Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-13785: Integer Overflow or Wraparound (CWE-190)
value: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 6.5
Published: 2018-07-09T13:29Z
Repository: https://github.com/glennrp/libpng
Language: C
Files changed: pngrutil.c
Commit date: 2018-06-17 22:56:29 -0400
Commit message: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)

Diff: diff --git a/pngrutil.c b/pngrutil.c
index 95571b51..5ba995ab 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -3165,14 +3165,17 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
 # endif
    if (png_ptr->chunk_name == png_IDAT)
    {
       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
       else
          idat_limit = png_ptr->height * row_factor;
       row_factor = row_factor > 32566? 32566 : row_factor;
       idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */
       idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;

Vulnerable code:          (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
          + 1 + (png_ptr->interlaced? 6: 0));
         idat_limit=PNG_UINT_31_MAX;
Fixed code:          (size_t)png_ptr->width
         * (size_t)png_ptr->channels
         * (png_ptr->bit_depth > 8? 2: 1)
         + 1
         + (png_ptr->interlaced? 6: 0);
         idat_limit = PNG_UINT_31_MAX;
CVE-2018-13785: Divide By Zero (CWE-369)
value: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
CWE description: The product divides a value by zero.
CVSS v3 base score: 6.5
Published: 2018-07-09T13:29Z
Repository: https://github.com/glennrp/libpng
Language: C
Files changed: pngrutil.c
Commit date: 2018-06-17 22:56:29 -0400
Commit message: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)

Diff: diff --git a/pngrutil.c b/pngrutil.c
index 95571b51..5ba995ab 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -3165,14 +3165,17 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
 # endif
    if (png_ptr->chunk_name == png_IDAT)
    {
       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
       else
          idat_limit = png_ptr->height * row_factor;
       row_factor = row_factor > 32566? 32566 : row_factor;
       idat_limit += 6 + 5*(idat_limit/row_factor+1); /* zlib+deflate overhead */
       idat_limit=idat_limit < PNG_UINT_31_MAX? idat_limit : PNG_UINT_31_MAX;

Vulnerable code:          (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
          + 1 + (png_ptr->interlaced? 6: 0));
         idat_limit=PNG_UINT_31_MAX;
Fixed code:          (size_t)png_ptr->width
         * (size_t)png_ptr->channels
         * (png_ptr->bit_depth > 8? 2: 1)
         + 1
         + (png_ptr->interlaced? 6: 0);
         idat_limit = PNG_UINT_31_MAX;
CVE-2023-49006: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-12-19T10:15Z
Repository: https://github.com/phpsysinfo/phpsysinfo
Language: PHP
Files changed: phpsysinfo.ini.new, read_config.php
Commit date: 2023-05-24 10:39:48 +0200
Commit message: Disable JSONP data mode by default for security reasons

Diff: diff --git a/phpsysinfo.ini.new b/phpsysinfo.ini.new
index f2c90f24..25b67c26 100644
--- a/phpsysinfo.ini.new
+++ b/phpsysinfo.ini.new
@@ -45,10 +45,17 @@ ADD_PATHS=false
 ; Example : ALLOWED="127.0.0.1,192.168.1.48,192.168.0.0/24" //allowed IP 127.0.0.1, 192.168.1.48 and 192.168.0.0/24
 ;           ALLOWED=false //no IP checking
 ;
 ALLOWED=false
 
+; Enable JSONP data mode (e.g. /phpsysinfo/xml.php?plugin=complete&jsonp&callback=getData)
+; Disabled by default for security reasons.
+; - false : JSONP data mode disabled
+; - true : JSONP data mode enabled
+;
+;JSONP=false
+
 ; List of sudo commands
 ; Example : SUDO_COMMANDS="iptables-save" //execute "sudo iptables-save" instead "iptables-save"
 ;           SUDO_COMMANDS=false //no sudo commands
 ;
 SUDO_COMMANDS=false
diff --git a/read_config.php b/read_config.php
index 17d0683a..53fbf38e 100644
--- a/read_config.php
+++ b/read_config.php
@@ -87,10 +87,15 @@ if (!defined('PSI_CONFIG_FILE')) {
             echo "Client IP address (".$ip.") not allowed.";
             die();
         }
     }
 
+    if (isset($_GET['jsonp']) && (!defined('PSI_JSONP') || !PSI_JSONP)) {
+        echo "JSONP data mode not enabled in phpsysinfo.ini.";
+        die();
+    }
+
     /* default error handler */
     if (function_exists('errorHandlerPsi')) {
         restore_error_handler();
     }
 

Fixed code: ; Enable JSONP data mode (e.g. /phpsysinfo/xml.php?plugin=complete&jsonp&callback=getData)
; Disabled by default for security reasons.
; - false : JSONP data mode disabled
; - true : JSONP data mode enabled
;
;JSONP=false

    if (isset($_GET['jsonp']) && (!defined('PSI_JSONP') || !PSI_JSONP)) {
        echo "JSONP data mode not enabled in phpsysinfo.ini.";
        die();
    }
CVE-2022-0839: Improper Restriction of XML External Entity Reference (CWE-611)
value: Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2022-03-04T15:15Z
Repository: https://github.com/liquibase/liquibase
Language: Other
Files changed: liquibase-core/src/test/groovy/liquibase/parser/core/xml/XMLChangeLogSAXParserTest.groovy
Commit date: 2022-02-04 11:43:43 -0600
Commit message: Added liquibase.secureParsing test

Diff: diff --git a/liquibase-core/src/test/groovy/liquibase/parser/core/xml/XMLChangeLogSAXParserTest.groovy b/liquibase-core/src/test/groovy/liquibase/parser/core/xml/XMLChangeLogSAXParserTest.groovy
index 1be751a0a..654db821c 100644
--- a/liquibase-core/src/test/groovy/liquibase/parser/core/xml/XMLChangeLogSAXParserTest.groovy
+++ b/liquibase-core/src/test/groovy/liquibase/parser/core/xml/XMLChangeLogSAXParserTest.groovy
@@ -21,11 +21,11 @@ import spock.lang.Specification
 
 class XMLChangeLogSAXParserTest extends Specification {
 
     def INSECURE_XML = """
 <!DOCTYPE databaseChangeLog [
-        <!ENTITY insecure SYSTEM "https://localhost/insecure">
+        <!ENTITY insecure SYSTEM "file://invalid.txt">
         ]>
 
 <databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
                    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
@@ -81,11 +81,11 @@ class XMLChangeLogSAXParserTest extends Specification {
 
         new XMLChangeLogSAXParser().parse("com/example/insecure.xml", new ChangeLogParameters(), resourceAccessor)
 
         then:
         def e = thrown(ChangeLogParseException)
-        e.message.contains("Failed to read external document 'insecure'")
+        e.message.contains("access is not allowed due to restriction set by the accessExternalDTD property")
     }
 
     def "allows liquibase.secureParsing=false to disable secure parsing"() {
         when:
         def resourceAccessor = new MockResourceAccessor(["com/example/insecure.xml": INSECURE_XML])
@@ -95,9 +95,9 @@ class XMLChangeLogSAXParserTest extends Specification {
         })
 
 
         then:
         def e = thrown(ChangeLogParseException)
-        e.message.contains("Connection refused")
+        e.message.contains("Error Reading Changelog File: invalid.txt")
     }
 
 }

Vulnerable code:         <!ENTITY insecure SYSTEM "https://localhost/insecure">
        e.message.contains("Failed to read external document 'insecure'")
        e.message.contains("Connection refused")
Fixed code:         <!ENTITY insecure SYSTEM "file://invalid.txt">
        e.message.contains("access is not allowed due to restriction set by the accessExternalDTD property")
        e.message.contains("Error Reading Changelog File: invalid.txt")
CVE-2022-39379: Deserialization of Untrusted Data (CWE-502)
value: Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-11-02T13:15Z
Repository: https://github.com/fluent/fluentd
Language: Ruby
Files changed: lib/fluent/oj_options.rb
Commit date: 2022-10-27 14:46:07 +0900
Commit message: Remove `object` from the available list of `FLUENT_OJ_OPTION_MODE`

There is less benefit by this option in actual, and it will instroduce
serious security risk since it can execute arbitrary Ruby code.
We remove it since keeping it secure is difficult.

ref: GHSL-2022-067

Signed-off-by: Takuro Ashie <ashie@clear-code.com>

Diff: diff --git a/lib/fluent/oj_options.rb b/lib/fluent/oj_options.rb
index f1c274c1..a76e1f81 100644
--- a/lib/fluent/oj_options.rb
+++ b/lib/fluent/oj_options.rb
@@ -9,11 +9,11 @@ module Fluent
       'use_to_json': :bool
     }
 
     ALLOWED_VALUES = {
       'bigdecimal_load': %i[bigdecimal float auto],
-      'mode': %i[strict null compat json rails object custom]
+      'mode': %i[strict null compat json rails custom]
     }
 
     DEFAULTS = {
       'bigdecimal_load': :float,
       'mode': :compat,

Vulnerable code:       'mode': %i[strict null compat json rails object custom]
Fixed code:       'mode': %i[strict null compat json rails custom]
CVE-2020-24391: Insufficient Information (NVD-CWE-noinfo)
value: mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-03-30T21:15Z
Repository: https://github.com/mongo-express/mongo-express
Language: JSON
Files changed: HISTORY.md, package.json
Commit date: 2020-06-22 15:52:27 -0700
Commit message: Bump 1.0.0-alpha.1

Diff: diff --git a/HISTORY.md b/HISTORY.md
index c3805fb..82286fe 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,5 +1,19 @@
+# 1.0-alpha.1 - Mon Jun 22, 2020
+Brekaing:
+- Change mongo-query-parser to 2.0. This changes how parsing works altogether and drop support for some advanced syntax but is safer [(#528)](https://github.com/mongo-express/mongo-express/pull/#528)
+- Rewrite the connection module to use mongo as much as possible and update mongodb to 3.5 [(#528)](https://github.com/mongo-express/mongo-express/pull/#528)
+
+New:
+- Add csv extension in file export [(#578)](https://github.com/mongo-express/mongo-express/pull/#578)
+- Don't drop the collection on Delete docs action when no query is provided. [(#502)](https://github.com/mongo-express/mongo-express/pull/#502)
+- Fix broken delete document for UUID (BinData 3 & 4) [(#538)](https://github.com/mongo-express/mongo-express/pull/#538)
+
+Deps:
+- Bump lodash to 4.6.2 [(#525)](https://github.com/mongo-express/mongo-express/pull/#525)
+
+
 # 0.54 - Tue Dec 24, 2019
 
 Breaking:
 - Change bson parsing to use mongo-query-parser [(#522)](https://github.com/mongo-express/mongo-express/pull/#522)
 - Drop support for node 6
diff --git a/package.json b/package.json
index 07b9db6..ecf8ecb 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
-  "version": "0.54.0",
+  "version": "1.0.0-alpha.1",
   "author": "https://github.com/mongo-express",
   "name": "mongo-express",
   "description": "Web-based admin interface for MongoDB",
   "keywords": [
     "admin",

Vulnerable code:   "version": "0.54.0",
Fixed code: # 1.0-alpha.1 - Mon Jun 22, 2020
Brekaing:
- Change mongo-query-parser to 2.0. This changes how parsing works altogether and drop support for some advanced syntax but is safer [(#528)](https://github.com/mongo-express/mongo-express/pull/#528)
- Rewrite the connection module to use mongo as much as possible and update mongodb to 3.5 [(#528)](https://github.com/mongo-express/mongo-express/pull/#528)

New:
- Add csv extension in file export [(#578)](https://github.com/mongo-express/mongo-express/pull/#578)
- Don't drop the collection on Delete docs action when no query is provided. [(#502)](https://github.com/mongo-express/mongo-express/pull/#502)
- Fix broken delete document for UUID (BinData 3 & 4) [(#538)](https://github.com/mongo-express/mongo-express/pull/#538)

Deps:
- Bump lodash to 4.6.2 [(#525)](https://github.com/mongo-express/mongo-express/pull/#525)


  "version": "1.0.0-alpha.1",
CVE-2021-21422: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-21T19:15Z
Repository: https://github.com/mongo-express/mongo-express
Language: Unknown
Commit date: 2021-03-04 23:00:26 -0500
Commit message: Merge pull request from GHSA-7p8h-86p5-wv3p

- Fix several XSS vulnerabilities
CVE-2018-14055: Improper Input Validation (CWE-20)
value: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2018-07-15T01:29Z
Repository: https://github.com/znc/znc
Language: C++
Files changed: src/Client.cpp, src/IRCSock.cpp
Commit date: 2018-07-14 07:08:50 +0100
Commit message: Better cleanup lines coming from network.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.

Diff: diff --git a/src/Client.cpp b/src/Client.cpp
index cec976c5..c0efd628 100644
--- a/src/Client.cpp
+++ b/src/Client.cpp
@@ -101,11 +101,12 @@ void CClient::SendRequiredPasswordNotice() {
 
 void CClient::ReadLine(const CString& sData) {
     CLanguageScope user_lang(GetUser() ? GetUser()->GetLanguage() : "");
     CString sLine = sData;
 
-    sLine.TrimRight("\n\r");
+    sLine.Replace("\n", "");
+    sLine.Replace("\r", "");
 
     DEBUG("(" << GetFullName() << ") CLI -> ZNC ["
         << CDebug::Filter(sLine) << "]");
 
     bool bReturn = false;
diff --git a/src/IRCSock.cpp b/src/IRCSock.cpp
index e9db5447..259881dc 100644
--- a/src/IRCSock.cpp
+++ b/src/IRCSock.cpp
@@ -154,11 +154,12 @@ void CIRCSock::Quit(const CString& sQuitMsg) {
 }
 
 void CIRCSock::ReadLine(const CString& sData) {
     CString sLine = sData;
 
-    sLine.TrimRight("\n\r");
+    sLine.Replace("\n", "");
+    sLine.Replace("\r", "");
 
     DEBUG("(" << m_pNetwork->GetUser()->GetUserName() << "/"
               << m_pNetwork->GetName() << ") IRC -> ZNC [" << sLine << "]");
 
     bool bReturn = false;

Vulnerable code:     sLine.TrimRight("\n\r");
    sLine.TrimRight("\n\r");
Fixed code:     sLine.Replace("\n", "");
    sLine.Replace("\r", "");
    sLine.Replace("\n", "");
    sLine.Replace("\r", "");
CVE-2018-14055: Improper Input Validation (CWE-20)
value: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate his privilege and inject rogue values into znc.conf.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2018-07-15T01:29Z
Repository: https://github.com/znc/znc
Language: C++
Files changed: src/Config.cpp
Commit date: 2018-07-14 07:05:57 +0100
Commit message: Don't let attackers inject rogue values into znc.conf

Because of this vulnerability, existing ZNC users could get Admin
permissions.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.

Diff: diff --git a/src/Config.cpp b/src/Config.cpp
index 2543d6ee..0730b894 100644
--- a/src/Config.cpp
+++ b/src/Config.cpp
@@ -172,21 +172,28 @@ bool CConfig::Parse(CFile& file, CString& sErrorMsg) {
 }
 
 void CConfig::Write(CFile& File, unsigned int iIndentation) {
     CString sIndentation = CString(iIndentation, '\t');
 
+    auto SingleLine = [](const CString& s) {
+        return s.Replace_n("\r", "").Replace_n("\n", "");
+    };
+
     for (const auto& it : m_ConfigEntries) {
         for (const CString& sValue : it.second) {
-            File.Write(sIndentation + it.first + " = " + sValue + "\n");
+            File.Write(SingleLine(sIndentation + it.first + " = " + sValue) +
+                       "\n");
         }
     }
 
     for (const auto& it : m_SubConfigs) {
         for (const auto& it2 : it.second) {
             File.Write("\n");
 
-            File.Write(sIndentation + "<" + it.first + " " + it2.first + ">\n");
+            File.Write(SingleLine(sIndentation + "<" + it.first + " " +
+                                  it2.first + ">") +
+                       "\n");
             it2.second.m_pSubConfig->Write(File, iIndentation + 1);
-            File.Write(sIndentation + "</" + it.first + ">\n");
+            File.Write(SingleLine(sIndentation + "</" + it.first + ">") + "\n");
         }
     }
 }

Vulnerable code:             File.Write(sIndentation + it.first + " = " + sValue + "\n");
            File.Write(sIndentation + "<" + it.first + " " + it2.first + ">\n");
            File.Write(sIndentation + "</" + it.first + ">\n");
Fixed code:     auto SingleLine = [](const CString& s) {
        return s.Replace_n("\r", "").Replace_n("\n", "");
    };

            File.Write(SingleLine(sIndentation + it.first + " = " + sValue) +
                       "\n");
            File.Write(SingleLine(sIndentation + "<" + it.first + " " +
                                  it2.first + ">") +
                       "\n");
            File.Write(SingleLine(sIndentation + "</" + it.first + ">") + "\n");
CVE-2018-14056: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2018-07-15T01:29Z
Repository: https://github.com/znc/znc
Language: C++
Files changed: src/WebModules.cpp
Commit date: 2018-07-14 07:09:26 +0100
Commit message: Don't let web skin name ../../../../ access files outside of usual skins directories.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.

Diff: diff --git a/src/WebModules.cpp b/src/WebModules.cpp
index 19ece50aa..a58419875 100644
--- a/src/WebModules.cpp
+++ b/src/WebModules.cpp
@@ -555,17 +555,19 @@ CWebSock::EPageReqResult CWebSock::PrintTemplate(const CString& sPageName,
         return PAGE_NOTFOUND;
     }
 }
 
 CString CWebSock::GetSkinPath(const CString& sSkinName) {
-    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkinName;
+    const CString sSkin = sSkinName.Replace_n("/", "_").Replace_n(".", "_");
+
+    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkin;
 
     if (!CFile::IsDir(sRet)) {
-        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkinName;
+        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkin;
 
         if (!CFile::IsDir(sRet)) {
-            sRet = CString(_SKINDIR_) + "/" + sSkinName;
+            sRet = CString(_SKINDIR_) + "/" + sSkin;
         }
     }
 
     return sRet + "/";
 }

Vulnerable code:     CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkinName;
        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkinName;
            sRet = CString(_SKINDIR_) + "/" + sSkinName;
Fixed code:     const CString sSkin = sSkinName.Replace_n("/", "_").Replace_n(".", "_");

    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkin;
        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkin;
            sRet = CString(_SKINDIR_) + "/" + sSkin;
CVE-2020-13775: NULL Pointer Dereference (CWE-476)
value: ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2020-06-02T23:15Z
Repository: https://github.com/znc/znc
Language: C++
Files changed: src/Client.cpp, test/integration/tests/core.cpp
Commit date: 2020-05-31 11:45:40 +0100
Commit message: Fix null pointer dereference in echo-message

The bug was introduced while fixing #1705. If a client did not enable
echo-message, and doesn't have a network, it crashes.

Thanks to LunarBNC for reporting this

Diff: diff --git a/src/Client.cpp b/src/Client.cpp
index 6d8f4518b..fb39b3fa7 100644
--- a/src/Client.cpp
+++ b/src/Client.cpp
@@ -887,11 +887,11 @@ void CClient::AddBuffer(const T& Message) {
 
 void CClient::EchoMessage(const CMessage& Message) {
     CMessage EchoedMessage = Message;
     for (CClient* pClient : GetClients()) {
         if (pClient->HasEchoMessage() ||
-            (pClient != this && (m_pNetwork->IsChan(Message.GetParam(0)) ||
+            (pClient != this && ((m_pNetwork && m_pNetwork->IsChan(Message.GetParam(0))) ||
                                  pClient->HasSelfMessage()))) {
             EchoedMessage.SetNick(GetNickMask());
             pClient->PutClient(EchoedMessage);
         }
     }
diff --git a/test/integration/tests/core.cpp b/test/integration/tests/core.cpp
index 863754fe5..f50a32c7b 100644
--- a/test/integration/tests/core.cpp
+++ b/test/integration/tests/core.cpp
@@ -295,9 +295,17 @@ TEST_F(ZNCTest, StatusEchoMessage) {
     auto client = LoginClient();
     client.Write("CAP REQ :echo-message");
     client.Write("PRIVMSG *status :blah");
     client.ReadUntil(":nick!user@irc.znc.in PRIVMSG *status :blah");
     client.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
+    client.Write("znc delnetwork test");
+    client.ReadUntil("Network deleted");
+    auto client2 = LoginClient();
+    client2.Write("PRIVMSG *status :blah2");
+    client2.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
+    auto client3 = LoginClient();
+    client3.Write("PRIVMSG *status :blah3");
+    client3.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
 }
 
 }  // namespace
 }  // namespace znc_inttest

Vulnerable code:             (pClient != this && (m_pNetwork->IsChan(Message.GetParam(0)) ||
Fixed code:             (pClient != this && ((m_pNetwork && m_pNetwork->IsChan(Message.GetParam(0))) ||
    client.Write("znc delnetwork test");
    client.ReadUntil("Network deleted");
    auto client2 = LoginClient();
    client2.Write("PRIVMSG *status :blah2");
    client2.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
    auto client3 = LoginClient();
    client3.Write("PRIVMSG *status :blah3");
    client3.ReadUntil(":*status!znc@znc.in PRIVMSG nick :Unknown command");
CVE-2018-25072: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in lojban jbovlaste. This affects an unknown part of the file dict/listing.html. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The patch is named 6ff44c2e87b1113eb07d76ea62e1f64193b04d15. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217647.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-08T13:15Z
Repository: https://github.com/lojban/jbovlaste
Language: HTML
Files changed: dict/listing.html
Commit date: 2018-06-01 22:07:23 -0700
Commit message: ... Seriously we still had an SQL injection?  ;_;

( http://jbovlaste.lojban.org/dict/listing.html?initial=u%27i failed with
an obvious injection error. )

Diff: diff --git a/dict/listing.html b/dict/listing.html
index 6821056..d6cfe80 100644
--- a/dict/listing.html
+++ b/dict/listing.html
@@ -145,11 +145,12 @@ new words from here.</p>
    push @conditions,
       "typeid=(SELECT typeid FROM valsitypes WHERE descriptor=?)";
    push @args, $type;
  }
  if(defined($initial)) {
-   push @conditions, "word LIKE '$initial%'";
+   push @conditions, "word LIKE ?";
+   push @args, ($initial . "%");
  }
 
  my $sql;
 
  if( $bg )

Vulnerable code:    push @conditions, "word LIKE '$initial%'";
Fixed code:    push @conditions, "word LIKE ?";
   push @args, ($initial . "%");
CVE-2023-26150: Improper Authentication (CWE-287)
value: Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication.**Note:**This issue is a result of missing checks for services that require an active session.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2023-10-03T05:15Z
Repository: https://github.com/FreeOpcUa/opcua-asyncio
Language: Python
Files changed: tests/test_crypto_connect.py
Commit date: 2022-09-07 11:06:54 +0200
Commit message: Revert "releax test_secure_channel_key_expiration test"

This reverts commit e02aed2909fbfd142059d30db0abb63947ab33f6.

Diff: diff --git a/tests/test_crypto_connect.py b/tests/test_crypto_connect.py
index 21b66875..b8defcea 100644
--- a/tests/test_crypto_connect.py
+++ b/tests/test_crypto_connect.py
@@ -305,11 +305,11 @@ async def test_secure_channel_key_expiration(srv_crypto_one_cert, mocker):
     )
     async with clt:
         assert clt.uaclient.security_policy.symmetric_cryptography.Prev_Verifier is None
         assert clt.uaclient.security_policy.symmetric_cryptography.Prev_Decryptor is None
 
-        await asyncio.sleep(timeout * 1.2)
+        await asyncio.sleep(timeout)
         sym_crypto = clt.uaclient.security_policy.symmetric_cryptography
         prev_verifier = sym_crypto.Prev_Verifier
         prev_decryptor = sym_crypto.Prev_Decryptor
         assert isinstance(prev_verifier, Verifier)
         assert isinstance(prev_decryptor, Decryptor)

Vulnerable code:         await asyncio.sleep(timeout * 1.2)
Fixed code:         await asyncio.sleep(timeout)
CVE-2022-2553: Improper Authentication (CWE-287)
value: The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 6.5
Published: 2022-07-28T15:15Z
Repository: https://github.com/ClusterLabs/booth
Language: C
Files changed: src/main.c
Commit date: 2022-07-04 09:41:57 +0200
Commit message: Revert "Refactor: main: substitute is_auth_req macro"

This reverts commit da79b8ba28ad4837a0fee13e5f8fb6f89fe0e24c.

authfile != authkey

Signed-off-by: Jan Friesse <jfriesse@redhat.com>

Diff: diff --git a/src/main.c b/src/main.c
index b50a883..b4a174f 100644
--- a/src/main.c
+++ b/src/main.c
@@ -362,11 +362,11 @@ static int setup_config(int type)
 
 	rv = read_config(cl.configfile, type);
 	if (rv < 0)
 		goto out;
 
-	if (is_auth_req()) {
+	if (booth_conf->authfile[0] != '\0') {
 		rv = read_authkey();
 		if (rv < 0)
 			goto out;
 #if HAVE_LIBGCRYPT
 		if (!gcry_check_version(NULL)) {

Vulnerable code: 	if (is_auth_req()) {
Fixed code: 	if (booth_conf->authfile[0] != '\0') {
CVE-2015-2972: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-07-19T15:59Z
Repository: https://github.com/sysphonic/thetis
Language: Ruby
Files changed: app/controllers/application_controller.rb
Commit date: 2015-07-07 10:34:01 +0900
Commit message: Some trivial bug-fixes.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>

Diff: diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 9b83a1af..b08bd837 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -97,11 +97,16 @@ class ApplicationController < ActionController::Base
   #
   def gate_process
 
     HistoryHelper.keep_last(request)
 
-    @login_user = User.find(session[:login_user_id])
+    SqlHelper.validate_token([session[:login_user_id]])
+    begin
+      @login_user = User.find(session[:login_user_id])
+    rescue => evar
+      @login_user = nil
+    end
 
     begin
       if @login_user.nil? \
            or @login_user.time_zone.nil? or @login_user.time_zone.empty?
         unless THETIS_USER_TIMEZONE_DEFAULT.nil? or THETIS_USER_TIMEZONE_DEFAULT.empty?

Vulnerable code:     @login_user = User.find(session[:login_user_id])
Fixed code:     SqlHelper.validate_token([session[:login_user_id]])
    begin
      @login_user = User.find(session[:login_user_id])
    rescue => evar
      @login_user = nil
    end
CVE-2021-23353: Insufficient Information (NVD-CWE-noinfo)
value: This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-03-09T19:15Z
Repository: https://github.com/MrRio/jsPDF
Language: JavaScript
Files changed: src/modules/addimage.js
Commit date: 2021-02-11 16:50:17 +0100
Commit message: fix ReDoS-vulnerable regexp in addImage (#3091)


Diff: diff --git a/src/modules/addimage.js b/src/modules/addimage.js
index 5d20660..d0295d0 100644
--- a/src/modules/addimage.js
+++ b/src/modules/addimage.js
@@ -628,11 +628,11 @@ import { atob, btoa } from "../libs/AtobBtoa.js";
     dataUrl = dataUrl || "";
     var dataUrlParts = dataUrl.split("base64,");
     var result = null;
 
     if (dataUrlParts.length === 2) {
-      var extractedInfo = /^data:(\w*\/\w*);*(charset=[\w=-]*)*;*$/.exec(
+      var extractedInfo = /^data:(\w*\/\w*);*(charset=(?!charset=)[\w=-]*)*;*$/.exec(
         dataUrlParts[0]
       );
       if (Array.isArray(extractedInfo)) {
         result = {
           mimeType: extractedInfo[1],

Vulnerable code:       var extractedInfo = /^data:(\w*\/\w*);*(charset=[\w=-]*)*;*$/.exec(
Fixed code:       var extractedInfo = /^data:(\w*\/\w*);*(charset=(?!charset=)[\w=-]*)*;*$/.exec(
CVE-2024-31995: Insufficient Information (NVD-CWE-noinfo)
value: `@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param.  This can allow invocations outside of the original intended time period.  A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T22:15Z
Repository: https://github.com/digitalbazaar/zcap
Language: JSON
Files changed: package.json
Commit date: 2024-03-29 15:14:23 -0400
Commit message: Express expectation of node >= 18.

Diff: diff --git a/package.json b/package.json
index 71ecaa0..1527cfb 100644
--- a/package.json
+++ b/package.json
@@ -61,11 +61,11 @@
       "text-summary",
       "text"
     ]
   },
   "engines": {
-    "node": ">=14"
+    "node": ">=18"
   },
   "keywords": [
     "Authorization Capability",
     "Authorization Capabilities",
     "JSON",

Vulnerable code:     "node": ">=14"
Fixed code:     "node": ">=18"
CVE-2021-4216: Divide By Zero (CWE-369)
value: A Floating point exception (division-by-zero) flaw was found in Mupdf for zero width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.
CWE description: The product divides a value by zero.
CVSS v3 base score: 5.5
Published: 2022-08-26T16:15Z
Repository: https://github.com/ArtifexSoftware/mupdf
Language: C
Files changed: source/tools/muraster.c
Commit date: 2022-01-18 20:34:11 +0100
Commit message: Bug 704834: Fix division by zero for zero width pages in muraster.

Diff: diff --git a/source/tools/muraster.c b/source/tools/muraster.c
index c2ceb62f2..97f4ae263 100644
--- a/source/tools/muraster.c
+++ b/source/tools/muraster.c
@@ -1001,12 +1001,13 @@ initialise_banding(fz_context *ctx, render_details *render, int color)
 		break;
 	}
 
 	w = render->ibounds.x1 - render->ibounds.x0;
 	min_band_mem = (size_t)bpp * w * min_band_height;
-	reps = (int)(max_band_memory / min_band_mem);
-	if (reps < 1)
+	if (min_band_mem > 0)
+		reps = (int)(max_band_memory / min_band_mem);
+	if (min_band_mem == 0 || reps < 1)
 		reps = 1;
 
 	/* Adjust reps to even out the work between threads */
 	if (render->num_workers > 0)
 	{

Vulnerable code: 	reps = (int)(max_band_memory / min_band_mem);
	if (reps < 1)
Fixed code: 	if (min_band_mem > 0)
		reps = (int)(max_band_memory / min_band_mem);
	if (min_band_mem == 0 || reps < 1)
CVE-2023-30857: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: @aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible prototype pollution issue for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package. The likelihood of exploitation is questionable, given that a class's metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can lead to a security impact. The issue has been patched in version `0.6.1`.

CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 3.7
Published: 2023-04-28T21:15Z
Repository: https://github.com/aedart/ion
Language: TypeScript
Files changed: packages/support/src/meta/meta.ts
Commit date: 2023-04-28 18:25:43 +0200
Commit message: Fix possible prototype pollution

Not entirely sure how likely this will ever be for metadata, but just in case that the entire metadata record's prototype is attempted polluted, then this will prevent it.
Diff: diff --git a/packages/support/src/meta/meta.ts b/packages/support/src/meta/meta.ts
index a1c1bc6..31a1ba7 100644
--- a/packages/support/src/meta/meta.ts
+++ b/packages/support/src/meta/meta.ts
@@ -215,11 +215,11 @@ function resolveMetadataRecord(owner: object, context: Context, useMetaFromConte
     if (useMetaFromContext) {
         return context.metadata as MetadataRecord;
     }
 
     // Obtain record from registry, or create new empty object.
-    let metadata: MetadataRecord = registry.get(owner) ?? {};
+    let metadata: MetadataRecord = registry.get(owner) ?? Object.create(null);
 
     // In case that the owner has Symbol.metadata defined (e.g. from base class),
     // then merge it current metadata. This ensures that inheritance works as
     // intended, whilst a base class still keeping its original metadata.
     if (Reflect.has(owner, METADATA)) {

Vulnerable code:     let metadata: MetadataRecord = registry.get(owner) ?? {};
Fixed code:     let metadata: MetadataRecord = registry.get(owner) ?? Object.create(null);
CVE-2019-18397: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.8
Published: 2019-11-13T14:15Z
Repository: https://github.com/fribidi/fribidi
Language: C
Files changed: lib/fribidi-bidi.c
Commit date: 2019-10-24 09:37:29 +0300
Commit message: Truncate isolate_level to FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL

Diff: diff --git a/lib/fribidi-bidi.c b/lib/fribidi-bidi.c
index 6c84392..d384878 100644
--- a/lib/fribidi-bidi.c
+++ b/lib/fribidi-bidi.c
@@ -745,11 +745,13 @@ fribidi_get_par_embedding_levels_ex (
               else
                 new_level = level + 2 - (level%2);
             }
 
 	  RL_LEVEL (pp) = level;
-          RL_ISOLATE_LEVEL (pp) = isolate_level++;
+          RL_ISOLATE_LEVEL (pp) = isolate_level;
+          if (isolate_level < FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL-1)
+              isolate_level++;
           base_level_per_iso_level[isolate_level] = new_level;
 
 	  if (!FRIBIDI_IS_NEUTRAL (override))
 	    RL_TYPE (pp) = override;
 

Vulnerable code:           RL_ISOLATE_LEVEL (pp) = isolate_level++;
Fixed code:           RL_ISOLATE_LEVEL (pp) = isolate_level;
          if (isolate_level < FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL-1)
              isolate_level++;
CVE-2022-25309: Heap-based Buffer Overflow (CWE-122)
value: A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading to a crash and causing a denial of service.
CWE description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CVSS v3 base score: 5.5
Published: 2022-09-06T18:15Z
Repository: https://github.com/fribidi/fribidi
Language: C
Files changed: lib/fribidi-char-sets-cap-rtl.c
Commit date: 2022-03-25 09:09:49 +0300
Commit message: Protected against garbage in the CapRTL encoder

Diff: diff --git a/lib/fribidi-char-sets-cap-rtl.c b/lib/fribidi-char-sets-cap-rtl.c
index b0c0e4a..f74e010 100644
--- a/lib/fribidi-char-sets-cap-rtl.c
+++ b/lib/fribidi-char-sets-cap-rtl.c
@@ -230,11 +230,16 @@ fribidi_cap_rtl_to_unicode (
 	      i--;
 	      break;
 	    }
 	}
       else
-	us[j++] = caprtl_to_unicode[(int) s[i]];
+      {
+        if ((int)s[i] < 0)
+          us[j++] = '?';
+        else
+          us[j++] = caprtl_to_unicode[(int) s[i]];
+      }
     }
 
   return j;
 }
 

Vulnerable code: 	us[j++] = caprtl_to_unicode[(int) s[i]];
Fixed code:       {
        if ((int)s[i] < 0)
          us[j++] = '?';
        else
          us[j++] = caprtl_to_unicode[(int) s[i]];
      }
CVE-2020-4045: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1. Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2020-06-11T22:15Z
Repository: https://github.com/ssbc/ssb-db
Language: Unknown
Commit date: 2020-06-11 14:36:12 +1200
Commit message: Merge pull request from GHSA-mpgr-2cx9-327h

Fix get() returning decrypted messages
CVE-2021-4170: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-16T21:15Z
Repository: https://github.com/janeczku/calibre-web
Language: JavaScript
Files changed: cps/static/js/edit_books.js
Commit date: 2021-11-20 13:40:23 +0100
Commit message: Fix upload of cover and book formats containing html characters

Diff: diff --git a/cps/static/js/edit_books.js b/cps/static/js/edit_books.js
index ddc7a3e7e..0bfe078cf 100644
--- a/cps/static/js/edit_books.js
+++ b/cps/static/js/edit_books.js
@@ -246,19 +246,19 @@ $("#search").on("change input.typeahead:selected", function(event) {
 $("#btn-upload-format").on("change", function () {
     var filename = $(this).val();
     if (filename.substring(3, 11) === "fakepath") {
         filename = filename.substring(12);
     } // Remove c:\fake at beginning from localhost chrome
-    $("#upload-format").html(filename);
+    $("#upload-format").text(filename);
 });
 
 $("#btn-upload-cover").on("change", function () {
     var filename = $(this).val();
     if (filename.substring(3, 11) === "fakepath") {
         filename = filename.substring(12);
     } // Remove c:\fake at beginning from localhost chrome
-    $("#upload-cover").html(filename);
+    $("#upload-cover").text(filename);
 });
 
 $("#xchange").click(function () {
     this.blur();
     var title = $("#book_title").val();

Vulnerable code:     $("#upload-format").html(filename);
    $("#upload-cover").html(filename);
Fixed code:     $("#upload-format").text(filename);
    $("#upload-cover").text(filename);