Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-39219: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusion vulnerability. As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type. Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`). It's expected that usage of more-than-one `Engine` in an embedding is relatively rare since an `Engine` is intended to be a globally shared resource, so the expectation is that the impact of this issue is relatively small. The fix implemented is to change this behavior to `panic!()` in Rust instead of silently allowing it. Using different `Engine` instances with a `Linker` is a programmer bug that `wasmtime` catches at runtime. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime and are using more than one `Engine` in your embedding it's recommended to instead use only one `Engine` for the entire program if possible. An `Engine` is designed to be a globally shared resource that is suitable to have only one for the lifetime of an entire process. If using multiple `Engine`s is required then code should be audited to ensure that `Linker` is only used with one `Engine`.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 6.3
Published: 2021-09-17T20:15Z
Repository: https://github.com/bytecodealliance/wasmtime
Language: Unknown
Commit date: 2021-09-17 10:29:35 -0700
Commit message: Merge pull request from GHSA-q879-9g95-56mx

Add an assertion that a `HostFunc`'s `store` agrees on engines
CVE-2021-4296: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 51f75c31f7fc33859a9a571311c67ae4e95d9c68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217019.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-29T09:15Z
Repository: https://github.com/w3c/Unicorn
Language: Unknown
Commit date: 2021-06-03 08:37:08 +0200
Commit message: Merge pull request #212 from w3c/nu-xss

Escape HTML in messages extracted from Validator NU output
CVE-2020-24390: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-08-27T16:15Z
Repository: https://github.com/EyesOfNetworkCommunity/eonweb
Language: PHP
Files changed: include/function.php
Commit date: 2020-06-16 16:24:27 +0200
Commit message: FIX 2.4 protect login/logout logs recording

Diff: diff --git a/include/function.php b/include/function.php
index b40da5d..d4a484d 100644
--- a/include/function.php
+++ b/include/function.php
@@ -368,14 +368,17 @@ function stripAccents($str, $charset='utf-8'){
 
 // Add Logs
 function logging($module,$command,$user=false){
 	global $database_eonweb;
 	global $dateformat;
-	if($user)
+	if($user){
+		$user = htmlspecialchars($user);
 		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','$user','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
-	elseif(isset($_COOKIE['user_name']))
-		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$_COOKIE['user_name']."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
+	}elseif(isset($_COOKIE['user_name'])){
+		$user = htmlspecialchars($_COOKIE['user_name']);
+		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$user."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
+	}
 }
 
 // Time
 function getmtime(){
   

Vulnerable code: 	if($user)
	elseif(isset($_COOKIE['user_name']))
		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$_COOKIE['user_name']."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
Fixed code: 	if($user){
		$user = htmlspecialchars($user);
	}elseif(isset($_COOKIE['user_name'])){
		$user = htmlspecialchars($_COOKIE['user_name']);
		sqlrequest($database_eonweb,"insert into logs values ('','".time()."','".$user."','$module','$command','".$_SERVER["REMOTE_ADDR"]."');");
	}
CVE-2024-24762: Inefficient Regular Expression Complexity (CWE-1333)
value: `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests, leading to regular expression denial of service. This vulnerability has been patched in version 0.0.7.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2024-02-05T15:15Z
Repository: https://github.com/tiangolo/fastapi
Language: Other
Files changed: pyproject.toml, requirements-tests.txt
Commit date: 2024-02-03 13:32:42 +0100
Commit message: Merge pull request from GHSA-qf9m-vfgh-m389


Diff: diff --git a/pyproject.toml b/pyproject.toml
index 3e43f35e..31d9c59b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -54,11 +54,11 @@ Repository = "https://github.com/tiangolo/fastapi"
 
 [project.optional-dependencies]
 all = [
     "httpx >=0.23.0",
     "jinja2 >=2.11.2",
-    "python-multipart >=0.0.5",
+    "python-multipart >=0.0.7",
     "itsdangerous >=1.1.0",
     "pyyaml >=5.3.1",
     "ujson >=4.0.1,!=4.0.2,!=4.1.0,!=4.2.0,!=4.3.0,!=5.0.0,!=5.1.0",
     "orjson >=3.2.1",
     "email_validator >=2.0.0",
diff --git a/requirements-tests.txt b/requirements-tests.txt
index e1a976c1..a5586c5c 100644
--- a/requirements-tests.txt
+++ b/requirements-tests.txt
@@ -11,11 +11,11 @@ dirty-equals ==0.6.0
 # probably when including SQLModel
 sqlalchemy >=1.3.18,<1.4.43
 databases[sqlite] >=0.3.2,<0.7.0
 orjson >=3.2.1,<4.0.0
 ujson >=4.0.1,!=4.0.2,!=4.1.0,!=4.2.0,!=4.3.0,!=5.0.0,!=5.1.0,<6.0.0
-python-multipart >=0.0.5,<0.0.7
+python-multipart >=0.0.7,<0.1.0
 flask >=1.1.2,<3.0.0
 anyio[trio] >=3.2.1,<4.0.0
 python-jose[cryptography] >=3.3.0,<4.0.0
 pyyaml >=5.3.1,<7.0.0
 passlib[bcrypt] >=1.7.2,<2.0.0

Vulnerable code:     "python-multipart >=0.0.5",
python-multipart >=0.0.5,<0.0.7
Fixed code:     "python-multipart >=0.0.7",
python-multipart >=0.0.7,<0.1.0
CVE-2022-39280: Inefficient Regular Expression Complexity (CWE-1333)
value: dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-10-06T18:16Z
Repository: https://github.com/pyupio/dparse
Language: Unknown
Commit date: 2022-08-09 09:49:32 -0500
Commit message: Merge pull request #57 from pyupio/security/remove-intensive-regex

Removing index server validation
CVE-2024-23323: Uncontrolled Resource Consumption (CWE-400)
value: Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 5.3
Published: 2024-02-09T23:15Z
Repository: https://github.com/envoyproxy/envoy
Language: YAML
Files changed: changelogs/current.yaml
Commit date: 2024-02-09 17:52:19 +0000
Commit message: Cache RE object in uri template matcher.

Fix [CVE-2024-23323](https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch)

Signed-off-by: Yan Avlasov <yavlasov@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Diff: diff --git a/changelogs/current.yaml b/changelogs/current.yaml
index fa11395e7d8..1db0c337be4 100644
--- a/changelogs/current.yaml
+++ b/changelogs/current.yaml
@@ -50,10 +50,13 @@ bug_fixes:
     Prevent Envoy from crashing at start up when the OpenTelemetry environment resource detector cannot detect any attributes.
 - area: proxy protocol
   change: |
     Fixed a crash when Envoy is configured for PROXY protocol on both a listener and cluster, and the listener receives
     a PROXY protocol header with address type LOCAL (typically used for health checks).
+- area: url matching
+  change: |
+    Fixed excessive CPU utilization when using regex URL template matcher.
 
 removed_config_or_runtime:
 # *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
 - area: http
   change: |

Fixed code: - area: url matching
  change: |
    Fixed excessive CPU utilization when using regex URL template matcher.
CVE-2021-3807: Inefficient Regular Expression Complexity (CWE-1333)
value: ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-09-17T07:15Z
Repository: https://github.com/chalk/ansi-regex
Language: JavaScript
Files changed: index.js
Commit date: 2021-09-10 22:23:24 +0200
Commit message: Fix potential ReDoS (#37)


Diff: diff --git a/index.js b/index.js
index 25a9ba7..130a092 100644
--- a/index.js
+++ b/index.js
@@ -1,8 +1,8 @@
 export default function ansiRegex({onlyFirst = false} = {}) {
 	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
+	    '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
 		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
 	].join('|');
 
 	return new RegExp(pattern, onlyFirst ? undefined : 'g');
 }

Vulnerable code: 		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
Fixed code: 	    '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
CVE-2023-33979: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive files are configured to be off-limits, sensitive information files in some working directories can be read through the `/file` route, leading to sensitive information leakage. This affects users that uses file configurations via `config.py`, `config_private.py`, `Dockerfile`. A patch is available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a workaround, one may use environment variables instead of `config*.py` files to configure this project, or use docker-compose installation to configure this project.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 6.5
Published: 2023-05-31T19:15Z
Repository: https://github.com/binary-husky/gpt_academic
Language: Python
Files changed: main.py
Commit date: 2023-05-28 20:23:47 +0800
Commit message: 修复Gradio配置泄露的问题

Diff: diff --git a/main.py b/main.py
index 85b38e1..458f840 100644
--- a/main.py
+++ b/main.py
@@ -195,11 +195,13 @@ def main():
         threading.Thread(target=open, name="open-browser", daemon=True).start()
         threading.Thread(target=auto_update, name="self-upgrade", daemon=True).start()
         threading.Thread(target=warm_up_modules, name="warm-up", daemon=True).start()
 
     auto_opentab_delay()
-    demo.queue(concurrency_count=CONCURRENT_COUNT).launch(server_name="0.0.0.0", server_port=PORT, auth=AUTHENTICATION, favicon_path="docs/logo.png")
+    demo.queue(concurrency_count=CONCURRENT_COUNT).launch(
+        server_name="0.0.0.0", server_port=PORT, auth=AUTHENTICATION,
+        favicon_path="docs/logo.png", blocked_paths=["config.py","config_private.py","docker-compose.yml","Dockerfile"])
 
     # 如果需要在二级路径下运行
     # CUSTOM_PATH, = get_conf('CUSTOM_PATH')
     # if CUSTOM_PATH != "/": 
     #     from toolbox import run_gradio_in_subpath

Vulnerable code:     demo.queue(concurrency_count=CONCURRENT_COUNT).launch(server_name="0.0.0.0", server_port=PORT, auth=AUTHENTICATION, favicon_path="docs/logo.png")
Fixed code:     demo.queue(concurrency_count=CONCURRENT_COUNT).launch(
        server_name="0.0.0.0", server_port=PORT, auth=AUTHENTICATION,
        favicon_path="docs/logo.png", blocked_paths=["config.py","config_private.py","docker-compose.yml","Dockerfile"])
CVE-2022-3152: Improper Authentication (CWE-287)
value: Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.8
Published: 2022-09-07T15:15Z
Repository: https://github.com/phpfusion/phpfusion
Language: PHP
Files changed: includes/classes/PHPFusion/UserFieldsInput.php
Commit date: 2022-08-19 15:16:46 +0800
Commit message: Security fixes

Signed-off-by: deviance <meangczac.chan@gmail.com>

Diff: diff --git a/includes/classes/PHPFusion/UserFieldsInput.php b/includes/classes/PHPFusion/UserFieldsInput.php
index 4cdd79e1c..f956c88bd 100644
--- a/includes/classes/PHPFusion/UserFieldsInput.php
+++ b/includes/classes/PHPFusion/UserFieldsInput.php
@@ -664,19 +664,16 @@ class UserFieldsInput {
 
         $this->data = $this->getData();
 
         // hidden input tamper check - user_hash must not be changed.
         // id request spoofing request
-        $a_check = ($this->userData["user_password"] != sanitizer("user_hash", "", "user_hash"));
-        $b_check = ($this->userData['user_id'] != fusion_get_userdata('user_id'));
-        // for admin with sufficient rights, skip all these formats
-        if (iADMIN && checkrights("M")) {
-            $a_check = FALSE;
-            $b_check = FALSE;
-        }
-        if ($a_check or $b_check) {
-            fusion_stop();
+        if (!(iADMIN && checkrights('M')) ||
+            ($this->userData['user_password'] != sanitizer("user_hash", "", "user_hash")) ||
+            ($this->data['user_id'] != fusion_get_userdata('user_id'))) {
+            fusion_stop($locale['error_request']);
+
+            return FALSE;
         }
 
         // check for password match
         if (fusion_safe()) {
 

Vulnerable code:         $a_check = ($this->userData["user_password"] != sanitizer("user_hash", "", "user_hash"));
        $b_check = ($this->userData['user_id'] != fusion_get_userdata('user_id'));
        // for admin with sufficient rights, skip all these formats
        if (iADMIN && checkrights("M")) {
            $a_check = FALSE;
            $b_check = FALSE;
        }
        if ($a_check or $b_check) {
            fusion_stop();
Fixed code:         if (!(iADMIN && checkrights('M')) ||
            ($this->userData['user_password'] != sanitizer("user_hash", "", "user_hash")) ||
            ($this->data['user_id'] != fusion_get_userdata('user_id'))) {
            fusion_stop($locale['error_request']);

            return FALSE;
CVE-2020-36618: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-12-19T14:15Z
Repository: https://github.com/FurqanSoftware/node-whois
Language: Other
Files changed: index.coffee
Commit date: 2021-08-29 23:44:44 +0600
Commit message: fix(vulnerability): Prototype Pollution Vulnerability (#105)

* fix: prevent prototype injection/derivatives bugs

* fix: indent

* fix: indent
Diff: diff --git a/index.coffee b/index.coffee
index 0e1fc30..855f44e 100644
--- a/index.coffee
+++ b/index.coffee
@@ -12,10 +12,14 @@ cleanParsingErrors = (string) =>
 
 @lookup = (addr, options, done) =>
 	if typeof done is 'undefined' and typeof options is 'function'
 		done = options
 		options = {}
+		
+      if addr == '__proto__'
+              done new Error 'lookup: __proto__ is not allowed to lookup'
+		return
 
 	_.defaults options,
 		follow: 2
 		timeout: 60000 # 60 seconds in ms
 

Fixed code: 		
      if addr == '__proto__'
              done new Error 'lookup: __proto__ is not allowed to lookup'
		return
CVE-2020-36560: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2022-12-27T22:15Z
Repository: https://github.com/artdarek/go-unzip
Language: Unknown
Commit date: 2020-03-08 08:20:38 +0100
Commit message: Merge pull request #2 from snoopysecurity/fix/santize-filename-paths

fix: sanitize filepath names
CVE-2022-4881: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in CapsAdmin PAC3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lua/pac3/core/shared/http.lua. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. The patch is identified as 8fc9e12dfa21d757be6eb4194c763e848b299ac0. It is recommended to apply a patch to fix this issue. VDB-217646 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-08T13:15Z
Repository: https://github.com/CapsAdmin/pac3
Language: Lua
Files changed: lua/pac3/core/shared/http.lua, lua/pac3/libraries/urltex.lua
Commit date: 2022-07-13 09:35:28 +0200
Commit message: Fix an HTML injection exploit (#1210)

* Improve FixURL

* Ensure number

* Simplify
Diff: diff --git a/lua/pac3/core/shared/http.lua b/lua/pac3/core/shared/http.lua
index bf85490e..d943d010 100644
--- a/lua/pac3/core/shared/http.lua
+++ b/lua/pac3/core/shared/http.lua
@@ -61,10 +61,11 @@ local function http(method, url, headers, cb, failcb)
 	})
 end
 
 function pac.FixUrl(url)
 	url = url:Trim()
+	url = url:gsub("[\"'<>\n\\]+", "")
 
 	if url:find("dropbox", 1, true) then
 		url = url:gsub([[^http%://dl%.dropboxusercontent%.com/]], [[https://dl.dropboxusercontent.com/]])
 		url = url:gsub([[^https?://dl.dropbox.com/]], [[https://www.dropbox.com/]])
 		url = url:gsub([[^https?://www.dropbox.com/s/(.+)%?dl%=[01]$]], [[https://dl.dropboxusercontent.com/s/%1]])
diff --git a/lua/pac3/libraries/urltex.lua b/lua/pac3/libraries/urltex.lua
index 403a9d5d..dda53ab3 100644
--- a/lua/pac3/libraries/urltex.lua
+++ b/lua/pac3/libraries/urltex.lua
@@ -112,11 +112,11 @@ function urltex.StartDownload(url, data)
 	if urltex.ActivePanel:IsValid() then
 		urltex.ActivePanel:Remove()
 	end
 
 	url = pac.FixUrl(url)
-	local size = data.size or urltex.TextureSize
+	local size = tonumber(data.size or urltex.TextureSize)
 	local id = "urltex_download_" .. url
 	local pnl
 	local frames_passed = 0
 
 	local function createDownloadPanel()
@@ -265,6 +265,6 @@ function urltex.StartDownload(url, data)
 	-- 5 sec max timeout, 5 maximal timeouts
 	timer.Create(id, 5, 5, onTimeout)
 	createDownloadPanel()
 end
 
-return urltex
\ No newline at end of file
+return urltex

Vulnerable code: 	local size = data.size or urltex.TextureSize
return urltex
Fixed code: 	url = url:gsub("[\"'<>\n\\]+", "")
	local size = tonumber(data.size or urltex.TextureSize)
return urltex
CVE-2021-36357: Incorrect Conversion between Numeric Types (CWE-681)
value: An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uint16_t "year" value, resulting in a type mismatch that can truncate a higher integer value to a smaller one, and bypass a timestamp check. The fix is to use the right endian conversion function.
CWE description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CVSS v3 base score: 9.8
Published: 2021-10-22T12:15Z
Repository: https://github.com/open-power/skiboot
Language: C
Files changed: libstb/secvar/backend/edk2-compat-process.c
Commit date: 2021-06-24 14:59:48 +0530
Commit message: secvar: fix endian conversion

unpack_timestamp() calls le32_to_cpu() for endian conversion of
uint16_t "year" value. This patch fixes the code to use le16_to_cpu().

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>

Diff: diff --git a/libstb/secvar/backend/edk2-compat-process.c b/libstb/secvar/backend/edk2-compat-process.c
index 244f2340..037c1b49 100644
--- a/libstb/secvar/backend/edk2-compat-process.c
+++ b/libstb/secvar/backend/edk2-compat-process.c
@@ -368,11 +368,11 @@ int update_timestamp(const char *key, const struct efi_time *timestamp, char *la
 }
 
 static uint64_t unpack_timestamp(const struct efi_time *timestamp)
 {
 	uint64_t val = 0;
-	uint16_t year = le32_to_cpu(timestamp->year);
+	uint16_t year = le16_to_cpu(timestamp->year);
 
 	/* pad1, nanosecond, timezone, daylight and pad2 are meant to be zero */
 	val |= ((uint64_t) timestamp->pad1 & 0xFF) << 0;
 	val |= ((uint64_t) timestamp->second & 0xFF) << (1*8);
 	val |= ((uint64_t) timestamp->minute & 0xFF) << (2*8);

Vulnerable code: 	uint16_t year = le32_to_cpu(timestamp->year);
Fixed code: 	uint16_t year = le16_to_cpu(timestamp->year);
CVE-2017-14498: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-09-15T18:29Z
Repository: https://github.com/silverstripe/silverstripe-installer
Language: Other
Files changed: assets/.htaccess
Commit date: 2017-05-25 13:18:13 +0100
Commit message: [SS-2017-017] FIX SVG uploads disabled by default

Diff: diff --git a/assets/.htaccess b/assets/.htaccess
index 38f1742..dd7381f 100644
--- a/assets/.htaccess
+++ b/assets/.htaccess
@@ -20,11 +20,11 @@
 # directory.
 #
 # Please note Apache 1.3 does not support regular expression case insensitive matches using PCRE style.
 #
 Deny from all
-<FilesMatch "\.(?i:html|htm|xhtml|js|css|bmp|png|gif|jpg|jpeg|ico|pcx|tif|tiff|au|mid|midi|mpa|mp3|ogg|m4a|ra|wma|wav|cda|avi|mpg|mpeg|asf|wmv|m4v|mov|mkv|mp4|ogv|webm|swf|flv|ram|rm|doc|docx|dotx|dotm|txt|rtf|xls|xlsx|xltx|xltm|pages|ppt|pptx|potx|potm|pps|csv|cab|arj|tar|zip|zipx|sit|sitx|svg|gz|tgz|bz2|ace|arc|pkg|dmg|hqx|jar|xml|pdf|gpx|kml)$">
+<FilesMatch "\.(?i:html|htm|xhtml|js|css|bmp|png|gif|jpg|jpeg|ico|pcx|tif|tiff|au|mid|midi|mpa|mp3|ogg|m4a|ra|wma|wav|cda|avi|mpg|mpeg|asf|wmv|m4v|mov|mkv|mp4|ogv|webm|swf|flv|ram|rm|doc|docx|dotx|dotm|txt|rtf|xls|xlsx|xltx|xltm|pages|ppt|pptx|potx|potm|pps|csv|cab|arj|tar|zip|zipx|sit|sitx|gz|tgz|bz2|ace|arc|pkg|dmg|hqx|jar|xml|pdf|gpx|kml)$">
 	Allow from all
 </FilesMatch>
 
 # We disable PHP via several methods
 # Replace the handler with the default plaintext handler

Vulnerable code: <FilesMatch "\.(?i:html|htm|xhtml|js|css|bmp|png|gif|jpg|jpeg|ico|pcx|tif|tiff|au|mid|midi|mpa|mp3|ogg|m4a|ra|wma|wav|cda|avi|mpg|mpeg|asf|wmv|m4v|mov|mkv|mp4|ogv|webm|swf|flv|ram|rm|doc|docx|dotx|dotm|txt|rtf|xls|xlsx|xltx|xltm|pages|ppt|pptx|potx|potm|pps|csv|cab|arj|tar|zip|zipx|sit|sitx|svg|gz|tgz|bz2|ace|arc|pkg|dmg|hqx|jar|xml|pdf|gpx|kml)$">
Fixed code: <FilesMatch "\.(?i:html|htm|xhtml|js|css|bmp|png|gif|jpg|jpeg|ico|pcx|tif|tiff|au|mid|midi|mpa|mp3|ogg|m4a|ra|wma|wav|cda|avi|mpg|mpeg|asf|wmv|m4v|mov|mkv|mp4|ogv|webm|swf|flv|ram|rm|doc|docx|dotx|dotm|txt|rtf|xls|xlsx|xltx|xltm|pages|ppt|pptx|potx|potm|pps|csv|cab|arj|tar|zip|zipx|sit|sitx|gz|tgz|bz2|ace|arc|pkg|dmg|hqx|jar|xml|pdf|gpx|kml)$">
CVE-2023-35849: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 7.5
Published: 2023-06-19T03:15Z
Repository: https://github.com/virtualsquare/picotcp
Language: C
Files changed: modules/pico_ipv4.c, modules/pico_tcp.c
Commit date: 2023-05-14 12:46:52 +0200
Commit message: More checks for correct header sizes

Reported-by: "P. Amsuo, Purdue University"

Diff: diff --git a/modules/pico_ipv4.c b/modules/pico_ipv4.c
index bdbaabad..ddbf029c 100644
--- a/modules/pico_ipv4.c
+++ b/modules/pico_ipv4.c
@@ -666,10 +666,15 @@ static int pico_ipv4_process_in(struct pico_stack *S, struct pico_protocol *self
     }
 
     f->transport_hdr = ((uint8_t *)f->net_hdr) + PICO_SIZE_IP4HDR + option_len;
     f->transport_len = (uint16_t)(short_be(hdr->len) - PICO_SIZE_IP4HDR - option_len);
     f->net_len = (uint16_t)(PICO_SIZE_IP4HDR + option_len);
+
+    if ((f->net_hdr + f->net_len) > (f->buffer + f->buffer_len)) {
+        pico_frame_discard(f);
+        return 0;
+    }
 #if defined(PICO_SUPPORT_IPV4FRAG) || defined(PICO_SUPPORT_IPV6FRAG)
     f->frag = short_be(hdr->frag);
 #endif
 
     if (f->transport_len > max_allowed) {
diff --git a/modules/pico_tcp.c b/modules/pico_tcp.c
index 53725be1..423d6966 100644
--- a/modules/pico_tcp.c
+++ b/modules/pico_tcp.c
@@ -866,10 +866,13 @@ static inline void tcp_parse_option_mss(struct pico_socket_tcp *t, uint8_t len,
 {
     uint16_t mss;
     if (tcpopt_len_check(idx, len, PICO_TCPOPTLEN_MSS) < 0)
         return;
 
+    if ((*idx + PICO_TCPOPTLEN_MSS) > len)
+        return;
+
     t->mss_ok = 1;
     mss = short_from(opt + *idx);
     *idx += (uint32_t)sizeof(uint16_t);
     if (t->mss > short_be(mss))
         t->mss = short_be(mss);
@@ -894,10 +897,14 @@ static int tcp_parse_options(struct pico_frame *f)
 {
     struct pico_socket_tcp *t = (struct pico_socket_tcp *)f->sock;
     uint8_t *opt = f->transport_hdr + PICO_SIZE_TCPHDR;
     uint32_t i = 0;
     f->timestamp = 0;
+
+    if (f->buffer + f->buffer_len > f->transport_hdr + f->transport_len)
+        return -1;
+
     while (i < (f->transport_len - PICO_SIZE_TCPHDR)) {
         uint8_t type =  opt[i++];
         uint8_t len;
         if(i < (f->transport_len - PICO_SIZE_TCPHDR) && (type > 1))
             len =  opt[i++];

Fixed code: 
    if ((f->net_hdr + f->net_len) > (f->buffer + f->buffer_len)) {
        pico_frame_discard(f);
        return 0;
    }
    if ((*idx + PICO_TCPOPTLEN_MSS) > len)
        return;


    if (f->buffer + f->buffer_len > f->transport_hdr + f->transport_len)
        return -1;
CVE-2022-32074: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-07-13T16:15Z
Repository: https://github.com/osTicket/osTicket-plugins
Language: Unknown
Commit date: 2022-05-19 11:28:14 -0500
Commit message: Merge pull request #229 from JediKev/security/latest-security-patches-05-2022

Reviewed-By: JediKev <kevin@enhancesoft.com>, aydreeihn <adriane@enhancesoft.com>
CVE-2023-3580: Other (NVD-CWE-Other)
value: Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 4.3
Published: 2023-07-10T16:15Z
Repository: https://github.com/squidex/squidex
Language: YAML
Files changed: .github/workflows/release.yml
Commit date: 2023-02-01 12:35:17 +0100
Commit message: Fix build.

Diff: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 18c60903d8..eb165e872a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -97,11 +97,11 @@ jobs:
           split-by: "."
 
       - name: Publish - Check Tag
         id: normal-version
         run: |
-          if [[ ${{ env.GITHUB_REF_SLUG }} =~ ^[0-9]+\.[0-9]+$ ]]; then
+          if [[ ${{ env.GITHUB_REF_SLUG }} =~ ^[0-9]+\.[0-9]+(\.[0-9]+){0,2}$ ]]; then
               echo "STABLE_VERSION=true" >> $GITHUB_ENV
           fi
 
       - name: Publish - Login to Docker Hub
         uses: docker/login-action@v2.1.0
@@ -115,17 +115,17 @@ jobs:
           docker tag squidex-local squidex/squidex:${{ env.GITHUB_REF_SLUG }}
           docker tag squidex-local squidex/squidex:${{ steps.version.outputs._0 }}
     
       - name: Publish - Push Tags
         run: |
-          docker tag squidex-local squidex/squidex:${{ env.GITHUB_REF_SLUG }}
-          docker tag squidex-local squidex/squidex:${{ steps.version.outputs._0 }}
+          docker push squidex/squidex:${{ env.GITHUB_REF_SLUG }}
+          docker push squidex/squidex:${{ steps.version.outputs._0 }}
     
-      - name: Publish - Push Latest
+      - name: Publish - Push Tags Latest
         if: env.STABLE_VERSION == 'true'
         run: |
-          docker tag squidex-local squidex/squidex:latest
+          docker push squidex/squidex:latest
 
       - name: Release - Make directories
         run: sudo mkdir /build /release
 
       - name: Release - Create container

Vulnerable code:           if [[ ${{ env.GITHUB_REF_SLUG }} =~ ^[0-9]+\.[0-9]+$ ]]; then
          docker tag squidex-local squidex/squidex:${{ env.GITHUB_REF_SLUG }}
          docker tag squidex-local squidex/squidex:${{ steps.version.outputs._0 }}
      - name: Publish - Push Latest
          docker tag squidex-local squidex/squidex:latest
Fixed code:           if [[ ${{ env.GITHUB_REF_SLUG }} =~ ^[0-9]+\.[0-9]+(\.[0-9]+){0,2}$ ]]; then
          docker push squidex/squidex:${{ env.GITHUB_REF_SLUG }}
          docker push squidex/squidex:${{ steps.version.outputs._0 }}
      - name: Publish - Push Tags Latest
          docker push squidex/squidex:latest
CVE-2020-26263: Inadequate Encryption Strength (CWE-326)
value: tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant. In particular, the code has multiple ways in which it leaks information about the decrypted ciphertext. It aborts as soon as the plaintext doesn't start with 0x00, 0x02. All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable. This is patched in versions 0.7.6 and 0.8.0-alpha39. Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not the case (see reference). As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the security policy of tlslite-ng.
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 7.5
Published: 2020-12-21T17:15Z
Repository: https://github.com/tlsfuzzer/tlslite-ng
Language: Unknown
Commit date: 2020-12-08 12:20:32 +0100
Commit message: Merge pull request #439 from tlsfuzzer/bleichenbacher-fixes-0.7

Bleichenbacher fixes [0.7]
CVE-2020-5291: Improper Privilege Management (CWE-269)
value: Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as root while being traceable. This can in turn be used to gain root permissions. Note that this only affects the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not default) This has been fixed in the 0.4.1 release, and all affected users should update.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.8
Published: 2020-03-31T18:15Z
Repository: https://github.com/containers/bubblewrap
Language: Unknown
Commit date: 2020-03-30 15:08:41 +0200
Commit message: Merge pull request from GHSA-j2qp-rvxj-43vj

Fix setuid vulnerability
CVE-2021-3690: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2022-08-23T16:15Z
Repository: https://github.com/undertow-io/undertow
Language: Java
Files changed: websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
Commit date: 2021-07-31 00:26:57 +0300
Commit message: [UNDERTOW-1935] - buffer leak on incoming websocket PONG message

Diff: diff --git a/websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java b/websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
index 12ae5bb38..a93822587 100644
--- a/websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
+++ b/websockets-jsr/src/main/java/io/undertow/websockets/jsr/FrameHandler.java
@@ -150,10 +150,12 @@ class FrameHandler extends AbstractReceiveListener {
                     } finally {
                         pooled.close();
                     }
                 }
             });
+        } else {
+            bufferedBinaryMessage.getData().free();
         }
     }
 
     @Override
     protected void onText(WebSocketChannel webSocketChannel, StreamSourceFrameChannel messageChannel) throws IOException {

Fixed code:         } else {
            bufferedBinaryMessage.getData().free();
CVE-2022-1319: Unchecked Return Value (CWE-252)
value: A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.
CWE description: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CVSS v3 base score: 7.5
Published: 2022-08-31T16:15Z
Repository: https://github.com/undertow-io/undertow
Language: Unknown
Commit date: 2022-06-13 13:23:50 +0200
Commit message: Merge pull request #1331 from fl4via/UNDERTOW-2060

[UNDERTOW-2060] fix double AJP response
CVE-2024-23341: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using `tuitse_html` without quoting the input, there is a html injection vulnerability. Version 1.3.2 contains a patch for the issue. As a workaround, sanitize Taigi input with HTML quotation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-01-23T18:15Z
Repository: https://github.com/i3thuan5/TuiTse-TsuSin
Language: Unknown
Commit date: 2024-01-16 09:45:16 +0800
Commit message: Merge pull request #22 from i3thuan5/siu-tua-kuaho

處理大括號錯誤
CVE-2018-15601: Improper Input Validation (CWE-20)
value: apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-08-21T02:29Z
Repository: https://github.com/jbroadway/elefant
Language: PHP
Files changed: apps/filemanager/handlers/upload/drop.php
Commit date: 2018-08-20 15:27:52 -0500
Commit message: Decode file names before restricting extensions

Diff: diff --git a/apps/filemanager/handlers/upload/drop.php b/apps/filemanager/handlers/upload/drop.php
index 8a8bd175..df76f119 100644
--- a/apps/filemanager/handlers/upload/drop.php
+++ b/apps/filemanager/handlers/upload/drop.php
@@ -35,18 +35,18 @@ if (isset ($_FILES['file']['error']) && $_FILES['file']['error'] > 0) {
 	);
 	echo json_encode (array ('success' => false, 'error' => $errors[$_FILES['file']['error']]));
 	return;
 }
 
+// some browsers may urlencode the file name
+$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
+
 if (preg_match ('/\.(php5?|phtml|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'])) {
 	echo json_encode (array ('success' => false, 'error' => __ ('Cannot upload executable files due to security.')));
 	return;
 }
 
-// some browsers may urlencode the file name
-$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
-
 if (@file_exists ($root . $_POST['path'] . '/' . $_FILES['file']['name'])) {
 	echo json_encode (array ('success' => false, 'error' => __ ('A file by that name already exists.')));
 	return;
 }
 if (strpos ($_FILES['file']['name'], '..') !== false) {

Vulnerable code: // some browsers may urlencode the file name
$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);

Fixed code: // some browsers may urlencode the file name
$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
CVE-2018-16975: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input validation in apps/designer/handlers/csspreview.php.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2018-09-12T21:29Z
Repository: https://github.com/jbroadway/elefant
Language: PHP
Files changed: apps/designer/handlers/csspreview.php
Commit date: 2018-09-11 02:14:22 -0500
Commit message: Fixed CSS preview including PHP tags, re: #286

Diff: diff --git a/apps/designer/handlers/csspreview.php b/apps/designer/handlers/csspreview.php
index 7e7e0a31..a9d407c6 100644
--- a/apps/designer/handlers/csspreview.php
+++ b/apps/designer/handlers/csspreview.php
@@ -21,11 +21,11 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
 				$page->layout = file_get_contents ('layouts/' . $_GET['layout'] . '/' . $_GET['layout'] . '.html');
 			}
 		}
 	}
 	if ($_GET['css'] && preg_match ('/^(layouts|css)\/[a-z0-9\/ _-]+\.css$/i', $_GET['css'])) {
-		$page->layout = str_replace ('</head>', '<style>' . file_get_contents ($_GET['css']) . '</style></head>', $page->layout);
+		$page->layout = str_replace ('</head>', '<style>' . strip_tags (file_get_contents ($_GET['css'])) . '</style></head>', $page->layout);
 	}
 } else {
 	if (! empty ($_POST['layout'])) {
 		if (strpos ($_POST['layout'], '..') === false) {
 			if (file_exists ('layouts/' . $_POST['layout'] . '.html')) {
@@ -34,11 +34,11 @@ if ($_SERVER['REQUEST_METHOD'] == 'GET') {
 				$page->layout = file_get_contents ('layouts/' . $_POST['layout'] . '/' . $_POST['layout'] . '.html');
 			}
 		}
 	}
 	if ($_POST['css']) {
-		$page->layout = str_replace ('</head>', '<style>' . $_POST['css'] . '</style></head>', $page->layout);
+		$page->layout = str_replace ('</head>', '<style>' . strip_tags ($_POST['css']) . '</style></head>', $page->layout);
 	}	
 }
 
 if ($page->layout === false) {
 	$page->layout = conf ('General', 'default_layout');

Vulnerable code: 		$page->layout = str_replace ('</head>', '<style>' . file_get_contents ($_GET['css']) . '</style></head>', $page->layout);
		$page->layout = str_replace ('</head>', '<style>' . $_POST['css'] . '</style></head>', $page->layout);
Fixed code: 		$page->layout = str_replace ('</head>', '<style>' . strip_tags (file_get_contents ($_GET['css'])) . '</style></head>', $page->layout);
		$page->layout = str_replace ('</head>', '<style>' . strip_tags ($_POST['css']) . '</style></head>', $page->layout);
CVE-2017-8342: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVSS v3 base score: 8.1
Published: 2017-04-30T15:59Z
Repository: https://github.com/Kozea/Radicale
Language: Python
Files changed: radicale/auth.py
Commit date: 2017-04-19 13:48:30 +0200
Commit message: Random timer to avoid timing oracles and simple bruteforce attacks

Important note: this is a security fix.

Diff: diff --git a/radicale/auth.py b/radicale/auth.py
index 2fa2807..8ae493a 100644
--- a/radicale/auth.py
+++ b/radicale/auth.py
@@ -55,10 +55,12 @@ following significantly more secure schemes are parsable by Radicale:
 
 import base64
 import functools
 import hashlib
 import os
+import random
+import time
 from importlib import import_module
 
 
 def load(configuration, logger):
     """Load the authentication manager chosen in configuration."""
@@ -190,8 +192,10 @@ class Auth(BaseAuth):
         with open(self.filename) as fd:
             for line in fd:
                 line = line.strip()
                 if line:
                     login, hash_value = line.split(":")
-                    if login == user:
-                        return self.verify(hash_value, password)
+                    if login == user and self.verify(hash_value, password):
+                        return True
+        # Random timer to avoid timing oracles and simple bruteforce attacks
+        time.sleep(1 + random.random())
         return False

Vulnerable code:                     if login == user:
                        return self.verify(hash_value, password)
Fixed code: import random
import time
                    if login == user and self.verify(hash_value, password):
                        return True
        # Random timer to avoid timing oracles and simple bruteforce attacks
        time.sleep(1 + random.random())