Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-12871: Inadequate Encryption Strength (CWE-326)
value: The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).
CWE description: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CVSS v3 base score: 5.9
Published: 2017-09-01T21:29Z
Repository: https://github.com/simplesamlphp/simplesamlphp
Language: PHP
Files changed: lib/SimpleSAML/Utils/Crypto.php
Commit date: 2017-03-30 10:51:00 +0200
Commit message: Fix an issue with IV generation in SimpleSAML\Utils\Crypto::aesEncrypt().

IVs must be random and one-time (never reused). Additionally, by deriving it from the key, the key length was effectively reduced to 128 bits.

Diff: diff --git a/lib/SimpleSAML/Utils/Crypto.php b/lib/SimpleSAML/Utils/Crypto.php
index d8a3356d..22335b32 100644
--- a/lib/SimpleSAML/Utils/Crypto.php
+++ b/lib/SimpleSAML/Utils/Crypto.php
@@ -84,11 +84,11 @@ class Crypto
 
         $raw    = defined('OPENSSL_RAW_DATA') ? OPENSSL_RAW_DATA : true;
         $key    = openssl_digest($secret, 'sha256');
         $method = 'AES-256-CBC';
         $ivSize = 16;
-        $iv     = substr($key, 0, $ivSize);
+        $iv     = openssl_random_pseudo_bytes($ivSize);
 
         return $iv.openssl_encrypt($data, $method, $key, $raw, $iv);
     }
 
 

Vulnerable code:         $iv     = substr($key, 0, $ivSize);
Fixed code:         $iv     = openssl_random_pseudo_bytes($ivSize);
CVE-2020-5301: Improper Handling of Case Sensitivity (CWE-178)
value: SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6.
CWE description: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CVSS v3 base score: 3.1
Published: 2020-04-21T20:15Z
Repository: https://github.com/simplesamlphp/simplesamlphp
Language: PHP
Files changed: lib/SimpleSAML/Module.php
Commit date: 2020-04-16 14:36:28 +0200
Commit message: Fix source code disclosure on case-insensitive file systems

If the file system containing the PHP code is case-insensitive, a
request containing an uppercase file extension will return the
contents of the PHP file to the browser instead of executing it.

E.g. a request for this URL will return the source code:

  https:/sp.example.org/simplesaml/module.php/core/frontpage_welcome.PHP

Fix that by converting the path to lowercase before checking the file
extension.

See the following page for details:

  https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq

Diff: diff --git a/lib/SimpleSAML/Module.php b/lib/SimpleSAML/Module.php
index d6f5c79ca..dfe056a38 100644
--- a/lib/SimpleSAML/Module.php
+++ b/lib/SimpleSAML/Module.php
@@ -257,11 +257,11 @@ class Module
             // file not found
             Logger::info('Could not find file \'' . $path . '\'.');
             throw new Error\NotFound('The URL wasn\'t found in the module.');
         }
 
-        if (substr($path, -4) === '.php') {
+        if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {
             // PHP file - attempt to run it
 
             /* In some environments, $_SERVER['SCRIPT_NAME'] is already set with $_SERVER['PATH_INFO']. Check for that
              * case, and append script name only if necessary.
              *

Vulnerable code:         if (substr($path, -4) === '.php') {
Fixed code:         if (mb_strtolower(substr($path, -4), 'UTF-8') === '.php') {
CVE-2014-9709: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2015-03-30T10:59Z
Repository: https://bitbucket.org/libgd/gd-libgd
Language: C
Files changed: src/gd_gif_in.c
Commit date: 2014-12-13 08:48:18 +0100
Commit message: Fix possible buffer read overflow
detected by -fsanitize=address, thanks to Jan Bee

Diff: diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c
index b3b4ca3..13a663c 100644
--- a/src/gd_gif_in.c
+++ b/src/gd_gif_in.c
@@ -73,12 +73,14 @@ static struct {
 } Gif89 = { -1, -1, -1, 0 };
 #endif
 
 #define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)
 
+#define CSD_BUF_SIZE 280
+
 typedef struct {
-	unsigned char buf[280];
+	unsigned char buf[CSD_BUF_SIZE];
 	int curbit;
 	int lastbit;
 	int done;
 	int last_byte;
 } CODE_STATIC_DATA;
@@ -466,11 +468,16 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
 		scd->lastbit = (2 + count) * 8;
 	}
 
 	ret = 0;
 	for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
-		ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+		if (i < CSD_BUF_SIZE * 8) {
+			ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+		} else {
+			ret = -1;
+			break;
+		}
 	}
 
 	scd->curbit += code_size;
 
 	return ret;

Vulnerable code: 	unsigned char buf[280];
		ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
Fixed code: #define CSD_BUF_SIZE 280

	unsigned char buf[CSD_BUF_SIZE];
		if (i < CSD_BUF_SIZE * 8) {
			ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
		} else {
			ret = -1;
			break;
		}
CVE-2017-11667: Insufficient Session Expiration (CWE-613)
value: OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 8.1
Published: 2017-07-26T20:29Z
Repository: https://github.com/opf/openproject
Language: Unknown
Commit date: 2017-06-29 13:05:39 +0200
Commit message: Merge remote-tracking branch 'origin/release/7.1' into dev
CVE-2020-36561: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2022-12-27T22:15Z
Repository: https://github.com/yi-ge/unzip
Language: Unknown
Commit date: 2020-03-08 16:43:13 +0800
Commit message: Merge pull request #1 from snoopysecurity/fix/santize-filename-paths

fix: sanitize filepath names
CVE-2020-27638: Reachable Assertion (CWE-617)
value: receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2020-10-22T13:15Z
Repository: https://github.com/NeoRaider/fastd
Language: C
Files changed: src/receive.c
Commit date: 2020-10-19 21:08:16 +0200
Commit message: receive: fix buffer leak when receiving invalid packets

For fastd versions before v20, this was just a memory leak (which could
still be used for DoS, as it's remotely triggerable). With the new
buffer management of fastd v20, this will trigger an assertion failure
instead as soon as the buffer pool is empty.

Diff: diff --git a/src/receive.c b/src/receive.c
index 043c9f2..6bca9f4 100644
--- a/src/receive.c
+++ b/src/receive.c
@@ -167,10 +167,15 @@ static inline void handle_socket_receive_known(
 		conf.protocol->handle_recv(peer, buffer);
 		break;
 
 	case PACKET_HANDSHAKE:
 		fastd_handshake_handle(sock, local_addr, remote_addr, peer, buffer);
+		break;
+
+	default:
+		fastd_buffer_free(buffer);
+		pr_debug("received packet with invalid type from %P[%I]", peer, remote_addr);
 	}
 }
 
 /** Determines if packets from known addresses are accepted */
 static inline bool allow_unknown_peers(void) {
@@ -193,10 +198,15 @@ static inline void handle_socket_receive_unknown(
 		}
 		break;
 
 	case PACKET_HANDSHAKE:
 		fastd_handshake_handle(sock, local_addr, remote_addr, NULL, buffer);
+		break;
+
+	default:
+		fastd_buffer_free(buffer);
+		pr_debug("received packet with invalid type from unknown address %I", remote_addr);
 	}
 }
 
 /** Handles a packet read from a socket */
 static inline void handle_socket_receive(

Fixed code: 		break;

	default:
		fastd_buffer_free(buffer);
		pr_debug("received packet with invalid type from %P[%I]", peer, remote_addr);
		break;

	default:
		fastd_buffer_free(buffer);
		pr_debug("received packet with invalid type from unknown address %I", remote_addr);
CVE-2020-15105: Cleartext Storage of Sensitive Information (CWE-312)
value: Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password and then leaves before entering their two-factor authentication code. The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' passwords are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' passwords are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis). This has been fixed in 1.12. After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas. In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used. As a workaround, wwitching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading.
CWE description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CVSS v3 base score: 5.4
Published: 2020-07-10T21:15Z
Repository: https://github.com/Bouke/django-two-factor-auth
Language: Unknown
Commit date: 2020-07-08 21:11:38 +0200
Commit message: Merge pull request from GHSA-vhr6-pvjm-9qwf

Discontinue storing credentials in the session store
CVE-2024-28186: Insufficient Information (NVD-CWE-noinfo)
value: FreeScout is an open source help desk and shared inbox built with PHP.

A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing complete stack traces of exceptions in its database. The sensitive information is then inadvertently disclosed to users via the `/conversation/ajax-html/send_log?folder_id=&thread_id={id}` endpoint. The stack trace reveals value of parameters, including the username and password, passed to the `Swift_Transport_Esmtp_Auth_LoginAuthenticator->authenticate()` function. Exploiting this vulnerability allows an attacker to gain unauthorized access to SMTP server credentials. With this sensitive information in hand, the attacker can potentially send unauthorized emails from the compromised SMTP server, posing a severe threat to the confidentiality and integrity of email communications. This could lead to targeted attacks on both the application users and the organization itself, compromising the security of email exchange servers. This issue has been addressed in version 1.8.124. Users are advised to upgrade. Users unable to upgrade should adopt the following measures: 1. Avoid Storing Complete Stack Traces, 2. Implement redaction mechanisms to filter and exclude sensitive information, and 3. Review and enhance the application's logging practices.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-12T20:15Z
Repository: https://github.com/freescout-helpdesk/freescout
Language: Unknown
Commit date: 2024-03-08 00:09:52 -0800
Commit message: Merge branch 'master' of github.com:freescout-helpdesk/freescout into dist
CVE-2024-34697: Insufficient Information (NVD-CWE-noinfo)
value: FreeScout is a free, self-hosted help desk and shared mailbox. A stored HTML Injection vulnerability has been identified in the Email Receival Module of the Freescout Application. The vulnerability allows attackers to inject malicious HTML content into emails sent to the application's mailbox. This vulnerability arises from improper handling of HTML content within incoming emails, allowing attackers to embed malicious HTML code in the context of the application's domain. Unauthenticated attackers can exploit this vulnerability to inject malicious HTML content into emails. This could lead to various attacks such as form hijacking, application defacement, or data exfiltration via CSS injection. Although unauthenticated attackers are limited to HTML injection, the consequences can still be severe. Version 1.8.139 implements strict input validation and sanitization mechanisms to ensure that any HTML content received via emails is properly sanitized to prevent malicious HTML injections.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:39Z
Repository: https://github.com/freescout-helpdesk/freescout
Language: PHP
Files changed: app/Http/Controllers/ConversationsController.php
Commit date: 2024-05-06 00:52:36 -0700
Commit message: Remove unwanted tags from HTML when editing threads - GHSA-985r-6qfc-hg8m

Diff: diff --git a/app/Http/Controllers/ConversationsController.php b/app/Http/Controllers/ConversationsController.php
index 99449c4e6..44aaef845 100755
--- a/app/Http/Controllers/ConversationsController.php
+++ b/app/Http/Controllers/ConversationsController.php
@@ -1953,15 +1953,16 @@ class ConversationsController extends Controller
                 } elseif (!$user->can('edit', $thread)) {
                     $response['msg'] = __('Not enough permissions');
                 }
 
                 if (!$response['msg']) {
+                    $thread->body = \Helper::stripDangerousTags($thread->body);
+
                     $data = [
                         'thread' => $thread
                     ];
                     $response['html'] = \View::make('conversations/partials/edit_thread')->with($data)->render();
-                    $response['html'] = \Helper::stripDangerousTags($response['html']);
 
                     $response['status'] = 'success';
                 }
                 break;
 

Vulnerable code:                     $response['html'] = \Helper::stripDangerousTags($response['html']);
Fixed code:                     $thread->body = \Helper::stripDangerousTags($thread->body);
CVE-2024-34698: Insufficient Information (NVD-CWE-noinfo)
value: FreeScout is a free, self-hosted help desk and shared mailbox. Versions of FreeScout prior to 1.8.139 contain a Prototype Pollution vulnerability in the `/public/js/main.js` source file. The Prototype Pollution arises because the `getQueryParam` Function recursively merges an object containing user-controllable properties into an existing object (For URL Query Parameters Parsing), without first sanitizing the keys. This can allow an attacker to inject a property with a key `__proto__`, along with arbitrarily nested properties. The merge operation assigns the nested properties to the `params` object's prototype instead of the target object itself. As a result, the attacker can pollute the prototype with properties containing harmful values, which are then inherited by user-defined objects and subsequently used by the application dangerously. The vulnerability lets an attacker control properties of objects that would otherwise be inaccessible. If the application subsequently handles an attacker-controlled property in an unsafe way, this can potentially be chained with other vulnerabilities like DOM-based XSS, Open Redirection, Cookie Manipulation, Link Manipulation, HTML Injection, etc. Version 1.8.139 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:39Z
Repository: https://github.com/freescout-helpdesk/freescout
Language: JavaScript
Files changed: public/js/main.js
Commit date: 2024-05-04 22:59:35 -0700
Commit message: Do not allow Prototype Pollution via getQueryParam() function - GHSA-rx6j-4c33-9h3r

Diff: diff --git a/public/js/main.js b/public/js/main.js
index 459520fa5..d0efb0392 100755
--- a/public/js/main.js
+++ b/public/js/main.js
@@ -2363,10 +2363,16 @@ function getQueryParam(name, qs) {
         params[key] = decodeURIComponent(tokens[2]);
     }
 
     // Process arrays
     for (var param in params) {
+
+    	// Skip __proto__
+    	// https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-rx6j-4c33-9h3r
+    	if (param.match(/^__proto__\[/i)) {
+    		continue;
+    	}
     	
     	// Two dimentional
     	var m = param.match(/^([^\[]+)\[([^\[]+)\]$/i);
 
     	if (m && m.length) {

Fixed code: 
    	// Skip __proto__
    	// https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-rx6j-4c33-9h3r
    	if (param.match(/^__proto__\[/i)) {
    		continue;
    	}
CVE-2021-41149: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2021-10-19T18:15Z
Repository: https://github.com/awslabs/tough
Language: Unknown
Commit date: 2021-10-19 07:34:15 -0700
Commit message: Merge pull request from GHSA-x3r5-q6mj-m485

sanitize target names and delegate role names
CVE-2021-41150: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2021-10-19T20:15Z
Repository: https://github.com/awslabs/tough
Language: Unknown
Commit date: 2021-10-19 07:34:15 -0700
Commit message: Merge pull request from GHSA-x3r5-q6mj-m485

sanitize target names and delegate role names
CVE-2016-1587: Improper Access Control (CWE-284)
value: The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 7.5
Published: 2019-04-22T16:29Z
Repository: https://github.com/snapcore/snapweb
Language: Unknown
Commit date: 2016-10-20 19:18:23 +0200
Commit message: Merge pull request #84 from dbarth/token

Access Token
CVE-2022-0841: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-03-03T16:15Z
Repository: https://github.com/ljharb/npm-lockfile
Language: Other
Files changed: .eslintrc, getLockfile.js
Commit date: 2022-03-01 21:38:48 -0800
Commit message: [Fix] reject invalid `only` values

Diff: diff --git a/.eslintrc b/.eslintrc
index 5597fdc..44d150f 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -5,8 +5,9 @@
 
 	"rules": {
 		"consistent-return": 1,
 		"func-name-matching": 0,
 		"max-nested-callbacks": 0,
+		"max-lines-per-function": 0,
 		"sort-keys": 0,
 	},
 }
diff --git a/getLockfile.js b/getLockfile.js
index ca351bb..423cd43 100644
--- a/getLockfile.js
+++ b/getLockfile.js
@@ -21,10 +21,13 @@ module.exports = function getLockfile(packageFile, date, {
 		return Promise.reject(colors.red(`\`packageFile\` must be a non-empty string; got ${inspect(packageFile)}`));
 	}
 	if (typeof date !== 'undefined' && !new Date(date).getTime()) {
 		return Promise.reject(colors.red(`\`date\` must be a valid Date format if provided; got ${inspect(date)}`));
 	}
+	if (only && only !== 'prod' && only !== 'production') {
+		return Promise.reject(colors.red('`only`, when provided, must be "prod" or "production"'));
+	}
 	const tmpDirP = getProjectTempDir({ npmNeeded, logger });
 	const npmRC = path.join(path.dirname(packageFile), '.npmrc');
 	const copyPkg = tmpDirP.then((tmpDir) => {
 		logger(colors.blue(`Creating \`package.json\` in temp dir for ${date || '“now”'} lockfile`));
 		return Promise.all([

Fixed code: 		"max-lines-per-function": 0,
	if (only && only !== 'prod' && only !== 'production') {
		return Promise.reject(colors.red('`only`, when provided, must be "prod" or "production"'));
	}
CVE-2017-5924: Use After Free (CWE-416)
value: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2017-04-03T05:59Z
Repository: https://github.com/VirusTotal/yara
Language: Other
Files changed: libyara/grammar.y
Commit date: 2017-01-09 13:17:39 +0100
Commit message: Make sure that loop depth is greater than 0 before decrementing it.

Diff: diff --git a/libyara/grammar.y b/libyara/grammar.y
index 446d3741..bf3c88b4 100644
--- a/libyara/grammar.y
+++ b/libyara/grammar.y
@@ -1015,12 +1015,15 @@ expression
 
         $$.type = EXPRESSION_TYPE_BOOLEAN;
       }
     | _FOR_ for_expression error
       {
-        compiler->loop_depth--;
-        compiler->loop_identifier[compiler->loop_depth] = NULL;
+        if (compiler->loop_depth > 0)
+        {
+          compiler->loop_depth--;
+          compiler->loop_identifier[compiler->loop_depth] = NULL;
+        }
       }
     | _FOR_ for_expression _IDENTIFIER_ _IN_
       {
         int var_index;
 

Vulnerable code:         compiler->loop_depth--;
        compiler->loop_identifier[compiler->loop_depth] = NULL;
Fixed code:         if (compiler->loop_depth > 0)
        {
          compiler->loop_depth--;
          compiler->loop_identifier[compiler->loop_depth] = NULL;
        }
CVE-2017-9465: Out-of-bounds Read (CWE-125)
value: The yr_arena_write_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain sensitive information from process memory via a crafted file that is mishandled in the yr_re_fast_exec function in libyara/re.c and the _yr_scan_match_callback function in libyara/scan.c.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2017-06-06T21:29Z
Repository: https://github.com/VirusTotal/yara
Language: C
Files changed: libyara/re.c, libyara/scan.c
Commit date: 2017-06-06 19:07:27 +0200
Commit message: Fix buffer overrun (issue #678). Add assert for detecting this kind of issues earlier.

Diff: diff --git a/libyara/re.c b/libyara/re.c
index 959979ba..1b767ff5 100644
--- a/libyara/re.c
+++ b/libyara/re.c
@@ -2318,15 +2318,15 @@ int yr_re_fast_exec(
           repeat_any_args = (RE_REPEAT_ANY_ARGS*)(ip + 1);
           next_opcode = ip + 1 + sizeof(RE_REPEAT_ANY_ARGS);
 
           for (i = repeat_any_args->min + 1; i <= repeat_any_args->max; i++)
           {
-            next_input = input + i * input_incr;
-
             if (bytes_matched + i >= max_bytes_matched)
               break;
 
+            next_input = input + i * input_incr;
+
             if ( *(next_opcode) != RE_OPCODE_LITERAL ||
                 (*(next_opcode) == RE_OPCODE_LITERAL &&
                  *(next_opcode + 1) == *next_input))
             {
               if (sp >= MAX_FAST_RE_STACK)
@@ -2339,10 +2339,11 @@ int yr_re_fast_exec(
             }
           }
 
           input += input_incr * repeat_any_args->min;
           bytes_matched += repeat_any_args->min;
+          bytes_matched = yr_min(bytes_matched, max_bytes_matched);
           ip = next_opcode;
 
           break;
 
         default:
diff --git a/libyara/scan.c b/libyara/scan.c
index a48c45e6..619e64cb 100644
--- a/libyara/scan.c
+++ b/libyara/scan.c
@@ -441,10 +441,13 @@ int _yr_scan_match_callback(
   size_t match_offset = match_data - callback_args->data;
 
   // total match length is the sum of backward and forward matches.
   match_length += callback_args->forward_matches;
 
+  // make sure that match fits into the data.
+  assert(match_offset + match_length <= callback_args->data_size);
+
   if (callback_args->full_word)
   {
     if (flags & RE_FLAGS_WIDE)
     {
       if (match_offset >= 2 &&

Vulnerable code:             next_input = input + i * input_incr;

Fixed code:             next_input = input + i * input_incr;

          bytes_matched = yr_min(bytes_matched, max_bytes_matched);
  // make sure that match fits into the data.
  assert(match_offset + match_length <= callback_args->data_size);
CVE-2022-45182: Insufficient Information (NVD-CWE-noinfo)
value: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2022-11-11T20:15Z
Repository: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash
Language: PHP
Files changed: dstarrepeater/link_manager.php
Commit date: 2022-10-03 16:43:16 +0100
Commit message: Update link_manager.php

probably better fix for #169
Diff: diff --git a/dstarrepeater/link_manager.php b/dstarrepeater/link_manager.php
index 404ca82..7474b1a 100755
--- a/dstarrepeater/link_manager.php
+++ b/dstarrepeater/link_manager.php
@@ -8,11 +8,14 @@ if (preg_match('/[^A-Z]/',$_POST["Link"])) { unset ($_POST["Link"]);}
 if ($_POST["Link"] == "LINK") {
 	if (preg_match('/[^A-Za-z0-9 ]/',$_POST["RefName"])) { unset ($_POST["RefName"]);}
 	if (preg_match('/[^A-Z]/',$_POST["Letter"])) { unset ($_POST["Letter"]);}
 	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
 	}
-
+if ($_POST["Link"] == "UNLINK") {
+	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
+	}
+	
 if (empty($_POST["RefName"]) || empty($_POST["Letter"]) || empty($_POST["Module"])) { echo "Somthing wrong with your input, try again";}
 
 
 else {
 	if (strlen($_POST["RefName"]) != 7) {
@@ -20,12 +23,11 @@ else {
 	} else {
 		$targetRef = $_POST["RefName"];
 	}
 	$targetRef = $targetRef.$_POST["Letter"];
 	$targetRef = strtoupper($targetRef);
-	$module = substr($_POST["Module"], 0, 7);
-	$module = preg_replace("/[^a-zA-Z0-9]+/", "", $module);
+	$module = $_POST["Module"];
 
         if (strlen($module) != 8) {							//Fix the length of the module information
 		$moduleFixedCs = strlen($module) - 1;                                   //Length of the string, -1
                 $moduleFixedBand = substr($module, -1);                                 //Single Band Letter in the 8th position
                 $moduleFixedCallPad = str_pad(substr($module, 0, $moduleFixedCs), 7);   //Pad the callsign area to 7 chars

Vulnerable code: 
	$module = substr($_POST["Module"], 0, 7);
	$module = preg_replace("/[^a-zA-Z0-9]+/", "", $module);
Fixed code: if ($_POST["Link"] == "UNLINK") {
	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
	}
	
	$module = $_POST["Module"];
CVE-2022-45182: Insufficient Information (NVD-CWE-noinfo)
value: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2022-11-11T20:15Z
Repository: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash
Language: PHP
Files changed: admin/admin.php
Commit date: 2022-10-03 20:16:07 +0100
Commit message: Update admin.php

More fixes relating to #169
Diff: diff --git a/admin/admin.php b/admin/admin.php
index 20bff804..d53ca01f 100755
--- a/admin/admin.php
+++ b/admin/admin.php
@@ -24,11 +24,13 @@ if (preg_match('/[^A-Z]/',$_POST["Link"])) { unset ($_POST["Link"]);}
 if ($_POST["Link"] == "LINK") {
 	if (preg_match('/[^A-Z0-9]/',$_POST["RefName"])) { unset ($_POST["RefName"]);}
 	if (preg_match('/[^A-Z]/',$_POST["Letter"])) { unset ($_POST["Letter"]);}
 	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
 	}
-
+if ($_POST["Link"] == "UNLINK") {
+	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
+	}
 if (empty($_POST["RefName"]) || empty($_POST["Letter"]) || empty($_POST["Module"])) { echo "Somthing wrong with your input, try again";}
 
 
 else {
 	$targetRef = $_POST["RefName"]." ".$_POST["Letter"];

Fixed code: if ($_POST["Link"] == "UNLINK") {
	if (preg_match('/[^A-Z0-9 ]/',$_POST["Module"])) { unset ($_POST["Module"]);}
	}
CVE-2022-45182: Insufficient Information (NVD-CWE-noinfo)
value: Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2022-11-11T20:15Z
Repository: https://github.com/AndyTaylorTweet/Pi-Star_DV_Dash
Language: PHP
Files changed: dstarrepeater/link_manager.php
Commit date: 2022-10-03 16:23:36 +0100
Commit message: Update link_manager.php

Fix #169
Diff: diff --git a/dstarrepeater/link_manager.php b/dstarrepeater/link_manager.php
index 6b8968ba..404ca82f 100755
--- a/dstarrepeater/link_manager.php
+++ b/dstarrepeater/link_manager.php
@@ -20,11 +20,12 @@ else {
 	} else {
 		$targetRef = $_POST["RefName"];
 	}
 	$targetRef = $targetRef.$_POST["Letter"];
 	$targetRef = strtoupper($targetRef);
-	$module = $_POST["Module"];
+	$module = substr($_POST["Module"], 0, 7);
+	$module = preg_replace("/[^a-zA-Z0-9]+/", "", $module);
 
         if (strlen($module) != 8) {							//Fix the length of the module information
 		$moduleFixedCs = strlen($module) - 1;                                   //Length of the string, -1
                 $moduleFixedBand = substr($module, -1);                                 //Single Band Letter in the 8th position
                 $moduleFixedCallPad = str_pad(substr($module, 0, $moduleFixedCs), 7);   //Pad the callsign area to 7 chars

Vulnerable code: 	$module = $_POST["Module"];
Fixed code: 	$module = substr($_POST["Module"], 0, 7);
	$module = preg_replace("/[^a-zA-Z0-9]+/", "", $module);
CVE-2022-36087: Improper Input Validation (CWE-20)
value: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2022-09-09T21:15Z
Repository: https://github.com/oauthlib/oauthlib
Language: Unknown
Commit date: 2022-09-09 21:48:14 +0200
Commit message: Merge pull request from GHSA-3pgj-pg6c-r5p7

Improve test coverage of IPv6 parsing
CVE-2013-10028: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in EELV Newsletter Plugin 2.x on WordPress. It has been rated as problematic. Affected by this issue is the function style_newsletter of the file lettreinfo.php. The manipulation of the argument email leads to cross site scripting. The attack may be launched remotely. The name of the patch is 3339b42316c5edf73e56eb209b6a3bb3e868d6ed. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230660.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-04T19:15Z
Repository: https://github.com/wp-plugins/eelv-newsletter
Language: PHP
Files changed: lettreinfo.php
Commit date: 2013-04-17 09:35:26 +0000
Commit message: XSS fix

git-svn-id: https://plugins.svn.wordpress.org/eelv-newsletter/trunk@698982 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/lettreinfo.php b/lettreinfo.php
index 30855ce..584a984 100644
--- a/lettreinfo.php
+++ b/lettreinfo.php
@@ -336,11 +336,11 @@ load_plugin_textdomain( 'eelv_lettreinfo', false, 'eelv-newsletter/languages' );
             }
             break;
          }
       }
       else{
-        $news_reg_return.= strip_tags($email).' : '.__('invalid address', 'eelv_lettreinfo');
+        $news_reg_return.= '<b>'.htmlspecialchars(strip_tags($email)).'</b> : '.__('invalid address', 'eelv_lettreinfo');
       }
     }
   }
   ////////////////////////////////////////////////////////////////////////////////////////////////////// FRONT OFFICE
   function get_news_form($id=''){

Vulnerable code:         $news_reg_return.= strip_tags($email).' : '.__('invalid address', 'eelv_lettreinfo');
Fixed code:         $news_reg_return.= '<b>'.htmlspecialchars(strip_tags($email)).'</b> : '.__('invalid address', 'eelv_lettreinfo');
CVE-2023-49281: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-12-01T22:15Z
Repository: https://github.com/Cainor/Calendarinho
Language: Python
Files changed: CalendarinhoApp/authentication.py
Commit date: 2023-10-11 17:11:31 +0300
Commit message: Full Fix for Open Redirect Issue #1

Diff: diff --git a/CalendarinhoApp/authentication.py b/CalendarinhoApp/authentication.py
index 79ee2ff..6f37cee 100644
--- a/CalendarinhoApp/authentication.py
+++ b/CalendarinhoApp/authentication.py
@@ -34,14 +34,12 @@ def loginForm(request, next=''):
             user = user = authenticate(username=username, password=password)
             if user and user.is_active:
                 login(request, user)
                 next_url = request.POST.get('next', '')
                 if (next_url and url_has_allowed_host_and_scheme(next_url, settings.ALLOWED_HOSTS)):
-                    print("Good People")
                     return HttpResponseRedirect(next_url)
                 else:
-                    print("fucking bad shit")
                     return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
             else:
                 messages.error(request, "Invalid login details given")
                 form = Login_Form()
                 return render(request, 'CalendarinhoApp/login.html', {'form': form})

Vulnerable code:                     print("Good People")
                    print("fucking bad shit")
CVE-2023-49281: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-12-01T22:15Z
Repository: https://github.com/Cainor/Calendarinho
Language: Python
Files changed: CalendarinhoApp/authentication.py
Commit date: 2023-10-11 08:32:09 +0300
Commit message: Fix Open Redirect - Thanks to @7hj4

Diff: diff --git a/CalendarinhoApp/authentication.py b/CalendarinhoApp/authentication.py
index 160457d..0b807ce 100644
--- a/CalendarinhoApp/authentication.py
+++ b/CalendarinhoApp/authentication.py
@@ -31,12 +31,13 @@ def loginForm(request, next=''):
             username = request.POST.get('username')
             password = request.POST.get('password')
             user = user = authenticate(username=username, password=password)
             if user and user.is_active:
                 login(request, user)
-                if 'next' in request.POST:
-                    return HttpResponseRedirect(request.POST.get('next'))
+                next_url = request.POST.get('next', '')
+                if next_url and next_url.startswith('/'):
+                    return HttpResponseRedirect(next_url)
                 else:
                     return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
             else:
                 messages.error(request, "Invalid login details given")
                 form = Login_Form()

Vulnerable code:                 if 'next' in request.POST:
                    return HttpResponseRedirect(request.POST.get('next'))
Fixed code:                 next_url = request.POST.get('next', '')
                if next_url and next_url.startswith('/'):
                    return HttpResponseRedirect(next_url)
CVE-2023-49281: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Calendarinho is an open source calendaring application to manage large teams of consultants. An Open Redirect issue occurs when a web application redirects users to external URLs without proper validation. This can lead to phishing attacks, where users are tricked into visiting malicious sites, potentially leading to information theft and reputational damage to the website used for redirection. The problem is has been patched in commit `15b2393`. Users are advised to update to a commit after `15b2393`. There are no known workarounds for this vulnerability. 
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-12-01T22:15Z
Repository: https://github.com/Cainor/Calendarinho
Language: Python
Files changed: CalendarinhoApp/authentication.py
Commit date: 2023-10-11 17:09:53 +0300
Commit message: Full Fix for Open Redirect Issue #1

Diff: diff --git a/CalendarinhoApp/authentication.py b/CalendarinhoApp/authentication.py
index 0b807ce..79ee2ff 100644
--- a/CalendarinhoApp/authentication.py
+++ b/CalendarinhoApp/authentication.py
@@ -9,10 +9,11 @@ from django.contrib.auth import authenticate, login, logout
 from django.urls import reverse
 from django.contrib import messages
 from django.contrib.auth.decorators import login_required
 from django.core.mail import EmailMessage
 from django.contrib.auth.forms import PasswordResetForm
+from django.utils.http import url_has_allowed_host_and_scheme
 import logging
 from django.conf import settings
 from .email import send_forget_password_OTP
 from threading import Thread
 
@@ -32,13 +33,15 @@ def loginForm(request, next=''):
             password = request.POST.get('password')
             user = user = authenticate(username=username, password=password)
             if user and user.is_active:
                 login(request, user)
                 next_url = request.POST.get('next', '')
-                if next_url and next_url.startswith('/'):
+                if (next_url and url_has_allowed_host_and_scheme(next_url, settings.ALLOWED_HOSTS)):
+                    print("Good People")
                     return HttpResponseRedirect(next_url)
                 else:
+                    print("fucking bad shit")
                     return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
             else:
                 messages.error(request, "Invalid login details given")
                 form = Login_Form()
                 return render(request, 'CalendarinhoApp/login.html', {'form': form})

Vulnerable code:                 if next_url and next_url.startswith('/'):
Fixed code: from django.utils.http import url_has_allowed_host_and_scheme
                if (next_url and url_has_allowed_host_and_scheme(next_url, settings.ALLOWED_HOSTS)):
                    print("Good People")
                    print("fucking bad shit")