Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-43324: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LibreNMS through 21.10.2 allows XSS via a widget title.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-11-03T15:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: app/Http/Controllers/OverviewController.php, app/Http/Controllers/Widgets/WidgetController.php
Commit date: 2021-10-29 20:34:24 -0500
Commit message: Fix widget title injection vulnerability (#13452)

Prevent html/js code from being injected into widget titles.
Diff: diff --git a/app/Http/Controllers/OverviewController.php b/app/Http/Controllers/OverviewController.php
index 000518804c..bdc4d911e1 100644
--- a/app/Http/Controllers/OverviewController.php
+++ b/app/Http/Controllers/OverviewController.php
@@ -101,11 +101,11 @@ class OverviewController extends Controller
 
         $bare = $request->bare;
         $data = serialize(json_encode($data));
         $dash_config = unserialize($data);
         $hide_dashboard_editor = UserPref::getPref($user, 'hide_dashboard_editor');
-        $widgets = Widget::select('widget_id', 'widget_title')->orderBy('widget_title')->get();
+        $widgets = Widget::select(['widget_id', 'widget_title'])->orderBy('widget_title')->get();
 
         $user_list = [];
         if ($user->can('manage', User::class)) {
             $user_list = User::select(['username', 'user_id'])
                 ->where('user_id', '!=', $user->user_id)
diff --git a/app/Http/Controllers/Widgets/WidgetController.php b/app/Http/Controllers/Widgets/WidgetController.php
index a58f8e073b..34d6b8ed7d 100644
--- a/app/Http/Controllers/Widgets/WidgetController.php
+++ b/app/Http/Controllers/Widgets/WidgetController.php
@@ -140,11 +140,11 @@ abstract class WidgetController extends Controller
             $show_settings = (int) $this->show_settings;
         }
 
         return response()->json([
             'status' => $status,
-            'title' => __($title),
+            'title' => htmlentities(__($title)),
             'html' => $html,
             'show_settings' => $show_settings,
             'settings' => $settings,
         ]);
     }

Vulnerable code:         $widgets = Widget::select('widget_id', 'widget_title')->orderBy('widget_title')->get();
            'title' => __($title),
Fixed code:         $widgets = Widget::select(['widget_id', 'widget_title'])->orderBy('widget_title')->get();
            'title' => htmlentities(__($title)),
CVE-2022-0575: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-14T12:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/addhost.inc.php
Commit date: 2022-02-13 19:07:37 +0100
Commit message: XSS fix, cont. (#13776)

https://huntr.dev/bounties/13951f51-deed-4a3d-8275-52306cc5a87d/ 
Diff: diff --git a/includes/html/pages/addhost.inc.php b/includes/html/pages/addhost.inc.php
index 07dc9e44ad..c951356735 100644
--- a/includes/html/pages/addhost.inc.php
+++ b/includes/html/pages/addhost.inc.php
@@ -43,13 +43,13 @@ if (! empty($_POST['hostname'])) {
         $additional = [];
         if (! $snmp_enabled) {
             $snmpver = 'v2c';
             $additional = [
                 'snmp_disable' => 1,
-                'os'           => $_POST['os'] ? $_POST['os_id'] : 'ping',
-                'hardware'     => $_POST['hardware'],
-                'sysName'      => $_POST['sysName'],
+                'os'           => $_POST['os'] ? strip_tags($_POST['os_id']) : 'ping',
+                'hardware'     => strip_tags($_POST['hardware']),
+                'sysName'      => strip_tags($_POST['sysName']),
             ];
         } elseif ($_POST['snmpver'] === 'v2c' || $_POST['snmpver'] === 'v1') {
             if ($_POST['community']) {
                 Config::set('snmp.community', [$_POST['community']]);
             }

Vulnerable code:                 'os'           => $_POST['os'] ? $_POST['os_id'] : 'ping',
                'hardware'     => $_POST['hardware'],
                'sysName'      => $_POST['sysName'],
Fixed code:                 'os'           => $_POST['os'] ? strip_tags($_POST['os_id']) : 'ping',
                'hardware'     => strip_tags($_POST['hardware']),
                'sysName'      => strip_tags($_POST['sysName']),
CVE-2022-0576: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-14T12:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/forms/alert-transports.inc.php
Commit date: 2022-02-13 11:00:56 +0100
Commit message: security - XSS Fix 01

fixing https://huntr.dev/bounties/114ba055-a2f0-4db9-aafb-95df944ba177/ (#13775)
Diff: diff --git a/includes/html/forms/alert-transports.inc.php b/includes/html/forms/alert-transports.inc.php
index 9675e9fc4c..21190036f3 100644
--- a/includes/html/forms/alert-transports.inc.php
+++ b/includes/html/forms/alert-transports.inc.php
@@ -32,14 +32,14 @@ if (! Auth::user()->hasGlobalAdmin()) {
 }
 
 $status = 'ok';
 $message = '';
 
-$transport_id = $vars['transport_id'];
-$name = $vars['name'];
+$transport_id = strip_tags($vars['transport_id']);
+$name = strip_tags($vars['name']);
 $is_default = (int) (isset($vars['is_default']) && $vars['is_default'] == 'on');
-$transport_type = $vars['transport-type'];
+$transport_type = strip_tags($vars['transport-type']);
 
 if (empty($name)) {
     $status = 'error';
     $message = 'No transport name provided';
 } elseif (empty($transport_type)) {

Vulnerable code: $transport_id = $vars['transport_id'];
$name = $vars['name'];
$transport_type = $vars['transport-type'];
Fixed code: $transport_id = strip_tags($vars['transport_id']);
$name = strip_tags($vars['name']);
$transport_type = strip_tags($vars['transport-type']);
CVE-2022-0589: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-15T09:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/forms/add-dashboard.inc.php, includes/html/forms/customoid.inc.php, includes/html/forms/transport-groups.inc.php
Commit date: 2022-02-13 20:54:58 +0000
Commit message: XSS fixes (#13780)


Diff: diff --git a/includes/html/forms/add-dashboard.inc.php b/includes/html/forms/add-dashboard.inc.php
index 0e9d357fd1..d33f07c0f4 100644
--- a/includes/html/forms/add-dashboard.inc.php
+++ b/includes/html/forms/add-dashboard.inc.php
@@ -32,11 +32,11 @@ if (! Auth::check()) {
 }
 
 $status = 'error';
 $message = 'unknown error';
 
-$dashboard_name = trim($_REQUEST['dashboard_name']);
+$dashboard_name = trim(strip_tags($_REQUEST['dashboard_name']));
 
 if (! empty($dashboard_name) && ($dash_id = dbInsert(['dashboard_name' => $dashboard_name, 'user_id' => Auth::id()], 'dashboards'))) {
     $status = 'ok';
     $message = 'Dashboard ' . $dashboard_name . ' created';
 } else {
diff --git a/includes/html/forms/customoid.inc.php b/includes/html/forms/customoid.inc.php
index aa10034c36..454925f128 100644
--- a/includes/html/forms/customoid.inc.php
+++ b/includes/html/forms/customoid.inc.php
@@ -15,13 +15,13 @@ $status = 'ok';
 $message = '';
 
 $device_id = $_POST['device_id'];
 $id = $_POST['ccustomoid_id'];
 $action = $_POST['action'];
-$name = $_POST['name'];
-$oid = $_POST['oid'];
-$datatype = $_POST['datatype'];
+$name = strip_tags($_POST['name']);
+$oid = strip_tags($_POST['oid']);
+$datatype = strip_tags($_POST['datatype']);
 if (empty(($_POST['unit']))) {
     $unit = ['NULL'];
 } else {
     $unit = $_POST['unit'];
 }
diff --git a/includes/html/forms/transport-groups.inc.php b/includes/html/forms/transport-groups.inc.php
index 62dae3cd68..535c137304 100644
--- a/includes/html/forms/transport-groups.inc.php
+++ b/includes/html/forms/transport-groups.inc.php
@@ -33,11 +33,11 @@ if (! Auth::user()->hasGlobalAdmin()) {
 
 $status = 'ok';
 $message = '';
 
 $group_id = $vars['group_id'];
-$name = $vars['name'];
+$name = strip_tags($vars['name']);
 
 $target_members = [];
 foreach ((array) $vars['members'] as $target) {
     $target_members[] = (int) $target;
 }

Vulnerable code: $dashboard_name = trim($_REQUEST['dashboard_name']);
$name = $_POST['name'];
$oid = $_POST['oid'];
$datatype = $_POST['datatype'];
$name = $vars['name'];
Fixed code: $dashboard_name = trim(strip_tags($_REQUEST['dashboard_name']));
$name = strip_tags($_POST['name']);
$oid = strip_tags($_POST['oid']);
$datatype = strip_tags($_POST['datatype']);
$name = strip_tags($vars['name']);
CVE-2022-0772: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-02-27T22:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/modal/alert_rule_list.inc.php
Commit date: 2022-02-22 08:28:31 -0600
Commit message: Resolved XSS issue from alert rule list modal (#13805)


Diff: diff --git a/includes/html/modal/alert_rule_list.inc.php b/includes/html/modal/alert_rule_list.inc.php
index ad6a50c7365..aa604c260ea 100644
--- a/includes/html/modal/alert_rule_list.inc.php
+++ b/includes/html/modal/alert_rule_list.inc.php
@@ -60,11 +60,11 @@ if (! Auth::user()->hasGlobalAdmin()) {
                                 $rule_display = QueryBuilderParser::fromJson($rule['builder'])->toSql(false);
                             }
                             echo "
                                 <tr>
                                     <td>{$rule['name']}</td>
-                                    <td><i>" . htmlentities($rule_display) . "</i></td>
+                                    <td><i>" . htmlentities(strip_tags($rule_display)) . "</i></td>
                                     <td>{$rule['severity']}</td>
                                     <td>{$rule['id']}</td>
                                 </tr>
                             ";
                         }

Vulnerable code:                                     <td><i>" . htmlentities($rule_display) . "</i></td>
Fixed code:                                     <td><i>" . htmlentities(strip_tags($rule_display)) . "</i></td>
CVE-2022-29711: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-02T14:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: app/Http/Controllers/Table/GraylogController.php
Commit date: 2022-04-20 01:10:02 +0200
Commit message: fix graylog xss (#13931)


Diff: diff --git a/app/Http/Controllers/Table/GraylogController.php b/app/Http/Controllers/Table/GraylogController.php
index bc0d9f418c6..ec911c790af 100644
--- a/app/Http/Controllers/Table/GraylogController.php
+++ b/app/Http/Controllers/Table/GraylogController.php
@@ -116,12 +116,12 @@ class GraylogController extends SimpleTableController
         $facility = $message['message']['facility'] ?? '';
 
         return [
             'severity'  => $this->severityLabel($level),
             'timestamp' => $displayTime,
-            'source'    => $device ? Url::deviceLink($device) : $message['message']['source'],
-            'message'   => $message['message']['message'] ?? '',
+            'source'    => $device ? Url::deviceLink($device) : htmlspecialchars($message['message']['source']),
+            'message'   => htmlspecialchars($message['message']['message'] ?? ''),
             'facility'  => is_numeric($facility) ? "($facility) " . __("syslog.facility.$facility") : $facility,
             'level'     => (is_numeric($level) && $level >= 0) ? "($level) " . __("syslog.severity.$level") : $level,
         ];
     }
 

Vulnerable code:             'source'    => $device ? Url::deviceLink($device) : $message['message']['source'],
            'message'   => $message['message']['message'] ?? '',
Fixed code:             'source'    => $device ? Url::deviceLink($device) : htmlspecialchars($message['message']['source']),
            'message'   => htmlspecialchars($message['message']['message'] ?? ''),
CVE-2022-3231: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-09-17T17:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: app/Http/Controllers/Table/AlertScheduleController.php
Commit date: 2022-09-16 11:59:48 -0500
Commit message: Fix scheduled maintenance xss (#14360)

Fix for fields title, notes, and maybe recurring_day. Other fields can't store html.

https://huntr.dev/bounties/bcb6ee68-1452-4fdb-932a-f1031d10984f/
Diff: diff --git a/app/Http/Controllers/Table/AlertScheduleController.php b/app/Http/Controllers/Table/AlertScheduleController.php
index 0285ce24d8d..d636de714ca 100644
--- a/app/Http/Controllers/Table/AlertScheduleController.php
+++ b/app/Http/Controllers/Table/AlertScheduleController.php
@@ -63,20 +63,20 @@ class AlertScheduleController extends TableController
      * @return array
      */
     public function formatItem($schedule)
     {
         return [
-            'title' => $schedule->title,
-            'notes' => $schedule->notes,
+            'title' => htmlentities($schedule->title),
+            'notes' => htmlentities($schedule->notes),
             'id' => $schedule->schedule_id,
             'start' => $schedule->recurring ? '' : $schedule->start->toDateTimeString('minutes'),
             'end' => $schedule->recurring ? '' : $schedule->end->toDateTimeString('minutes'),
             'start_recurring_dt' => $schedule->recurring ? $schedule->start_recurring_dt : '',
             'start_recurring_hr' => $schedule->recurring ? $schedule->start_recurring_hr : '',
             'end_recurring_dt' => $schedule->recurring ? $schedule->end_recurring_dt : '',
             'end_recurring_hr' => $schedule->recurring ? $schedule->end_recurring_hr : '',
             'recurring' => $schedule->recurring ? __('Yes') : __('No'),
-            'recurring_day' => $schedule->recurring ? implode(',', $schedule->recurring_day) : '',
+            'recurring_day' => $schedule->recurring ? htmlentities(implode(',', $schedule->recurring_day)) : '',
             'status' => $schedule->status,
         ];
     }
 }

Vulnerable code:             'title' => $schedule->title,
            'notes' => $schedule->notes,
            'recurring_day' => $schedule->recurring ? implode(',', $schedule->recurring_day) : '',
Fixed code:             'title' => htmlentities($schedule->title),
            'notes' => htmlentities($schedule->notes),
            'recurring_day' => $schedule->recurring ? htmlentities(implode(',', $schedule->recurring_day)) : '',
CVE-2023-48294: Insufficient Information (NVD-CWE-noinfo)
value: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to `graph.php` to access graphs generated on the particular Device. This request can be accessed by a low privilege user and they can enumerate devices on librenms with their id or hostname. Leveraging this vulnerability a low privilege user can see all devices registered by admin users. This vulnerability has been addressed in commit `489978a923` which has been included in release version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.3
Published: 2023-11-17T22:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/graphs/graph.inc.php
Commit date: 2023-11-06 09:09:25 -0600
Commit message: Fix graphs device check before auth (#15551)

It should be after the auth check.
Diff: diff --git a/includes/html/graphs/graph.inc.php b/includes/html/graphs/graph.inc.php
index c3410536fbc..17da4b6409b 100644
--- a/includes/html/graphs/graph.inc.php
+++ b/includes/html/graphs/graph.inc.php
@@ -7,14 +7,13 @@ use LibreNMS\Enum\ImageFormat;
 try {
     if (isset($vars['device'])) {
         $device = is_numeric($vars['device'])
             ? device_by_id_cache($vars['device'])
             : device_by_name($vars['device']);
-        if (empty($device['device_id'])) {
-            throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
+        if (isset($device['device_id'])) {
+            DeviceCache::setPrimary($device['device_id']);
         }
-        DeviceCache::setPrimary($device['device_id']);
     }
 
     // variables for included graphs
     $graph_params = new GraphParameters($vars);
     // set php variables for legacy graphs
@@ -57,10 +56,15 @@ try {
         graph_error('No Authorization', 'No Auth');
 
         return;
     }
 
+    // check after auth
+    if (isset($vars['device']) && empty($device['device_id'])) {
+        throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
+    }
+
     $rrd_options = $graph_params . ' ' . $rrd_options;
 
     // command output requested
     if (! empty($command_only)) {
         echo "<div class='infobox'>";

Vulnerable code:         if (empty($device['device_id'])) {
            throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
        DeviceCache::setPrimary($device['device_id']);
Fixed code:         if (isset($device['device_id'])) {
            DeviceCache::setPrimary($device['device_id']);
    // check after auth
    if (isset($vars['device']) && empty($device['device_id'])) {
        throw new \LibreNMS\Exceptions\RrdGraphException('Device not found');
    }
CVE-2023-4977: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value:  Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 5.4
Published: 2023-09-15T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/search.inc.php, includes/html/pages/search/ipv4.inc.php
Commit date: 2023-09-13 23:35:49 -0500
Commit message: Fix injection in search pages ipv4, etc (#15311)

Reported by: https://huntr.dev/users/hainguyen0207
Diff: diff --git a/includes/html/pages/search.inc.php b/includes/html/pages/search.inc.php
index c918ee9f008..842327246f6 100644
--- a/includes/html/pages/search.inc.php
+++ b/includes/html/pages/search.inc.php
@@ -44,7 +44,7 @@ unset($sep);
 print_optionbar_end();
 
 if (file_exists("includes/html/pages/search/$search_type.inc.php")) {
     include "includes/html/pages/search/$search_type.inc.php";
 } else {
-    echo report_this("Unknown search type $search_type");
+    echo report_this('Unknown search type ' . htmlspecialchars($search_type));
 }
diff --git a/includes/html/pages/search/ipv4.inc.php b/includes/html/pages/search/ipv4.inc.php
index 4222aac96ae..7704a9e3796 100644
--- a/includes/html/pages/search/ipv4.inc.php
+++ b/includes/html/pages/search/ipv4.inc.php
@@ -83,12 +83,12 @@ if ($_POST['interface'] == 'Vlan%') {
     {
         return {
             id: "address-search",
             search_type: "ipv4",
             device_id: '<?php echo htmlspecialchars($_POST['device_id']); ?>',
-            interface: '<?php echo $_POST['interface']; ?>',
-            address: '<?php echo $_POST['address']; ?>'
+            interface: '<?php echo htmlspecialchars($_POST['interface']); ?>',
+            address: '<?php echo htmlspecialchars($_POST['address']); ?>'
         };
     },
     url: "ajax_table.php",
     formatters: {
         "tooltip": function (column, row) {

Vulnerable code:     echo report_this("Unknown search type $search_type");
            interface: '<?php echo $_POST['interface']; ?>',
            address: '<?php echo $_POST['address']; ?>'
Fixed code:     echo report_this('Unknown search type ' . htmlspecialchars($search_type));
            interface: '<?php echo htmlspecialchars($_POST['interface']); ?>',
            address: '<?php echo htmlspecialchars($_POST['address']); ?>'
CVE-2023-4978: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-15T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/search/ipv4.inc.php
Commit date: 2023-09-13 23:48:24 -0500
Commit message: Fix another injection in ipv4 search page (#15312)

Reported by: https://huntr.dev/users/trunggg02
Diff: diff --git a/includes/html/pages/search/ipv4.inc.php b/includes/html/pages/search/ipv4.inc.php
index 7704a9e3796..b7e13a0471f 100644
--- a/includes/html/pages/search/ipv4.inc.php
+++ b/includes/html/pages/search/ipv4.inc.php
@@ -71,11 +71,11 @@ if ($_POST['interface'] == 'Vlan%') {
 ?>
                   ">VLANs</option>"+
                   "</select>"+
                   "</div>&nbsp;"+
                   "<div class=\"form-group\">"+
-                  "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo $_POST['address']; ?>\" class=\"form-control input-sm\" placeholder=\"IPv4 Address\"/>"+
+                  "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo htmlspecialchars($_POST['address']); ?>\" class=\"form-control input-sm\" placeholder=\"IPv4 Address\"/>"+
                   "</div>&nbsp;"+
                   "<button type=\"submit\" class=\"btn btn-default input-sm\">Search</button>"+
                   "</form></span></div>"+
                   "<div class=\"col-sm-3 actionBar\"><p class=\"{{css.actions}}\"></p></div></div></div>"
     },

Vulnerable code:                   "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo $_POST['address']; ?>\" class=\"form-control input-sm\" placeholder=\"IPv4 Address\"/>"+
Fixed code:                   "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo htmlspecialchars($_POST['address']); ?>\" class=\"form-control input-sm\" placeholder=\"IPv4 Address\"/>"+
CVE-2023-4979: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-15T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/common/outages.inc.php
Commit date: 2023-09-13 23:10:37 -0500
Commit message: Fix improperly escaped output in outages page (#15310)

Fixes XSS reported by https://huntr.dev/users/hainguyen0207
Diff: diff --git a/includes/html/common/outages.inc.php b/includes/html/common/outages.inc.php
index b8574dcf69d..947a8f28f0b 100644
--- a/includes/html/common/outages.inc.php
+++ b/includes/html/common/outages.inc.php
@@ -37,12 +37,12 @@ var outages_grid = $("#outages").bootgrid({
     },
     post: function ()
     {
         return {
             device: ' . (empty($vars['device']) ? 'null' : (int) $vars['device']) . ',
-            to: "' . addcslashes($vars['to'], '"') . '",
-            from: "' . addcslashes($vars['from'], '"') . '",
+            to: "' . htmlspecialchars($vars['to']) . '",
+            from: "' . htmlspecialchars($vars['from']) . '",
         };
     },
     url: "' . url('/ajax/table/outages') . '"
 });
 

Vulnerable code:             to: "' . addcslashes($vars['to'], '"') . '",
            from: "' . addcslashes($vars['from'], '"') . '",
Fixed code:             to: "' . htmlspecialchars($vars['to']) . '",
            from: "' . htmlspecialchars($vars['from']) . '",
CVE-2023-4982: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-15T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/search/fdb.inc.php
Commit date: 2023-09-14 00:22:42 -0500
Commit message: Fix injection vulnerability in fdb search page (#15315)

unescaped search output
reported by: https://huntr.dev/users/hainguyen0207
Diff: diff --git a/includes/html/pages/search/fdb.inc.php b/includes/html/pages/search/fdb.inc.php
index 285954e66e4..931f273c6b4 100755
--- a/includes/html/pages/search/fdb.inc.php
+++ b/includes/html/pages/search/fdb.inc.php
@@ -110,11 +110,11 @@ if ($vars['searchby'] == 'vlan') {
                 "</select>"+
                 "</div>"+
                 "<div class=\"form-group\">"+
                 "<input type=\"text\" name=\"searchPhrase\" id=\"address\" value=\""+
 <?php
-echo '"' . $vars['searchPhrase'] . '"+';
+echo '"' . htmlspecialchars($vars['searchPhrase']) . '"+';
 ?>
 
                 "\" class=\"form-control input-sm\" placeholder=\"Value\" />"+
                 "</div>"+
                 "<button type=\"submit\" class=\"btn btn-default input-sm\">Search</button>"+

Vulnerable code: echo '"' . $vars['searchPhrase'] . '"+';
Fixed code: echo '"' . htmlspecialchars($vars['searchPhrase']) . '"+';
CVE-2023-5060: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-19T03:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/search/ipv6.inc.php
Commit date: 2023-09-15 16:05:08 -0500
Commit message: Fix unescaped output in ipv6 search page (#15327)


Diff: diff --git a/includes/html/pages/search/ipv6.inc.php b/includes/html/pages/search/ipv6.inc.php
index 1f8b221eb7b..f07b130cd28 100644
--- a/includes/html/pages/search/ipv6.inc.php
+++ b/includes/html/pages/search/ipv6.inc.php
@@ -72,11 +72,11 @@ if ($_POST['interface'] == 'Vlan%') {
 
                 ">VLANs</option>"+
                 "</select>"+
                 "</div>"+
                 "<div class=\"form-group\">"+
-                "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo $_POST['address']; ?>\" class=\"form-control input-sm\" placeholder=\"IPv6 Address\"/>"+
+                "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo htmlspecialchars($_POST['address']); ?>\" class=\"form-control input-sm\" placeholder=\"IPv6 Address\"/>"+
                 "</div>"+
                 "<button type=\"submit\" class=\"btn btn-default input-sm\">Search</button>"+
                 "</form></span></div>"+
                   "<div class=\"col-sm-3 actionBar\"><p class=\"{{css.actions}}\"></p></div></div></div>"
     },
@@ -84,12 +84,12 @@ if ($_POST['interface'] == 'Vlan%') {
     {
         return {
             id: "address-search",
             search_type: "ipv6",
             device_id: '<?php echo htmlspecialchars($_POST['device_id']); ?>',
-            interface: '<?php echo $_POST['interface']; ?>',
-            address: '<?php echo $_POST['address']; ?>'
+            interface: '<?php echo htmlspecialchars($_POST['interface']); ?>',
+            address: '<?php echo htmlspecialchars($_POST['address']); ?>'
         };
     },
     url: "ajax_table.php",
     formatters: {
         "tooltip": function (column, row) {

Vulnerable code:                 "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo $_POST['address']; ?>\" class=\"form-control input-sm\" placeholder=\"IPv6 Address\"/>"+
            interface: '<?php echo $_POST['interface']; ?>',
            address: '<?php echo $_POST['address']; ?>'
Fixed code:                 "<input type=\"text\" name=\"address\" id=\"address\" size=40 value=\"<?php echo htmlspecialchars($_POST['address']); ?>\" class=\"form-control input-sm\" placeholder=\"IPv6 Address\"/>"+
            interface: '<?php echo htmlspecialchars($_POST['interface']); ?>',
            address: '<?php echo htmlspecialchars($_POST['address']); ?>'
CVE-2023-5591: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value:  SQL Injection in GitHub repository librenms/librenms prior to 23.10.0.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 6.5
Published: 2023-10-16T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/table/address-search.inc.php
Commit date: 2023-10-05 23:04:04 -0500
Commit message: Fix MAC search sql injection (#15402)

unparameterized variable
Diff: diff --git a/includes/html/table/address-search.inc.php b/includes/html/table/address-search.inc.php
index ad3a3f73975..2d85bc8848f 100644
--- a/includes/html/table/address-search.inc.php
+++ b/includes/html/table/address-search.inc.php
@@ -35,11 +35,12 @@ if ($vars['search_type'] == 'ipv4') {
     if (! empty($prefix)) {
         $sql .= " AND ipv6_prefixlen = '$prefix'";
     }
 } elseif ($vars['search_type'] == 'mac') {
     $sql = ' FROM `ports` AS I, `devices` AS D';
-    $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE '%" . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . "%' $where ";
+    $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE ? $where ";
+    $param[] = '%' . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . '%';
 }//end if
 if (is_numeric($vars['device_id'])) {
     $sql .= ' AND I.device_id = ?';
     $param[] = $vars['device_id'];
 }

Vulnerable code:     $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE '%" . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . "%' $where ";
Fixed code:     $sql .= " WHERE I.device_id = D.device_id AND `ifPhysAddress` LIKE ? $where ";
    $param[] = '%' . trim(str_replace([':', ' ', '-', '.', '0x'], '', $vars['address'])) . '%';
CVE-2024-32480: Insufficient Information (NVD-CWE-noinfo)
value: LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Versions prior to 24.4.0 are vulnerable to SQL injection. The `order` parameter is obtained from `$request`. After performing a string check, the value is directly incorporated into an SQL statement and concatenated, resulting in a SQL injection vulnerability. An attacker may extract a whole database this way. Version 24.4.0 fixes the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-22T23:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/api_functions.inc.php
Commit date: 2024-04-16 10:38:17 -0500
Commit message: Improve order validation in list_devices function to prevent SQL injection (#15885)


Diff: diff --git a/includes/html/api_functions.inc.php b/includes/html/api_functions.inc.php
index 4f8beaef345..89930652b9a 100644
--- a/includes/html/api_functions.inc.php
+++ b/includes/html/api_functions.inc.php
@@ -311,16 +311,14 @@ function list_devices(Illuminate\Http\Request $request)
     $order = $request->get('order');
     $type = $request->get('type');
     $query = $request->get('query');
     $param = [];
 
-    if (empty($order)) {
-        $order = 'hostname';
-    }
-
-    if (stristr($order, ' desc') === false && stristr($order, ' asc') === false) {
-        $order = 'd.`' . $order . '` ASC';
+    if (preg_match('/^([a-z_]+)(?: (desc|asc))?$/i', $order, $matches)) {
+        $order = "d.`$matches[1]` " . ($matches[2] ?? 'ASC');
+    } else {
+        $order = 'd.`hostname` ASC';
     }
 
     $select = ' d.*, GROUP_CONCAT(dd.device_id) AS dependency_parent_id, GROUP_CONCAT(dd.hostname) AS dependency_parent_hostname, `location`, `lat`, `lng` ';
     $join = ' LEFT JOIN `device_relationships` AS dr ON dr.`child_device_id` = d.`device_id` LEFT JOIN `devices` AS dd ON dr.`parent_device_id` = dd.`device_id` LEFT JOIN `locations` ON `locations`.`id` = `d`.`location_id`';
 

Vulnerable code:     if (empty($order)) {
        $order = 'hostname';
    }

    if (stristr($order, ' desc') === false && stristr($order, ' asc') === false) {
        $order = 'd.`' . $order . '` ASC';
Fixed code:     if (preg_match('/^([a-z_]+)(?: (desc|asc))?$/i', $order, $matches)) {
        $order = "d.`$matches[1]` " . ($matches[2] ?? 'ASC');
    } else {
        $order = 'd.`hostname` ASC';
CVE-2021-41098: Improper Restriction of XML External Entity Reference (CWE-611)
value: Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 7.5
Published: 2021-09-27T20:15Z
Repository: https://github.com/sparklemotion/nokogiri
Language: Unknown
Commit date: 2021-09-26 17:44:03 -0400
Commit message: Merge pull request #2328 from sparklemotion/flavorjones-GHSA-2rr5-8q37-2w7h_main

fix JRuby SAX parser entity handling
CVE-2020-26279: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2021-03-24T21:15Z
Repository: https://github.com/whyrusleeping/tar-utils
Language: Go
Files changed: extractor.go
Commit date: 2020-12-01 14:12:10 -0500
Commit message: more closely match default tar errors (GNU + BSD binaries)

Diff: diff --git a/extractor.go b/extractor.go
index 0088c71..7266dde 100644
--- a/extractor.go
+++ b/extractor.go
@@ -102,11 +102,16 @@ func (te *Extractor) Sanitize(toggle bool) {
 	}
 }
 
 // outputPath returns the path at which to place tarPath
 func (te *Extractor) outputPath(tarPath string) (outPath string, err error) {
-	elems := strings.Split(tarPath, "/")    // break into elems
+	elems := strings.Split(tarPath, "/") // break into elems
+	for _, e := range elems {
+		if e == ".." {
+			return "", fmt.Errorf("%s : path contains '..'", tarPath)
+		}
+	}
 	elems = elems[1:]                       // remove original root
 	outPath = strings.Join(elems, "/")      // join elems
 	outPath = gopath.Join(te.Path, outPath) // rebase on to extraction target root
 	// sanitize path to be platform legal
 	if te.SanitizePathFunc != nil {

Vulnerable code: 	elems := strings.Split(tarPath, "/")    // break into elems
Fixed code: 	elems := strings.Split(tarPath, "/") // break into elems
	for _, e := range elems {
		if e == ".." {
			return "", fmt.Errorf("%s : path contains '..'", tarPath)
		}
	}
CVE-2020-36566: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2022-12-27T22:15Z
Repository: https://github.com/whyrusleeping/tar-utils
Language: Go
Files changed: extractor.go
Commit date: 2020-12-01 14:12:10 -0500
Commit message: more closely match default tar errors (GNU + BSD binaries)

Diff: diff --git a/extractor.go b/extractor.go
index 0088c71..7266dde 100644
--- a/extractor.go
+++ b/extractor.go
@@ -102,11 +102,16 @@ func (te *Extractor) Sanitize(toggle bool) {
 	}
 }
 
 // outputPath returns the path at which to place tarPath
 func (te *Extractor) outputPath(tarPath string) (outPath string, err error) {
-	elems := strings.Split(tarPath, "/")    // break into elems
+	elems := strings.Split(tarPath, "/") // break into elems
+	for _, e := range elems {
+		if e == ".." {
+			return "", fmt.Errorf("%s : path contains '..'", tarPath)
+		}
+	}
 	elems = elems[1:]                       // remove original root
 	outPath = strings.Join(elems, "/")      // join elems
 	outPath = gopath.Join(te.Path, outPath) // rebase on to extraction target root
 	// sanitize path to be platform legal
 	if te.SanitizePathFunc != nil {

Vulnerable code: 	elems := strings.Split(tarPath, "/")    // break into elems
Fixed code: 	elems := strings.Split(tarPath, "/") // break into elems
	for _, e := range elems {
		if e == ".." {
			return "", fmt.Errorf("%s : path contains '..'", tarPath)
		}
	}
CVE-2023-30797: Use of Insufficiently Random Values (CWE-330)
value: 

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.



CWE description: The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CVSS v3 base score: 7.5
Published: 2023-04-19T20:15Z
Repository: https://github.com/Netflix/lemur
Language: Unknown
Commit date: 2023-02-28 10:03:07 -0800
Commit message: Merge pull request from GHSA-5fqv-mpj8-h7gm

Security fix
CVE-2024-31206: Insufficient Information (NVD-CWE-noinfo)
value: dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `dectalk-tts@1.0.0`, network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle (MITM) attack. The network request was upgraded to HTTPS in version `1.0.1`. There are no workarounds, but some precautions include not sending any sensitive information and carefully verifying the API response before saving it.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T23:15Z
Repository: https://github.com/JstnMcBrd/dectalk-tts
Language: TypeScript
Files changed: src/index.ts
Commit date: 2024-02-12 18:01:47 -0700
Commit message: Send request over HTTPS (#4)


Diff: diff --git a/src/index.ts b/src/index.ts
index 45ebcba..56accb1 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -13,11 +13,11 @@ export default async function dectalk(text: string): Promise<Buffer> {
 	if (text.length === 0) {
 		throw new TypeError('Text cannot be empty or only whitespace');
 	}
 
 	// Format request URL
-	const url = new URL('http://tts.cyzon.us/tts');
+	const url = new URL('https://tts.cyzon.us/tts');
 	url.search = new URLSearchParams({ text }).toString();
 
 	// Send request
 	const response = await fetch(url);
 

Vulnerable code: 	const url = new URL('http://tts.cyzon.us/tts');
Fixed code: 	const url = new URL('https://tts.cyzon.us/tts');
CVE-2023-32312: Insufficient Information (NVD-CWE-noinfo)
value: UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit flow is not safe. For traditional MVC applications, it is recommended to use the authorization code flow, which requires the client to authenticate with the authorization server using a client secret. This flow provides better security, as it involves exchanging an authorization code for an access token and/or ID token, rather than directly returning tokens in the URL fragment. This issue has been patched in commit `e792429f9` and a release to Nuget is pending. Users are advised to upgrade when possible.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-06-09T20:15Z
Repository: https://github.com/umbraco/UmbracoIdentityExtensions
Language: Unknown
Commit date: 2023-06-09 13:48:09 +0200
Commit message: Merge pull request from GHSA-f2rf-8mwf-6jfh

ClientSecret for Azure AD Auth for release/v2.0
CVE-2019-25156: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in dstar2018 Agency up to 61. Affected by this vulnerability is an unknown functionality of the file search.php. The manipulation of the argument QSType/QuickSearch leads to cross site scripting. The attack can be launched remotely. The patch is named 975b56953efabb434519d9feefcc53685fb8d0ab. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-244495.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-11-07T06:15Z
Repository: https://github.com/dstar2018/agency-code-repo
Language: PHP
Files changed: search.php
Commit date: 2019-01-15 12:11:46 -0800
Commit message: Fix XSS vulnerability in search.php.  SF bug #5.
Some IT security students at the University of Darmstadt in Germany were kind enough to find and report this issue.

Diff: diff --git a/search.php b/search.php
index 2db68bf..2655b6d 100644
--- a/search.php
+++ b/search.php
@@ -30,18 +30,19 @@ should be included in this distribution.
 </LICENSE>
 */
 
 $quiet = 'Y';
 include 'includes.php';
-$qs_type = $_REQUEST['QSType'];
+$qs_type = strip_tags($_REQUEST['QSType']);
+$qs_text = strip_tags($_REQUEST['QuickSearch']);
 
 $tmp_searches = array_keys($AG_QUICK_SEARCHES);
 array_push($tmp_searches,'news');
 
 if (!in_array($qs_type,$tmp_searches)) {
 	agency_top_header();
-	out(alert_mark('Unknown Quick Search Type: '.$qs_type));
+	out(alert_mark(webify('Unknown Quick Search Type: '.$qs_type)));
 	page_close();
 	exit;
 }
 
 switch ($qs_type) {
@@ -49,11 +50,11 @@ switch ($qs_type) {
  default :
 	$func=$qs_type.'_search';
 	if (function_exists($func)) {
 		$out = $func();
 	} else {
-		$out = object_quick_search($qs_type,$_REQUEST['QuickSearch']);
+		$out = object_quick_search($qs_type,$qs_text);
 	}
 }
 
 agency_top_header();
 out(html_heading_1('Search Results') .$out);

Vulnerable code: $qs_type = $_REQUEST['QSType'];
	out(alert_mark('Unknown Quick Search Type: '.$qs_type));
		$out = object_quick_search($qs_type,$_REQUEST['QuickSearch']);
Fixed code: $qs_type = strip_tags($_REQUEST['QSType']);
$qs_text = strip_tags($_REQUEST['QuickSearch']);
	out(alert_mark(webify('Unknown Quick Search Type: '.$qs_type)));
		$out = object_quick_search($qs_type,$qs_text);
CVE-2021-4048: Out-of-bounds Read (CWE-125)
value: An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2021-12-08T22:15Z
Repository: https://github.com/Reference-LAPACK/lapack
Language: Unknown
Commit date: 2021-10-01 08:27:02 -0600
Commit message: Merge pull request #625 from JuliaComputing/kf/slarrvbounds

Thank you!