Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-19858: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-01-21T13:15Z
Repository: https://github.com/plutinosoft/Platinum
Language: C++
Files changed: Source/Core/PltHttpServer.cpp
Commit date: 2019-07-22 23:07:31 -0700
Commit message: Fix vulnerability around urls crafter as http://host/../secret.foo (#24)


Diff: diff --git a/Source/Core/PltHttpServer.cpp b/Source/Core/PltHttpServer.cpp
index 3d9180c..4cdcf49 100644
--- a/Source/Core/PltHttpServer.cpp
+++ b/Source/Core/PltHttpServer.cpp
@@ -188,11 +188,11 @@ PLT_HttpServer::ServeFile(const NPT_HttpRequest&        request,
     NPT_InputStreamReference stream;
     NPT_File                 file(file_path);
     NPT_FileInfo             file_info;
     
     // prevent hackers from accessing files outside of our root
-    if ((file_path.Find("/..") >= 0) || (file_path.Find("\\..") >= 0) ||
+    if ((file_path.Find("../") >= 0) || (file_path.Find("..\\") >= 0) ||
         NPT_FAILED(NPT_File::GetInfo(file_path, &file_info))) {
         return NPT_ERROR_NO_SUCH_ITEM;
     }
     
     // check for range requests

Vulnerable code:     if ((file_path.Find("/..") >= 0) || (file_path.Find("\\..") >= 0) ||
Fixed code:     if ((file_path.Find("../") >= 0) || (file_path.Find("..\\") >= 0) ||
CVE-2018-18206: Integer Overflow or Wraparound (CWE-190)
value: In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2018-10-10T09:29Z
Repository: https://github.com/Bytom/bytom
Language: Go
Files changed: p2p/discover/net.go
Commit date: 2018-08-31 13:48:40 +0800
Commit message: p2p/discv5: fix idx can be negative after uint convert to int(can cause crash) (#1307)


Diff: diff --git a/p2p/discover/net.go b/p2p/discover/net.go
index a6319d89..3645860f 100644
--- a/p2p/discover/net.go
+++ b/p2p/discover/net.go
@@ -1219,11 +1219,11 @@ func (net *Network) checkTopicRegister(data *topicRegister) (*pong, error) {
 	// that the other side is trying to register.
 	hash, _, _ := wireHash(data.Topics)
 	if hash != pongpkt.data.(*pong).TopicHash {
 		return nil, errors.New("topic hash mismatch")
 	}
-	if data.Idx < 0 || int(data.Idx) >= len(data.Topics) {
+	if int(data.Idx) < 0 || int(data.Idx) >= len(data.Topics) {
 		return nil, errors.New("topic index out of range")
 	}
 	return pongpkt.data.(*pong), nil
 }
 

Vulnerable code: 	if data.Idx < 0 || int(data.Idx) >= len(data.Topics) {
Fixed code: 	if int(data.Idx) < 0 || int(data.Idx) >= len(data.Topics) {
CVE-2015-3454: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2017-09-06T21:29Z
Repository: https://github.com/VulcanJS/Vulcan
Language: JavaScript
Files changed: lib/publications.js, server/publications/users.js
Commit date: 2015-03-25 10:12:03 +0900
Commit message: do not publish password bcrypt token

Diff: diff --git a/lib/publications.js b/lib/publications.js
index 1395555e..de0472d3 100644
--- a/lib/publications.js
+++ b/lib/publications.js
@@ -23,10 +23,15 @@ privacyOptions = { // true means exposed
   'votes.downvotedPosts': true,
   'votes.upvotedComments': true,
   'votes.upvotedPosts': true
 };
 
+// options for your own user account (for security reasons, block certain properties)
+ownUserOptions = {
+  'services.password.bcrypt': false
+}
+
 // minimum required properties to display avatars
 avatarOptions = {
   _id: true,
   email_hash: true,
   slug: true,
diff --git a/server/publications/users.js b/server/publications/users.js
index 32c13a0f..63f750e0 100644
--- a/server/publications/users.js
+++ b/server/publications/users.js
@@ -1,9 +1,9 @@
 // Publish the current user
 
 Meteor.publish('currentUser', function() {
-  var user = Meteor.users.find({_id: this.userId});
+  var user = Meteor.users.find({_id: this.userId}, {fields: ownUserOptions});
   return user;
 });
 
 // publish all users for admins to make autocomplete work
 // TODO: find a better way

Vulnerable code:   var user = Meteor.users.find({_id: this.userId});
Fixed code: // options for your own user account (for security reasons, block certain properties)
ownUserOptions = {
  'services.password.bcrypt': false
}

  var user = Meteor.users.find({_id: this.userId}, {fields: ownUserOptions});
CVE-2019-14667: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-08-05T20:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Other
Files changed: resources/views/v1/transactions/convert.twig
Commit date: 2019-08-02 20:57:36 +0200
Commit message: Fix #2363

Diff: diff --git a/resources/views/v1/transactions/convert.twig b/resources/views/v1/transactions/convert.twig
index 051f843a40..6c591337fa 100644
--- a/resources/views/v1/transactions/convert.twig
+++ b/resources/views/v1/transactions/convert.twig
@@ -15,11 +15,11 @@
                     <div class="box-header with-border">
                         <h3 class="box-title">{{ ('convert_options_'~sourceType.type~destinationType.type)|_ }}</h3>
                     </div>
                     <div class="box-body">
                         {{ ExpandedForm.staticText('type', sourceType.type|_) }}
-                        {{ ExpandedForm.staticText('description', '<a href="'~route('transactions.show', journal.id)~'">'~journal.description~'</a>') }}
+                        {{ ExpandedForm.staticText('description', '<a href="'~route('transactions.show', journal.id)~'">'~journal.description|escape~'</a>') }}
                         {{ ExpandedForm.staticText('date', journal.date.formatLocalized(monthAndDayFormat)) }}
 
                         {# in case of withdrawal #}
                         {% if sourceType.type == "Withdrawal" %}
                             {{ ExpandedForm.staticText('source_account_asset', '<a href="'~route('accounts.show',[sourceAccount.id])~'">'~sourceAccount.name|escape~'</a>') }}

Vulnerable code:                         {{ ExpandedForm.staticText('description', '<a href="'~route('transactions.show', journal.id)~'">'~journal.description~'</a>') }}
Fixed code:                         {{ ExpandedForm.staticText('description', '<a href="'~route('transactions.show', journal.id)~'">'~journal.description|escape~'</a>') }}
CVE-2019-14669: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-08-05T20:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Other
Files changed: resources/views/v1/reports/audit/report.twig
Commit date: 2019-08-02 16:46:45 +0200
Commit message: Fix #2366

Diff: diff --git a/resources/views/v1/reports/audit/report.twig b/resources/views/v1/reports/audit/report.twig
index 2a22974078..ce28483e70 100644
--- a/resources/views/v1/reports/audit/report.twig
+++ b/resources/views/v1/reports/audit/report.twig
@@ -40,11 +40,11 @@
             <div class="box-body">
 
                 <em>
                     {{ trans('firefly.no_audit_activity',
                         {
-                            account_name: account.name,
+                            account_name: account.name|escape,
                             url: url,
                             start: start.formatLocalized(monthAndDayFormat),
                             end: end.formatLocalized(monthAndDayFormat),
                         })|raw }}
                 </em>
@@ -53,21 +53,21 @@
             <div class="box-body table-responsive no-padding">
                 <p style="padding:10px;">
 
                     {{ trans('firefly.audit_end_balance',
                         {
-                            account_name: account.name,
+                            account_name: account.name|escape,
                             url: url,
                             end: auditData[account.id].end,
                             balance: formatAmountByAccount(account,auditData[account.id].endBalance)
                         })|raw }}
                 </p>
                 {% include 'reports.partials.journals-audit'  with {'journals': auditData[account.id].journals,'account':account} %}
                 <p style="padding:10px;">
                     {{ trans('firefly.audit_end_balance',
                         {
-                            account_name: account.name,
+                            account_name: account.name|escape,
                             url: url,
                             end: auditData[account.id].dayBefore,
                             balance: formatAmountByAccount(account, auditData[account.id].dayBeforeBalance)
                         })|raw }}
                 </p>

Vulnerable code:                             account_name: account.name,
                            account_name: account.name,
                            account_name: account.name,
Fixed code:                             account_name: account.name|escape,
                            account_name: account.name|escape,
                            account_name: account.name|escape,
CVE-2019-14670: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-08-05T20:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: PHP
Files changed: app/Http/Controllers/Rule/CreateController.php
Commit date: 2019-08-02 16:44:48 +0200
Commit message: Fix #2365

Diff: diff --git a/app/Http/Controllers/Rule/CreateController.php b/app/Http/Controllers/Rule/CreateController.php
index 03f47f7dee..464f5d4608 100644
--- a/app/Http/Controllers/Rule/CreateController.php
+++ b/app/Http/Controllers/Rule/CreateController.php
@@ -122,11 +122,11 @@ public function create(Request $request, RuleGroup $ruleGroup = null)
      * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
      * @SuppressWarnings(PHPMD.CyclomaticComplexity)
      */
     public function createFromBill(Request $request, Bill $bill)
     {
-        $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => $bill->name]));
+        $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => e($bill->name)]));
 
         $this->createDefaultRuleGroup();
         $this->createDefaultRule();
         $preFilled = [
             'strict'      => true,

Vulnerable code:         $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => $bill->name]));
Fixed code:         $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => e($bill->name)]));
CVE-2019-14671: Improper Input Validation (CWE-20)
value: Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 3.3
Published: 2019-08-05T20:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: PHP
Files changed: app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
Commit date: 2019-08-02 17:05:54 +0200
Commit message: Fix #2367

Diff: diff --git a/app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php b/app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
index 2c688158e0..51da2ed0f0 100644
--- a/app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
+++ b/app/Support/Import/JobConfiguration/FinTS/NewFinTSJobHandler.php
@@ -58,10 +58,13 @@ public function configureJob(array $data): MessageBag
         $config['fints_bank_code'] = (string)($data['fints_bank_code'] ?? '');
         $config['fints_username']  = (string)($data['fints_username'] ?? '');
         $config['fints_password']  = (string)(Crypt::encrypt($data['fints_password']) ?? '');
         $config['apply-rules']     = 1 === (int)$data['apply_rules'];
 
+        // sanitize FinTS URL.
+        $config['fints_url'] = $this->validURI($config['fints_url']) ? $config['fints_url'] : '';
+
         $this->repository->setConfiguration($this->importJob, $config);
 
 
         $incomplete = false;
         foreach ($config as $value) {
@@ -106,6 +109,23 @@ public function setImportJob(ImportJob $importJob): void
         $this->importJob  = $importJob;
         $this->repository = app(ImportJobRepositoryInterface::class);
         $this->repository->setUser($importJob->user);
     }
 
+    /**
+     * @param string $fints_url
+     *
+     * @return bool
+     */
+    private function validURI(string $fintsUri): bool
+    {
+        $res = filter_var($fintsUri, FILTER_VALIDATE_URL);
+        if (false === $res) {
+            return false;
+        }
+        $scheme = parse_url($fintsUri, PHP_URL_SCHEME);
+
+        return 'https' === $scheme;
+    }
+
+
 }

Fixed code:         // sanitize FinTS URL.
        $config['fints_url'] = $this->validURI($config['fints_url']) ? $config['fints_url'] : '';

    /**
     * @param string $fints_url
     *
     * @return bool
     */
    private function validURI(string $fintsUri): bool
    {
        $res = filter_var($fintsUri, FILTER_VALIDATE_URL);
        if (false === $res) {
            return false;
        }
        $scheme = parse_url($fintsUri, PHP_URL_SCHEME);

        return 'https' === $scheme;
    }
CVE-2019-14672: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-08-05T20:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: PHP
Files changed: app/Support/Http/Controllers/UserNavigation.php
Commit date: 2019-08-03 05:08:20 +0200
Commit message: Fix #2370

Diff: diff --git a/app/Support/Http/Controllers/UserNavigation.php b/app/Support/Http/Controllers/UserNavigation.php
index 66e30c5c02..1cac4ed6b0 100644
--- a/app/Support/Http/Controllers/UserNavigation.php
+++ b/app/Support/Http/Controllers/UserNavigation.php
@@ -122,22 +122,22 @@ protected function redirectToAccount(TransactionJournal $journal)
     protected function redirectToOriginalAccount(Account $account)
     {
         /** @var Transaction $transaction */
         $transaction = $account->transactions()->first();
         if (null === $transaction) {
-            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => $account->name, 'id' => $account->id]));
+            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => e($account->name), 'id' => $account->id]));
             Log::error(sprintf('Expected a transaction. Account #%d has none. BEEP, error.', $account->id));
 
             return redirect(route('index'));
         }
 
         $journal = $transaction->transactionJournal;
         /** @var Transaction $opposingTransaction */
         $opposingTransaction = $journal->transactions()->where('transactions.id', '!=', $transaction->id)->first();
 
         if (null === $opposingTransaction) {
-            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => $account->name, 'id' => $account->id]));
+            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => e($account->name), 'id' => $account->id]));
             Log::error(sprintf('Expected an opposing transaction. Account #%d has none. BEEP, error.', $account->id));
         }
 
         return redirect(route('accounts.show', [$opposingTransaction->account_id]));
     }

Vulnerable code:             app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => $account->name, 'id' => $account->id]));
            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => $account->name, 'id' => $account->id]));
Fixed code:             app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => e($account->name), 'id' => $account->id]));
            app('session')->flash('error', trans('firefly.account_missing_transaction', ['name' => e($account->name), 'id' => $account->id]));
CVE-2021-3663: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 7.5
Published: 2021-07-25T14:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: PHP
Files changed: app/Http/Controllers/Auth/LoginController.php
Commit date: 2021-07-23 06:26:42 +0200
Commit message: Add missing rate limiter.

Diff: diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 13afb3a466..27a8cb866d 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -27,10 +27,11 @@
 use DB;
 use FireflyIII\Http\Controllers\Controller;
 use FireflyIII\Providers\RouteServiceProvider;
 use Illuminate\Contracts\View\Factory;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
+use Illuminate\Foundation\Auth\ThrottlesLogins;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Validation\ValidationException;
 use Illuminate\View\View;
@@ -45,11 +46,11 @@
  *
  * @codeCoverageIgnore
  */
 class LoginController extends Controller
 {
-    use AuthenticatesUsers;
+    use AuthenticatesUsers, ThrottlesLogins;
 
     /**
      * Where to redirect users after login.
      *
      * @var string

Vulnerable code:     use AuthenticatesUsers;
Fixed code: use Illuminate\Foundation\Auth\ThrottlesLogins;
    use AuthenticatesUsers, ThrottlesLogins;
CVE-2021-3846: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2021-10-19T13:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: PHP
Files changed: app/Helpers/Attachments/AttachmentHelper.php
Commit date: 2021-10-01 11:33:45 +0200
Commit message: Make sure temp file is closed (and thus deleted)

Diff: diff --git a/app/Helpers/Attachments/AttachmentHelper.php b/app/Helpers/Attachments/AttachmentHelper.php
index d442d461376..b988220f21b 100644
--- a/app/Helpers/Attachments/AttachmentHelper.php
+++ b/app/Helpers/Attachments/AttachmentHelper.php
@@ -169,10 +169,11 @@ public function saveAttachmentFromApi(Attachment $attachment, string $content):
         $finfo       = finfo_open(FILEINFO_MIME_TYPE);
         $mime        = finfo_file($finfo, $path);
         $allowedMime = config('firefly.allowedMimes');
         if (!in_array($mime, $allowedMime, true)) {
             Log::error(sprintf('Mime type %s is not allowed for API file upload.', $mime));
+            fclose($resource);
 
             return false;
         }
         // is allowed? Save the file, without encryption.
         $this->uploadDisk->put($attachment->fileName(), $content);

Fixed code:             fclose($resource);
CVE-2023-0298: Incorrect Authorization (CWE-863)
value: Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2023-01-14T08:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Unknown
Commit date: 2023-01-14 07:55:11 +0100
Commit message: Merge pull request #6850 from firefly-iii/fix-auth-issue

Expand authentication validation in API.
CVE-2023-1788: Insufficient Session Expiration (CWE-613)
value: Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2023-04-05T16:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Unknown
Commit date: 2023-02-20 12:46:36 +0100
Commit message: Merge pull request #7062 from firefly-iii/JC5-patch-1

Update session.php
CVE-2023-1789: Improper Input Validation (CWE-20)
value: Improper Input Validation in GitHub repository firefly-iii/firefly-iii prior to 6.0.0.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2023-04-01T02:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Unknown
Commit date: 2023-02-17 05:50:11 +0100
Commit message: Merge pull request #7043 from firefly-iii/fix-bad-escape

Catch escape in currencies
CVE-2015-1471: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-02-12T16:59Z
Repository: https://github.com/delta/pragyan
Language: PHP
Files changed: index.php
Commit date: 2015-02-03 23:15:21 -0600
Commit message: Update index.php
Diff: diff --git a/index.php b/index.php
index 7903f95..09ae3db 100755
--- a/index.php
+++ b/index.php
@@ -142,11 +142,11 @@ $userId=firstTimeGetUserId();
 if(isset($_GET['page']))
 	$pageFullPath = strtolower($_GET['page']);
 ///Case 2 : request for a user profile page
 else if(isset($_GET['user'])) {
 	$publicPageRequest = true;
-	$userProfileId = $_GET['user'];
+	$userProfileId = safe_html(escape($_GET['user']));
 	//This is just to prevent parsing a NULL url when someone misplaces the code for User profile parser
 	$pageFullPath = "home";
 }
 else $pageFullPath = "home";
 

Vulnerable code: 	$userProfileId = $_GET['user'];
Fixed code: 	$userProfileId = safe_html(escape($_GET['user']));
CVE-2019-16161: NULL Pointer Dereference (CWE-476)
value: Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-09-09T17:15Z
Repository: https://github.com/k-takata/Onigmo
Language: Unknown
Commit date: 2019-07-29 21:43:26 +0900
Commit message: Merge pull request #134 from k-takata/fix-segv-in-error-str

Fix SEGV in onig_error_code_to_str() (Fix #132)
CVE-2021-41131: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.7
Published: 2021-10-19T18:15Z
Repository: https://github.com/theupdateframework/python-tuf
Language: Unknown
Commit date: 2021-10-19 14:21:29 +0100
Commit message: Merge pull request from GHSA-wjw6-2cqr-j4qr

Fix client issue with rolenames as filenames
CVE-2014-4668: Improper Authentication (CWE-287)
value: The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Published: 2014-07-02T04:14Z
Repository: https://github.com/cherokee/webserver
Language: C
Files changed: cherokee/validator_ldap.c
Commit date: 2014-02-11 22:45:41 +0100
Commit message: Prevent the LDAP validator from accepting an empty password.

Diff: diff --git a/cherokee/validator_ldap.c b/cherokee/validator_ldap.c
index f007f6a4..417fd9e4 100644
--- a/cherokee/validator_ldap.c
+++ b/cherokee/validator_ldap.c
@@ -333,11 +333,12 @@ cherokee_validator_ldap_check (cherokee_validator_ldap_t *ldap,
 	cherokee_validator_ldap_props_t *props   = VAL_LDAP_PROP(ldap);
 
 	/* Sanity checks
 	 */
 	if ((conn->validator == NULL) ||
-	    cherokee_buffer_is_empty (&conn->validator->user))
+	    cherokee_buffer_is_empty (&conn->validator->user) ||
+	    cherokee_buffer_is_empty (&conn->validator->passwd))
 		return ret_error;
 
 	size = cherokee_buffer_cnt_cspn (&conn->validator->user, 0, "*()");
 	if (size != conn->validator->user.len)
 		return ret_error;

Vulnerable code: 	    cherokee_buffer_is_empty (&conn->validator->user))
Fixed code: 	    cherokee_buffer_is_empty (&conn->validator->user) ||
	    cherokee_buffer_is_empty (&conn->validator->passwd))
CVE-2019-9870: Data Processing Errors (CWE-19)
value: plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements.
CWE description: Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CVSS v3 base score: 9.8
Published: 2019-03-21T16:01Z
Repository: https://github.com/w8tcha/CKEditor-oEmbed-Plugin
Language: JavaScript
Files changed: oembed/plugin.js
Commit date: 2019-03-14 10:23:17 +0100
Commit message: fixed #94

Diff: diff --git a/oembed/plugin.js b/oembed/plugin.js
index 78108bb..06b52c5 100644
--- a/oembed/plugin.js
+++ b/oembed/plugin.js
@@ -77,13 +77,10 @@
                                     attributes: '*'
                                 },
                                 'div(embeddedContent,oembed-provider-*) blockquote': {
                                     attributes: '*'
                                 },
-                                'div(embeddedContent,oembed-provider-*) script': {
-                                    attributes: '*'
-                                },
                                 'div(embeddedContent,oembed-provider-*) embed': {
                                     attributes: '*'
                                 }
                             },
                             template:

Vulnerable code:                                 'div(embeddedContent,oembed-provider-*) script': {
                                    attributes: '*'
                                },
CVE-2020-15007: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2020-06-24T11:15Z
Repository: https://github.com/AXDOOMER/doom-vanille
Language: C
Files changed: m_misc.c
Commit date: 2020-06-11 01:57:07 -0400
Commit message: Fix buffer overflow in M_LoadDefaults

Too much data will most likely result in a crash or freeze, but you can overwrite the stack which can be used to do an arbitrary code execution. (https://twitter.com/notrevenant/status/1268654123903340544)

Diff: diff --git a/m_misc.c b/m_misc.c
index 7e49a51..01629ad 100644
--- a/m_misc.c
+++ b/m_misc.c
@@ -477,11 +477,11 @@ void M_LoadDefaults (void)
     if (f)
     {
 	while (!feof(f))
 	{
 	    isstring = false;
-	    if (fscanf (f, "%79s %[^\n]\n", def, strparm) == 2)
+	    if (fscanf (f, "%79s %99[^\n]\n", def, strparm) == 2)
 	    {
 		if (strparm[0] == '"')
 		{
 		    // get a string default
 		    isstring = true;

Vulnerable code: 	    if (fscanf (f, "%79s %[^\n]\n", def, strparm) == 2)
Fixed code: 	    if (fscanf (f, "%79s %99[^\n]\n", def, strparm) == 2)
CVE-2020-7611: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due to not validating request headers passed to the client.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 9.8
Published: 2020-03-30T22:15Z
Repository: https://github.com/micronaut-projects/micronaut-core
Language: Java
Files changed: http-netty/src/main/java/io/micronaut/http/netty/NettyHttpHeaders.java
Commit date: 2020-03-09 14:20:28 -0400
Commit message: Validate client headers

Diff: diff --git a/http-netty/src/main/java/io/micronaut/http/netty/NettyHttpHeaders.java b/http-netty/src/main/java/io/micronaut/http/netty/NettyHttpHeaders.java
index 97956bef1..35d6a191d 100644
--- a/http-netty/src/main/java/io/micronaut/http/netty/NettyHttpHeaders.java
+++ b/http-netty/src/main/java/io/micronaut/http/netty/NettyHttpHeaders.java
@@ -51,11 +51,11 @@ public class NettyHttpHeaders implements MutableHttpHeaders {
 
     /**
      * Default constructor.
      */
     public NettyHttpHeaders() {
-        this.nettyHeaders = new DefaultHttpHeaders(false);
+        this.nettyHeaders = new DefaultHttpHeaders();
         this.conversionService = ConversionService.SHARED;
     }
 
     /**
      * @return The underlying Netty headers.

Vulnerable code:         this.nettyHeaders = new DefaultHttpHeaders(false);
Fixed code:         this.nettyHeaders = new DefaultHttpHeaders();
CVE-2020-11722: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2020-04-12T19:15Z
Repository: https://github.com/crawl/crawl
Language: C++
Files changed: crawl-ref/source/clua.cc
Commit date: 2020-02-16 13:34:42 +0800
Commit message: Disable lua load(), loadstring() bytcode loading

Diff: diff --git a/crawl-ref/source/clua.cc b/crawl-ref/source/clua.cc
index d336a278dc..80976b68fd 100644
--- a/crawl-ref/source/clua.cc
+++ b/crawl-ref/source/clua.cc
@@ -302,10 +302,13 @@ int CLua::loadfile(lua_State *ls, const char *filename, bool trusted,
     FileLineInput f(file.c_str());
     string script;
     while (!f.eof())
         script += f.get_line() + "\n";
 
+    if (script[0] == 0x1b)
+        abort();
+
     // prefixing with @ stops lua from adding [string "%s"]
     return luaL_loadbuffer(ls, &script[0], script.length(),
                            ("@" + file).c_str());
 }
 
@@ -794,10 +797,12 @@ void CLua::init_libraries()
 {
     lua_stack_cleaner clean(state());
 
     lua_pushcfunction(_state, lua_loadstring);
     lua_setglobal(_state, "loadstring");
+    lua_pushnil(_state);
+    lua_setglobal(_state, "load");
 
     // Open Crawl bindings
     cluaopen_kills(_state);
     cluaopen_you(_state);
     cluaopen_item(_state);

Fixed code:     if (script[0] == 0x1b)
        abort();

    lua_pushnil(_state);
    lua_setglobal(_state, "load");
CVE-2020-11722: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2020-04-12T19:15Z
Repository: https://github.com/crawl/crawl
Language: C++
Files changed: crawl-ref/source/clua.cc
Commit date: 2020-02-13 21:31:55 +0800
Commit message: Disable lua bytecode loading

Diff: diff --git a/crawl-ref/source/clua.cc b/crawl-ref/source/clua.cc
index 7a4afa91ac..d336a278dc 100644
--- a/crawl-ref/source/clua.cc
+++ b/crawl-ref/source/clua.cc
@@ -774,14 +774,31 @@ void CLua::init_lua()
 
     lua_pushlightuserdata(_state, this);
     setregistry("__clua");
 }
 
+static int lua_loadstring(lua_State *ls)
+{
+    const auto lua = luaL_checkstring(ls, 1);
+    if (lua[0] == 0x1b)
+        abort();
+    lua_settop(ls, 0);
+    if (luaL_loadstring(ls, lua))
+    {
+        lua_pushnil(ls);
+        lua_insert(ls, 1);
+    }
+    return lua_gettop(ls);
+}
+
 void CLua::init_libraries()
 {
     lua_stack_cleaner clean(state());
 
+    lua_pushcfunction(_state, lua_loadstring);
+    lua_setglobal(_state, "loadstring");
+
     // Open Crawl bindings
     cluaopen_kills(_state);
     cluaopen_you(_state);
     cluaopen_item(_state);
     cluaopen_food(_state);

Fixed code: static int lua_loadstring(lua_State *ls)
{
    const auto lua = luaL_checkstring(ls, 1);
    if (lua[0] == 0x1b)
        abort();
    lua_settop(ls, 0);
    if (luaL_loadstring(ls, lua))
    {
        lua_pushnil(ls);
        lua_insert(ls, 1);
    }
    return lua_gettop(ls);
}

    lua_pushcfunction(_state, lua_loadstring);
    lua_setglobal(_state, "loadstring");
CVE-2019-25085: Use After Free (CWE-416)
value: A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder.c. The manipulation leads to use after free. It is possible to initiate the attack remotely. The name of the patch is d83587b2a364eb9a9a53be7e6a708074e252de14. It is recommended to apply a patch to fix this issue. The identifier VDB-216789 was assigned to this vulnerability.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.8
Published: 2022-12-26T07:15Z
Repository: https://github.com/GNOME/gvdb
Language: C
Files changed: gvdb-builder.c
Commit date: 2019-06-27 16:58:03 -0500
Commit message: Fix gvdb_table_write_contents_async()

It worked when I first wrote it, but I broke it during the late stages
of code review. str is already freed here, so this is a use-after-free
vulnerability for starters. It also causes the file saved to be always
empty.

Diff: diff --git a/gvdb-builder.c b/gvdb-builder.c
index cf94691..e36e9ab 100644
--- a/gvdb-builder.c
+++ b/gvdb-builder.c
@@ -606,11 +606,13 @@ gvdb_table_write_contents_async (GHashTable          *table,
 
   task = g_task_new (NULL, cancellable, callback, user_data);
   g_task_set_task_data (task, data, (GDestroyNotify)write_contents_data_free);
   g_task_set_source_tag (task, gvdb_table_write_contents_async);
 
-  g_file_replace_contents_async (file, str->str, str->len,
+  g_file_replace_contents_async (file,
+                                 g_bytes_get_data (bytes, NULL),
+                                 g_bytes_get_size (bytes),
                                  NULL, FALSE,
                                  G_FILE_CREATE_PRIVATE | G_FILE_CREATE_REPLACE_DESTINATION,
                                  cancellable, replace_contents_cb, g_steal_pointer (&task));
 
   g_bytes_unref (bytes);

Vulnerable code:   g_file_replace_contents_async (file, str->str, str->len,
Fixed code:   g_file_replace_contents_async (file,
                                 g_bytes_get_data (bytes, NULL),
                                 g_bytes_get_size (bytes),
CVE-2021-40348: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2021-11-01T05:15Z
Repository: https://github.com/uyuni-project/uyuni
Language: Other
Files changed: spacewalk/admin/spacewalk-admin.changes
Commit date: 2021-10-28 12:28:24 +0200
Commit message: Merge pull request #4414 from uyuni-project/Uyuni-2021.09

Backport #4413 and tagging to master
Diff: diff --cc spacewalk/admin/spacewalk-admin.changes
index c1be10665c,bab34bad7c..894cd225ec
--- a/spacewalk/admin/spacewalk-admin.changes
+++ b/spacewalk/admin/spacewalk-admin.changes
@@@ -1,8 -1,13 +1,16 @@@
 +- Add connection details for postgresql salt pillar
 +- replaced pidof with pgrep and removed sysvinit-tools dependency
 +
+ -------------------------------------------------------------------
+ Thu Oct 28 12:16:53 CEST 2021 - jgonzalez@suse.com
+ 
+ - version 4.3.2-1
+   * Fix setup with rhn-config-satellite (bsc#1190300)
+   * Allow admins to modify only spacewalk config files with
+     rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)
+ 
  -------------------------------------------------------------------
  Mon Aug 09 10:57:26 CEST 2021 - jgonzalez@suse.com
  
  - version 4.3.1-1
  - added pidof requirement for RHEL (bsc#1186129).

Fixed code:  -------------------------------------------------------------------
 Thu Oct 28 12:16:53 CEST 2021 - jgonzalez@suse.com
 
 - version 4.3.2-1
   * Fix setup with rhn-config-satellite (bsc#1190300)
   * Allow admins to modify only spacewalk config files with
     rhn-config-satellite.pl (bsc#1190040) (CVE-2021-40348)
CVE-2020-7704: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2020-08-17T17:15Z
Repository: https://github.com/piranna/linux-cmdline
Language: JavaScript
Files changed: index.js, test.js
Commit date: 2020-08-15 01:41:49 +0200
Commit message: [fix] Don't pollute prototype

Diff: diff --git a/index.js b/index.js
index 675fe73..a6a70f1 100644
--- a/index.js
+++ b/index.js
@@ -3,31 +3,41 @@ function reducer(result, arg)
   arg = arg.split('=')
 
   // Get key node
   const keypath = arg.shift().split('.')
 
-  let key = keypath.shift()
-  let node = result
-
-  while(keypath.length)
-  {
-    node[key] = node[key] || {}
-    node = node[key]
-
-    key = keypath.shift()
-  }
-
   // Get value
   let val = true
   if(arg.length)
   {
     val = arg.join('=').split(',')
     if(val.length === 1) val = val[0]
   }
 
+  let key = keypath.shift()
+
+  if(!keypath.length) return {...result, [key]: val}
+
+  if(!result.hasOwnProperty(key)) result = {...result, [key]: {}}
+
+  let newKey
+  let newNode
+  let node = result
+
+  while(true)
+  {
+    newKey = keypath.shift()
+    newNode = node[key]
+
+    if(!keypath.length) break
+
+    node = node[key] = {...newNode, [newKey]: newNode[newKey] || {}}
+    key = newKey
+  }
+
   // Store value
-  node[key] = val
+  node[key] = {...newNode, [newKey]: val}
 
   return result
 }
 
 
diff --git a/test.js b/test.js
index 9c4ab13..36d48af 100755
--- a/test.js
+++ b/test.js
@@ -17,5 +17,20 @@ const expected =
 }
 
 const result = linuxCmdline(cmdline)
 
 deepStrictEqual(result, expected)
+
+
+// Don't pollute prototype
+const result2 = linuxCmdline('__proto__.polluted=foo')
+const expected2 =
+{
+  ['__proto__']:
+  {
+    polluted: 'foo'
+  }
+}
+
+deepStrictEqual(result2, expected2)
+
+deepStrictEqual({}.__proto__.polluted, undefined)

Vulnerable code:   let key = keypath.shift()
  let node = result

  while(keypath.length)
  {
    node[key] = node[key] || {}
    node = node[key]

    key = keypath.shift()
  }

  node[key] = val
Fixed code:   let key = keypath.shift()

  if(!keypath.length) return {...result, [key]: val}

  if(!result.hasOwnProperty(key)) result = {...result, [key]: {}}

  let newKey
  let newNode
  let node = result

  while(true)
  {
    newKey = keypath.shift()
    newNode = node[key]

    if(!keypath.length) break

    node = node[key] = {...newNode, [newKey]: newNode[newKey] || {}}
    key = newKey
  }

  node[key] = {...newNode, [newKey]: val}


// Don't pollute prototype
const result2 = linuxCmdline('__proto__.polluted=foo')
const expected2 =
{
  ['__proto__']:
  {
    polluted: 'foo'
  }
}

deepStrictEqual(result2, expected2)

deepStrictEqual({}.__proto__.polluted, undefined)