Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-23444: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
value: This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
CWE description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CVSS v3 base score: 9.8
Published: 2021-09-21T17:15Z
Repository: https://github.com/clientIO/joint
Language: Other
Files changed: src/util/util.mjs, test/jointjs/core/util.js
Commit date: 2021-09-06 20:20:21 +0200
Commit message: util.setByPath() - prevent prototype pollution (#1514)


Diff: diff --git a/src/util/util.mjs b/src/util/util.mjs
index 2f893556..5c2114d2 100644
--- a/src/util/util.mjs
+++ b/src/util/util.mjs
@@ -138,10 +138,13 @@ export const getByPath = function(obj, path, delimiter) {
 };
 
 const isGetSafe = function(obj, key) {
     // Prevent prototype pollution
     // https://snyk.io/vuln/SNYK-JS-JSON8MERGEPATCH-1038399
+    if (typeof key !== 'string' && typeof key !== 'number') {
+        key = String(key);
+    }
     if (key === 'constructor' && typeof obj[key] === 'function') {
         return false;
     }
     if (key === '__proto__') {
         return false;
diff --git a/test/jointjs/core/util.js b/test/jointjs/core/util.js
index 81f5e8ea..ffd142e5 100644
--- a/test/jointjs/core/util.js
+++ b/test/jointjs/core/util.js
@@ -334,11 +334,15 @@ QUnit.module('util', function(hooks) {
             assert.deepEqual(joint.util.setByPath([null], '0/property', 10), [{ property: 10 }], 'replace null item with an object');
             assert.deepEqual(joint.util.setByPath({ array: [] }, 'array/1', 'index'), { array: [undefined, 'index'] }, 'define array');
             assert.deepEqual(joint.util.setByPath({ object: {}}, 'object/1', 'property'), { object: { '1': 'property' }}, 'define property');
         });
 
-        ['__proto__/polluted', 'constructor/prototype/polluted'].forEach(function(path) {
+        [
+            '__proto__/polluted',
+            'constructor/prototype/polluted',
+            [['__proto__'], 'polluted']
+        ].forEach(function(path) {
             QUnit.test('setting "' + path + '" does not pollute prototype' , function(assert) {
                 var obj = {};
                 assert.notOk(obj.polluted);
                 joint.util.setByPath({}, path, true, '/');
                 assert.notOk(obj.polluted);

Vulnerable code:         ['__proto__/polluted', 'constructor/prototype/polluted'].forEach(function(path) {
Fixed code:     if (typeof key !== 'string' && typeof key !== 'number') {
        key = String(key);
    }
        [
            '__proto__/polluted',
            'constructor/prototype/polluted',
            [['__proto__'], 'polluted']
        ].forEach(function(path) {
CVE-2015-9542: Out-of-bounds Write (CWE-787)
value: add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-02-24T15:15Z
Repository: https://github.com/FreeRADIUS/pam_radius
Language: C
Files changed: src/pam_radius_auth.c
Commit date: 2015-05-21 15:40:11 -0400
Commit message: Use "length", which has been limited in size

Diff: diff --git a/src/pam_radius_auth.c b/src/pam_radius_auth.c
index 7c7c9d9..396d1cf 100644
--- a/src/pam_radius_auth.c
+++ b/src/pam_radius_auth.c
@@ -534,11 +534,11 @@ static void add_password(AUTH_HDR *request, unsigned char type, CONST char *pass
 		length += (AUTH_PASS_LEN - 1);		/* round it up */
 		length &= ~(AUTH_PASS_LEN - 1);		/* chop it off */
 	}						/* 16*N maps to itself */
 
 	memset(hashed, 0, length);
-	memcpy(hashed, password, strlen(password));
+	memcpy(hashed, password, length);
 
 	attr = find_attribute(request, PW_PASSWORD);
 
 	if (type == PW_PASSWORD) {
 		vector = request->vector;

Vulnerable code: 	memcpy(hashed, password, strlen(password));
Fixed code: 	memcpy(hashed, password, length);
CVE-2018-8088: Insufficient Information (NVD-CWE-noinfo)
value: org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2018-03-20T16:29Z
Repository: https://github.com/qos-ch/slf4j
Language: Java
Files changed: slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
Commit date: 2018-03-14 01:09:26 +0100
Commit message: fix SLF4J-431

Diff: diff --git a/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java b/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
index cdfbb04c..42467905 100755
--- a/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
+++ b/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
@@ -38,10 +38,12 @@ import java.beans.ExceptionListener;
 /**
  * Base class for Event Data. Event Data contains data to be logged about an
  * event. Users may extend this class for each EventType they want to log.
  * 
  * @author Ralph Goers
+ * 
+ * @deprecated Due to a security vulnerability, this class will be removed without replacement.
  */
 public class EventData implements Serializable {
 
     private static final long serialVersionUID = 153270778642103985L;
 

Fixed code:  * 
 * @deprecated Due to a security vulnerability, this class will be removed without replacement.
CVE-2022-27311: Server-Side Request Forgery (SSRF) (CWE-918)
value: Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2022-04-25T13:15Z
Repository: https://github.com/amro/gibbon
Language: Ruby
Files changed: lib/gibbon/api_request.rb, spec/gibbon/gibbon_spec.rb
Commit date: 2022-02-18 07:58:42 -0500
Commit message: Ensure we raise if the root domain changed and it was not an expected behavior

Diff: diff --git a/lib/gibbon/api_request.rb b/lib/gibbon/api_request.rb
index b48a7a3..7e376d1 100644
--- a/lib/gibbon/api_request.rb
+++ b/lib/gibbon/api_request.rb
@@ -192,9 +192,11 @@ module Gibbon
       base_api_url + @request_builder.path
     end
 
     def base_api_url
       computed_api_endpoint = "https://#{get_data_center_from_api_key(self.api_key)}api.mailchimp.com"
+      raise Gibbon::GibbonError, "SSRF attempt" unless URI(computed_api_endpoint).host.include?("api.mailchimp.com")
+
       "#{self.api_endpoint || computed_api_endpoint}/3.0/"
     end
   end
 end
diff --git a/spec/gibbon/gibbon_spec.rb b/spec/gibbon/gibbon_spec.rb
index 9814e22..0ea3c04 100644
--- a/spec/gibbon/gibbon_spec.rb
+++ b/spec/gibbon/gibbon_spec.rb
@@ -160,10 +160,16 @@ describe Gibbon do
       @gibbon.api_key = @api_key
       @gibbon.api_endpoint = "https://us6.api.mailchimp.com"
       @request = Gibbon::APIRequest.new(builder: @gibbon)
       expect {@request.validate_api_key}.not_to raise_error
     end
+
+    it "raises with a valid SSRF attack" do
+      @api_key = "-attacker.net/test/?"
+      @gibbon.api_key = @api_key
+      expect {@gibbon.try.retrieve}.not_to raise_error
+    end
   end
 
   describe "class variables" do
     let(:logger) { double(:logger) }
 
@@ -211,11 +217,11 @@ describe Gibbon do
     end
 
     it "set debug on new instances" do
       expect(Gibbon::Request.new.debug).to eq(Gibbon::Request.debug)
     end
-    
+
     it "set faraday_adapter on new instances" do
       expect(Gibbon::Request.new.faraday_adapter).to eq(Gibbon::Request.faraday_adapter)
     end
 
     it "set logger on new instances" do

Fixed code:       raise Gibbon::GibbonError, "SSRF attempt" unless URI(computed_api_endpoint).host.include?("api.mailchimp.com")


    it "raises with a valid SSRF attack" do
      @api_key = "-attacker.net/test/?"
      @gibbon.api_key = @api_key
      expect {@gibbon.try.retrieve}.not_to raise_error
    end
CVE-2022-32202: NULL Pointer Dereference (CWE-476)
value: In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-06-02T14:16Z
Repository: https://github.com/thorfdbg/libjpeg
Language: C++
Files changed: control/linebitmaprequester.cpp
Commit date: 2022-05-31 12:17:21 +0200
Commit message: Fixed a NULL-pointer access in the line-based reconstruction process
in case no valid scan was found and no data is present.

Diff: diff --git a/control/linebitmaprequester.cpp b/control/linebitmaprequester.cpp
index 1f91663..ca0b968 100644
--- a/control/linebitmaprequester.cpp
+++ b/control/linebitmaprequester.cpp
@@ -41,11 +41,11 @@
 /*
 **
 ** This class pulls blocks from the frame and reconstructs from those
 ** quantized block lines or encodes from them.
 **
-** $Id: linebitmaprequester.cpp,v 1.36 2021/07/22 13:18:36 thor Exp $
+** $Id: linebitmaprequester.cpp,v 1.37 2022/05/31 10:16:52 thor Exp $
 **
 */
 
 /// Includes
 #include "control/bitmapctrl.hpp"
@@ -560,11 +560,15 @@ void LineBitmapRequester::ReconstructRegion(const RectAngle<LONG> &orgregion,con
 
         for(i = 0;i < m_ucCount;i++) {      
           LONG *dst = m_ppCTemp[i];
           if (i >= rr->rr_usFirstComponent && i <= rr->rr_usLastComponent) {
             ExtractBitmap(m_ppTempIBM[i],r,i);
-            FetchRegion(x,*m_pppImage[i],dst);
+            if (*m_pppImage[i]) {
+              FetchRegion(x,*m_pppImage[i],dst);
+            } else {
+              memset(dst,0,sizeof(LONG) * 64);
+            }
           } else {
             memset(dst,0,sizeof(LONG) * 64);
           }
         }
         //

Vulnerable code: ** $Id: linebitmaprequester.cpp,v 1.36 2021/07/22 13:18:36 thor Exp $
            FetchRegion(x,*m_pppImage[i],dst);
Fixed code: ** $Id: linebitmaprequester.cpp,v 1.37 2022/05/31 10:16:52 thor Exp $
            if (*m_pppImage[i]) {
              FetchRegion(x,*m_pppImage[i],dst);
            } else {
              memset(dst,0,sizeof(LONG) * 64);
            }
CVE-2017-5847: Out-of-bounds Read (CWE-125)
value: The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-02-09T15:59Z
Repository: https://github.com/GStreamer/gst-plugins-ugly
Language: C
Files changed: gst/asfdemux/gstasfdemux.c
Commit date: 2017-01-31 13:50:21 +0200
Commit message: asfdemux: Check that we have enough data available before parsing bool/uint extended content descriptors

https://bugzilla.gnome.org/show_bug.cgi?id=777955

Diff: diff --git a/gst/asfdemux/gstasfdemux.c b/gst/asfdemux/gstasfdemux.c
index 255a427f..b8d48ad6 100644
--- a/gst/asfdemux/gstasfdemux.c
+++ b/gst/asfdemux/gstasfdemux.c
@@ -3437,11 +3437,16 @@ gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,
             }
           }
           break;
         }
         case ASF_DEMUX_DATA_TYPE_DWORD:{
-          guint uint_val = GST_READ_UINT32_LE (value);
+          guint uint_val;
+
+          if (value_len < 4)
+            break;
+
+          uint_val = GST_READ_UINT32_LE (value);
 
           /* this is the track number */
           g_value_init (&tag_value, G_TYPE_UINT);
 
           /* WM/Track counts from 0 */
@@ -3451,11 +3456,16 @@ gst_asf_demux_process_ext_content_desc (GstASFDemux * demux, guint8 * data,
           g_value_set_uint (&tag_value, uint_val);
           break;
         }
           /* Detect 3D */
         case ASF_DEMUX_DATA_TYPE_BOOL:{
-          gboolean bool_val = GST_READ_UINT32_LE (value);
+          gboolean bool_val;
+
+          if (value_len < 4)
+            break;
+
+          bool_val = GST_READ_UINT32_LE (value);
 
           if (strncmp ("Stereoscopic", name_utf8, strlen (name_utf8)) == 0) {
             if (bool_val) {
               GST_INFO_OBJECT (demux, "This is 3D contents");
               content3D = TRUE;

Vulnerable code:           guint uint_val = GST_READ_UINT32_LE (value);
          gboolean bool_val = GST_READ_UINT32_LE (value);
Fixed code:           guint uint_val;

          if (value_len < 4)
            break;

          uint_val = GST_READ_UINT32_LE (value);
          gboolean bool_val;

          if (value_len < 4)
            break;

          bool_val = GST_READ_UINT32_LE (value);
CVE-2013-4558: Improper Input Validation (CWE-20)
value: The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-12-07T20:55Z
Repository: https://github.com/apache/subversion
Language: C
Files changed: subversion/mod_dav_svn/repos.c
Commit date: 2013-11-14 20:51:21 +0000
Commit message: * subversion/mod_dav_svn/mod_dav_svn.c:
  (get_parent_resource): Use canonical form of path.

Fixes CVE-2013-4558, see our advisory at:
http://subversion.apache.org/security/CVE-2013-4558-advisory.txt


git-svn-id: https://svn.apache.org/repos/asf/subversion/trunk@1542071 13f79535-47bb-0310-9956-ffa450edef68

Diff: diff --git a/subversion/mod_dav_svn/repos.c b/subversion/mod_dav_svn/repos.c
index 22bd298ba9..f7956be90c 100644
--- a/subversion/mod_dav_svn/repos.c
+++ b/subversion/mod_dav_svn/repos.c
@@ -2440,13 +2440,16 @@ get_parent_resource(const dav_resource *resource,
                                                               resource->pool),
                                     TRUE, resource->pool);
       parent->info = parentinfo;
 
       parentinfo->uri_path =
-        svn_stringbuf_create(get_parent_path(resource->info->uri_path->data,
-                                             TRUE, resource->pool),
-                             resource->pool);
+        svn_stringbuf_create(
+               get_parent_path(
+                   svn_urlpath__canonicalize(resource->info->uri_path->data,
+                                            resource->pool),
+                   TRUE, resource->pool),
+               resource->pool);
       parentinfo->repos = resource->info->repos;
       parentinfo->root = resource->info->root;
       parentinfo->r = resource->info->r;
       parentinfo->svn_client_options = resource->info->svn_client_options;
       parentinfo->repos_path = get_parent_path(resource->info->repos_path,

Vulnerable code:         svn_stringbuf_create(get_parent_path(resource->info->uri_path->data,
                                             TRUE, resource->pool),
                             resource->pool);
Fixed code:         svn_stringbuf_create(
               get_parent_path(
                   svn_urlpath__canonicalize(resource->info->uri_path->data,
                                            resource->pool),
                   TRUE, resource->pool),
               resource->pool);
CVE-2018-10017: Out-of-bounds Read (CWE-125)
value: soundlib/Snd_fx.cpp in OpenMPT before 1.27.07.00 and libopenmpt before 0.3.8 allows remote attackers to cause a denial of service (out-of-bounds read) via an IT or MO3 file with many nested pattern loops.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-04-11T05:29Z
Repository: https://github.com/OpenMPT/openmpt
Language: C++
Files changed: soundlib/Snd_fx.cpp
Commit date: 2018-04-07 16:04:51 +0000
Commit message: [Fix] Possible out-of-bounds read when computing length of some IT files with pattern loops (OpenMPT: formats that are converted to IT, libopenmpt: IT/ITP/MO3), caught with afl-fuzz.

git-svn-id: https://source.openmpt.org/svn/openmpt/trunk/OpenMPT@10027 56274372-70c3-4bfc-bfc3-4c3a0b034d27

Diff: diff --git a/soundlib/Snd_fx.cpp b/soundlib/Snd_fx.cpp
index c623da591..29f93c1de 100644
--- a/soundlib/Snd_fx.cpp
+++ b/soundlib/Snd_fx.cpp
@@ -1202,11 +1202,12 @@ std::vector<GetLengthType> CSoundFile::GetLength(enmGetLengthResetMode adjustMod
 				}
 			}
 			if(GetType() == MOD_TYPE_IT)
 			{
 				// IT pattern loop start row update - at the end of a pattern loop, set pattern loop start to next row (for upcoming pattern loops with missing SB0)
-				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++)
+				pChn = playState.Chn;
+				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++, pChn++)
 				{
 					if((pChn->rowCommand.command == CMD_S3MCMDEX && pChn->rowCommand.param >= 0xB1 && pChn->rowCommand.param <= 0xBF))
 					{
 						memory.chnSettings[nChn].patLoop = memory.elapsedTime;
 						memory.chnSettings[nChn].patLoopSmp = playState.m_lTotalSampleCount;

Vulnerable code: 				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++)
Fixed code: 				pChn = playState.Chn;
				for(CHANNELINDEX nChn = 0; nChn < GetNumChannels(); nChn++, pChn++)
CVE-2024-30252: Insufficient Information (NVD-CWE-noinfo)
value: Livemarks is a browser extension that provides RSS feed bookmark folders. Versions of Livemarks prior to 3.7 are vulnerable to cross-site request forgery. A malicious website may be able to coerce the extension to send an authenticated GET request to an arbitrary URL. An authenticated request is a request where the cookies of the browser are sent along with the request. The `subscribe.js` script uses the first parameter from the current URL location as the URL of the RSS feed to subscribe to and checks that the RSS feed is valid XML. `subscribe.js` is accessible by an attacker website due to its use in `subscribe.html`, an HTML page that is declared as a `web_accessible_resource` in `manifest.json`. This issue may lead to `Privilege Escalation`. A CSRF breaks the integrity of servers running on a private network. A user of the browser extension may have a private server with dangerous functionality, which is assumed to be safe due to network segmentation. Upon receiving an authenticated request instantiated from an attacker, this integrity is broken. Version 3.7 fixes this issue by removing subscribe.html from `web_accessible_resources`.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T19:15Z
Repository: https://github.com/nt1m/livemarks
Language: JSON
Files changed: manifest.json
Commit date: 2024-02-27 10:05:32 +0100
Commit message: Remove unnecessary web_accessible_resources

This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).

Diff: diff --git a/manifest.json b/manifest.json
index 329f8c0..a27582c 100644
--- a/manifest.json
+++ b/manifest.json
@@ -38,13 +38,10 @@
     "default_title": "__MSG_subscribe__",
     "default_popup": "popup/popup.html"
   },
   "permissions": ["storage", "bookmarks", "history", "webRequest", "webRequestBlocking", "<all_urls>", "tabs", "menus"],
   "version": "3.6",
-  "web_accessible_resources": [
-    "pages/subscribe/subscribe.html"
-  ],
   "applications": {
     "gecko": {
       "id": "{c5867acc-54c9-4074-9574-04d8818d53e8}"
     }
   }

Vulnerable code:   "web_accessible_resources": [
    "pages/subscribe/subscribe.html"
  ],
CVE-2015-6961: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the _next parameter to user/logout.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2017-10-18T20:29Z
Repository: https://github.com/web2py/web2py
Language: Unknown
Commit date: 2015-07-02 06:40:12 -0500
Commit message: Merge pull request #1012 from ortgit/master

Security fix: Validate for open redirect everywhere, not just in login()
CVE-2016-10321: 7PK - Security Features (CWE-254)
value: web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
CWE description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
CVSS v3 base score: 9.8
Published: 2017-04-10T14:59Z
Repository: https://github.com/web2py/web2py
Language: Python
Files changed: applications/admin/controllers/default.py, applications/admin/models/access.py
Commit date: 2016-05-04 19:02:53 +0100
Commit message: Check if host is denied before verifying password

Diff: diff --git a/applications/admin/controllers/default.py b/applications/admin/controllers/default.py
index 9eaf90d15..bed4e8633 100644
--- a/applications/admin/controllers/default.py
+++ b/applications/admin/controllers/default.py
@@ -119,10 +119,13 @@ def index():
         session.last_time = t0
     if not send:
         send = URL('site')
     if session.authorized:
         redirect(send)
+    elif failed_login_count() >= allowed_number_of_attempts:
+        time.sleep(2 ** allowed_number_of_attempts)
+        raise HTTP(403)
     elif request.vars.password:
         if verify_password(request.vars.password[:1024]):
             session.authorized = True
             login_record(True)
 
diff --git a/applications/admin/models/access.py b/applications/admin/models/access.py
index fa1ee01cb..b94ce8d08 100644
--- a/applications/admin/models/access.py
+++ b/applications/admin/models/access.py
@@ -102,27 +102,31 @@ def write_hosts_deny(denied_hosts):
             line = '%s %s %s\n' % (key, val[0], val[1])
             f.write(line)
     portalocker.unlock(f)
     f.close()
 
-
 def login_record(success=True):
     denied_hosts = read_hosts_deny()
     val = (0, 0)
     if success and request.client in denied_hosts:
         del denied_hosts[request.client]
-    elif not success and not request.is_local:
+    elif not success:
         val = denied_hosts.get(request.client, (0, 0))
         if time.time() - val[1] < expiration_failed_logins \
             and val[0] >= allowed_number_of_attempts:
             return val[0]  # locked out
         time.sleep(2 ** val[0])
         val = (val[0] + 1, int(time.time()))
         denied_hosts[request.client] = val
     write_hosts_deny(denied_hosts)
     return val[0]
 
+def failed_login_count():
+    denied_hosts = read_hosts_deny()
+    val = denied_hosts.get(request.client, (0, 0))
+    return val[0]
+
 
 # ###########################################################
 # ## session expiration
 # ###########################################################
 

Vulnerable code: 
    elif not success and not request.is_local:
Fixed code:     elif failed_login_count() >= allowed_number_of_attempts:
        time.sleep(2 ** allowed_number_of_attempts)
        raise HTTP(403)
    elif not success:
def failed_login_count():
    denied_hosts = read_hosts_deny()
    val = denied_hosts.get(request.client, (0, 0))
    return val[0]
CVE-2016-3952: Credentials Management Errors (CWE-255)
value: web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify.  NOTE: this issue can be leveraged by remote attackers to gain administrative access.
CWE description: Weaknesses in this category are related to the management of credentials.
CVSS v3 base score: 7.8
Published: 2018-02-06T18:29Z
Repository: https://github.com/web2py/web2py
Language: Python
Files changed: gluon/globals.py
Commit date: 2016-03-14 14:52:41 -0500
Commit message: DO NOT LEAK GLOBALS SETTINGS INTO request object

Diff: diff --git a/gluon/globals.py b/gluon/globals.py
index 5581ade84..4f9ff8110 100644
--- a/gluon/globals.py
+++ b/gluon/globals.py
@@ -184,11 +184,10 @@ class Request(Storage):
 
     def __init__(self, env):
         Storage.__init__(self)
         self.env = Storage(env)
         self.env.web2py_path = global_settings.applications_parent
-        self.env.update(global_settings)
         self.cookies = Cookie.SimpleCookie()
         self._get_vars = None
         self._post_vars = None
         self._vars = None
         self._body = None
@@ -200,11 +199,10 @@ class Request(Storage):
         self.now = datetime.datetime.now()
         self.utcnow = datetime.datetime.utcnow()
         self.is_restful = False
         self.is_https = False
         self.is_local = False
-        self.global_settings = settings.global_settings
         self._uuid = None
 
     def parse_get_vars(self):
         """Takes the QUERY_STRING and unpacks it to get_vars
         """

Vulnerable code:         self.env.update(global_settings)
        self.global_settings = settings.global_settings
CVE-2022-33146: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-06-27T01:15Z
Repository: https://github.com/web2py/web2py
Language: Python
Files changed: applications/admin/controllers/default.py
Commit date: 2022-06-04 10:57:08 -0700
Commit message: added validation of send attribute in admin

Diff: diff --git a/applications/admin/controllers/default.py b/applications/admin/controllers/default.py
index e5f242ea4..65994811e 100644
--- a/applications/admin/controllers/default.py
+++ b/applications/admin/controllers/default.py
@@ -10,11 +10,11 @@ if EXPERIMENTAL_STUFF:
 
 import re
 from gluon.admin import *
 from gluon.fileutils import abspath, read_file, write_file
 from gluon.utils import web2py_uuid
-from gluon.tools import Config
+from gluon.tools import Config, prevent_open_redirect
 from gluon.compileapp import find_exposed_functions
 from glob import glob
 from gluon._compat import iteritems, PY2, pickle, xrange, urlopen, to_bytes, StringIO, to_native, reload
 import gluon.rewrite
 import shutil
@@ -116,11 +116,11 @@ def get_app(name=None):
 
 
 def index():
     """ Index handler """
 
-    send = request.vars.send
+    send = prevent_open_redirect(request.vars.send)
     if DEMO_MODE:
         session.authorized = True
         session.last_time = t0
     if not send:
         send = URL('site')

Vulnerable code: from gluon.tools import Config
    send = request.vars.send
Fixed code: from gluon.tools import Config, prevent_open_redirect
    send = prevent_open_redirect(request.vars.send)
CVE-2022-23604: Insufficient Information (NVD-CWE-noinfo)
value: x26-Cogs is a repository of cogs made by Twentysix for the Red Discord bot. Among these cogs is the Defender cog, a tool for Discord server moderation. A vulnerability in the Defender cog prior to version 1.10.0 allows users with admin privileges to issue commands as other users who share the same server. If a bot owner shares the same server as the attacker, it is possible for the attacker to issue bot-owner restricted commands. The issue has been patched in version 1.10.0. One may unload the Defender cog as a workaround.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.2
Published: 2022-02-15T16:15Z
Repository: https://github.com/Twentysix26/x26-Cogs
Language: Python
Files changed: defender/core/warden/rule.py
Commit date: 2022-01-31 14:22:52 +0100
Commit message: [Defender] WD: Ensure issuer of issue-command can view the channel

Diff: diff --git a/defender/core/warden/rule.py b/defender/core/warden/rule.py
index fe21bc7..4967a1b 100644
--- a/defender/core/warden/rule.py
+++ b/defender/core/warden/rule.py
@@ -1157,10 +1157,13 @@ class WardenRule:
                     except ValueError:
                         raise ExecutionError(f"{params.destination} is not a valid ID.")
                     if msg_obj.channel is None:
                         raise ExecutionError(f"Failed to issue command. I could not find the "
                                             "notification channel.")
+                    if msg_obj.channel.permissions_for(issuer).view_channel is False:
+                        raise ExecutionError("Failed to issue command. The issuer has no permissions "
+                                             "to view the destination channel.")
 
             msg_obj.author = issuer
             prefix = await cog.bot.get_prefix(msg_obj)
             msg_obj.content = prefix[0] + safe_sub(params.command)
             cog.bot.dispatch("message", msg_obj)

Fixed code:                     if msg_obj.channel.permissions_for(issuer).view_channel is False:
                        raise ExecutionError("Failed to issue command. The issuer has no permissions "
                                             "to view the destination channel.")
CVE-2022-1365: Incorrect Authorization (CWE-863)
value: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2022-04-15T23:15Z
Repository: https://github.com/lquixada/cross-fetch
Language: JSON
Files changed: .github/workflows/ci.yml, package.json
Commit date: 2022-01-20 17:40:13 -0500
Commit message: chore: updated node-fetch version to 2.6.7 (#124)

* chore: updated node-fetch version to 2.6.7

* build: use node 16.x instead of 15.x
Diff: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3b6f33d..568f17a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,11 +29,11 @@ jobs:
     needs: [install]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        node-version: [10.x, 12.x, 14.x, 15.x]
+        node-version: [10.x, 12.x, 14.x, 16.x]
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
     steps:
     - uses: actions/checkout@v2
     - uses: actions/cache@v2
       with:
diff --git a/package.json b/package.json
index 226fbd9..7268472 100644
--- a/package.json
+++ b/package.json
@@ -68,11 +68,11 @@
   "license": "MIT",
   "bugs": {
     "url": "https://github.com/lquixada/cross-fetch/issues"
   },
   "dependencies": {
-    "node-fetch": "2.6.5"
+    "node-fetch": "2.6.7"
   },
   "devDependencies": {
     "@commitlint/cli": "12.0.1",
     "@commitlint/config-conventional": "12.0.1",
     "@types/chai": "4.2.22",

Vulnerable code:         node-version: [10.x, 12.x, 14.x, 15.x]
    "node-fetch": "2.6.5"
Fixed code:         node-version: [10.x, 12.x, 14.x, 16.x]
    "node-fetch": "2.6.7"
CVE-2012-2129: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-08-27T21:55Z
Repository: https://github.com/splitbrain/dokuwiki
Language: PHP
Files changed: inc/html.php
Commit date: 2012-04-19 11:26:46 +0200
Commit message: escape target error message (SECURITY) FS#2487 FS#2488

The error message when a non-existant editor was tried to load wasn't
escaped correctly, allowing to introduce arbitrary JavaScript to the
output, leading to a XSS vulnerability.

Note: the reported second XCRF vulnerability is the same bug, the xploit
code simply uses JavaScript to extract a valid CSRF token from the site

Diff: diff --git a/inc/html.php b/inc/html.php
index b233e1d9..022cd792 100644
--- a/inc/html.php
+++ b/inc/html.php
@@ -1434,11 +1434,11 @@ function html_edit(){
  */
 function html_edit_form($param) {
     global $TEXT;
 
     if ($param['target'] !== 'section') {
-        msg('No editor for edit target ' . $param['target'] . ' found.', -1);
+        msg('No editor for edit target ' . hsc($param['target']) . ' found.', -1);
     }
 
     $attr = array('tabindex'=>'1');
     if (!$param['wr']) $attr['readonly'] = 'readonly';
 

Vulnerable code:         msg('No editor for edit target ' . $param['target'] . ' found.', -1);
Fixed code:         msg('No editor for edit target ' . hsc($param['target']) . ' found.', -1);
CVE-2017-18123: Improper Input Validation (CWE-20)
value: The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.6
Published: 2018-02-03T15:29Z
Repository: https://github.com/splitbrain/dokuwiki
Language: PHP
Files changed: lib/exe/ajax.php
Commit date: 2017-06-27 15:08:29 +0200
Commit message: filter special chars from ajax call parameter. fixes #2019

Diff: diff --git a/lib/exe/ajax.php b/lib/exe/ajax.php
index b3e9a618f..9f9db5391 100644
--- a/lib/exe/ajax.php
+++ b/lib/exe/ajax.php
@@ -13,13 +13,13 @@ session_write_close();
 
 header('Content-Type: text/html; charset=utf-8');
 
 //call the requested function
 if($INPUT->post->has('call')){
-    $call = $INPUT->post->str('call');
+    $call = $INPUT->post->filter('utf8_stripspecials')->str('call');
 }else if($INPUT->get->has('call')){
-    $call = $INPUT->get->str('call');
+    $call = $INPUT->get->filter('utf8_stripspecials')->str('call');
 }else{
     exit;
 }
 $callfn = 'ajax_'.$call;
 

Vulnerable code:     $call = $INPUT->post->str('call');
    $call = $INPUT->get->str('call');
Fixed code:     $call = $INPUT->post->filter('utf8_stripspecials')->str('call');
    $call = $INPUT->get->filter('utf8_stripspecials')->str('call');
CVE-2022-3123: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-09-05T10:15Z
Repository: https://github.com/splitbrain/dokuwiki
Language: PHP
Files changed: inc/Ui/PageDiff.php
Commit date: 2022-09-03 18:51:00 +0200
Commit message: SECURITY fix difftype handling. #3761

Diff: diff --git a/inc/Ui/PageDiff.php b/inc/Ui/PageDiff.php
index fe98d296cc..92aacb76a4 100644
--- a/inc/Ui/PageDiff.php
+++ b/inc/Ui/PageDiff.php
@@ -103,17 +103,18 @@ class PageDiff extends Diff
         if (!isset($this->RevInfo1, $this->RevInfo2)) {
             parent::handle();
         }
 
         // requested diff view type
+        $mode = '';
         if ($INPUT->has('difftype')) {
-            $this->preference['difftype'] = $INPUT->str('difftype');
+            $mode = $INPUT->str('difftype');
         } else {
             // read preference from DokuWiki cookie. PageDiff only
             $mode = get_doku_pref('difftype', null);
-            if (isset($mode)) $this->preference['difftype'] = $mode;
         }
+        if(in_array($mode, ['inline','sidebyside'])) $this->preference['difftype'] = $mode;
 
         if (!$INPUT->has('rev') && !$INPUT->has('rev2')) {
             global $INFO, $REV;
             if ($this->id == $INFO['id'])
                 $REV = $this->rev1; // store revision back in $REV
@@ -220,11 +221,11 @@ class PageDiff extends Diff
             return ($changeType === DOKU_CHANGE_TYPE_MINOR_EDIT) ? ' class="minor"' : '';
         };
 
         // display diff view table
         echo '<div class="table">';
-        echo '<table class="diff diff_'.$this->preference['difftype'] .'">';
+        echo '<table class="diff diff_'.hsc($this->preference['difftype']) .'">';
 
         //navigation and header
         switch ($this->preference['difftype']) {
             case 'inline':
                 $title1 = $rev1Title . ($rev1Summary ? '<br />'.$rev1Summary : '');

Vulnerable code:             $this->preference['difftype'] = $INPUT->str('difftype');
            if (isset($mode)) $this->preference['difftype'] = $mode;
        echo '<table class="diff diff_'.$this->preference['difftype'] .'">';
Fixed code:         $mode = '';
            $mode = $INPUT->str('difftype');
        if(in_array($mode, ['inline','sidebyside'])) $this->preference['difftype'] = $mode;
        echo '<table class="diff diff_'.hsc($this->preference['difftype']) .'">';
CVE-2009-10001: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2. This vulnerability affects unknown code of the file example-form.php. The manipulation of the argument captcha with the input %3Cscript%3Ealert(1)%3C/script%3E leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.3 is able to address this issue. The name of the patch is c84fb6b153bebaf228feee0cbf50728d27ae3f80. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218296.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-13T18:15Z
Repository: https://github.com/jianlinwei/cool-php-captcha
Language: PHP
Files changed: example-form.php
Commit date: 2009-02-23 02:55:02 +0000
Commit message: FIXED issue #2: Solves XSS en example-form.php

For example:
http://127.0.0.1/example-form.php?captcha=%3Cscript%3Ealert(1)%3C/script%3E

Diff: diff --git a/example-form.php b/example-form.php
index d321074..e6bc385 100644
--- a/example-form.php
+++ b/example-form.php
@@ -38,21 +38,23 @@ if (!empty($_REQUEST['captcha'])) {
     } else {
         $captcha_message = "Valid captcha";
         $style = "background-color: #CCFF99";
     }
 
+    $request_captcha = htmlspecialchars($_REQUEST['captcha']);
+
     echo <<<HTML
         <div id="result" style="$style">
         <h2>$captcha_message</h2>
         <table>
         <tr>
             <td>Session CAPTCHA:</td>
             <td>{$_SESSION['captcha']}</td>
         </tr>
         <tr>
             <td>Form CAPTCHA:</td>
-            <td>{$_REQUEST['captcha']}</td>
+            <td>$request_captcha</td>
         </tr>
         </table>
         </div>
 HTML;
     unset($_SESSION['captcha']);

Vulnerable code:             <td>{$_REQUEST['captcha']}</td>
Fixed code:     $request_captcha = htmlspecialchars($_REQUEST['captcha']);

            <td>$request_captcha</td>
CVE-2021-21385: Improper Certificate Validation (CWE-295)
value: Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 7.4
Published: 2021-03-24T21:15Z
Repository: https://github.com/openMF/mifos-mobile
Language: Unknown
Commit date: 2021-03-14 18:02:19 +0100
Commit message: Merge pull request from GHSA-9657-33wf-rmvx

Remove insecure TrustManager & HostnameVerifier.
CVE-2021-21385: Improper Validation of Certificate with Host Mismatch (CWE-297)
value: Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.
CWE description: The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
CVSS v3 base score: 7.4
Published: 2021-03-24T21:15Z
Repository: https://github.com/openMF/mifos-mobile
Language: Unknown
Commit date: 2021-03-14 18:02:19 +0100
Commit message: Merge pull request from GHSA-9657-33wf-rmvx

Remove insecure TrustManager & HostnameVerifier.
CVE-2015-3171: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.5
Published: 2017-07-25T18:29Z
Repository: https://github.com/sosreport/sos
Language: Python
Files changed: sos/sosreport.py
Commit date: 2014-10-30 16:46:01 +0000
Commit message: [sosreport] fix archive permissions regression

Restore the umask save/restore around archive creation and ensure
the effective umask is 077 at the time of archive creation.

Fixes #425.

Signed-off-by: Bryn M. Reeves <bmr@redhat.com>

Diff: diff --git a/sos/sosreport.py b/sos/sosreport.py
index 664414f..99b5f47 100644
--- a/sos/sosreport.py
+++ b/sos/sosreport.py
@@ -1325,10 +1325,11 @@ class SoSReport(object):
         # this must come before archive creation to ensure that log
         # files are closed and cleaned up at exit.
         self._finish_logging()
         # package up the results for the support organization
         if not self.opts.build:
+            old_umask = os.umask(0o077)
             if not self.opts.quiet:
                 print(_("Creating compressed archive..."))
             # compression could fail for a number of reasons
             try:
                 final_filename = self.archive.finalize(
@@ -1343,10 +1344,12 @@ class SoSReport(object):
             except:
                 if self.opts.debug:
                     raise
                 else:
                     return False
+            finally:
+                os.umask(old_umask)
         else:
             final_filename = self.archive.get_archive_path()
         self.policy.display_results(final_filename, build=self.opts.build)
         self.tempfile_util.clean()
         return True

Fixed code:             old_umask = os.umask(0o077)
            finally:
                os.umask(old_umask)
CVE-2024-29862: Insufficient Information (NVD-CWE-noinfo)
value: The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certain TCP packets when a connection is not in the ESTABLISHED state.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T04:15Z
Repository: https://github.com/chirpstack/chirpstack-mqtt-forwarder
Language: Other
Files changed: packaging/vendor/kerlink/klkgw/files/chirpstack-mqtt-forwarder.init
Commit date: 2024-03-11 09:56:42 +0000
Commit message: Fix Kerlink firewall rule security issue.

This limits accepting incoming TCP packets from the --sport for
ESTABLISHED connections only.

Diff: diff --git a/packaging/vendor/kerlink/klkgw/files/chirpstack-mqtt-forwarder.init b/packaging/vendor/kerlink/klkgw/files/chirpstack-mqtt-forwarder.init
index be09288..ee173d7 100755
--- a/packaging/vendor/kerlink/klkgw/files/chirpstack-mqtt-forwarder.init
+++ b/packaging/vendor/kerlink/klkgw/files/chirpstack-mqtt-forwarder.init
@@ -8,11 +8,11 @@ DAEMON_PID=/var/run/$NAME.pid
 
 function iptables_accept {
     [ -n "${1}" ] || exit 1
     local RULE="OUTPUT -t filter -p tcp --dport ${1} -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
-    local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"
+    local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"
     iptables -C ${RULE} 2> /dev/null || iptables -I ${RULE}
 }
 
 
 function do_start {

Vulnerable code:     local RULE="INPUT -t filter -p tcp --sport ${1} -j ACCEPT"
Fixed code:     local RULE="INPUT -t filter -p tcp --sport ${1} -m conntrack --ctstate ESTABLISHED -j ACCEPT"