository: https://github.com/cobbler/cobbler
Language: Unknown
Commit date: 2022-03-11 09:59:35 +0100
Commit message: Merge pull request from GHSA-mcg6-h362-cmq5

Security: Fix CVE-2022-0860
CVE-2017-12588: Use of Externally-Controlled Format String (CWE-134)
value: The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 9.8
Published: 2017-08-06T14:29Z
Repository: https://github.com/rsyslog/rsyslog
Language: Unknown
Commit date: 2017-06-01 15:39:40 +0200
Commit message: Merge pull request #1565 from Whissi/fix-format-security-issue-in-zmq-modules

Fix format security issue in zmq3 modules
CVE-2022-24903: Improper Validation of Specified Quantity in Input (CWE-1284)
value: Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.
CWE description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CVSS v3 base score: 8.1
Published: 2022-05-06T00:15Z
Repository: https://github.com/rsyslog/rsyslog
Language: Unknown
Commit date: 2022-05-05 14:04:42 +0200
Commit message: Merge pull request from GHSA-ggw7-xr6h-mmr8

net bugfix: potential buffer overrun
CVE-2021-39230: Insufficient Information (NVD-CWE-noinfo)
value: Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to the Trinity kernel. There are no workarounds.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2021-09-21T17:15Z
Repository: https://github.com/FrankEnderman/Butter
Language: Other
Files changed: Trinity.bat
Commit date: 2021-09-21 07:57:35 +0530
Commit message: refined broken mode
Diff: diff --git a/Trinity.bat b/Trinity.bat
index bf8fe70..7a3afd8 100644
--- a/Trinity.bat
+++ b/Trinity.bat
@@ -356,10 +356,11 @@ if %FD% == 1 goto TEXT
 if %FD% == 2 goto menu
 :songs
 start iexplore "https://www.youtube.com/watch?v=-345VbbYTN8"
 :ctrlPanel
 cls
+timeout /T 1 /NOBREAK >nul
 echo 1.power options 2.productivity 3.menu 4.BROKEN MODE (DANGER)
 set /p DFF= select:
 if %DFF% == 1 goto powerOptions
 if %DFF% == 2 goto menu2
 if %DFF% == 3 goto menu
@@ -368,11 +369,11 @@ if %DFF% == 4 goto brokenMode
 cls
 echo %random%
 timeout /T 2 /NOBREAK >nul
 echo %random%%random%%random%%random%%random%%random%%random%
 timeout /T 4 /NOBREAK >nul
-echo %random%%random%%random%%random%%random%%random%%random%
+echo %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%
 timeout /T 3 /NOBREAK >nul
 echo DRIVE CORRUPT
 timeout /T 1 /NOBREAK >nul
 echo 0x010100000000 DOS error 
 timeout /T 5 /NOBREAK >nul
@@ -383,8 +384,8 @@ timeout /T 3 /NOBREAK >nul
 cls
 timeout /T 3 /NOBREAK >nul
 echo restarting....
 timeout /T 2 /NOBREAK >nul
 echo BOOTING INTO TRINITY RRBI
-timeout /T 2 /NOBREAK >nul
+timeout /T 5 /NOBREAK >nul
 pause
 goto boot

Vulnerable code: echo %random%%random%%random%%random%%random%%random%%random%
timeout /T 2 /NOBREAK >nul
Fixed code: timeout /T 1 /NOBREAK >nul
echo %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%
timeout /T 5 /NOBREAK >nul
CVE-2021-39169: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting (XSS). XSS could compromise the API request token. This issue has been fixed in version 12.51.0. There are no known workarounds aside from upgrading.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-08-27T13:15Z
Repository: https://github.com/misskey-dev/misskey
Language: Other
Files changed: src/client/components/dialog.vue
Commit date: 2020-10-25 12:25:13 +0900
Commit message: Use MFM instead of v-html to avoid XSS

Diff: diff --git a/src/client/components/dialog.vue b/src/client/components/dialog.vue
index 810f4284c..f157a37ea 100644
--- a/src/client/components/dialog.vue
+++ b/src/client/components/dialog.vue
@@ -10,12 +10,12 @@
 			<Fa :icon="faExclamationTriangle" v-if="type === 'warning'"/>
 			<Fa :icon="faInfoCircle" v-if="type === 'info'"/>
 			<Fa :icon="faQuestionCircle" v-if="type === 'question'"/>
 			<Fa :icon="faSpinner" pulse v-if="type === 'waiting'"/>
 		</div>
-		<header v-if="title" v-html="title"></header>
-		<div class="body" v-if="text" v-html="text"></div>
+		<header v-if="title"><Mfm :text="title"/></header>
+		<div class="body" v-if="text"><Mfm :text="text"/></div>
 		<MkInput v-if="input" v-model:value="inputValue" autofocus :type="input.type || 'text'" :placeholder="input.placeholder" @keydown="onInputKeydown"></MkInput>
 		<MkSelect v-if="select" v-model:value="selectedValue" autofocus>
 			<template v-if="select.items">
 				<option v-for="item in select.items" :value="item.value">{{ item.text }}</option>
 			</template>

Vulnerable code: 		<header v-if="title" v-html="title"></header>
		<div class="body" v-if="text" v-html="text"></div>
Fixed code: 		<header v-if="title"><Mfm :text="title"/></header>
		<div class="body" v-if="text"><Mfm :text="text"/></div>
CVE-2023-24812: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the `api/notes/search-by-tag` endpoint.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-22T20:15Z
Repository: https://github.com/misskey-dev/misskey
Language: TypeScript
Files changed: packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
Commit date: 2023-02-04 18:21:07 +0900
Commit message: fix(server): improve security

Diff: diff --git a/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts b/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
index 061e371d65..bcd793ac43 100644
--- a/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
+++ b/packages/backend/src/server/api/endpoints/notes/search-by-tag.ts
@@ -93,18 +93,18 @@ export default class extends Endpoint<typeof meta, typeof paramDef> {
 			if (me) this.queryService.generateMutedUserQuery(query, me);
 			if (me) this.queryService.generateBlockedUserQuery(query, me);
 
 			try {
 				if (ps.tag) {
-					if (!safeForSql(ps.tag)) throw 'Injection';
+					if (!safeForSql(normalizeForSearch(ps.tag))) throw 'Injection';
 					query.andWhere(`'{"${normalizeForSearch(ps.tag)}"}' <@ note.tags`);
 				} else {
 					query.andWhere(new Brackets(qb => {
 						for (const tags of ps.query!) {
 							qb.orWhere(new Brackets(qb => {
 								for (const tag of tags) {
-									if (!safeForSql(tag)) throw 'Injection';
+									if (!safeForSql(normalizeForSearch(tag))) throw 'Injection';
 									qb.andWhere(`'{"${normalizeForSearch(tag)}"}' <@ note.tags`);
 								}
 							}));
 						}
 					}));

Vulnerable code: 					if (!safeForSql(ps.tag)) throw 'Injection';
									if (!safeForSql(tag)) throw 'Injection';
Fixed code: 					if (!safeForSql(normalizeForSearch(ps.tag))) throw 'Injection';
									if (!safeForSql(normalizeForSearch(tag))) throw 'Injection';
CVE-2023-43793: Improper Authentication (CWE-287)
value: Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2023-10-04T21:15Z
Repository: https://github.com/misskey-dev/misskey
Language: Markdown
Files changed: CHANGELOG.md, packages/backend/src/server/web/ClientServerService.ts
Commit date: 2023-08-20 10:00:10 +0900
Commit message: fix(backend): ジョブキュー管理画面の認証を回避できる問題を修正

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5d9301d74d..38dcddaa91 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,10 +37,11 @@
 ### Server
 - cacheRemoteFilesの初期値はfalseになりました
 - ファイルアップロード時等にファイル名の拡張子を修正する関数(correctFilename)の挙動を改善
 - Fix: 一部のfeatured noteを照会できない問題を修正
 - Fix: muteがapiからのuser list timeline取得で機能しない問題を修正
+- Fix: ジョブキュー管理画面の認証を回避できる問題を修正
 
 ## 13.14.2
 
 ### Client
 - リストTLで、ユーザーが追加・削除されてもTLを初期化しないように
diff --git a/packages/backend/src/server/web/ClientServerService.ts b/packages/backend/src/server/web/ClientServerService.ts
index b2b443cf36..25f59914ff 100644
--- a/packages/backend/src/server/web/ClientServerService.ts
+++ b/packages/backend/src/server/web/ClientServerService.ts
@@ -141,11 +141,13 @@ export class ClientServerService {
 		//#region Bull Dashboard
 		const bullBoardPath = '/queue';
 
 		// Authenticate
 		fastify.addHook('onRequest', async (request, reply) => {
-			if (request.url === bullBoardPath || request.url.startsWith(bullBoardPath + '/')) {
+			// %71ueueとかでリクエストされたら困るため
+			const url = decodeURI(request.url);
+			if (url === bullBoardPath || url.startsWith(bullBoardPath + '/')) {
 				const token = request.cookies.token;
 				if (token == null) {
 					reply.code(401);
 					throw new Error('login required');
 				}

Vulnerable code: 			if (request.url === bullBoardPath || request.url.startsWith(bullBoardPath + '/')) {
Fixed code: - Fix: ジョブキュー管理画面の認証を回避できる問題を修正
			// %71ueueとかでリクエストされたら困るため
			const url = decodeURI(request.url);
			if (url === bullBoardPath || url.startsWith(bullBoardPath + '/')) {
CVE-2022-31621: Improper Locking (CWE-667)
value: MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CWE description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CVSS v3 base score: 5.5
Published: 2022-05-25T21:15Z
Repository: https://github.com/MariaDB/server
Language: C++
Files changed: extra/mariabackup/ds_xbstream.cc
Commit date: 2021-09-15 14:55:45 +0200
Commit message: MDEV-26574 An improper locking bug due to unreleased lock in the ds_xbstream.cc

release lock in all as cases n xbstream_open, also fix the case where malloc would return NULL.

Diff: diff --git a/extra/mariabackup/ds_xbstream.cc b/extra/mariabackup/ds_xbstream.cc
index 3b60456f8ed..798d7da6da4 100644
--- a/extra/mariabackup/ds_xbstream.cc
+++ b/extra/mariabackup/ds_xbstream.cc
@@ -124,19 +124,23 @@ xbstream_open(ds_ctxt_t *ctxt, const char *path, MY_STAT *mystat)
 	stream_ctxt = (ds_stream_ctxt_t *) ctxt->ptr;
 
 	pthread_mutex_lock(&stream_ctxt->mutex);
 	if (stream_ctxt->dest_file == NULL) {
 		stream_ctxt->dest_file = ds_open(dest_ctxt, path, mystat);
-		if (stream_ctxt->dest_file == NULL) {
-			return NULL;
-		}
 	}
 	pthread_mutex_unlock(&stream_ctxt->mutex);
+	if (stream_ctxt->dest_file == NULL) {
+		return NULL;
+	}
 
 	file = (ds_file_t *) my_malloc(sizeof(ds_file_t) +
 				       sizeof(ds_stream_file_t),
 				       MYF(MY_FAE));
+	if (!file) {
+		msg("my_malloc() failed.");
+		goto err;
+	}
 	stream_file = (ds_stream_file_t *) (file + 1);
 
 	xbstream = stream_ctxt->xbstream;
 
 	xbstream_file = xb_stream_write_open(xbstream, path, mystat,

Vulnerable code: 		if (stream_ctxt->dest_file == NULL) {
			return NULL;
		}
Fixed code: 	if (stream_ctxt->dest_file == NULL) {
		return NULL;
	}
	if (!file) {
		msg("my_malloc() failed.");
		goto err;
	}
CVE-2022-31622: Improper Locking (CWE-667)
value: MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CWE description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CVSS v3 base score: 5.5
Published: 2022-05-25T21:15Z
Repository: https://github.com/MariaDB/server
Language: C++
Files changed: extra/mariabackup/ds_compress.cc
Commit date: 2021-11-09 17:05:55 +1100
Commit message: MDEV-26561 Fix a bug due to unreleased lock

Fix a bug of unreleased lock ctrl_mutex in the method create_worker_threads

Diff: diff --git a/extra/mariabackup/ds_compress.cc b/extra/mariabackup/ds_compress.cc
index 23de4d851163..72c938799473 100644
--- a/extra/mariabackup/ds_compress.cc
+++ b/extra/mariabackup/ds_compress.cc
@@ -367,10 +367,11 @@ create_worker_threads(uint n)
 
 		if (pthread_create(&thd->id, NULL, compress_worker_thread_func,
 				   thd)) {
 			msg("compress: pthread_create() failed: "
 			    "errno = %d", errno);
+			pthread_mutex_unlock(&thd->ctrl_mutex);
 			goto err;
 		}
 	}
 
 	/* Wait for the threads to start */

Fixed code: 			pthread_mutex_unlock(&thd->ctrl_mutex);
CVE-2022-31623: Improper Locking (CWE-667)
value: MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CWE description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CVSS v3 base score: 5.5
Published: 2022-05-25T21:15Z
Repository: https://github.com/MariaDB/server
Language: C++
Files changed: extra/mariabackup/ds_compress.cc
Commit date: 2021-11-09 17:05:55 +1100
Commit message: MDEV-26561 mariabackup release locks

The previous threads locked need to be released too.

This occurs if the initialization of any of the non-first
mutex/conditition variables errors occurs.

Diff: diff --git a/extra/mariabackup/ds_compress.cc b/extra/mariabackup/ds_compress.cc
index 72c938799473..a85523bd880c 100644
--- a/extra/mariabackup/ds_compress.cc
+++ b/extra/mariabackup/ds_compress.cc
@@ -384,10 +384,17 @@ create_worker_threads(uint n)
 	}
 
 	return threads;
 
 err:
+	while (i > 0) {
+		comp_thread_ctxt_t *thd;
+		i--;
+		thd = threads + i;
+		pthread_mutex_unlock(&thd->ctrl_mutex);
+	}
+
 	my_free(threads);
 	return NULL;
 }
 
 static

Fixed code: 	while (i > 0) {
		comp_thread_ctxt_t *thd;
		i--;
		thd = threads + i;
		pthread_mutex_unlock(&thd->ctrl_mutex);
	}
CVE-2021-42362: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.


CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2021-11-17T18:15Z
Repository: https://github.com/cabrerahector/wordpress-popular-posts
Language: PHP
Files changed: src/Image.php
Commit date: 2021-06-03 11:09:16 -0400
Commit message: Image: verifies that URLs are images

Diff: diff --git a/src/Image.php b/src/Image.php
index 86ae36c..aed65d8 100644
--- a/src/Image.php
+++ b/src/Image.php
@@ -622,10 +622,13 @@ class Image {
      * @param   string      $url   Image url.
      * @return  string|bool Image path, or false on failure.
      */
     private function fetch_external_image($id, $url)
     {
+        if ( ! $this->is_image_url($url) )
+            return false;
+
         $full_image_path = trailingslashit($this->get_plugin_uploads_dir()['basedir']) . "{$id}_" . sanitize_file_name(rawurldecode(wp_basename($url)));
 
         // if the file exists already, return URL and path
         if ( file_exists($full_image_path) )
             return $full_image_path;
@@ -930,10 +933,19 @@ class Image {
         $parse_url = str_replace($path, implode('/', $encoded_path), $url);
 
         if ( ! filter_var($parse_url, FILTER_VALIDATE_URL) )
             return false;
 
+        // Check extension
+        $file_name = basename($path);
+        $file_name = sanitize_file_name($file_name);
+        $ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
+        $allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
+
+        if ( ! in_array($ext, $allowed_ext) )
+            return false;
+
         // sanitize URL, just in case
         $image_url = esc_url($url);
         // remove querystring
         preg_match('/[^\?]+\.(jpg|JPG|jpe|JPE|jpeg|JPEG|gif|GIF|png|PNG)/', $image_url, $matches);
 

Fixed code:         if ( ! $this->is_image_url($url) )
            return false;

        // Check extension
        $file_name = basename($path);
        $file_name = sanitize_file_name($file_name);
        $ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
        $allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];

        if ( ! in_array($ext, $allowed_ext) )
            return false;
CVE-2022-23634: Improper Resource Shutdown or Release (CWE-404)
value: Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
CWE description: The product does not release or incorrectly releases a resource before it is made available for re-use.
CVSS v3 base score: 5.9
Published: 2022-02-11T22:15Z
Repository: https://github.com/puma/puma
Language: Ruby
Files changed: lib/puma/request.rb
Commit date: 2022-02-11 12:51:26 -0800
Commit message: Ensure `close` is called on the response body no matter what

Another fallout from https://github.com/puma/puma/pull/2809 is that
in some cases the `res_body.close` wasn't called because some previous code
raised.

For Rails apps it means CurrentAttributes and a few other important
states aren't reset properly.

This is being improved on the Rails side too, but I believe it would
be good to harden this on the puma side as well.

Diff: diff --git a/lib/puma/request.rb b/lib/puma/request.rb
index 10508c8d..691ada42 100644
--- a/lib/puma/request.rb
+++ b/lib/puma/request.rb
@@ -169,15 +169,20 @@ module Puma
         rescue SystemCallError, IOError
           raise ConnectionError, "Connection error detected during write"
         end
 
       ensure
-        uncork_socket io
-
-        body.close
-        client.tempfile.unlink if client.tempfile
-        res_body.close if res_body.respond_to? :close
+        begin
+          uncork_socket io
+
+          body.close
+          client.tempfile.unlink if client.tempfile
+        ensure
+          # Whatever happens, we MUST call `close` on the response body.
+          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
+          res_body.close if res_body.respond_to? :close
+        end
 
         after_reply.each { |o| o.call }
       end
 
       res_info[:keep_alive]

Vulnerable code:         uncork_socket io

        body.close
        client.tempfile.unlink if client.tempfile
        res_body.close if res_body.respond_to? :close
Fixed code:         begin
          uncork_socket io

          body.close
          client.tempfile.unlink if client.tempfile
        ensure
          # Whatever happens, we MUST call `close` on the response body.
          # Otherwise Rack::BodyProxy callbacks may not fire and lead to various state leaks
          res_body.close if res_body.respond_to? :close
        end
CVE-2018-20226: Insufficient Information (NVD-CWE-noinfo)
value: An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the lack of overriding the Role.toString method.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.2
Published: 2018-12-21T23:29Z
Repository: https://github.com/TheHive-Project/Cortex
Language: Scala
Files changed: app/org/thp/cortex/controllers/UserCtrl.scala
Commit date: 2018-12-20 11:58:39 +0100
Commit message: #158 Fix checks in user creation

Diff: diff --git a/app/org/thp/cortex/controllers/UserCtrl.scala b/app/org/thp/cortex/controllers/UserCtrl.scala
index 7db3d66..3e2124b 100644
--- a/app/org/thp/cortex/controllers/UserCtrl.scala
+++ b/app/org/thp/cortex/controllers/UserCtrl.scala
@@ -40,11 +40,11 @@ class UserCtrl @Inject() (
       // Check if organization is valid
       organization ← organizationSrv.get(organizationId)
       if organization.status() == OrganizationStatus.Active &&
         (request.roles.contains(Roles.superAdmin) ||
           (userOrganizationId == organizationId &&
-            !request.body.getStrings("roles").getOrElse(Nil).contains(Roles.superAdmin.toString)))
+            !request.body.getStrings("roles").getOrElse(Nil).contains(Roles.superAdmin.name)))
       user ← userSrv.create(request.body.set("organization", organizationId))
     } yield renderer.toOutput(CREATED, user))
       .recoverWith {
         case _: NoSuchElementException ⇒ Future.failed(AuthorizationError("You are not authorized to perform this action"))
       }

Vulnerable code:             !request.body.getStrings("roles").getOrElse(Nil).contains(Roles.superAdmin.toString)))
Fixed code:             !request.body.getStrings("roles").getOrElse(Nil).contains(Roles.superAdmin.name)))
CVE-2022-41922: Deserialization of Untrusted Data (CWE-502)
value: `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-11-23T18:15Z
Repository: https://github.com/yiisoft/yii
Language: Unknown
Commit date: 2022-11-21 14:48:12 +0100
Commit message: Merge pull request from GHSA-442f-wcwq-fpcf

Fix for CVE-2022-41922
CVE-2023-47130: Deserialization of Untrusted Data (CWE-502)
value: Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. An attacker may leverage this vulnerability to compromise the host system. A fix has been developed for the 1.1.29 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2023-11-14T21:15Z
Repository: https://github.com/yiisoft/yii
Language: Unknown
Commit date: 2023-11-14 10:18:46 +0100
Commit message: Merge pull request from GHSA-mw2w-2hj2-fg8q

Advisory fix
CVE-2023-1527: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository tsolucio/corebos prior to 8.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-21T00:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: include/utils/VtlibUtils.php
Commit date: 2023-03-21 00:00:44 +0100
Commit message: sec(VTLIB) purify clean javascript in href

Diff: diff --git a/include/utils/VtlibUtils.php b/include/utils/VtlibUtils.php
index c0105839de..347125d08c 100644
--- a/include/utils/VtlibUtils.php
+++ b/include/utils/VtlibUtils.php
@@ -478,10 +478,20 @@ function vtlib_purify($input, $ignore = false) {
 				foreach ($input as $k => $v) {
 					$value[$k] = vtlib_purify($v, $ignore);
 				}
 			} else { // Simple type
 				$value = $__htmlpurifier_instance->purify($input);
+				if (strpos($value, '<a') !== false && strpos($value, 'javascript') !== false) {
+					$dom = new DOMDocument;
+					$dom->loadHTML($value, LIBXML_HTML_NODEFDTD | LIBXML_HTML_NOIMPLIED);
+					foreach ($dom->getElementsByTagName('a') as $node) {
+						if ($node->hasAttribute('href') && !filter_var($node->getAttribute('href'), FILTER_VALIDATE_URL) !== false) {
+							$node->removeAttribute('href');
+							$value = trim($dom->saveHTML(), "\n");
+						}
+					}
+				}
 			}
 		}
 	}
 	if (is_array($value)) {
 		$value = changeHTMLAmpersandsInArray($value);

Fixed code: 				if (strpos($value, '<a') !== false && strpos($value, 'javascript') !== false) {
					$dom = new DOMDocument;
					$dom->loadHTML($value, LIBXML_HTML_NODEFDTD | LIBXML_HTML_NOIMPLIED);
					foreach ($dom->getElementsByTagName('a') as $node) {
						if ($node->hasAttribute('href') && !filter_var($node->getAttribute('href'), FILTER_VALIDATE_URL) !== false) {
							$node->removeAttribute('href');
							$value = trim($dom->saveHTML(), "\n");
						}
					}
				}
CVE-2023-3069: Improper Authentication (CWE-287)
value: Unverified Password Change in GitHub repository tsolucio/corebos prior to 8.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2023-06-02T17:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: modules/Vtiger/ExecuteFunctions.php
Commit date: 2023-06-02 17:09:38 +0200
Commit message: sec(Users) repeat password checks in backend before update

Diff: diff --git a/modules/Vtiger/ExecuteFunctions.php b/modules/Vtiger/ExecuteFunctions.php
index 4ddf3f9046..60e5838765 100644
--- a/modules/Vtiger/ExecuteFunctions.php
+++ b/modules/Vtiger/ExecuteFunctions.php
@@ -619,24 +619,18 @@ switch ($functiontocall) {
 		break;
 	case 'setNewPassword':
 		Vtiger_Request::validateRequest();
 		require_once 'modules/Users/Users.php';
 		require_once 'include/utils/UserInfoUtil.php';
+		require_once 'include/Webservices/ChangePassword.php';
 		$userid = vtlib_purify($_REQUEST['record']);
-		if (is_admin($current_user) || $current_user->id==$userid) {
-			$focus = new Users();
-			$focus->mode='edit';
-			$focus->id = $userid;
-			$focus->retrieve_entity_info($userid, 'Users');
-			$ret = $focus->change_password('old_password', vtlib_purify(substr($_REQUEST['new_password'], 0, 1024)));
-			if ($ret) {
-				$ret = array('password'=>$ret);
-			} else {
-				$ret = array('password'=>false, 'msg' => $focus->error_string);
-			}
-		} else {
-			$ret = array('password'=>false, 'msg' => $focus->error_string);
+		try {
+			$npass = vtlib_purify($_REQUEST['new_password']);
+			vtws_changePassword(vtlib_purify($_REQUEST['record']), 'nocheck_old_password', $npass, $npass, $current_user);
+			$ret = array('password'=>true);
+		} catch (\Throwable $th) {
+			$ret = array('password'=>false, 'msg' => $th->getMessage());
 		}
 		break;
 	case 'ismoduleactive':
 		$mod = vtlib_purify($_REQUEST['checkmodule']);
 		$rdo = vtlib_isModuleActive($mod);

Vulnerable code: 		if (is_admin($current_user) || $current_user->id==$userid) {
			$focus = new Users();
			$focus->mode='edit';
			$focus->id = $userid;
			$focus->retrieve_entity_info($userid, 'Users');
			$ret = $focus->change_password('old_password', vtlib_purify(substr($_REQUEST['new_password'], 0, 1024)));
			if ($ret) {
				$ret = array('password'=>$ret);
			} else {
				$ret = array('password'=>false, 'msg' => $focus->error_string);
			}
		} else {
			$ret = array('password'=>false, 'msg' => $focus->error_string);
Fixed code: 		require_once 'include/Webservices/ChangePassword.php';
		try {
			$npass = vtlib_purify($_REQUEST['new_password']);
			vtws_changePassword(vtlib_purify($_REQUEST['record']), 'nocheck_old_password', $npass, $npass, $current_user);
			$ret = array('password'=>true);
		} catch (\Throwable $th) {
			$ret = array('password'=>false, 'msg' => $th->getMessage());
CVE-2023-3070: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-02T17:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: data/CRMEntity.php, modules/Users/Save.php
Commit date: 2023-06-02 17:34:48 +0200
Commit message: sec(Emails) sanitize email fields

Diff: diff --git a/data/CRMEntity.php b/data/CRMEntity.php
index b24b041d39..ab232e6cea 100644
--- a/data/CRMEntity.php
+++ b/data/CRMEntity.php
@@ -866,10 +866,12 @@ class CRMEntity {
 						$rows = $adb->num_rows($res);
 						if ($rows > 0) {
 							$fldvalue = $adb->query_result($res, 0, 'email1');
 						}
 					}
+				} elseif ($uitype == 13) {
+					$fldvalue = filter_var($this->column_fields[$fieldname], FILTER_SANITIZE_EMAIL);
 				} elseif (($uitype == 72 || $uitype == 7 || $uitype == 9) && !$ajaxSave) {
 					// Some of the currency fields like Unit Price, Total, Sub-total and normal numbers do not need currency conversion during save
 					$fldvalue = CurrencyField::convertToDBFormat($this->column_fields[$fieldname], null, true);
 					if ($insertion_mode == 'edit') {
 						$fldvalue = $this->adjustCurrencyField($fieldname, $fldvalue, $tabid);
diff --git a/modules/Users/Save.php b/modules/Users/Save.php
index 87d4155eb1..19ef890c75 100644
--- a/modules/Users/Save.php
+++ b/modules/Users/Save.php
@@ -122,10 +122,13 @@ if (empty($_REQUEST['changepassword']) || $_REQUEST['changepassword'] != 'true')
 	}
 	if (isset($_SESSION['internal_mailer']) && $_SESSION['internal_mailer'] != $focus->column_fields['internal_mailer']) {
 		coreBOS_Session::set('internal_mailer', $focus->column_fields['internal_mailer']);
 	}
 	setObjectValuesFromRequest($focus);
+	$focus->column_fields['email1'] = filter_var($focus->column_fields['email1'], FILTER_SANITIZE_EMAIL);
+	$focus->column_fields['email2'] = filter_var($focus->column_fields['email2'], FILTER_SANITIZE_EMAIL);
+	$focus->column_fields['secondaryemail'] = filter_var($focus->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
 
 	if (empty($focus->column_fields['roleid']) && !empty($_POST['user_role'])) {
 		$focus->column_fields['roleid'] = $_POST['user_role'];
 	}
 	$focus->save('Users');

Fixed code: 				} elseif ($uitype == 13) {
					$fldvalue = filter_var($this->column_fields[$fieldname], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['email1'] = filter_var($focus->column_fields['email1'], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['email2'] = filter_var($focus->column_fields['email2'], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['secondaryemail'] = filter_var($focus->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
CVE-2023-3071: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-02T17:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: modules/PickList/PickListAction.php
Commit date: 2023-06-02 17:49:48 +0200
Commit message: sec(Picklist) sanitize picklist values

Diff: diff --git a/modules/PickList/PickListAction.php b/modules/PickList/PickListAction.php
index da1ff413da..edd9806707 100644
--- a/modules/PickList/PickListAction.php
+++ b/modules/PickList/PickListAction.php
@@ -35,11 +35,11 @@ if ($mode == 'add') {
 	foreach ($arr as $val) {
 		if (!empty($val)) {
 			$id = $adb->getUniqueID("vtiger_$tableName");
 			$picklist_valueid = getUniquePicklistID();
 			$sql = "insert into vtiger_$tableName values (?,?,?,?)";
-			$adb->pquery($sql, array($id, $val, 1, $picklist_valueid));
+			$adb->pquery($sql, array($id, vtlib_purify($val), 1, $picklist_valueid));
 			//add the picklist values to the selected roles
 			foreach ($roles as $roleid) {
 				$sql ="select max(sortid)+1 as sortid
 					from vtiger_role2picklist
 					left join vtiger_$tableName on vtiger_$tableName.picklist_valueid=vtiger_role2picklist.picklistvalueid

Vulnerable code: 			$adb->pquery($sql, array($id, $val, 1, $picklist_valueid));
Fixed code: 			$adb->pquery($sql, array($id, vtlib_purify($val), 1, $picklist_valueid));
CVE-2023-3073: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8 via evvtgendoc.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-02T19:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: modules/Documents/SaveFolder.php
Commit date: 2023-06-02 18:25:23 +0200
Commit message: sec(Documents) sanitize and limit folder name and description

Diff: diff --git a/modules/Documents/SaveFolder.php b/modules/Documents/SaveFolder.php
index b8b072b70c..b14ea98029 100644
--- a/modules/Documents/SaveFolder.php
+++ b/modules/Documents/SaveFolder.php
@@ -13,12 +13,12 @@ require_once 'include/database/PearDatabase.php';
 
 global $adb;
 
 $local_log = LoggerManager::getLogger('index');
 $folderid = isset($_REQUEST['record']) ? vtlib_purify($_REQUEST['record']) : '';
-$foldername = utf8RawUrlDecode($_REQUEST['foldername']);
-$folderdesc = utf8RawUrlDecode($_REQUEST['folderdesc']);
+$foldername = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['foldername']))), 0, 20);
+$folderdesc = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['folderdesc']))), 0, 50);
 
 if (isset($_REQUEST['savemode']) && $_REQUEST['savemode'] == 'Save') {
 	if ($folderid == '') {
 		$dbQuery = 'select foldername from vtiger_attachmentsfolder where foldername=?';
 		$result1 = $adb->pquery($dbQuery, array($foldername));

Vulnerable code: $foldername = utf8RawUrlDecode($_REQUEST['foldername']);
$folderdesc = utf8RawUrlDecode($_REQUEST['folderdesc']);
Fixed code: $foldername = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['foldername']))), 0, 20);
$folderdesc = substr(vtlib_purify(trim(utf8RawUrlDecode($_REQUEST['folderdesc']))), 0, 50);