Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-27678: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2020-10-26T12:17Z
Repository: https://github.com/illumos/illumos-gate
Language: C
Files changed: usr/src/lib/libpam/pam_framework.c
Commit date: 2020-10-22 10:07:33 -0400
Commit message: 13242 parse_user_name in PAM is sloppy
Reviewed by: Alex Wilson <alex@cooperi.net>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>

Diff: diff --git a/usr/src/lib/libpam/pam_framework.c b/usr/src/lib/libpam/pam_framework.c
index b3340ffd5e0..9c462188122 100644
--- a/usr/src/lib/libpam/pam_framework.c
+++ b/usr/src/lib/libpam/pam_framework.c
@@ -22,11 +22,11 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
 /*
- * Copyright (c) 2019, Joyent, Inc.
+ * Copyright 2020, Joyent, Inc.
  */
 
 #include <syslog.h>
 #include <dlfcn.h>
 #include <sys/types.h>
@@ -654,23 +654,24 @@ parse_user_name(char *user_input, char **ret_username)
 	/*
 	 * username will be the first string we get from user_input
 	 * - we skip leading whitespaces and ignore trailing whitespaces
 	 */
 	while (*ptr != '\0') {
-		if ((*ptr == ' ') || (*ptr == '\t'))
+		if ((*ptr == ' ') || (*ptr == '\t') ||
+		    (index >= PAM_MAX_RESP_SIZE)) {
 			break;
-		else {
+		} else {
 			username[index] = *ptr;
 			index++;
 			ptr++;
 		}
 	}
 
 	/* ret_username will be freed in pam_get_user(). */
-	if ((*ret_username = malloc(index + 1)) == NULL)
+	if (index >= PAM_MAX_RESP_SIZE ||
+	    (*ret_username = strdup(username)) == NULL)
 		return (PAM_BUF_ERR);
-	(void) strcpy(*ret_username, username);
 	return (PAM_SUCCESS);
 }
 
 /*
  * Get the value of PAM_USER. If not set, then use the convenience function

Vulnerable code:  * Copyright (c) 2019, Joyent, Inc.
		if ((*ptr == ' ') || (*ptr == '\t'))
		else {
	if ((*ret_username = malloc(index + 1)) == NULL)
	(void) strcpy(*ret_username, username);
Fixed code:  * Copyright 2020, Joyent, Inc.
		if ((*ptr == ' ') || (*ptr == '\t') ||
		    (index >= PAM_MAX_RESP_SIZE)) {
		} else {
	if (index >= PAM_MAX_RESP_SIZE ||
	    (*ret_username = strdup(username)) == NULL)
CVE-2017-16907: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-11-20T20:29Z
Repository: https://github.com/horde/base
Language: PHP
Files changed: lib/View/Sidebar.php
Commit date: 2018-09-25 12:12:35 -0400
Commit message: Bug: 14857

Escape user supplied color data, preventing XSS vuln.

Diff: diff --git a/lib/View/Sidebar.php b/lib/View/Sidebar.php
index e8963262..fed0734b 100644
--- a/lib/View/Sidebar.php
+++ b/lib/View/Sidebar.php
@@ -219,11 +219,11 @@ class Horde_View_Sidebar extends Horde_View
                 $foreground = 'fff';
             }
             if (strlen($row['style'])) {
                 $row['style'] .= ';';
             }
-            $row['style'] .= 'background-color:' . $row['color']
+            $row['style'] .= 'background-color:' . htmlspecialchars($row['color'])
                 . ';color:#' . $foreground;
             if (isset($row['edit'])) {
                 $row['editLink'] = $row['edit']
                     ->link(array(
                         'title' =>  _("Edit"),

Vulnerable code:             $row['style'] .= 'background-color:' . $row['color']
Fixed code:             $row['style'] .= 'background-color:' . htmlspecialchars($row['color'])
CVE-2019-3554: Data Processing Errors (CWE-19)
value: Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00
CWE description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CVSS v3 base score: 5.9
Published: 2019-01-15T22:29Z
Repository: https://github.com/facebook/wangle
Language: C
Files changed: wangle/bootstrap/AcceptRoutingHandler-inl.h
Commit date: 2019-01-10 15:30:01 -0800
Commit message: AcceptRoutingHandler should not assume a folly::AsyncSocket

Summary:
There is no reason to perform a cast to folly::AsyncSocket, when all of the
required behavior is in folly::AsyncTransportWrapper.

CVE-2019-3554

Reviewed By: avasylev

Differential Revision: D13599212

fbshipit-source-id: 3bb5475fe464c04cf5c04115f34e1bcf237cb4aa

Diff: diff --git a/wangle/bootstrap/AcceptRoutingHandler-inl.h b/wangle/bootstrap/AcceptRoutingHandler-inl.h
index d21fda6..b0b27f3 100644
--- a/wangle/bootstrap/AcceptRoutingHandler-inl.h
+++ b/wangle/bootstrap/AcceptRoutingHandler-inl.h
@@ -84,12 +84,13 @@ void AcceptRoutingHandler<Pipeline, R>::onRoutingData(
   auto routingPipeline = std::move(routingPipelineIter->second);
   routingPipelines_.erase(routingPipelineIter);
 
   // Fetch the socket from the pipeline and pause reading from the
   // socket
-  auto socket = std::dynamic_pointer_cast<folly::AsyncSocket>(
+  auto socket = std::dynamic_pointer_cast<folly::AsyncTransportWrapper>(
       routingPipeline->getTransport());
+  CHECK(socket);
   routingPipeline->transportInactive();
   socket->detachEventBase();
 
   // Hash based on routing data to pick a new acceptor
   uint64_t hash = std::hash<R>()(routingData.routingData);

Vulnerable code:   auto socket = std::dynamic_pointer_cast<folly::AsyncSocket>(
Fixed code:   auto socket = std::dynamic_pointer_cast<folly::AsyncTransportWrapper>(
  CHECK(socket);
CVE-2019-20387: Out-of-bounds Read (CWE-125)
value: repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2020-01-21T23:15Z
Repository: https://github.com/openSUSE/libsolv
Language: C
Files changed: src/repodata.c
Commit date: 2019-08-06 10:13:38 +0800
Commit message: repodata_schema2id: fix heap-buffer-overflow in memcmp

When the length of last schema in data->schemadata is
less than length of input schema, we got a read overflow
in asan test.

Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>

Diff: diff --git a/src/repodata.c b/src/repodata.c
index 0c7a51f1..3cae0fe4 100644
--- a/src/repodata.c
+++ b/src/repodata.c
@@ -209,15 +209,17 @@ repodata_schema2id(Repodata *data, Id *schema, int create)
   len++;
 
   cid = schematahash[h];
   if (cid)
     {
-      if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
+      if ((data->schemata[cid] + len <= data->schemadatalen) &&
+			  !memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
         return cid;
       /* cache conflict, do a slow search */
       for (cid = 1; cid < data->nschemata; cid++)
-        if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
+        if ((data->schemata[cid] + len <= data->schemadatalen) &&
+				!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
           return cid;
     }
   /* a new one */
   if (!create)
     return 0;

Vulnerable code:       if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
        if (!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
Fixed code:       if ((data->schemata[cid] + len <= data->schemadatalen) &&
			  !memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
        if ((data->schemata[cid] + len <= data->schemadatalen) &&
				!memcmp(data->schemadata + data->schemata[cid], schema, len * sizeof(Id)))
CVE-2020-36630: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216771.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-12-25T20:15Z
Repository: https://github.com/FreePBX/cdr
Language: Unknown
Commit date: 2020-08-10 06:53:37 +0000
Commit message: Merge pull request #20 in FREEPBX/cdr from ~VMISHRA/cdr:bugfix/FREEI-1763-14 to release/14.0

* commit '4aceac9f7e27b4715d702ce5fee377f13da6e89f':
  FREEI-1763 (ver14)SQL Injection in Cdr Module for the UCP application
CVE-2022-46663: Other (NVD-CWE-Other)
value: In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2023-02-07T21:15Z
Repository: https://github.com/gwsw/less
Language: C
Files changed: line.c
Commit date: 2022-10-07 19:25:46 -0700
Commit message: End OSC8 hyperlink on invalid embedded escape sequence.

Diff: diff --git a/line.c b/line.c
index 236c49a..cba7bdd 100644
--- a/line.c
+++ b/line.c
@@ -631,12 +631,12 @@ ansi_step(pansi, ch)
 	if (pansi->hlink)
 	{
 		/* Hyperlink ends with \7 or ESC-backslash. */
 		if (ch == '\7')
 			return ANSI_END;
-		if (pansi->prev_esc && ch == '\\')
-			return ANSI_END;
+		if (pansi->prev_esc)
+            return (ch == '\\') ? ANSI_END : ANSI_ERR;
 		pansi->prev_esc = (ch == ESC);
 		return ANSI_MID;
 	}
 	if (pansi->hindex >= 0)
 	{

Vulnerable code: 		if (pansi->prev_esc && ch == '\\')
			return ANSI_END;
Fixed code: 		if (pansi->prev_esc)
            return (ch == '\\') ? ANSI_END : ANSI_ERR;
CVE-2022-48624: Insufficient Information (NVD-CWE-noinfo)
value: close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-19T01:15Z
Repository: https://github.com/gwsw/less
Language: C
Files changed: filename.c
Commit date: 2022-06-25 11:54:43 -0700
Commit message: Shell-quote filenames when invoking LESSCLOSE.

Diff: diff --git a/filename.c b/filename.c
index 5824e38..dff20c0 100644
--- a/filename.c
+++ b/filename.c
@@ -970,10 +970,12 @@ close_altfile(altfilename, filename)
 	char *altfilename;
 	char *filename;
 {
 #if HAVE_POPEN
 	char *lessclose;
+	char *qfilename;
+	char *qaltfilename;
 	FILE *fd;
 	char *cmd;
 	int len;
 	
 	if (secure)
@@ -984,13 +986,17 @@ close_altfile(altfilename, filename)
 	if (num_pct_s(lessclose) > 2) 
 	{
 		error("LESSCLOSE ignored; must contain no more than 2 %%s", NULL_PARG);
 		return;
 	}
-	len = (int) (strlen(lessclose) + strlen(filename) + strlen(altfilename) + 2);
+	qfilename = shell_quote(filename);
+	qaltfilename = shell_quote(altfilename);
+	len = (int) (strlen(lessclose) + strlen(qfilename) + strlen(qaltfilename) + 2);
 	cmd = (char *) ecalloc(len, sizeof(char));
-	SNPRINTF2(cmd, len, lessclose, filename, altfilename);
+	SNPRINTF2(cmd, len, lessclose, qfilename, qaltfilename);
+	free(qaltfilename);
+	free(qfilename);
 	fd = shellcmd(cmd);
 	free(cmd);
 	if (fd != NULL)
 		pclose(fd);
 #endif

Vulnerable code: 	len = (int) (strlen(lessclose) + strlen(filename) + strlen(altfilename) + 2);
	SNPRINTF2(cmd, len, lessclose, filename, altfilename);
Fixed code: 	char *qfilename;
	char *qaltfilename;
	qfilename = shell_quote(filename);
	qaltfilename = shell_quote(altfilename);
	len = (int) (strlen(lessclose) + strlen(qfilename) + strlen(qaltfilename) + 2);
	SNPRINTF2(cmd, len, lessclose, qfilename, qaltfilename);
	free(qaltfilename);
	free(qfilename);
CVE-2024-32487: Insufficient Information (NVD-CWE-noinfo)
value: less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-13T15:15Z
Repository: https://github.com/gwsw/less
Language: C
Files changed: filename.c
Commit date: 2024-04-11 17:49:48 -0700
Commit message: Fix bug when viewing a file whose name contains a newline.

Diff: diff --git a/filename.c b/filename.c
index f90e0e82..a52c6354 100644
--- a/filename.c
+++ b/filename.c
@@ -125,15 +125,24 @@ static constant char * metachars(void)
 }
 
 /*
  * Is this a shell metacharacter?
  */
-static int metachar(char c)
+static lbool metachar(char c)
 {
 	return (strchr(metachars(), c) != NULL);
 }
 
+/*
+ * Must use quotes rather than escape char for this metachar?
+ */
+static lbool must_quote(char c)
+{
+	/* {{ Maybe the set of must_quote chars should be configurable? }} */
+	return (c == '\n'); 
+}
+
 /*
  * Insert a backslash before each metacharacter in a string.
  */
 public char * shell_quoten(constant char *s, size_t slen)
 {
@@ -162,10 +171,13 @@ public char * shell_quoten(constant char *s, size_t slen)
 				/*
 				 * We've got a metachar, but this shell 
 				 * doesn't support escape chars.  Use quotes.
 				 */
 				use_quotes = TRUE;
+			} else if (must_quote(*p))
+			{
+				len += 3; /* open quote + char + close quote */
 			} else
 			{
 				/*
 				 * Allow space for the escape char.
 				 */
@@ -192,19 +204,26 @@ public char * shell_quoten(constant char *s, size_t slen)
 	} else
 	{
 		constant char *es = s + slen;
 		while (s < es)
 		{
-			if (metachar(*s))
+			if (!metachar(*s))
 			{
-				/*
-				 * Add the escape char.
-				 */
+				*np++ = *s++;
+			} else if (must_quote(*s))
+			{
+				/* Surround the char with quotes. */
+				*np++ = openquote;
+				*np++ = *s++;
+				*np++ = closequote;
+			} else
+			{
+				/* Insert an escape char before the char. */
 				strcpy(np, esc);
 				np += esclen;
+				*np++ = *s++;
 			}
-			*np++ = *s++;
 		}
 		*np = '\0';
 	}
 	return (newstr);
 }

Vulnerable code: static int metachar(char c)
			if (metachar(*s))
				/*
				 * Add the escape char.
				 */
			*np++ = *s++;
Fixed code: static lbool metachar(char c)
/*
 * Must use quotes rather than escape char for this metachar?
 */
static lbool must_quote(char c)
{
	/* {{ Maybe the set of must_quote chars should be configurable? }} */
	return (c == '\n'); 
}

			} else if (must_quote(*p))
			{
				len += 3; /* open quote + char + close quote */
			if (!metachar(*s))
				*np++ = *s++;
			} else if (must_quote(*s))
			{
				/* Surround the char with quotes. */
				*np++ = openquote;
				*np++ = *s++;
				*np++ = closequote;
			} else
			{
				/* Insert an escape char before the char. */
				*np++ = *s++;
CVE-2015-3296: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-09-21T14:29Z
Repository: https://github.com/julianlam/nodebb-plugin-markdown
Language: JSON
Files changed: index.js, package.json
Commit date: 2015-03-30 17:01:09 -0400
Commit message: updated plugin to use markdown-it instead of remarkable, and updated validateLink method to discard all data-uris, until a solution is developed upstream.

Diff: diff --git a/index.js b/index.js
index 2aab028..2ff4ccd 100644
--- a/index.js
+++ b/index.js
@@ -1,9 +1,9 @@
 (function() {
 	"use strict";
 
-	var	Remarkable = require('remarkable'),
+	var	MarkdownIt = require('markdown-it'),
 		fs = require('fs'),
 		path = require('path'),
 		url = require('url'),
 		async = module.parent.require('async'),
 		meta = module.parent.require('./meta'),
@@ -65,11 +65,22 @@
 					}
 
 					_self.highlight = _self.config.highlight || true;
 					delete _self.config.highlight;
 
-					parser = new Remarkable(_self.config);
+					parser = new MarkdownIt(_self.config);
+
+					// Override the link validator from MarkdownIt, so you cannot link directly to a data-uri
+					parser.validateLink = function(url) {
+						var BAD_PROTOCOLS    = [ 'vbscript', 'javascript', 'file', 'data' ];
+						var str = url.trim().toLowerCase();
+
+						if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
+							return false;
+						}
+						return true;
+					}
 				});
 			},
 
 			loadThemes: function() {
 				fs.readdir(path.join(__dirname, 'public/styles'), function(err, files) {
diff --git a/package.json b/package.json
index 21fbdd2..f74a877 100644
--- a/package.json
+++ b/package.json
@@ -16,11 +16,11 @@
   "license": "MIT",
   "bugs": {
     "url": "https://github.com/julianlam/nodebb-plugin-markdown/issues"
   },
   "dependencies": {
-    "remarkable": "^1.3.0"
+    "markdown-it": "^4.0.3"
   },
   "nbbpm": {
     "compatibility": "^0.7.0"
   }
 }

Vulnerable code: 	var	Remarkable = require('remarkable'),
					parser = new Remarkable(_self.config);
    "remarkable": "^1.3.0"
Fixed code: 	var	MarkdownIt = require('markdown-it'),
					parser = new MarkdownIt(_self.config);

					// Override the link validator from MarkdownIt, so you cannot link directly to a data-uri
					parser.validateLink = function(url) {
						var BAD_PROTOCOLS    = [ 'vbscript', 'javascript', 'file', 'data' ];
						var str = url.trim().toLowerCase();

						if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
							return false;
						}
						return true;
					}
    "markdown-it": "^4.0.3"
CVE-2021-23370: Insufficient Information (NVD-CWE-noinfo)
value: This affects the package swiper before 6.5.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-04-12T14:15Z
Repository: https://github.com/nolimits4web/swiper
Language: JavaScript
Files changed: src/utils/utils.js
Commit date: 2021-03-25 11:45:49 +0300
Commit message: fix(core): fixed __proto__ pollution

Diff: diff --git a/src/utils/utils.js b/src/utils/utils.js
index 4c93486..4134f73 100644
--- a/src/utils/utils.js
+++ b/src/utils/utils.js
@@ -90,11 +90,11 @@ function isObject(o) {
 function extend(...args) {
   const to = Object(args[0]);
   for (let i = 1; i < args.length; i += 1) {
     const nextSource = args[i];
     if (nextSource !== undefined && nextSource !== null) {
-      const keysArray = Object.keys(Object(nextSource));
+      const keysArray = Object.keys(Object(nextSource)).filter((key) => key !== '__proto__');
       for (let nextIndex = 0, len = keysArray.length; nextIndex < len; nextIndex += 1) {
         const nextKey = keysArray[nextIndex];
         const desc = Object.getOwnPropertyDescriptor(nextSource, nextKey);
         if (desc !== undefined && desc.enumerable) {
           if (isObject(to[nextKey]) && isObject(nextSource[nextKey])) {

Vulnerable code:       const keysArray = Object.keys(Object(nextSource));
Fixed code:       const keysArray = Object.keys(Object(nextSource)).filter((key) => key !== '__proto__');
CVE-2020-36651: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The identifier of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-01-18T01:15Z
Repository: https://github.com/youngerheart/nodeserver
Language: JavaScript
Files changed: nodeserver.js
Commit date: 2020-08-22 01:12:46 +0200
Commit message: [FIX] Path traversal sanitizing request path
Diff: diff --git a/nodeserver.js b/nodeserver.js
index 1a63041..e4e88be 100644
--- a/nodeserver.js
+++ b/nodeserver.js
@@ -25,12 +25,12 @@ function start(config) {
     for(var key in conf.serv) {
       if(request.headers.host.indexOf(key) !== -1) {
         host = conf.serv[key];
       }
     }
-    
-    var nowTemp = host.frondend + (request.url.replace('/', '') || host.baseTemp);
+
+    var nowTemp = (host.frondend + (request.url.replace('/', '') || host.baseTemp)).replace(/\.\./g, '');
     var httpHead = header(nowTemp);
     conf.app = conf.getApp(host.backend);
     if(!host) {
       error(response);
       return;

Vulnerable code:     
    var nowTemp = host.frondend + (request.url.replace('/', '') || host.baseTemp);
Fixed code: 
    var nowTemp = (host.frondend + (request.url.replace('/', '') || host.baseTemp)).replace(/\.\./g, '');
CVE-2015-3409: Other (NVD-CWE-Other)
value: Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-05-19T18:59Z
Repository: https://github.com/audreyt/module-signature
Language: Perl
Files changed: lib/Module/Signature.pm
Commit date: 2015-04-07 02:37:30 +0800
Commit message: * Avoid loading modules from relative paths in @INC for Text::Diff etc.

  Also reported by John Lightsey.

Diff: diff --git a/lib/Module/Signature.pm b/lib/Module/Signature.pm
index 154c592..51cef59 100644
--- a/lib/Module/Signature.pm
+++ b/lib/Module/Signature.pm
@@ -117,10 +117,12 @@ sub verify {
 sub _verify {
     my $signature = shift || $SIGNATURE;
     my $sigtext   = shift || '';
     my $plaintext = shift || '';
 
+    # Avoid loading modules from relative paths in @INC.
+    local @INC = grep { File::Spec->file_name_is_absolute($_) } @INC;
     local $SIGNATURE = $signature if $signature ne $SIGNATURE;
 
     if ($AutoKeyRetrieve and !$CanKeyRetrieve) {
         if (!defined $CanKeyRetrieve) {
             require IO::Socket::INET;

Fixed code:     # Avoid loading modules from relative paths in @INC.
    local @INC = grep { File::Spec->file_name_is_absolute($_) } @INC;
CVE-2019-15296: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2019-08-21T07:15Z
Repository: https://github.com/knik0/faad2
Language: C
Files changed: libfaad/bits.c, libfaad/syntax.c
Commit date: 2019-06-10 13:58:40 +0200
Commit message: Fix a couple buffer overflows

https://hackerone.com/reports/502816
https://hackerone.com/reports/507858

https://github.com/videolan/vlc/blob/master/contrib/src/faad2/faad2-fix-overflows.patch

Diff: diff --git a/libfaad/bits.c b/libfaad/bits.c
index dc14d7a..4c0de24 100644
--- a/libfaad/bits.c
+++ b/libfaad/bits.c
@@ -165,11 +165,14 @@ void faad_resetbits(bitfile *ld, int bits)
 {
     uint32_t tmp;
     int words = bits >> 5;
     int remainder = bits & 0x1F;
 
-    ld->bytes_left = ld->buffer_size - words*4;
+    if (ld->buffer_size < words * 4)
+        ld->bytes_left = 0;
+    else
+        ld->bytes_left = ld->buffer_size - words*4;
 
     if (ld->bytes_left >= 4)
     {
         tmp = getdword(&ld->start[words]);
         ld->bytes_left -= 4;
diff --git a/libfaad/syntax.c b/libfaad/syntax.c
index e7fb113..c992543 100644
--- a/libfaad/syntax.c
+++ b/libfaad/syntax.c
@@ -2302,10 +2302,12 @@ static uint8_t excluded_channels(bitfile *ld, drc_info *drc)
     n++;
 
     while ((drc->additional_excluded_chns[n-1] = faad_get1bit(ld
         DEBUGVAR(1,104,"excluded_channels(): additional_excluded_chns"))) == 1)
     {
+        if (i >= MAX_CHANNELS - num_excl_chan - 7)
+            return n;
         for (i = num_excl_chan; i < num_excl_chan+7; i++)
         {
             drc->exclude_mask[i] = faad_get1bit(ld
                 DEBUGVAR(1,105,"excluded_channels(): exclude_mask"));
         }

Vulnerable code:     ld->bytes_left = ld->buffer_size - words*4;
Fixed code:     if (ld->buffer_size < words * 4)
        ld->bytes_left = 0;
    else
        ld->bytes_left = ld->buffer_size - words*4;
        if (i >= MAX_CHANNELS - num_excl_chan - 7)
            return n;
CVE-2021-32272: Out-of-bounds Write (CWE-787)
value: An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2021-09-20T16:15Z
Repository: https://github.com/knik0/faad2
Language: C
Files changed: frontend/mp4read.c
Commit date: 2020-08-31 10:02:37 +0200
Commit message: fix heap-buffer-overflow in mp4read.c

This originated from an integer overflow: If mp4config.frame.ents
would be read-in with a value of (uint32t)(-1), it would overflow to 0
in the size calculation for the allocation in the next line. The
malloc() function would then successfully return a pointer to a memory
region of size 0, which will cause a segfault when written to.

Fixes #57.

Diff: diff --git a/frontend/mp4read.c b/frontend/mp4read.c
index 1414684..6a618d3 100644
--- a/frontend/mp4read.c
+++ b/frontend/mp4read.c
@@ -342,11 +342,14 @@ static int stszin(int size)
     u32in();
     // Sample size
     u32in();
     // Number of entries
     mp4config.frame.ents = u32in();
-    // fixme: check atom size
+
+    if (!(mp4config.frame.ents + 1))
+        return ERR_FAIL;
+
     mp4config.frame.data = malloc(sizeof(*mp4config.frame.data)
                                   * (mp4config.frame.ents + 1));
 
     if (!mp4config.frame.data)
         return ERR_FAIL;

Vulnerable code:     // fixme: check atom size
Fixed code: 
    if (!(mp4config.frame.ents + 1))
        return ERR_FAIL;
CVE-2022-35930: Improper Verification of Cryptographic Signature (CWE-347)
value: PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are NO attestations of the type being verified (--type defaults to "custom"). An example image that can be used to test this is `ghcr.io/distroless/static@sha256:dd7614b5a12bc4d617b223c588b4e0c833402b8f4991fb5702ea83afad1986e2`. Users should upgrade to version 0.2.1 to resolve this issue. There are no workarounds for users unable to upgrade.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 8.8
Published: 2022-08-04T22:15Z
Repository: https://github.com/sigstore/policy-controller
Language: Unknown
Commit date: 2022-08-04 09:06:30 -0700
Commit message: Merge pull request from GHSA-739f-hw6h-7wq8

Compute the filtered attestation list.
CVE-2022-24913: Exposure of Resource to Wrong Sphere (CWE-668)
value: Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdTempFileProvider.java, which uses the permissive File.createTempFile() function, exposing temporary file contents.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 5.5
Published: 2023-01-12T05:15Z
Repository: https://github.com/cowtowncoder/java-merge-sort
Language: Java
Files changed: src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java
Commit date: 2022-11-19 02:05:10 +0000
Commit message: vuln-fix: Temporary File Information Disclosure



This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>
Diff: diff --git a/src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java b/src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java
index d2e37fa..213f9eb 100644
--- a/src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java
+++ b/src/main/java/com/fasterxml/sort/std/StdTempFileProvider.java
@@ -1,8 +1,9 @@
 package com.fasterxml.sort.std;
 
 import java.io.*;
+import java.nio.file.Files;
 
 import com.fasterxml.sort.TempFileProvider;
 
 /**
  * Default {@link TempFileProvider} implementation which uses JDK default
@@ -33,10 +34,10 @@ public class StdTempFileProvider
     }
     
     @Override
     public File provide() throws IOException
     {
-        File f = File.createTempFile(_prefix, _suffix);
+        File f = Files.createTempFile(_prefix, _suffix).toFile();
         f.deleteOnExit();
         return f;
     }
 }

Vulnerable code:         File f = File.createTempFile(_prefix, _suffix);
Fixed code: import java.nio.file.Files;
        File f = Files.createTempFile(_prefix, _suffix).toFile();
CVE-2014-125055: Observable Timing Discrepancy (CWE-208)
value: A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596.
CWE description: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.3
Published: 2023-01-07T09:15Z
Repository: https://github.com/agnivade/easy-scrypt
Language: Go
Files changed: scrypt.go
Commit date: 2014-10-10 15:50:08 -0700
Commit message: Preventing timing attacks

- By using ConstantTimeCompare

Reviewed by:
Testing:
Tickets:
Backport:

Diff: diff --git a/scrypt.go b/scrypt.go
index 71a5a4a..c378826 100644
--- a/scrypt.go
+++ b/scrypt.go
@@ -2,10 +2,11 @@ package scrypt
 
 import (
 	"bytes"
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/binary"
 	"log"
 
 	"code.google.com/p/go.crypto/scrypt"
 )
@@ -115,12 +116,16 @@ func VerifyPassphrase(passphrase string, keylen_bytes int, target_key []byte) (r
 		log.Fatalf("hash_digest.Write failed: %s\n", err)
 		return
 	}
 	source_hash := hash_digest.Sum(nil)
 
-	result = bytes.Equal(source_master_key, target_master_key) &&
-		bytes.Equal(target_hash, source_hash)
+	// ConstantTimeCompare returns ints. Converting it to bool
+	key_comp := subtle.ConstantTimeCompare(source_master_key,
+		target_master_key) != 0
+	hash_comp := subtle.ConstantTimeCompare(target_hash,
+		source_hash) != 0
+	result = key_comp && hash_comp
 	return
 }
 
 func generateSalt() (salt []byte) {
 	salt = make([]byte, 16)

Vulnerable code: 	result = bytes.Equal(source_master_key, target_master_key) &&
		bytes.Equal(target_hash, source_hash)
Fixed code: 	"crypto/subtle"
	// ConstantTimeCompare returns ints. Converting it to bool
	key_comp := subtle.ConstantTimeCompare(source_master_key,
		target_master_key) != 0
	hash_comp := subtle.ConstantTimeCompare(target_hash,
		source_hash) != 0
	result = key_comp && hash_comp
CVE-2021-4270: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers.cs. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6140b140ccd02b5e4e7d6ba013ac1225724487f4. It is recommended to apply a patch to fix this issue. VDB-216474 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T19:15Z
Repository: https://github.com/peders/Imprint-CMS
Language: C#
Files changed: ImprintCMS/Models/ViewHelpers.cs
Commit date: 2021-04-09 13:58:42 +0200
Commit message: Encode search query to prevent XSS attacks.

Diff: diff --git a/ImprintCMS/Models/ViewHelpers.cs b/ImprintCMS/Models/ViewHelpers.cs
index a1b0c7a..71de14c 100644
--- a/ImprintCMS/Models/ViewHelpers.cs
+++ b/ImprintCMS/Models/ViewHelpers.cs
@@ -470,11 +470,11 @@ namespace ImprintCMS.Models
 <fieldset>
 	<p>
 		<input type=""search"" name=""q"" id=""query"" value=""{1}"" placeholder=""{2}"" />
 		<input type=""submit"" id=""button"" value=""{3}"" /></p>
 </fieldset>
-</form>", action, query, SitePhrases.LabelSearchPlaceholder, SitePhrases.LabelSearch));
+</form>", action, helper.AttributeEncode(query), SitePhrases.LabelSearchPlaceholder, SitePhrases.LabelSearch));
         }
 
         public static HtmlString Legend(this HtmlHelper helper, string text)
         {
             return new HtmlString("<span class=\"widget legend\" title=\"" + helper.Encode(text) + "\">" + SitePhrases.LabelLegendPlaceholder + "</span>");

Vulnerable code: </form>", action, query, SitePhrases.LabelSearchPlaceholder, SitePhrases.LabelSearch));
Fixed code: </form>", action, helper.AttributeEncode(query), SitePhrases.LabelSearchPlaceholder, SitePhrases.LabelSearch));
CVE-2022-35923: Inefficient Regular Expression Complexity (CWE-1333)
value: v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()` function a payload of 'a' + 'a'.repeat(i) + 'A' with 32 leading characters took 29443 ms to execute. The same issue happens with uppercase(). Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2022-08-02T20:15Z
Repository: https://github.com/imbrn/v8n
Language: JavaScript
Files changed: src/v8n.js
Commit date: 2022-06-30 23:06:27 -0300
Commit message: fix inefficient regular expressions on lowercase and uppercase rules

Diff: diff --git a/src/v8n.js b/src/v8n.js
index 7072acc..1af2539 100644
--- a/src/v8n.js
+++ b/src/v8n.js
@@ -187,13 +187,19 @@ const availableRules = {
 
   // Pattern
 
   pattern: expected => value => expected.test(value),
 
-  lowercase: () => value => /^([a-z]+\s*)+$/.test(value),
+  lowercase: () => value => {
+    return (
+      typeof value === 'boolean' ||
+      (value === value.toLowerCase() && value.trim() !== '')
+    );
+  },
 
-  uppercase: () => value => /^([A-Z]+\s*)+$/.test(value),
+  uppercase: () => value =>
+    value === value.toUpperCase() && value.trim() !== '',
 
   vowel: () => value => /^[aeiou]+$/i.test(value),
 
   consonant: () => value => /^(?=[^aeiou])([a-z]+)$/i.test(value),
 

Vulnerable code:   lowercase: () => value => /^([a-z]+\s*)+$/.test(value),
  uppercase: () => value => /^([A-Z]+\s*)+$/.test(value),
Fixed code:   lowercase: () => value => {
    return (
      typeof value === 'boolean' ||
      (value === value.toLowerCase() && value.trim() !== '')
    );
  },
  uppercase: () => value =>
    value === value.toUpperCase() && value.trim() !== '',
CVE-2020-7206: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-07-17T22:15Z
Repository: https://github.com/HewlettPackard/nagios-plugins-hpilo
Language: Unknown
Commit date: 2020-07-16 17:25:17 -0500
Commit message: Merge pull request #8 from dchangtw/1.5.0

CVE-2020-7206: Fix php code injection problem
CVE-2018-20962: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-08-08T20:15Z
Repository: https://github.com/Laravel-Backpack/CRUD
Language: PHP
Files changed: CHANGELOG.md, src/resources/views/columns/select.blade.php
Commit date: 2018-05-10 05:19:48 +0000
Commit message: fixes #1297 - possible xss vulnerability in select field type

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d225eb..5235a31 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,10 +22,11 @@ All Notable changes to `Backpack CRUD` will be documented in this file
 
 ## [3.4.9] - 2018-05-xx
 
 ## Fixed
 - #1378 - when a custom default page length is specified, it should show up in the page length menu;
+- #1297 - possible XSS vulnerability in ```select``` field type; now using ```e()``` to escape the attribute;
 
 
 ## [3.4.8] - 2018-05-07
 
 ## Fixed
diff --git a/src/resources/views/columns/select.blade.php b/src/resources/views/columns/select.blade.php
index f0a50c6..82b0aed 100644
--- a/src/resources/views/columns/select.blade.php
+++ b/src/resources/views/columns/select.blade.php
@@ -1,11 +1,11 @@
 {{-- single relationships (1-1, 1-n) --}}
 <span>
     <?php
         $attributes = $crud->getModelAttributeFromRelation($entry, $column['entity'], $column['attribute']);
         if (count($attributes)) {
-            echo implode(', ', $attributes);
+            echo e(implode(', ', $attributes));
         } else {
             echo '-';
         }
     ?>
 </span>

Vulnerable code:             echo implode(', ', $attributes);
Fixed code: - #1297 - possible XSS vulnerability in ```select``` field type; now using ```e()``` to escape the attribute;
            echo e(implode(', ', $attributes));
CVE-2015-2784: Improper Input Validation (CWE-20)
value: The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2020-01-21T18:15Z
Repository: https://github.com/rsantamaria/papercrop
Language: Ruby
Files changed: lib/paperclip_processors/cropper.rb
Commit date: 2015-09-21 18:10:38 +0100
Commit message: Sanitized crop input, logs with Paperclip log function if anything weird happens

Diff: diff --git a/lib/paperclip_processors/cropper.rb b/lib/paperclip_processors/cropper.rb
index a2807f6..184afdd 100644
--- a/lib/paperclip_processors/cropper.rb
+++ b/lib/paperclip_processors/cropper.rb
@@ -14,15 +14,20 @@ module Paperclip
 
     def crop_command
       target = @attachment.instance
 
       if target.cropping?(@attachment.name)
-        w = target.send :"#{@attachment.name}_crop_w"
-        h = target.send :"#{@attachment.name}_crop_h"
-        x = target.send :"#{@attachment.name}_crop_x"
-        y = target.send :"#{@attachment.name}_crop_y"
-        ["-crop", "#{w}x#{h}+#{x}+#{y}"]
+        begin
+          w = Integer(target.send :"#{@attachment.name}_crop_w")
+          h = Integer(target.send :"#{@attachment.name}_crop_h")
+          x = Integer(target.send :"#{@attachment.name}_crop_x")
+          y = Integer(target.send :"#{@attachment.name}_crop_y")
+          ["-crop", "#{w}x#{h}+#{x}+#{y}"]
+        rescue
+          Paperclip.log("[papercrop] #{@attachment.name} crop w/h/x/y were non-integer")
+          return
+        end
       end
     end
 
   end
 end
\ No newline at end of file

Vulnerable code:         w = target.send :"#{@attachment.name}_crop_w"
        h = target.send :"#{@attachment.name}_crop_h"
        x = target.send :"#{@attachment.name}_crop_x"
        y = target.send :"#{@attachment.name}_crop_y"
        ["-crop", "#{w}x#{h}+#{x}+#{y}"]
Fixed code:         begin
          w = Integer(target.send :"#{@attachment.name}_crop_w")
          h = Integer(target.send :"#{@attachment.name}_crop_h")
          x = Integer(target.send :"#{@attachment.name}_crop_x")
          y = Integer(target.send :"#{@attachment.name}_crop_y")
          ["-crop", "#{w}x#{h}+#{x}+#{y}"]
        rescue
          Paperclip.log("[papercrop] #{@attachment.name} crop w/h/x/y were non-integer")
          return
        end
CVE-2017-20164: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2023-01-07T20:15Z
Repository: https://github.com/symbiote/silverstripe-seed
Language: PHP
Files changed: code/extensions/SecurityLoginExtension.php
Commit date: 2017-02-16 15:46:17 +1100
Commit message: SECURITY, fixing a possible phishing exploit.

Diff: diff --git a/code/extensions/SecurityLoginExtension.php b/code/extensions/SecurityLoginExtension.php
index af0d020..a80ec4f 100644
--- a/code/extensions/SecurityLoginExtension.php
+++ b/code/extensions/SecurityLoginExtension.php
@@ -5,11 +5,11 @@ class SecurityLoginExtension extends Extension {
 	public function onBeforeSecurityLogin() {
 
 		// Determine whether a user has already authenticated, and whether a back URL exists.
 
 		$URL = $this->owner->getRequest()->getVar('BackURL');
-		if(Member::currentUserID() && $URL) {
+		if(Member::currentUserID() && $URL && Director::is_site_url($URL)) {
 
 			// Take the user to the back URL.
 
 			$this->owner->redirect($URL);
 		}

Vulnerable code: 		if(Member::currentUserID() && $URL) {
Fixed code: 		if(Member::currentUserID() && $URL && Director::is_site_url($URL)) {