Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-5227: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (CWE-776)
value: Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.
CWE description: The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
CVSS v3 base score: 7.5
Published: 2020-01-28T23:15Z
Repository: https://github.com/lkiesow/python-feedgen
Language: Unknown
Commit date: 2020-01-28 17:49:08 +0100
Commit message: Merge pull request from GHSA-g8q7-xv52-hf9f

Prevent XML Denial of Service Attacks
CVE-2016-5429: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 3.7
Published: 2016-09-03T20:59Z
Repository: https://github.com/nov/jose-php
Language: PHP
Files changed: src/JOSE/JWE.php
Commit date: 2016-08-31 01:03:07 +0900
Commit message: one more hash_equals, and better CEK decryption error handling

Diff: diff --git a/src/JOSE/JWE.php b/src/JOSE/JWE.php
index 4bc1923..964d8ce 100644
--- a/src/JOSE/JWE.php
+++ b/src/JOSE/JWE.php
@@ -166,10 +166,12 @@ class JOSE_JWE extends JOSE_JWT {
             throw new JOSE_Exception_EncryptionFailed('Master key encryption failed');
         }
     }
 
     private function decryptContentEncryptionKey($private_key_or_secret) {
+        $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
+        $fake_content_encryption_key = $this->content_encryption_key;
         switch ($this->header['alg']) {
             case 'RSA1_5':
                 $rsa = $this->rsa($private_key_or_secret, RSA::ENCRYPTION_PKCS1);
                 $this->content_encryption_key = $rsa->decrypt($this->jwe_encrypted_key);
                 break;
@@ -192,11 +194,11 @@ class JOSE_JWE extends JOSE_JWT {
         if (!$this->content_encryption_key) {
             # NOTE:
             #  Not to disclose timing difference between CEK decryption error and others.
             #  Mitigating Bleichenbacher Attack on PKCS#1 v1.5
             #  ref.) http://inaz2.hatenablog.com/entry/2016/01/26/222303
-            $this->generateContentEncryptionKey(null);
+            $this->content_encryption_key = $fake_content_encryption_key;
         }
     }
 
     private function deriveEncryptionAndMacKeys() {
         switch ($this->header['enc']) {
@@ -280,11 +282,11 @@ class JOSE_JWE extends JOSE_JWT {
             0, $sha_size / 2 / 8
         );
     }
 
     private function checkAuthenticationTag() {
-        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {
+        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
             return true;
         } else {
             throw new JOSE_Exception_UnexpectedAlgorithm('Invalid authentication tag');
         }
     }

Vulnerable code:             $this->generateContentEncryptionKey(null);
        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {
Fixed code:         $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
        $fake_content_encryption_key = $this->content_encryption_key;
            $this->content_encryption_key = $fake_content_encryption_key;
        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
CVE-2016-5429: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 3.7
Published: 2016-09-03T20:59Z
Repository: https://github.com/nov/jose-php
Language: PHP
Files changed: src/JOSE/JWS.php
Commit date: 2016-08-30 10:37:36 +0900
Commit message: explicit alg check & secure hash comparison

Diff: diff --git a/src/JOSE/JWS.php b/src/JOSE/JWS.php
index 950d6b4..60c1cbb 100644
--- a/src/JOSE/JWS.php
+++ b/src/JOSE/JWS.php
@@ -120,18 +120,24 @@ class JOSE_JWS extends JOSE_JWT {
 
     private function _verify($public_key_or_secret, $expected_alg = null) {
         $segments = explode('.', $this->raw);
         $signature_base_string = implode('.', array($segments[0], $segments[1]));
         if (!$expected_alg) {
-            # NOTE: might better to warn here
             $expected_alg = $this->header['alg'];
+            $using_autodetected_alg = true;
         }
         switch ($expected_alg) {
             case 'HS256':
             case 'HS384':
             case 'HS512':
-                return $this->signature === hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
+                if ($using_autodetected_alg) {
+                    throw new JOSE_Exception_UnexpectedAlgorithm(
+                        'HMAC algs MUST be explicitly specified as $expected_alg'
+                    );
+                }
+                $hmac_hash = hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
+                return hash_equals($this->signature, $hmac_hash);
             case 'RS256':
             case 'RS384':
             case 'RS512':
                 return $this->rsa($public_key_or_secret, RSA::SIGNATURE_PKCS1)->verify($signature_base_string, $this->signature);
             case 'ES256':

Vulnerable code:             # NOTE: might better to warn here
                return $this->signature === hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
Fixed code:             $using_autodetected_alg = true;
                if ($using_autodetected_alg) {
                    throw new JOSE_Exception_UnexpectedAlgorithm(
                        'HMAC algs MUST be explicitly specified as $expected_alg'
                    );
                }
                $hmac_hash = hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
                return hash_equals($this->signature, $hmac_hash);
CVE-2016-5430: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-09-03T20:59Z
Repository: https://github.com/nov/jose-php
Language: PHP
Files changed: src/JOSE/JWE.php
Commit date: 2016-08-31 01:03:07 +0900
Commit message: one more hash_equals, and better CEK decryption error handling

Diff: diff --git a/src/JOSE/JWE.php b/src/JOSE/JWE.php
index 4bc1923..964d8ce 100644
--- a/src/JOSE/JWE.php
+++ b/src/JOSE/JWE.php
@@ -166,10 +166,12 @@ class JOSE_JWE extends JOSE_JWT {
             throw new JOSE_Exception_EncryptionFailed('Master key encryption failed');
         }
     }
 
     private function decryptContentEncryptionKey($private_key_or_secret) {
+        $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
+        $fake_content_encryption_key = $this->content_encryption_key;
         switch ($this->header['alg']) {
             case 'RSA1_5':
                 $rsa = $this->rsa($private_key_or_secret, RSA::ENCRYPTION_PKCS1);
                 $this->content_encryption_key = $rsa->decrypt($this->jwe_encrypted_key);
                 break;
@@ -192,11 +194,11 @@ class JOSE_JWE extends JOSE_JWT {
         if (!$this->content_encryption_key) {
             # NOTE:
             #  Not to disclose timing difference between CEK decryption error and others.
             #  Mitigating Bleichenbacher Attack on PKCS#1 v1.5
             #  ref.) http://inaz2.hatenablog.com/entry/2016/01/26/222303
-            $this->generateContentEncryptionKey(null);
+            $this->content_encryption_key = $fake_content_encryption_key;
         }
     }
 
     private function deriveEncryptionAndMacKeys() {
         switch ($this->header['enc']) {
@@ -280,11 +282,11 @@ class JOSE_JWE extends JOSE_JWT {
             0, $sha_size / 2 / 8
         );
     }
 
     private function checkAuthenticationTag() {
-        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {
+        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
             return true;
         } else {
             throw new JOSE_Exception_UnexpectedAlgorithm('Invalid authentication tag');
         }
     }

Vulnerable code:             $this->generateContentEncryptionKey(null);
        if ($this->authentication_tag === $this->calculateAuthenticationTag()) {
Fixed code:         $this->generateContentEncryptionKey(null); # NOTE: run this always not to make timing difference
        $fake_content_encryption_key = $this->content_encryption_key;
            $this->content_encryption_key = $fake_content_encryption_key;
        if (hash_equals($this->authentication_tag, $this->calculateAuthenticationTag())) {
CVE-2016-5431: Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
value: The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
CWE description: The product uses a broken or risky cryptographic algorithm or protocol.
CVSS v3 base score: 7.5
Published: 2019-08-07T15:15Z
Repository: https://github.com/nov/jose-php
Language: PHP
Files changed: src/JOSE/JWS.php
Commit date: 2016-08-30 10:37:36 +0900
Commit message: explicit alg check & secure hash comparison

Diff: diff --git a/src/JOSE/JWS.php b/src/JOSE/JWS.php
index 950d6b4..60c1cbb 100644
--- a/src/JOSE/JWS.php
+++ b/src/JOSE/JWS.php
@@ -120,18 +120,24 @@ class JOSE_JWS extends JOSE_JWT {
 
     private function _verify($public_key_or_secret, $expected_alg = null) {
         $segments = explode('.', $this->raw);
         $signature_base_string = implode('.', array($segments[0], $segments[1]));
         if (!$expected_alg) {
-            # NOTE: might better to warn here
             $expected_alg = $this->header['alg'];
+            $using_autodetected_alg = true;
         }
         switch ($expected_alg) {
             case 'HS256':
             case 'HS384':
             case 'HS512':
-                return $this->signature === hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
+                if ($using_autodetected_alg) {
+                    throw new JOSE_Exception_UnexpectedAlgorithm(
+                        'HMAC algs MUST be explicitly specified as $expected_alg'
+                    );
+                }
+                $hmac_hash = hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
+                return hash_equals($this->signature, $hmac_hash);
             case 'RS256':
             case 'RS384':
             case 'RS512':
                 return $this->rsa($public_key_or_secret, RSA::SIGNATURE_PKCS1)->verify($signature_base_string, $this->signature);
             case 'ES256':

Vulnerable code:             # NOTE: might better to warn here
                return $this->signature === hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
Fixed code:             $using_autodetected_alg = true;
                if ($using_autodetected_alg) {
                    throw new JOSE_Exception_UnexpectedAlgorithm(
                        'HMAC algs MUST be explicitly specified as $expected_alg'
                    );
                }
                $hmac_hash = hash_hmac($this->digest(), $signature_base_string, $public_key_or_secret, true);
                return hash_equals($this->signature, $hmac_hash);
CVE-2021-4236: NULL Pointer Dereference (CWE-476)
value: Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 9.8
Published: 2022-12-27T22:15Z
Repository: https://github.com/ecnepsnai/web
Language: Go
Files changed: websocket.go
Commit date: 2020-12-30 15:48:46 -0800
Commit message: Fix: websocket requests were not authenticated

Diff: diff --git a/websocket.go b/websocket.go
index e78895c..4d8a892 100644
--- a/websocket.go
+++ b/websocket.go
@@ -1,8 +1,9 @@
 package web
 
 import (
+	"encoding/json"
 	"net/http"
 
 	"github.com/gorilla/websocket"
 	"github.com/julienschmidt/httprouter"
 )
@@ -22,18 +23,37 @@ var upgrader = websocket.Upgrader{
 	WriteBufferSize: 1024,
 }
 
 func (s *Server) socketHandler(endpointHandle SocketHandle, options HandleOptions) httprouter.Handle {
 	return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
+		var userData interface{}
+
+		if options.AuthenticateMethod != nil {
+			userData = options.AuthenticateMethod(r)
+			if isUserdataNil(userData) {
+				if options.UnauthorizedMethod == nil {
+					s.log.Warn("Rejected authenticated request")
+					w.Header().Set("Content-Type", "application/json")
+					w.WriteHeader(http.StatusUnauthorized)
+					json.NewEncoder(w).Encode(Error{401, "Unauthorized"})
+					return
+				}
+
+				options.UnauthorizedMethod(w, r)
+				return
+			}
+		}
+
 		conn, err := upgrader.Upgrade(w, r, nil)
 		if err != nil {
 			s.log.Error("Error upgrading client for websocket connection: %s", err.Error())
 			return
 		}
 		endpointHandle(Request{
-			Params: ps,
-			log:    s.log,
+			Params:   ps,
+			UserData: userData,
+			log:      s.log,
 		}, WSConn{
 			c: conn,
 		})
 		s.log.Debug("HTTP WS Request: ws://%s", r.RequestURI)
 	}

Vulnerable code: 			Params: ps,
			log:    s.log,
Fixed code: 	"encoding/json"
		var userData interface{}

		if options.AuthenticateMethod != nil {
			userData = options.AuthenticateMethod(r)
			if isUserdataNil(userData) {
				if options.UnauthorizedMethod == nil {
					s.log.Warn("Rejected authenticated request")
					w.Header().Set("Content-Type", "application/json")
					w.WriteHeader(http.StatusUnauthorized)
					json.NewEncoder(w).Encode(Error{401, "Unauthorized"})
					return
				}

				options.UnauthorizedMethod(w, r)
				return
			}
		}

			Params:   ps,
			UserData: userData,
			log:      s.log,
CVE-2022-1715: Other (NVD-CWE-Other)
value: Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-05-13T17:15Z
Repository: https://github.com/neorazorx/facturascripts
Language: PHP
Files changed: Core/App/AppController.php
Commit date: 2022-05-12 20:14:56 +0200
Commit message: Fixed string comparison to avoid automatic cast during database password check.
------
Corregida la comparación de cadenas para evitar cast automático durante la comprobación de la contraseña de la basew de datos.

Diff: diff --git a/Core/App/AppController.php b/Core/App/AppController.php
index 1910311926..407038efbe 100644
--- a/Core/App/AppController.php
+++ b/Core/App/AppController.php
@@ -209,13 +209,13 @@ class AppController extends App
         $nick = $this->request->request->get('fsNewUserPasswd');
         $pass = $this->request->request->get('fsNewPasswd');
         $pass2 = $this->request->request->get('fsNewPasswd2');
 
         if ($pass != $pass2) {
-            ToolBox::i18nLog()->warning('different-passwords', ['%userNick%' => $nick]);
+            ToolBox::i18nLog()->warning('different-passwords', ['%userNick%' => htmlspecialchars($nick)]);
             return;
-        } elseif ($user->loadFromCode($nick) && $this->request->request->get('fsDbPasswd') == FS_DB_PASS) {
+        } elseif ($user->loadFromCode($nick) && $this->request->request->get('fsDbPasswd') === FS_DB_PASS) {
             $user->setPassword($pass);
             $user->save();
             ToolBox::i18nLog()->notice('record-updated-correctly');
             return;
         }

Vulnerable code:             ToolBox::i18nLog()->warning('different-passwords', ['%userNick%' => $nick]);
        } elseif ($user->loadFromCode($nick) && $this->request->request->get('fsDbPasswd') == FS_DB_PASS) {
Fixed code:             ToolBox::i18nLog()->warning('different-passwords', ['%userNick%' => htmlspecialchars($nick)]);
        } elseif ($user->loadFromCode($nick) && $this->request->request->get('fsDbPasswd') === FS_DB_PASS) {
CVE-2022-2066: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-13T13:15Z
Repository: https://github.com/neorazorx/facturascripts
Language: PHP
Files changed: Core/App/AppController.php
Commit date: 2022-04-28 11:29:31 +0200
Commit message: Sanitized username when showing user not found message.
------
Saneado nombre de usuario al mostrar el mensaje de usuario no encontrado.

Diff: diff --git a/Core/App/AppController.php b/Core/App/AppController.php
index 83c42b7241..0dd563c518 100644
--- a/Core/App/AppController.php
+++ b/Core/App/AppController.php
@@ -285,11 +285,11 @@ class AppController extends App
             ToolBox::i18nLog()->warning('login-password-fail');
             return false;
         }
 
         $this->ipWarning();
-        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => $nick]);
+        ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => htmlspecialchars($nick)]);
         return false;
     }
 
     /**
      * Authenticate the user using the cookie.

Vulnerable code:         ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => $nick]);
Fixed code:         ToolBox::i18nLog()->warning('login-user-not-found', ['%nick%' => htmlspecialchars($nick)]);
CVE-2023-38403: Integer Overflow or Wraparound (CWE-190)
value: iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2023-07-17T21:15Z
Repository: https://github.com/esnet/iperf
Language: C
Files changed: src/iperf_api.c
Commit date: 2023-07-07 11:35:02 -0700
Commit message: Fix memory allocation hazard (#1542). (#1543)

Reported by:	@someusername123 on GitHub
Diff: diff --git a/src/iperf_api.c b/src/iperf_api.c
index f2d4162..a95e024 100644
--- a/src/iperf_api.c
+++ b/src/iperf_api.c
@@ -2668,10 +2668,11 @@ JSON_write(int fd, cJSON *json)
 
 static cJSON *
 JSON_read(int fd)
 {
     uint32_t hsize, nsize;
+    size_t strsize;
     char *str;
     cJSON *json = NULL;
     int rc;
 
     /*
@@ -2680,11 +2681,13 @@ JSON_read(int fd)
      * structure, NULL if there was an error.
      */
     if (Nread(fd, (char*) &nsize, sizeof(nsize), Ptcp) >= 0) {
 	hsize = ntohl(nsize);
 	/* Allocate a buffer to hold the JSON */
-	str = (char *) calloc(sizeof(char), hsize+1);	/* +1 for trailing null */
+	strsize = hsize + 1;              /* +1 for trailing NULL */
+	if (strsize) {
+	str = (char *) calloc(sizeof(char), strsize);
 	if (str != NULL) {
 	    rc = Nread(fd, str, hsize, Ptcp);
 	    if (rc >= 0) {
 		/*
 		 * We should be reading in the number of bytes corresponding to the
@@ -2699,10 +2702,14 @@ JSON_read(int fd)
 		    printf("WARNING:  Size of data read does not correspond to offered length\n");
 		}
 	    }
 	}
 	free(str);
+	}
+	else {
+	    printf("WARNING:  Data length overflow\n");
+	}
     }
     return json;
 }
 
 /*************************************************************/

Vulnerable code: 	str = (char *) calloc(sizeof(char), hsize+1);	/* +1 for trailing null */
Fixed code:     size_t strsize;
	strsize = hsize + 1;              /* +1 for trailing NULL */
	if (strsize) {
	str = (char *) calloc(sizeof(char), strsize);
	}
	else {
	    printf("WARNING:  Data length overflow\n");
	}
CVE-2013-2182: Permissions, Privileges, and Access Controls (CWE-264)
value: The Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers to bypass access restrictions via a crafted URI, as demonstrated by an encoded forward slash.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-06-13T14:55Z
Repository: https://github.com/monkey/monkey
Language: C
Files changed: plugins/mandril/mandril.c
Commit date: 2014-05-20 11:22:31 -0600
Commit message: Mandril: check decoded URI (fix #92)

Signed-off-by: Eduardo Silva <eduardo@monkey.io>

Diff: diff --git a/plugins/mandril/mandril.c b/plugins/mandril/mandril.c
index 8df087b..820f441 100644
--- a/plugins/mandril/mandril.c
+++ b/plugins/mandril/mandril.c
@@ -347,11 +347,12 @@ int _mkp_stage_30(struct plugin *p,
     mk_ptr_t referer;
     (void) p;
     (void) cs;
 
     PLUGIN_TRACE("[FD %i] Mandril validating URL", cs->socket);
-    if (mk_security_check_url(sr->uri) < 0) {
+
+    if (mk_security_check_url(sr->uri_processed) < 0) {
         PLUGIN_TRACE("[FD %i] Close connection, blocked URL", cs->socket);
         mk_api->header_set_http_status(sr, MK_CLIENT_FORBIDDEN);
         return MK_PLUGIN_RET_CLOSE_CONX;
     }
 

Vulnerable code:     if (mk_security_check_url(sr->uri) < 0) {
Fixed code: 
    if (mk_security_check_url(sr->uri_processed) < 0) {
CVE-2015-10069: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the patch is 62a6e24efdfa195b70d7df140d8287fdc38eb66d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218896.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-19T08:15Z
Repository: https://github.com/viakondratiuk/cash-machine
Language: Python
Files changed: machine.py
Commit date: 2015-03-22 22:50:58 +0200
Commit message: Prevent sql injection, refresh db.

Diff: diff --git a/machine.db b/machine.db
index 97d1e7c..e2bad70 100644
Binary files a/machine.db and b/machine.db differ
diff --git a/machine.py b/machine.py
index 2fc9972..68172d3 100644
--- a/machine.py
+++ b/machine.py
@@ -149,12 +149,11 @@ def is_card_at_session(request):
 
 def is_card_pin_at_session(request):
     return 'card' in request.session and request.session['card']['valid_pin'] is True
 
 def get_card(request, cc_number):
-    q = "select * from cards where cc_number = '%s'" % cc_number.replace('-', '')
-    row = request.db.execute(q).fetchone()
+    row = request.db.execute("select * from cards where cc_number = ?", (cc_number.replace('-', ''),)).fetchone()
     if row is not None:
         return dict(
             id = row[0],
             cc_number = row[1],
             pin = row[2],
@@ -170,11 +169,11 @@ def update_failed_attempts(request, failed_attempts):
     request.db.execute("update cards set failed_attempts = ? where id = ?", (failed_attempts, card['id']))
     request.db.commit()
 
 def block_card(request):
     card = request.session['card']
-    request.db.execute("update cards set status = 'blocked' where id = %s" % card['id'])
+    request.db.execute("update cards set status = 'blocked' where id = ?", (card['id'],))
     request.db.commit()
 
 def save_balance_check(request):
     card = request.session['card']
     request.db.execute(

Vulnerable code:     q = "select * from cards where cc_number = '%s'" % cc_number.replace('-', '')
    row = request.db.execute(q).fetchone()
    request.db.execute("update cards set status = 'blocked' where id = %s" % card['id'])
Fixed code:     row = request.db.execute("select * from cards where cc_number = ?", (cc_number.replace('-', ''),)).fetchone()
    request.db.execute("update cards set status = 'blocked' where id = ?", (card['id'],))
CVE-2023-2731: NULL Pointer Dereference (CWE-476)
value: A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-05-17T22:15Z
Repository: https://github.com/libsdl-org/libtiff
Language: C
Files changed: libtiff/tif_lzw.c
Commit date: 2023-04-29 12:20:46 +0200
Commit message: LZWDecode(): avoid crash when trying to read again from a strip whith a missing end-of-information marker (fixes #548)

Diff: diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
index ba75a07e..d631fa10 100644
--- a/libtiff/tif_lzw.c
+++ b/libtiff/tif_lzw.c
@@ -421,10 +421,14 @@ static int LZWDecode(TIFF *tif, uint8_t *op0, tmsize_t occ0, uint16_t s)
     assert(sp != NULL);
     assert(sp->dec_codetab != NULL);
 
     if (sp->read_error)
     {
+        TIFFErrorExtR(tif, module,
+                      "LZWDecode: Scanline %" PRIu32 " cannot be read due to "
+                      "previous error",
+                      tif->tif_row);
         return 0;
     }
 
     /*
      * Restart interrupted output operation.
@@ -740,10 +744,11 @@ after_loop:
         return (0);
     }
     return (1);
 
 no_eoi:
+    sp->read_error = 1;
     TIFFErrorExtR(tif, module,
                   "LZWDecode: Strip %" PRIu32 " not terminated with EOI code",
                   tif->tif_curstrip);
     return 0;
 error_code:

Fixed code:         TIFFErrorExtR(tif, module,
                      "LZWDecode: Scanline %" PRIu32 " cannot be read due to "
                      "previous error",
                      tif->tif_row);
    sp->read_error = 1;
CVE-2022-1295: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-04-11T12:15Z
Repository: https://github.com/alvarotrigo/fullpage.js
Language: Unknown
Commit date: 2022-04-11 04:36:51 +0200
Commit message: Merge pull request #4351 from alvarotrigo/dev

- Fixed bug: jquery adaptor didnt work
CVE-2022-1330: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-12T21:15Z
Repository: https://github.com/alvarotrigo/fullpage.js
Language: Unknown
Commit date: 2022-04-12 22:14:07 +0200
Commit message: Merge pull request #4360 from ranjit-git/ranjit-git-patch-1

Ranjit git patch 1
CVE-2021-4269: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 20220306-001 is able to address this issue. The name of the patch is 591405b4ed160fbefc1dca1e55c5745079a7bb48. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216472.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/simplerisk/code
Language: JavaScript
Files changed: simplerisk/js/common.js
Commit date: 2021-03-06 12:58:09 -0600
Commit message: Potential XSS fix

Diff: diff --git a/simplerisk/js/common.js b/simplerisk/js/common.js
index 3bb9bf62..dae4e1b0 100644
--- a/simplerisk/js/common.js
+++ b/simplerisk/js/common.js
@@ -337,11 +337,15 @@ function checkAndSetValidation(container)
                 issue_el.parent().find("button.multiselect").focus()
             }else{
                 issue_el.addClass("error");
                 issue_el.focus()
             }
-            var message = field_required_lang.replace("_XXX_", issue_el.attr("title"))
+
+            // We have to make sure that no html gets through to toastr as it's displaying what it gets 'as is';
+            var escaped = $("<div/>").text(issue_el.attr("title")).html();
+            var message = field_required_lang.replace("_XXX_", escaped);
+
             showAlertFromMessage(message, false)
         }
         return false;
     }
     else

Vulnerable code:             var message = field_required_lang.replace("_XXX_", issue_el.attr("title"))
Fixed code: 
            // We have to make sure that no html gets through to toastr as it's displaying what it gets 'as is';
            var escaped = $("<div/>").text(issue_el.attr("title")).html();
            var message = field_required_lang.replace("_XXX_", escaped);
CVE-2023-45811: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: Synchrony deobfuscator is a javascript cleaner & deobfuscator.  A `__proto__` pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A `__proto__` pollution vulnerability exists in the `LiteralMap` transformer allowing crafted input to modify properties in the Object prototype. A fix has been released in `deobfuscator@2.4.4`. Users are advised to upgrade. Users unable to upgrade should launch node with the [--disable-proto=delete][disable-proto] or [--disable-proto=throw][disable-proto] flags

CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 7.8
Published: 2023-10-17T23:15Z
Repository: https://github.com/relative/synchrony
Language: Unknown
Commit date: 2023-10-17 12:55:02 -0400
Commit message: Merge pull request from GHSA-jg82-xh3w-rhxx

Advisory fix 1
CVE-2021-21335: Improper Authentication (CWE-287)
value: In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in version 1.1.1 of spnego-http-auth-nginx-module. As a workaround, one may disable basic authentication.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2021-03-08T21:15Z
Repository: https://github.com/stnoonan/spnego-http-auth-nginx-module
Language: C
Files changed: ngx_http_auth_spnego_module.c
Commit date: 2021-02-26 10:31:41 +0000
Commit message: Check basic auth result against != NGX_OK rather than == NGX_DECLINED

This corrects the error handling case when ngx_http_auth_spnego_basic is called with a bad configuration or bad username. These cases return NGX_ERROR, which allowed basic auth to proceed.

Thanks to Prakapovich Pavel aka Flyguy.by for pointing this out.
Diff: diff --git a/ngx_http_auth_spnego_module.c b/ngx_http_auth_spnego_module.c
index 97c0b44..25683f2 100644
--- a/ngx_http_auth_spnego_module.c
+++ b/ngx_http_auth_spnego_module.c
@@ -1041,11 +1041,11 @@ ngx_http_auth_spnego_handler(
         if (NGX_OK == ret) {
             spnego_debug0("Basic auth credentials supplied by client");
             /* If basic auth is enabled and basic creds are supplied
              * attempt basic auth.  If we attempt basic auth, we do
              * not fall through to real SPNEGO */
-            if (NGX_DECLINED == ngx_http_auth_spnego_basic(r, ctx, alcf)) {
+            if (NGX_OK != ngx_http_auth_spnego_basic(r, ctx, alcf)) {
                 spnego_debug0("Basic auth failed");
                 if (NGX_ERROR == ngx_http_auth_spnego_headers_basic_only(r, ctx, alcf)) {
                     spnego_debug0("Error setting headers");
                     return (ctx->ret = NGX_HTTP_INTERNAL_SERVER_ERROR);
                 }

Vulnerable code:             if (NGX_DECLINED == ngx_http_auth_spnego_basic(r, ctx, alcf)) {
Fixed code:             if (NGX_OK != ngx_http_auth_spnego_basic(r, ctx, alcf)) {
CVE-2020-4040: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2020-06-08T22:15Z
Repository: https://github.com/bolt/bolt
Language: Unknown
Commit date: 2020-05-07 15:24:47 +0200
Commit message: Merge pull request #7853 from bolt/fix/csrf-check-on-preview

Check CSRF on Preview page
CVE-2020-4041: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-06-08T22:15Z
Repository: https://github.com/bolt/bolt
Language: Unknown
Commit date: 2020-05-07 15:24:47 +0200
Commit message: Merge pull request #7853 from bolt/fix/csrf-check-on-preview

Check CSRF on Preview page
CVE-2021-26276: Improper Control of Dynamically-Managed Code Resources (CWE-913)
value: scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data
CWE description: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CVSS v3 base score: 5.3
Published: 2021-01-27T20:15Z
Repository: https://github.com/godaddy/node-config-shield
Language: JSON
Files changed: package.json, scripts/cli.js
Commit date: 2021-01-21 14:40:49 -0500
Commit message: Replaced eval with JSON5.parse

Diff: diff --git a/package.json b/package.json
index 8d78a6c..f42346b 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "config-shield",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Store and retrieve data sensative in nature",
   "main": "./lib/index.js",
   "scripts": {
     "test": "mocha",
     "start": "npm run cli",
@@ -27,7 +27,10 @@
   "maintainers": [
     {
       "name": "asilvas",
       "email": "asilvas@godaddy.com"
     }
-  ]
+  ],
+  "dependencies": {
+    "json5": "^2.1.3"
+  }
 }
diff --git a/scripts/cli.js b/scripts/cli.js
index 60cb477..55f6ff6 100644
--- a/scripts/cli.js
+++ b/scripts/cli.js
@@ -1,6 +1,7 @@
 var readline = require('readline');
+var JSON5 = require('json5');
 
 var rl = readline.createInterface({
   input: process.stdin,
   output: process.stdout
 });
@@ -75,11 +76,11 @@ function cmdSet(key, val) {
   var objVal = val;
 
   try {
     var strTest = /^[\'\"](.*?)[\'\"]$/.exec(val);
     if (!strTest || strTest.length !== 2) { // do not parse if explicitly a string
-      objVal = eval('(' + val + ')'); // attempt to parse
+      objVal = JSON5.parse(val); // attempt to parse
     } else {
       objVal = strTest[1];
     }
   } catch(ex) {
     // use as existing string

Vulnerable code:   "version": "0.2.1",
  ]
      objVal = eval('(' + val + ')'); // attempt to parse
Fixed code:   "version": "0.2.2",
  ],
  "dependencies": {
    "json5": "^2.1.3"
  }
var JSON5 = require('json5');
      objVal = JSON5.parse(val); // attempt to parse
CVE-2018-12713: Insufficient Information (NVD-CWE-noinfo)
value: GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was intended to be private.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.1
Published: 2018-06-24T22:29Z
Repository: https://github.com/GNOME/gimp
Language: C
Files changed: app/tests/test-xcf.c
Commit date: 2018-06-24 04:55:44 +0200
Commit message: Issue #1689: create unique temporary file with g_file_open_tmp().

Not sure this is really solving the issue reported, which is that
`g_get_tmp_dir()` uses environment variables (yet as g_file_open_tmp()
uses g_get_tmp_dir()…). But at least g_file_open_tmp() should create
unique temporary files, which prevents overriding existing files (which
is most likely the only real attack possible here, or at least the only
one I can think of unless some weird vulnerabilities exist in glib).

Diff: diff --git a/app/tests/test-xcf.c b/app/tests/test-xcf.c
index 9fc2ec1f4b..98ca4f0bed 100644
--- a/app/tests/test-xcf.c
+++ b/app/tests/test-xcf.c
@@ -293,11 +293,12 @@ gimp_write_and_read_file (Gimp     *gimp,
                           gboolean  use_gimp_2_8_features)
 {
   GimpImage           *image;
   GimpImage           *loaded_image;
   GimpPlugInProcedure *proc;
-  gchar               *filename;
+  gchar               *filename = NULL;
+  gint                 file_handle;
   GFile               *file;
 
   /* Create the image */
   image = gimp_create_mainimage (gimp,
                                  with_unusual_stuff,
@@ -309,11 +310,13 @@ gimp_write_and_read_file (Gimp     *gimp,
                          with_unusual_stuff,
                          compat_paths,
                          use_gimp_2_8_features);
 
   /* Write to file */
-  filename = g_build_filename (g_get_tmp_dir (), "gimp-test.xcf", NULL);
+  file_handle = g_file_open_tmp ("gimp-test-XXXXXX.xcf", &filename, NULL);
+  g_assert (file_handle != -1);
+  close (file_handle);
   file = g_file_new_for_path (filename);
   g_free (filename);
 
   proc = gimp_plug_in_manager_file_procedure_find (image->gimp->plug_in_manager,
                                                    GIMP_FILE_PROCEDURE_GROUP_SAVE,

Vulnerable code:   gchar               *filename;
  filename = g_build_filename (g_get_tmp_dir (), "gimp-test.xcf", NULL);
Fixed code:   gchar               *filename = NULL;
  gint                 file_handle;
  file_handle = g_file_open_tmp ("gimp-test-XXXXXX.xcf", &filename, NULL);
  g_assert (file_handle != -1);
  close (file_handle);
CVE-2023-2479: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-05-02T15:15Z
Repository: https://github.com/appium/appium-desktop
Language: Markdown
Files changed: README.md
Commit date: 2023-04-12 14:04:14 -0700
Commit message: docs: update readme with security warning
Diff: diff --git a/README.md b/README.md
index cd01839..26a91d9 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,13 @@
 # [DEPRECATED] 
 # Please use [Appium Inspector](https://github.com/appium/appium-inspector) and the command line version of [Appium](https://github.com/appium/appium) to inspect elements.
 
 ❗❗ This project is no longer maintained since it is not compatible with Appium 2.0+. For Appium 1.x and 2.0+, use the command line Appium server (see the [Appium docs](https://appium.github.io/appium/docs/en/latest/) for installation and setup information), in combination with [Appium Inspector](https://github.com/appium/appium-inspector).
 
-The old documentation for this project remains below.
+❗❗ Since this project was deprecated at least one security vulnerability was discovered that could allow remote code execution by a malicious party if Appium Desktop's open ports are exposed to the wider internet. This project is unsupported and no fixes are planned. Again, please do not use Appium Desktop anymore. Use Appium and the Appium Inspector instead.
+
+_The old documentation for this project remains below._
 
 # Appium Desktop
 
 [![Build Status](https://dev.azure.com/AppiumCI/Appium%20Desktop/_apis/build/status/appium.appium-desktop)](https://dev.azure.com/AppiumCI/Appium%20Desktop/_build/latest?definitionId=1)
 [![Crowdin](https://d322cqt584bo4o.cloudfront.net/appium-desktop/localized.svg)](https://crowdin.com/project/appium-desktop)

Vulnerable code: The old documentation for this project remains below.
Fixed code: ❗❗ Since this project was deprecated at least one security vulnerability was discovered that could allow remote code execution by a malicious party if Appium Desktop's open ports are exposed to the wider internet. This project is unsupported and no fixes are planned. Again, please do not use Appium Desktop anymore. Use Appium and the Appium Inspector instead.

_The old documentation for this project remains below._
CVE-2017-12868: Session Fixation (CWE-384)
value: The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 9.8
Published: 2017-09-01T13:29Z
Repository: https://github.com/simplesamlphp/simplesamlphp
Language: PHP
Files changed: lib/SimpleSAML/Utils/Crypto.php
Commit date: 2017-05-05 10:54:55 +0200
Commit message: bugfix: SimpleSAML\Utils\Crypto returns true for different strings using PHP < 5.6.

The reason was the lack of conversion to integer for each character of the strings before applying the XOR operator to them. The operator returns always an empty string when applied to two characters, and applying a binary-wise OR between 0 and an empty string, yields 0. Therefore, $diff is always 0, and the function returns true for every two strings with same length, regardless of their contents.

Diff: diff --git a/lib/SimpleSAML/Utils/Crypto.php b/lib/SimpleSAML/Utils/Crypto.php
index e9e22956..c7d16921 100644
--- a/lib/SimpleSAML/Utils/Crypto.php
+++ b/lib/SimpleSAML/Utils/Crypto.php
@@ -402,12 +402,12 @@ class Crypto
         $len = mb_strlen($known, '8bit'); // see mbstring.func_overload
         if ($len !== mb_strlen($user, '8bit')) {
             return false; // length differs
         }
         $diff = 0;
-        for ($i = 0; $i < $len; ++$i) {
-            $diff |= $known[$i] ^ $user[$i];
+        for ($i = 0; $i < $len; $i++) {
+            $diff |= ord($known[$i]) ^ ord($user[$i]);
         }
         // if all the bytes in $a and $b are identical, $diff should be equal to 0
         return $diff === 0;
     }
 

Vulnerable code:         for ($i = 0; $i < $len; ++$i) {
            $diff |= $known[$i] ^ $user[$i];
Fixed code:         for ($i = 0; $i < $len; $i++) {
            $diff |= ord($known[$i]) ^ ord($user[$i]);