Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-5934: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-10-15T19:29Z
Repository: https://github.com/moinwiki/moin-1.9
Language: Python
Files changed: MoinMoin/action/fckdialog.py, docs/CHANGES
Commit date: 2018-09-09 19:57:01 +0200
Commit message: security fix for CVE-2017-5934, XSS in GUI editor related code

Thanks to Nitin Venkatesh for discovering and reporting this!

Diff: diff --git a/MoinMoin/action/fckdialog.py b/MoinMoin/action/fckdialog.py
index b86a6a86..e078b7c3 100644
--- a/MoinMoin/action/fckdialog.py
+++ b/MoinMoin/action/fckdialog.py
@@ -201,10 +201,11 @@ def page_list(request):
 ''' % "".join(["<option>%s</option>\n" % wikiutil.escape(p) for p in pages]))
 
 def link_dialog(request):
     # list of wiki pages
     name = request.values.get("pagename", "")
+    name_escaped = wikiutil.escape(name)
     if name:
         from MoinMoin import search
         # XXX error handling!
         searchresult = search.searchPages(request, 't:"%s"' % name)
 
@@ -297,11 +298,11 @@ def link_dialog(request):
        <input type="hidden" id="basepage" name="basepage" value="%(basepage)s">
        <table cellSpacing="0" cellPadding="0" align="center" border="0">
         <tr>
          <td>
           <span fckLang="PageDlgName">Page Name</span><br>
-          <input id="txtPagename" name="pagename" size="30" value="%(name)s">
+          <input id="txtPagename" name="pagename" size="30" value="%(name_escaped)s">
          </td>
          <td valign="bottom">
            <input id=btnSearchpage type="submit" value="Search">
          </td>
         </tr>
diff --git a/docs/CHANGES b/docs/CHANGES
index f6f06388..011e1012 100644
--- a/docs/CHANGES
+++ b/docs/CHANGES
@@ -21,10 +21,11 @@ Version 1.9.10 aka "the end of spam release" (not released yet)
   HINT: please read the changelog below carefully before upgrading to 1.9.10.
         This release has some fundamental changes you (and your wiki users)
         should be aware of beforehands.
 
   Fixes:
+  * security fix for CVE-2017-5934, XSS in GUI editor related code
   * fix wrong digestmod of hmac.new calls (incorporate 1.9.9 patch)
   * fix broken table attribute processing (wikiutil.escape)
   * fix AttributeError in multifile action
   * read text attachments using universal newlines (including \r line seps)
   * anywikidraw / twikidraw: check write permissions early

Vulnerable code:           <input id="txtPagename" name="pagename" size="30" value="%(name)s">
Fixed code:     name_escaped = wikiutil.escape(name)
          <input id="txtPagename" name="pagename" size="30" value="%(name_escaped)s">
  * security fix for CVE-2017-5934, XSS in GUI editor related code
CVE-2020-15275: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-11-11T16:15Z
Repository: https://github.com/moinwiki/moin-1.9
Language: Unknown
Commit date: 2020-11-08 17:19:20 +0100
Commit message: Merge pull request from GHSA-4q96-6xhq-ff43

security: fix stored XSS vulnerability via SVG attachment
CVE-2022-36086: Improper Validation of Specified Quantity in Input (CWE-1284)
value: linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::<usize>` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::<usize>` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::<usize>()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::<usize>()`.
CWE description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CVSS v3 base score: 9.8
Published: 2022-09-07T23:15Z
Repository: https://github.com/rust-osdev/linked-list-allocator
Language: Unknown
Commit date: 2022-09-06 21:08:19 +0200
Commit message: Merge pull request from GHSA-xg8p-34w2-j49j

Infallible extend
CVE-2017-5537: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2017-03-15T15:59Z
Repository: https://github.com/WeblateOrg/weblate
Language: Python
Files changed: weblate/accounts/tests/test_registration.py, weblate/accounts/views.py
Commit date: 2017-01-17 22:34:21 +0100
Commit message: Do not show validation error on password reset

This can leak information whether account exists or not.

Fixes #1317

Signed-off-by: Michal Čihař <michal@cihar.com>

Diff: diff --git a/weblate/accounts/tests/test_registration.py b/weblate/accounts/tests/test_registration.py
index d4b86e88f..d9a77e74d 100644
--- a/weblate/accounts/tests/test_registration.py
+++ b/weblate/accounts/tests/test_registration.py
@@ -208,10 +208,27 @@ class RegistrationTest(TestCase, RegistrationTestMixin):
         )
         self.assertRedirects(response, reverse('email-sent'))
 
         self.assert_registration('[Weblate] Password reset on Weblate')
 
+    def test_reset_nonexisting(self):
+        '''
+        Test for password reset.
+        '''
+        response = self.client.get(
+            reverse('password_reset'),
+        )
+        self.assertContains(response, 'Reset my password')
+        response = self.client.post(
+            reverse('password_reset'),
+            {
+                'email': 'test@example.com'
+            }
+        )
+        self.assertRedirects(response, reverse('email-sent'))
+        self.assertEqual(len(mail.outbox), 0)
+
     def test_reset_twice(self):
         '''
         Test for password reset.
         '''
         User.objects.create_user('testuser', 'test@example.com', 'x')
diff --git a/weblate/accounts/views.py b/weblate/accounts/views.py
index dbe5814da..91e0be5ed 100644
--- a/weblate/accounts/views.py
+++ b/weblate/accounts/views.py
@@ -570,10 +570,12 @@ def reset_password(request):
             if request.user.is_authenticated():
                 logout(request)
 
             request.session['password_reset'] = True
             return complete(request, 'email')
+        else:
+            return redirect('email-sent')
     else:
         form = ResetForm()
 
     return render(
         request,

Fixed code:     def test_reset_nonexisting(self):
        '''
        Test for password reset.
        '''
        response = self.client.get(
            reverse('password_reset'),
        )
        self.assertContains(response, 'Reset my password')
        response = self.client.post(
            reverse('password_reset'),
            {
                'email': 'test@example.com'
            }
        )
        self.assertRedirects(response, reverse('email-sent'))
        self.assertEqual(len(mail.outbox), 0)

        else:
            return redirect('email-sent')
CVE-2021-3906: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 6.5
Published: 2021-10-27T22:15Z
Repository: https://github.com/bookstackapp/bookstack
Language: PHP
Files changed: app/Uploads/ImageRepo.php
Commit date: 2021-10-26 09:39:16 +0800
Commit message: Update ImageRepo.php

fix image validation vulnerability
Diff: diff --git a/app/Uploads/ImageRepo.php b/app/Uploads/ImageRepo.php
index c4205e357..e76a0a97d 100644
--- a/app/Uploads/ImageRepo.php
+++ b/app/Uploads/ImageRepo.php
@@ -36,11 +36,11 @@ class ImageRepo
     /**
      * Check if the given image extension is supported by BookStack.
      */
     public function imageExtensionSupported(string $extension): bool
     {
-        return in_array(trim($extension, '. \t\n\r\0\x0B'), static::$supportedExtensions);
+        return in_array(trim($extension, ". \t\n\r\0\x0B"), static::$supportedExtensions);
     }
 
     /**
      * Get an image with the given id.
      */

Vulnerable code:         return in_array(trim($extension, '. \t\n\r\0\x0B'), static::$supportedExtensions);
Fixed code:         return in_array(trim($extension, ". \t\n\r\0\x0B"), static::$supportedExtensions);
CVE-2021-4194: Incorrect Authorization (CWE-863)
value: bookstack is vulnerable to Improper Access Control
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2022-01-06T18:15Z
Repository: https://github.com/bookstackapp/bookstack
Language: Unknown
Commit date: 2022-01-06 12:03:15 +0000
Commit message: Merge branch 'sort_changes'

Related to #3134
CVE-2024-33883: Insufficient Information (NVD-CWE-noinfo)
value: The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-28T16:15Z
Repository: https://github.com/mde/ejs
Language: JavaScript
Files changed: lib/ejs.js, lib/utils.js
Commit date: 2024-04-12 08:06:40 -0700
Commit message: Basic pollution protection

Diff: diff --git a/lib/ejs.js b/lib/ejs.js
index 65590eae..1153b53f 100755
--- a/lib/ejs.js
+++ b/lib/ejs.js
@@ -504,12 +504,12 @@ exports.Template = Template;
 
 exports.clearCache = function () {
   exports.cache.reset();
 };
 
-function Template(text, opts) {
-  opts = opts || utils.createNullProtoObjWherePossible();
+function Template(text, optsParam) {
+  var opts = utils.hasOwnOnlyObject(optsParam);
   var options = utils.createNullProtoObjWherePossible();
   this.templateText = text;
   /** @type {string | null} */
   this.mode = null;
   this.truncate = false;
@@ -947,5 +947,6 @@ exports.name = _NAME;
 
 /* istanbul ignore if */
 if (typeof window != 'undefined') {
   window.ejs = exports;
 }
+
diff --git a/lib/utils.js b/lib/utils.js
index a0434d58..396edb36 100644
--- a/lib/utils.js
+++ b/lib/utils.js
@@ -236,6 +236,15 @@ exports.createNullProtoObjWherePossible = (function () {
   return function () {
     return {};
   };
 })();
 
+exports.hasOwnOnlyObject = function (obj) {
+  var o = exports.createNullProtoObjWherePossible();
+  for (var p in obj) {
+    if (hasOwn(obj, p)) {
+      o[p] = obj[p];
+    }
+  }
+  return o;
+};
 

Vulnerable code: function Template(text, opts) {
  opts = opts || utils.createNullProtoObjWherePossible();
Fixed code: function Template(text, optsParam) {
  var opts = utils.hasOwnOnlyObject(optsParam);

exports.hasOwnOnlyObject = function (obj) {
  var o = exports.createNullProtoObjWherePossible();
  for (var p in obj) {
    if (hasOwn(obj, p)) {
      o[p] = obj[p];
    }
  }
  return o;
};
CVE-2020-10235: Improper Encoding or Escaping of Output (CWE-116)
value: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 8.8
Published: 2020-03-09T16:15Z
Repository: https://github.com/Froxlor/Froxlor
Language: PHP
Files changed: install/lib/class.FroxlorInstall.php
Commit date: 2020-03-04 19:35:57 +0100
Commit message: secure shell-execution of mysqldump on installation if given database-name exists

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/install/lib/class.FroxlorInstall.php b/install/lib/class.FroxlorInstall.php
index 11a16bfb8..dc67120f5 100644
--- a/install/lib/class.FroxlorInstall.php
+++ b/install/lib/class.FroxlorInstall.php
@@ -733,11 +733,11 @@ class FroxlorInstall
 				$do_backup = true;
 				$mysql_dump = '/usr/local/bin/mysqldump';
 			}
 
 			if ($do_backup) {
-				$command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
+				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
 				$output = exec($command);
 				if (stristr($output, "error")) {
 					$content .= $this->_status_message('red', $this->_lng['install']['backup_failed']);
 				} else {
 					$content .= $this->_status_message('green', 'OK (' . $filename . ')');

Vulnerable code: 				$command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
Fixed code: 				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
CVE-2020-10235: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: An issue was discovered in Froxlor before 0.10.14. Remote attackers with access to the installation routine could have executed arbitrary code via the database configuration options that were passed unescaped to exec, because of _backupExistingDatabase in install/lib/class.FroxlorInstall.php.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-03-09T16:15Z
Repository: https://github.com/Froxlor/Froxlor
Language: PHP
Files changed: install/lib/class.FroxlorInstall.php
Commit date: 2020-03-04 19:35:57 +0100
Commit message: secure shell-execution of mysqldump on installation if given database-name exists

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/install/lib/class.FroxlorInstall.php b/install/lib/class.FroxlorInstall.php
index 11a16bfb8..dc67120f5 100644
--- a/install/lib/class.FroxlorInstall.php
+++ b/install/lib/class.FroxlorInstall.php
@@ -733,11 +733,11 @@ class FroxlorInstall
 				$do_backup = true;
 				$mysql_dump = '/usr/local/bin/mysqldump';
 			}
 
 			if ($do_backup) {
-				$command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
+				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
 				$output = exec($command);
 				if (stristr($output, "error")) {
 					$content .= $this->_status_message('red', $this->_lng['install']['backup_failed']);
 				} else {
 					$content .= $this->_status_message('green', 'OK (' . $filename . ')');

Vulnerable code: 				$command = $mysql_dump . " " . $this->_data['mysql_database'] . " -u " . $this->_data['mysql_root_user'] . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
Fixed code: 				$command = $mysql_dump . " " . escapeshellarg($this->_data['mysql_database']) . " -u " . escapeshellarg($this->_data['mysql_root_user']) . " --password='" . $this->_data['mysql_root_pass'] . "' --result-file=" . $filename;
CVE-2021-42325: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2021-10-12T20:15Z
Repository: https://github.com/Froxlor/Froxlor
Language: PHP
Files changed: lib/Froxlor/Database/Manager/DbManagerMySQL.php
Commit date: 2021-10-11 18:33:48 +0200
Commit message: use prepared statement for creating databases to avoid sql injections in custom db-names

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/lib/Froxlor/Database/Manager/DbManagerMySQL.php b/lib/Froxlor/Database/Manager/DbManagerMySQL.php
index bf2f01ca8..70b6eee4f 100644
--- a/lib/Froxlor/Database/Manager/DbManagerMySQL.php
+++ b/lib/Froxlor/Database/Manager/DbManagerMySQL.php
@@ -58,11 +58,14 @@ class DbManagerMySQL
 	 *
 	 * @param string $dbname
 	 */
 	public function createDatabase($dbname = null)
 	{
-		Database::query("CREATE DATABASE `" . $dbname . "`");
+		$stmt = Database::prepare("CREATE DATABASE :dbname");
+		Database::pexecute($stmt, [
+			'dbname' => $dbname
+		]);
 	}
 
 	/**
 	 * grants access privileges on a database with the same
 	 * username and sets the password for that user the given access_host

Vulnerable code: 		Database::query("CREATE DATABASE `" . $dbname . "`");
Fixed code: 		$stmt = Database::prepare("CREATE DATABASE :dbname");
		Database::pexecute($stmt, [
			'dbname' => $dbname
		]);
CVE-2022-24753: Insufficient Information (NVD-CWE-noinfo)
value: Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7
Published: 2022-03-09T23:15Z
Repository: https://github.com/stripe/stripe-cli
Language: Go
Files changed: pkg/config/config.go, pkg/open/open.go
Commit date: 2022-02-16 13:56:25 -0800
Commit message: replace exec package (#820)


Diff: diff --git a/pkg/config/config.go b/pkg/config/config.go
index f4b7527..11fcb14 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -3,16 +3,17 @@ package config
 import (
 	"bytes"
 	"fmt"
 	"io/ioutil"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"time"
 
+	exec "golang.org/x/sys/execabs"
+
 	"github.com/BurntSushi/toml"
 	"github.com/mitchellh/go-homedir"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/viper"
 	prefixed "github.com/x-cray/logrus-prefixed-formatter"
diff --git a/pkg/open/open.go b/pkg/open/open.go
index e1e7065..9f3ce12 100644
--- a/pkg/open/open.go
+++ b/pkg/open/open.go
@@ -1,11 +1,12 @@
 package open
 
 import (
 	"fmt"
-	"os/exec"
 	"runtime"
+
+	exec "golang.org/x/sys/execabs"
 )
 
 var execCommand = exec.Command
 
 // Browser takes a url and opens it using the default browser on the operating system

Vulnerable code: 	"os/exec"
	"os/exec"
Fixed code: 	exec "golang.org/x/sys/execabs"


	exec "golang.org/x/sys/execabs"
CVE-2017-14061: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2017-08-31T16:29Z
Repository: https://gitlab.com/libidn/libidn2
Language: C
Files changed: lib/bidi.c
Commit date: 2017-08-01 11:15:10 +0200
Commit message: lib/bidi: Fix integer overflow (found by fuzzing)

Diff: diff --git a/lib/bidi.c b/lib/bidi.c
index 7582981..47b6ff0 100644
--- a/lib/bidi.c
+++ b/lib/bidi.c
@@ -28,20 +28,21 @@
 
 #include <config.h>
 
 #include "idn2.h"
 
+#include <sys/types.h>
 #include <stdbool.h>
 
 #include "bidi.h"
 
 #include <unictype.h>
 
 static bool
 _isBidi (const uint32_t *label, size_t llen)
 {
-  while (llen-- > 0) {
+  for (; (ssize_t) llen > 0; llen--) {
     int bc = uc_bidi_category (*label++);
 
     if (bc == UC_BIDI_R || bc == UC_BIDI_AL || bc == UC_BIDI_AN)
       return 1;
   }

Vulnerable code:   while (llen-- > 0) {
Fixed code: #include <sys/types.h>
  for (; (ssize_t) llen > 0; llen--) {
CVE-2017-14062: Integer Overflow or Wraparound (CWE-190)
value: Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2017-08-31T16:29Z
Repository: https://gitlab.com/libidn/libidn2
Language: C
Files changed: lib/puny_decode.c
Commit date: 2017-08-01 11:16:47 +0200
Commit message: lib/puny_decode: Fix integer overflow (found by fuzzing)

Diff: diff --git a/lib/puny_decode.c b/lib/puny_decode.c
index 3a1dd4f..7fb5305 100644
--- a/lib/puny_decode.c
+++ b/lib/puny_decode.c
@@ -91,14 +91,14 @@ enum { base = 36, tmin = 1, tmax = 26, skew = 38, damp = 700,
 
 /* decode_digit(cp) returns the numeric value of a basic code */
 /* point (for use in representing integers) in the range 0 to */
 /* base-1, or base if cp does not represent a value.          */
 
-static punycode_uint decode_digit(punycode_uint cp)
+static unsigned decode_digit(int cp)
 {
-  return  cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
-          cp - 97 < 26 ? cp - 97 :  base;
+  return (unsigned) (cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
+         cp - 97 < 26 ? cp - 97 :  base);
 }
 
 /*** Platform-specific constants ***/
 
 /* maxint is the maximum value of a punycode_uint variable: */

Vulnerable code: static punycode_uint decode_digit(punycode_uint cp)
  return  cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
          cp - 97 < 26 ? cp - 97 :  base;
Fixed code: static unsigned decode_digit(int cp)
  return (unsigned) (cp - 48 < 10 ? cp - 22 :  cp - 65 < 26 ? cp - 65 :
         cp - 97 < 26 ? cp - 97 :  base);
CVE-2019-12290: Improper Input Validation (CWE-20)
value: GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2019-10-22T16:15Z
Repository: https://gitlab.com/libidn/libidn2
Language: Other
Files changed: NEWS
Commit date: 2019-07-24 11:19:20 +0200
Commit message: Update NEWS for CVE-2019-12290

Diff: diff --git a/NEWS b/NEWS
index f5f6d6fe..46c3b3f8 100644
--- a/NEWS
+++ b/NEWS
@@ -1,10 +1,18 @@
 Libidn2 NEWS -- History of user-visible changes.                -*- outline -*-
 Copyright (C) 2011-2017 Simon Josefsson
 Copyright (C) 2018-2019 Tim Ruehsen
 See the end for copying conditions.
 
+* Version 2.x.x (unreleased)
+
+** Mitre has assigned CVE-2019-12290 which was fixed by
+   the roundtrip feature introduced in 2.2.0 (commit 241e8f48)
+
+** Update the data tables from Unicode 6.3.0 to Unicode 11.0
+
+
 * Version 2.2.0 (released 2019-05-23)
 
 ** Perform A-Label roundtrip for lookup functions by default
 
 ** Stricter check of input to punycode decoder

Fixed code: * Version 2.x.x (unreleased)

** Mitre has assigned CVE-2019-12290 which was fixed by
   the roundtrip feature introduced in 2.2.0 (commit 241e8f48)

** Update the data tables from Unicode 6.3.0 to Unicode 11.0
CVE-2014-125036: Other (NVD-CWE-Other)
value: A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as ed4ca2cf012677973c220cdba36b5c60bfa0260b. It is recommended to apply a patch to fix this issue. VDB-217190 is the identifier assigned to this vulnerability.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 4.3
Published: 2023-01-02T19:15Z
Repository: https://github.com/drybjed/ansible-ntp
Language: YAML
Files changed: meta/main.yml
Commit date: 2014-10-08 19:15:48 +0200
Commit message: Limit connections to ntp service in firewall

This should help mitigate potential NTP amplification attacks.

Diff: diff --git a/meta/main.yml b/meta/main.yml
index 77059de..f1f10a8 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -5,16 +5,23 @@ dependencies:
   - role: debops.ferm
     ferm_input_list:
 
       - type: 'dport_accept'
         dport: [ 'ntp' ]
+        protocol: [ 'tcp', 'udp' ]
         saddr: '{{ ntp_allow }}'
-        accept_any: True
         filename: 'ntp_dependency_accept'
         weight: '50'
         enabled: '{{ ntp_listen }}'
 
+      - type: 'dport_limit'
+        dport: [ 'ntp' ]
+        protocol: [ 'tcp', 'udp' ]
+        filename: 'ntp_dependency_limit'
+        weight: '50'
+        enabled: '{{ ntp_listen }}'
+
 galaxy_info:
   author: 'Maciej Delmanowski'
   description: 'Manage time synchronization, NTP server and timezone'
   company: 'DebOps'
   license: 'GNU General Public License v3'

Vulnerable code:         accept_any: True
Fixed code:         protocol: [ 'tcp', 'udp' ]
      - type: 'dport_limit'
        dport: [ 'ntp' ]
        protocol: [ 'tcp', 'udp' ]
        filename: 'ntp_dependency_limit'
        weight: '50'
        enabled: '{{ ntp_listen }}'
CVE-2022-24774: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2022-03-22T17:15Z
Repository: https://github.com/CycloneDX/cyclonedx-bom-repo-server
Language: Other
Files changed: semver.txt
Commit date: 2022-03-22 00:37:25 +0000
Commit message: Security release - remediation of CVE-2022-24774

Signed-off-by: Patrick Dwyer <patrick.dwyer@owasp.org>

Diff: diff --git a/semver.txt b/semver.txt
index 227cea2..38f77a6 100644
--- a/semver.txt
+++ b/semver.txt
@@ -1 +1 @@
-2.0.0
+2.0.1

Vulnerable code: 2.0.0
Fixed code: 2.0.1
CVE-2018-19837: Uncontrolled Resource Consumption (CWE-400)
value: In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 6.5
Published: 2018-12-04T09:29Z
Repository: https://github.com/sass/libsass
Language: C++
Files changed: src/parser.cpp
Commit date: 2018-07-03 20:05:57 +1000
Commit message: Remove legacy workaround for parsing modulo operator

Fixes #2659

Diff: diff --git a/src/parser.cpp b/src/parser.cpp
index ee51d56b..3053aaf4 100644
--- a/src/parser.cpp
+++ b/src/parser.cpp
@@ -1721,14 +1721,10 @@ namespace Sass {
     { return lexed_number(lexed); }
 
     if (lex< variable >())
     { return SASS_MEMORY_NEW(Variable, pstate, Util::normalize_underscores(lexed)); }
 
-    // Special case handling for `%` proceeding an interpolant.
-    if (lex< sequence< exactly<'%'>, optional< percentage > > >())
-    { return SASS_MEMORY_NEW(String_Constant, pstate, lexed); }
-
     css_error("Invalid CSS", " after ", ": expected expression (e.g. 1px, bold), was ");
 
     // unreachable statement
     return 0;
   }

Vulnerable code:     // Special case handling for `%` proceeding an interpolant.
    if (lex< sequence< exactly<'%'>, optional< percentage > > >())
    { return SASS_MEMORY_NEW(String_Constant, pstate, lexed); }
CVE-2023-41048: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-21T15:15Z
Repository: https://github.com/plone/plone.namedfile
Language: Unknown
Commit date: 2023-09-21 13:22:31 +0200
Commit message: Merge pull request from GHSA-jj7c-jrv4-c65x

Force download of image scales when inline is not allowed for mime type [master]
CVE-2020-15178: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The `message` field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.3
Published: 2020-09-15T18:15Z
Repository: https://github.com/PrestaShop/contactform
Language: PHP
Files changed: contactform.php
Commit date: 2020-09-15 10:03:00 +0200
Commit message: Merge pull request from GHSA-95hx-62rh-gg96

Do not unescape form message data
Diff: diff --cc contactform.php
index 4e3da74,3135a3f..2de421f
--- a/contactform.php
+++ b/contactform.php
@@@ -580,24 -581,17 +581,24 @@@ class Contactform extends Module implem
              if (!count($this->context->controller->errors)
                  && empty($mailAlreadySend)
                  && ($sendConfirmationEmail || $sendNotificationEmail)
              ) {
                  $var_list = [
 +                    '{firstname}' => '',
 +                    '{lastname}' => '',
                      '{order_name}' => '-',
                      '{attached_file}' => '-',
-                     '{message}' => Tools::nl2br(Tools::stripslashes($message)),
+                     '{message}' => Tools::nl2br(Tools::htmlentitiesUTF8(Tools::stripslashes($message))),
                      '{email}' =>  $from,
                      '{product_name}' => '',
                  ];
  
 +                if (isset($customer->id)) {
 +                    $var_list['{firstname}'] = $customer->firstname;
 +                    $var_list['{lastname}'] = $customer->lastname;
 +                }
 +
                  if (isset($file_attachment['name'])) {
                      $var_list['{attached_file}'] = $file_attachment['name'];
                  }
                  $id_product = (int)Tools::getValue('id_product');
  

Vulnerable code:                      '{message}' => Tools::nl2br(Tools::stripslashes($message)),
Fixed code:                      '{message}' => Tools::nl2br(Tools::htmlentitiesUTF8(Tools::stripslashes($message))),
CVE-2019-10260: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-28T17:29Z
Repository: https://github.com/totaljs/cms
Language: HTML
Files changed: themes/admin/views/index.html
Commit date: 2019-02-13 20:29:31 +0100
Commit message: Fixed XSS.

Diff: diff --git a/themes/admin/views/index.html b/themes/admin/views/index.html
index 45d9a0d..9b59d98 100755
--- a/themes/admin/views/index.html
+++ b/themes/admin/views/index.html
@@ -188,10 +188,14 @@
 				return;
 			}
 
 			var msg = '';
 			var t = common.notifications.template;
+
+			if (item.message)
+				item.message = Thelpers.encode(item.message);
+
 			switch (item.type) {
 
 				case 'navigation.save':
 					msg = t.format('@(Navigation has been saved)', item.message);
 					break;

Fixed code: 
			if (item.message)
				item.message = Thelpers.encode(item.message);
CVE-2019-10260: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-03-28T17:29Z
Repository: https://github.com/totaljs/cms
Language: JavaScript
Files changed: themes/admin/public/ui.js
Commit date: 2019-02-13 20:29:24 +0100
Commit message: Fixed XSS.

Diff: diff --git a/themes/admin/public/ui.js b/themes/admin/public/ui.js
index 2667788..a893966 100755
--- a/themes/admin/public/ui.js
+++ b/themes/admin/public/ui.js
@@ -557,11 +557,11 @@ COMPONENT('grid', 'filter:true;external:false;fillcount:50;filterlabel:Filtering
 		for (var i = 0, length = items.length; i < length; i++) {
 			builder.push('<tr class="ui-grid-row" data-index="' + i + '">');
 			for (var j = 0, jl = columns.length; j < jl; j++) {
 				var column = columns[j];
 				var val = items[i][column.name];
-				m.value = column.template ? column.template(items[i], column) : column.render ? column.render(val, column, items[i]) : val == null ? '' : (column.format ? val.format(column.format) : val);
+				m.value = column.template ? column.template(items[i], column) : column.render ? column.render(val, column, items[i]) : val == null ? '' : Thelpers.encode((column.format ? val.format(column.format) : val));
 				m.index = j;
 				m.align = column.align;
 				m.background = column.background;
 				builder.push(self.template(m, column));
 			}

Vulnerable code: 				m.value = column.template ? column.template(items[i], column) : column.render ? column.render(val, column, items[i]) : val == null ? '' : (column.format ? val.format(column.format) : val);
Fixed code: 				m.value = column.template ? column.template(items[i], column) : column.render ? column.render(val, column, items[i]) : val == null ? '' : Thelpers.encode((column.format ? val.format(column.format) : val));
CVE-2022-31072: Incorrect Default Permissions (CWE-276)
value: Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 3.3
Published: 2022-06-15T23:15Z
Repository: https://github.com/octokit/octokit.rb
Language: Unknown
Commit date: 2022-06-15 15:40:51 -0500
Commit message: Merge pull request #1446 from octokit/updates-release-steps-ic

Adds details on how to run a manual file integrity check
CVE-2024-2288: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Published: 2024-06-06T19:15Z
Repository: https://github.com/parisneo/lollms-webui
Language: Unknown
Commit date: 2024-03-07 13:20:08 +0100
Commit message: Merge pull request #506 from ParisNeo/ParisNeo-patch-3

Update README.md
CVE-2019-14857: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2019-11-26T12:15Z
Repository: https://github.com/zmartzone/mod_auth_openidc
Language: Other
Files changed: ChangeLog, configure.ac, src/mod_auth_openidc.c
Commit date: 2019-10-03 04:05:31 +0200
Commit message: 2.4.0.2 oops

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
Diff: diff --git a/ChangeLog b/ChangeLog
index 6c9c3c6..e2b020f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,8 @@
 10/02/2019
 - improve validation of the post-logout URL parameter on logout; thanks AIMOTO Norihito; closes #449
-- release 2.4.0.1
+- release 2.4.0.2
 
 08/28/2019
 - fixes #447 #441 : changed storing POST params from localStorage to
   sessionStorage due to some issue of losing data in localStorage in Firefox
   (private mode) 
diff --git a/configure.ac b/configure.ac
index 851f42e..8afab04 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
-AC_INIT([mod_auth_openidc],[2.4.0.1],[hans.zandbelt@zmartzone.eu])
+AC_INIT([mod_auth_openidc],[2.4.0.2],[hans.zandbelt@zmartzone.eu])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 
 # This section defines the --with-apxs2 option.
 AC_ARG_WITH(
diff --git a/src/mod_auth_openidc.c b/src/mod_auth_openidc.c
index 7d56eef..309a28c 100644
--- a/src/mod_auth_openidc.c
+++ b/src/mod_auth_openidc.c
@@ -3045,11 +3045,11 @@ static apr_byte_t oidc_validate_post_logout_url(request_rec *r, const char *url,
 				apr_psprintf(r->pool,
 						"logout value \"%s\" does not match the hostname of the current request \"%s\"",
 						apr_uri_unparse(r->pool, &uri, 0), c_host);
 		oidc_error(r, "%s: %s", *err_str, *err_desc);
 		return FALSE;
-	} else if (strstr(url, "/") != url) {
+	} else if ((uri.hostname == NULL) && (strstr(url, "/") != url)) {
 		*err_str = apr_pstrdup(r->pool, "Malformed URL");
 		*err_desc =
 				apr_psprintf(r->pool,
 						"No hostname was parsed and it does not seem to be relative, i.e starting with '/': %s",
 						url);

Vulnerable code: - release 2.4.0.1
AC_INIT([mod_auth_openidc],[2.4.0.1],[hans.zandbelt@zmartzone.eu])
	} else if (strstr(url, "/") != url) {
Fixed code: - release 2.4.0.2
AC_INIT([mod_auth_openidc],[2.4.0.2],[hans.zandbelt@zmartzone.eu])
	} else if ((uri.hostname == NULL) && (strstr(url, "/") != url)) {
CVE-2019-20479: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2020-02-20T06:15Z
Repository: https://github.com/zmartzone/mod_auth_openidc
Language: Unknown
Commit date: 2019-11-12 14:23:58 +0100
Commit message: Merge pull request #453 from oss-aimoto/fix_openredirect_starting_slash_backslash

Fix open redirect starting with a slash and backslash
CVE-2021-32785: Use of Externally-Controlled Format String (CWE-134)
value: mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CVSS v3 base score: 7.5
Published: 2021-07-22T22:15Z
Repository: https://github.com/zmartzone/mod_auth_openidc
Language: Unknown
Commit date: 2021-07-22 18:13:56 +0200
Commit message: Merge pull request from GHSA-55r8-6w97-xxr4

use redisvCommand to avoid crash with crafted key when using Redis wi…
CVE-2021-32786: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2021-07-22T22:15Z
Repository: https://github.com/zmartzone/mod_auth_openidc
Language: Unknown
Commit date: 2021-07-22 18:22:57 +0200
Commit message: Merge pull request from GHSA-xm4c-5wm5-jqv7

replace potentially harmful backslashes with forward slashes when val…