Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2012-1108: Improper Input Validation (CWE-20)
value: The parse function in ogg/xiphcomment.cpp in TagLib 1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted vendorLength field in an ogg file.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2012-09-06T18:55Z
Repository: https://github.com/taglib/taglib
Language: C++
Files changed: taglib/ogg/xiphcomment.cpp
Commit date: 2011-06-09 18:44:54 +0200
Commit message: Be more careful when parsing Vorbis Comments

Diff: diff --git a/taglib/ogg/xiphcomment.cpp b/taglib/ogg/xiphcomment.cpp
index 344d9cf..e7e8fa9 100644
--- a/taglib/ogg/xiphcomment.cpp
+++ b/taglib/ogg/xiphcomment.cpp
@@ -293,25 +293,35 @@ void Ogg::XiphComment::parse(const ByteVector &data)
   d->vendorID = String(data.mid(pos, vendorLength), String::UTF8);
   pos += vendorLength;
 
   // Next the number of fields in the comment vector.
 
-  int commentFields = data.mid(pos, 4).toUInt(false);
+  uint commentFields = data.mid(pos, 4).toUInt(false);
   pos += 4;
 
-  for(int i = 0; i < commentFields; i++) {
+  if(commentFields > (data.size() - 8) / 4) {
+    return;
+  }
+
+  for(uint i = 0; i < commentFields; i++) {
 
     // Each comment field is in the format "KEY=value" in a UTF8 string and has
     // 4 bytes before the text starts that gives the length.
 
-    int commentLength = data.mid(pos, 4).toUInt(false);
+    uint commentLength = data.mid(pos, 4).toUInt(false);
     pos += 4;
 
     String comment = String(data.mid(pos, commentLength), String::UTF8);
     pos += commentLength;
+    if(pos > data.size()) {
+      break;
+    }
 
     int commentSeparatorPosition = comment.find("=");
+    if(commentSeparatorPosition == -1) {
+      break;
+    }
 
     String key = comment.substr(0, commentSeparatorPosition);
     String value = comment.substr(commentSeparatorPosition + 1);
 
     addField(key, value, false);

Vulnerable code:   int commentFields = data.mid(pos, 4).toUInt(false);
  for(int i = 0; i < commentFields; i++) {
    int commentLength = data.mid(pos, 4).toUInt(false);
Fixed code:   uint commentFields = data.mid(pos, 4).toUInt(false);
  if(commentFields > (data.size() - 8) / 4) {
    return;
  }

  for(uint i = 0; i < commentFields; i++) {
    uint commentLength = data.mid(pos, 4).toUInt(false);
    if(pos > data.size()) {
      break;
    }
    if(commentSeparatorPosition == -1) {
      break;
    }
CVE-2012-1584: Numeric Errors (CWE-189)
value: Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2012-09-06T18:55Z
Repository: https://github.com/taglib/taglib
Language: C++
Files changed: taglib/toolkit/tbytevector.cpp
Commit date: 2012-03-10 08:46:20 +0100
Commit message: Avoid uint overflow in case the length + index is over UINT_MAX

Diff: diff --git a/taglib/toolkit/tbytevector.cpp b/taglib/toolkit/tbytevector.cpp
index 5edbfbf..cb6a5a0 100644
--- a/taglib/toolkit/tbytevector.cpp
+++ b/taglib/toolkit/tbytevector.cpp
@@ -361,11 +361,11 @@ ByteVector ByteVector::mid(uint index, uint length) const
   if(index > size())
     return v;
 
   ConstIterator endIt;
 
-  if(length < 0xffffffff && length + index < size())
+  if(length < size() - index)
     endIt = d->data.begin() + index + length;
   else
     endIt = d->data.end();
 
   v.d->data.insert(v.d->data.begin(), ConstIterator(d->data.begin() + index), endIt);

Vulnerable code:   if(length < 0xffffffff && length + index < size())
Fixed code:   if(length < size() - index)
CVE-2017-12678: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2017-08-08T01:34Z
Repository: https://github.com/taglib/taglib
Language: C++
Files changed: taglib/mpeg/id3v2/id3v2framefactory.cpp
Commit date: 2017-09-30 10:15:41 -0500
Commit message: Don't assume TDRC is an instance of TextIdentificationFrame (#831)

If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame
which causes problems in rebuildAggregateFrames() when it is assumed
that TDRC is a TextIdentificationFrame
Diff: diff --git a/taglib/mpeg/id3v2/id3v2framefactory.cpp b/taglib/mpeg/id3v2/id3v2framefactory.cpp
index 759a9b7b..9347ab86 100644
--- a/taglib/mpeg/id3v2/id3v2framefactory.cpp
+++ b/taglib/mpeg/id3v2/id3v2framefactory.cpp
@@ -332,14 +332,15 @@ void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const
   if(tag->header()->majorVersion() < 4 &&
      tag->frameList("TDRC").size() == 1 &&
      tag->frameList("TDAT").size() == 1)
   {
     TextIdentificationFrame *tdrc =
-      static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
+      dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
     UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front());
 
-    if(tdrc->fieldList().size() == 1 &&
+    if(tdrc &&
+       tdrc->fieldList().size() == 1 &&
        tdrc->fieldList().front().size() == 4 &&
        tdat->data().size() >= 5)
     {
       String date(tdat->data().mid(1), String::Type(tdat->data()[0]));
       if(date.length() == 4) {

Vulnerable code:       static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
    if(tdrc->fieldList().size() == 1 &&
Fixed code:       dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front());
    if(tdrc &&
       tdrc->fieldList().size() == 1 &&
CVE-2021-35938: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 6.7
Published: 2022-08-25T20:15Z
Repository: https://github.com/rpm-software-management/rpm
Language: C
Files changed: lib/fsm.c
Commit date: 2022-02-16 10:57:18 +0200
Commit message: Set file metadata via fd-based ops for everything but symlinks

Regular file ops are fd-based already, for the rest we need to open them
manually. Files with temporary suffix must never be followed, for
directories (and pre-existing FA_TOUCHed files) use the rpm symlink
"root or target owner allowed" rule wrt following.

This mostly fixes CVE-2021-35938, but as we're not yet using dirfd-based
operatiosn for everything there are corner cases left undone. And then
there's the plugin API which needs updating for all this.

Diff: diff --git a/lib/fsm.c b/lib/fsm.c
index 913e9de2d7..6f781c64d6 100644
--- a/lib/fsm.c
+++ b/lib/fsm.c
@@ -988,10 +988,18 @@ int rpmPackageFilesInstall(rpmts ts, rpmte te, rpmfiles files,
                 /* XXX Special case /dev/log, which shouldn't be packaged anyways */
                 if (!IS_DEV_LOG(fp->fpath))
                     rc = RPMERR_UNKNOWN_FILETYPE;
             }
 
+	    if (!rc && fd == -1 && !S_ISLNK(fp->sb.st_mode)) {
+		/* Only follow safe symlinks, and never on temporary files */
+		fd = fsmOpenat(di.dirfd, fp->fpath,
+				fp->suffix ? AT_SYMLINK_NOFOLLOW : 0);
+		if (fd < 0)
+		    rc = RPMERR_OPEN_FAILED;
+	    }
+
 setmeta:
 	    if (!rc && fp->setmeta) {
 		rc = fsmSetmeta(fd, di.dirfd, fp->fpath,
 				fi, plugins, fp->action,
 				&fp->sb, nofcaps);

Fixed code: 	    if (!rc && fd == -1 && !S_ISLNK(fp->sb.st_mode)) {
		/* Only follow safe symlinks, and never on temporary files */
		fd = fsmOpenat(di.dirfd, fp->fpath,
				fp->suffix ? AT_SYMLINK_NOFOLLOW : 0);
		if (fd < 0)
		    rc = RPMERR_OPEN_FAILED;
	    }
CVE-2023-49292: Insufficient Information (NVD-CWE-noinfo)
value: ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in 2.0.8. Users are advised to upgrade.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.8
Published: 2023-12-05T00:15Z
Repository: https://github.com/ecies/go
Language: Go
Files changed: privatekey.go, publickey.go
Commit date: 2023-12-04 21:35:16 +0100
Commit message: fix: additional security checks added

Diff: diff --git a/privatekey.go b/privatekey.go
index 38e8b33..a2db9a2 100644
--- a/privatekey.go
+++ b/privatekey.go
@@ -75,10 +75,14 @@ func (k *PrivateKey) Hex() string {
 func (k *PrivateKey) Encapsulate(pub *PublicKey) ([]byte, error) {
 	if pub == nil {
 		return nil, fmt.Errorf("public key is empty")
 	}
 
+	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
+		return nil, fmt.Errorf("invalid public key")
+	}
+
 	var secret bytes.Buffer
 	secret.Write(k.PublicKey.Bytes(false))
 
 	sx, sy := pub.Curve.ScalarMult(pub.X, pub.Y, k.D.Bytes())
 	secret.Write([]byte{0x04})
@@ -96,10 +100,14 @@ func (k *PrivateKey) Encapsulate(pub *PublicKey) ([]byte, error) {
 func (k *PrivateKey) ECDH(pub *PublicKey) ([]byte, error) {
 	if pub == nil {
 		return nil, fmt.Errorf("public key is empty")
 	}
 
+	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
+		return nil, fmt.Errorf("invalid public key")
+	}
+
 	// Shared secret generation
 	sx, sy := pub.Curve.ScalarMult(pub.X, pub.Y, k.D.Bytes())
 
 	var ss []byte
 	if sy.Bit(0) != 0 { // If odd
diff --git a/publickey.go b/publickey.go
index dbd1adb..da1ffaf 100644
--- a/publickey.go
+++ b/publickey.go
@@ -135,12 +135,16 @@ func (k *PublicKey) Hex(compressed bool) string {
 }
 
 // Decapsulate decapsulates key by using Key Encapsulation Mechanism and returns symmetric key;
 // can be safely used as encryption key
 func (k *PublicKey) Decapsulate(priv *PrivateKey) ([]byte, error) {
+	if !k.Curve.IsOnCurve(k.X, k.Y) {
+		return nil, fmt.Errorf("invalid public key")
+	}
+
 	if priv == nil {
-		return nil, fmt.Errorf("public key is empty")
+		return nil, fmt.Errorf("private key is empty")
 	}
 
 	var secret bytes.Buffer
 	secret.Write(k.Bytes(false))
 

Vulnerable code: 		return nil, fmt.Errorf("public key is empty")
Fixed code: 	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
		return nil, fmt.Errorf("invalid public key")
	}

	if !k.Curve.IsOnCurve(pub.X, pub.Y) {
		return nil, fmt.Errorf("invalid public key")
	}

	if !k.Curve.IsOnCurve(k.X, k.Y) {
		return nil, fmt.Errorf("invalid public key")
	}

		return nil, fmt.Errorf("private key is empty")
CVE-2021-4213: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2022-08-24T16:15Z
Repository: https://github.com/dogtagpki/jss
Language: Java
Files changed: src/main/java/org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java
Commit date: 2022-02-14 10:51:01 +0000
Commit message: Additional fix for TLS connection I missed from original patch
Diff: diff --git a/src/main/java/org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java b/src/main/java/org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java
index 93b290c3..1f0e10b3 100644
--- a/src/main/java/org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java
+++ b/src/main/java/org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java
@@ -959,11 +959,10 @@ public class JSSEngineReferenceImpl extends JSSEngine {
 
         // Prefer inbound alerts to outbound alerts.
         while (ssl_fd.inboundOffset < ssl_fd.inboundAlerts.size()) {
             SSLAlertEvent event = ssl_fd.inboundAlerts.get(ssl_fd.inboundOffset);
             ssl_fd.inboundOffset += 1;
-	    event.setEngine(this);
 
             if (event.getLevelEnum() == SSLAlertLevel.WARNING && event.getDescriptionEnum() == SSLAlertDescription.CLOSE_NOTIFY) {
                 debug("Got inbound CLOSE_NOTIFY alert");
                 closeInbound();
             }
@@ -983,11 +982,10 @@ public class JSSEngineReferenceImpl extends JSSEngine {
         }
 
         while (ssl_fd.outboundOffset < ssl_fd.outboundAlerts.size()) {
             SSLAlertEvent event = ssl_fd.outboundAlerts.get(ssl_fd.outboundOffset);
             ssl_fd.outboundOffset += 1;
-            event.setEngine(this);
 
             if (event.getLevelEnum() == SSLAlertLevel.WARNING && event.getDescriptionEnum() == SSLAlertDescription.CLOSE_NOTIFY) {
                 debug("Sent outbound CLOSE_NOTIFY alert.");
                 closeOutbound();
             }

Vulnerable code: 	    event.setEngine(this);
            event.setEngine(this);
CVE-2022-24300: Other (NVD-CWE-Other)
value: Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-02-02T06:15Z
Repository: https://github.com/minetest/minetest
Language: C++
Files changed: src/itemstackmetadata.cpp
Commit date: 2021-01-28 21:33:10 +0000
Commit message: Sanitize ItemStack meta text

Diff: diff --git a/src/itemstackmetadata.cpp b/src/itemstackmetadata.cpp
index 4aa1a0903..7a26fbb0e 100644
--- a/src/itemstackmetadata.cpp
+++ b/src/itemstackmetadata.cpp
@@ -19,10 +19,11 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 
 
 #include "itemstackmetadata.h"
 #include "util/serialize.h"
 #include "util/strfnd.h"
+#include <algorithm>
 
 #define DESERIALIZE_START '\x01'
 #define DESERIALIZE_KV_DELIM '\x02'
 #define DESERIALIZE_PAIR_DELIM '\x03'
 #define DESERIALIZE_START_STR "\x01"
@@ -35,14 +36,26 @@ void ItemStackMetadata::clear()
 {
 	Metadata::clear();
 	updateToolCapabilities();
 }
 
+static void sanitize_string(std::string &str)
+{
+	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_START), str.end());
+	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_KV_DELIM), str.end());
+	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_PAIR_DELIM), str.end());
+}
+
 bool ItemStackMetadata::setString(const std::string &name, const std::string &var)
 {
-	bool result = Metadata::setString(name, var);
-	if (name == TOOLCAP_KEY)
+	std::string clean_name = name;
+	std::string clean_var = var;
+	sanitize_string(clean_name);
+	sanitize_string(clean_var);
+
+	bool result = Metadata::setString(clean_name, clean_var);
+	if (clean_name == TOOLCAP_KEY)
 		updateToolCapabilities();
 	return result;
 }
 
 void ItemStackMetadata::serialize(std::ostream &os) const

Vulnerable code: 	bool result = Metadata::setString(name, var);
	if (name == TOOLCAP_KEY)
Fixed code: #include <algorithm>
static void sanitize_string(std::string &str)
{
	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_START), str.end());
	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_KV_DELIM), str.end());
	str.erase(std::remove(str.begin(), str.end(), DESERIALIZE_PAIR_DELIM), str.end());
}

	std::string clean_name = name;
	std::string clean_var = var;
	sanitize_string(clean_name);
	sanitize_string(clean_var);

	bool result = Metadata::setString(clean_name, clean_var);
	if (clean_name == TOOLCAP_KEY)
CVE-2022-24301: Incorrect Default Permissions (CWE-276)
value: In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.
CWE description: During installation, installed file permissions are set to allow anyone to modify those files.
CVSS v3 base score: 6.5
Published: 2022-02-02T06:15Z
Repository: https://github.com/minetest/minetest
Language: C++
Files changed: src/network/serverpackethandler.cpp
Commit date: 2020-08-29 16:41:03 +0100
Commit message: Prevent players accessing inventories of other players (#10341)


Diff: diff --git a/src/network/serverpackethandler.cpp b/src/network/serverpackethandler.cpp
index dcbb114bf..abd9deff0 100644
--- a/src/network/serverpackethandler.cpp
+++ b/src/network/serverpackethandler.cpp
@@ -628,17 +628,23 @@ void Server::handleCommand_InventoryAction(NetworkPacket* pkt)
 
 		m_inventory_mgr->setInventoryModified(ma->from_inv);
 		if (ma->from_inv != ma->to_inv)
 			m_inventory_mgr->setInventoryModified(ma->to_inv);
 
-		bool from_inv_is_current_player =
-			(ma->from_inv.type == InventoryLocation::PLAYER) &&
-			(ma->from_inv.name == player->getName());
-
-		bool to_inv_is_current_player =
-			(ma->to_inv.type == InventoryLocation::PLAYER) &&
-			(ma->to_inv.name == player->getName());
+		bool from_inv_is_current_player = false;
+		if (ma->from_inv.type == InventoryLocation::PLAYER) {
+			if (ma->from_inv.name != player->getName())
+				return;
+			from_inv_is_current_player = true;
+		}
+		
+		bool to_inv_is_current_player = false;
+		if (ma->to_inv.type == InventoryLocation::PLAYER) {
+			if (ma->to_inv.name != player->getName())
+				return;
+			to_inv_is_current_player = true;
+		}
 
 		InventoryLocation *remote = from_inv_is_current_player ?
 			&ma->to_inv : &ma->from_inv;
 
 		// Check for out-of-range interaction

Vulnerable code: 		bool from_inv_is_current_player =
			(ma->from_inv.type == InventoryLocation::PLAYER) &&
			(ma->from_inv.name == player->getName());

		bool to_inv_is_current_player =
			(ma->to_inv.type == InventoryLocation::PLAYER) &&
			(ma->to_inv.name == player->getName());
Fixed code: 		bool from_inv_is_current_player = false;
		if (ma->from_inv.type == InventoryLocation::PLAYER) {
			if (ma->from_inv.name != player->getName())
				return;
			from_inv_is_current_player = true;
		}
		
		bool to_inv_is_current_player = false;
		if (ma->to_inv.type == InventoryLocation::PLAYER) {
			if (ma->to_inv.name != player->getName())
				return;
			to_inv_is_current_player = true;
		}
CVE-2015-0278: Improper Check for Dropped Privileges (CWE-273)
value: libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.
CWE description: The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
Published: 2015-05-18T15:59Z
Repository: https://github.com/libuv/libuv
Language: C
Files changed: src/unix/process.c
Commit date: 2014-02-10 22:38:40 +0100
Commit message: unix: call setgoups before calling setuid/setgid

Partial fix for #1093

Diff: diff --git a/src/unix/process.c b/src/unix/process.c
index 0fc8f640..1efd588b 100644
--- a/src/unix/process.c
+++ b/src/unix/process.c
@@ -328,10 +328,21 @@ static void uv__process_child_init(const uv_process_options_t* options,
     uv__write_int(error_fd, -errno);
     perror("chdir()");
     _exit(127);
   }
 
+  if (options->flags & (UV_PROCESS_SETUID | UV_PROCESS_SETGID)) {
+    /* When dropping privileges from root, the `setgroups` call will
+     * remove any extraneous groups. If we don't call this, then
+     * even though our uid has dropped, we may still have groups
+     * that enable us to do super-user things. This will fail if we
+     * aren't root, so don't bother checking the return value, this
+     * is just done as an optimistic privilege dropping function.
+     */
+    SAVE_ERRNO(setgroups(0, NULL));
+  }
+
   if ((options->flags & UV_PROCESS_SETGID) && setgid(options->gid)) {
     uv__write_int(error_fd, -errno);
     perror("setgid()");
     _exit(127);
   }

Fixed code:   if (options->flags & (UV_PROCESS_SETUID | UV_PROCESS_SETGID)) {
    /* When dropping privileges from root, the `setgroups` call will
     * remove any extraneous groups. If we don't call this, then
     * even though our uid has dropped, we may still have groups
     * that enable us to do super-user things. This will fail if we
     * aren't root, so don't bother checking the return value, this
     * is just done as an optimistic privilege dropping function.
     */
    SAVE_ERRNO(setgroups(0, NULL));
  }
CVE-2024-24806: Server-Side Request Forgery (SSRF) (CWE-918)
value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.3
Published: 2024-02-07T22:15Z
Repository: https://github.com/libuv/libuv
Language: C
Files changed: src/idna.c, test/test-idna.c
Commit date: 2024-02-07 20:49:53 +0100
Commit message: fix: always zero-terminate idna output

Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6

Diff: diff --git a/src/idna.c b/src/idna.c
index 3cf79ca9..4638546d 100644
--- a/src/idna.c
+++ b/src/idna.c
@@ -354,13 +354,14 @@ ssize_t uv__idna_toascii(const char* s, const char* se, char* d, char* de) {
 
     if (rc < 0)
       return rc;
   }
 
-  if (d < de)
-    *d++ = '\0';
+  if (d >= de)
+    return UV_EINVAL;
 
+  *d++ = '\0';
   return d - ds;  /* Number of bytes written. */
 }
 
 
 ssize_t uv_wtf8_length_as_utf16(const char* source_ptr) {
diff --git a/test/test-idna.c b/test/test-idna.c
index bcacfc8a..5f8d696a 100644
--- a/test/test-idna.c
+++ b/test/test-idna.c
@@ -98,10 +98,11 @@ TEST_IMPL(utf8_decode1) {
 }
 
 TEST_IMPL(utf8_decode1_overrun) {
   const char* p;
   char b[1];
+  char c[1];
 
   /* Single byte. */
   p = b;
   b[0] = 0x7F;
   ASSERT_EQ(0x7F, uv__utf8_decode1(&p, b + 1));
@@ -111,10 +112,13 @@ TEST_IMPL(utf8_decode1_overrun) {
   p = b;
   b[0] = 0xC0;
   ASSERT_EQ((unsigned) -1, uv__utf8_decode1(&p, b + 1));
   ASSERT_PTR_EQ(p, b + 1);
 
+  b[0] = 0x7F;
+  ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 1, c, c + 1));
+
   return 0;
 }
 
 /* Doesn't work on z/OS because that platform uses EBCDIC, not ASCII. */
 #ifndef __MVS__

Vulnerable code:   if (d < de)
    *d++ = '\0';
Fixed code:   if (d >= de)
    return UV_EINVAL;
  *d++ = '\0';
  char c[1];
  b[0] = 0x7F;
  ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 1, c, c + 1));
CVE-2024-24806: Server-Side Request Forgery (SSRF) (CWE-918)
value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.3
Published: 2024-02-07T22:15Z
Repository: https://github.com/libuv/libuv
Language: C
Files changed: src/idna.c, test/test-idna.c
Commit date: 2024-02-07 20:50:04 +0100
Commit message: fix: reject zero-length idna inputs

Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6

Diff: diff --git a/src/idna.c b/src/idna.c
index 4638546d0..efc5f283c 100644
--- a/src/idna.c
+++ b/src/idna.c
@@ -320,10 +320,13 @@ ssize_t uv__idna_toascii(const char* s, const char* se, char* d, char* de) {
   const char* st;
   unsigned c;
   char* ds;
   int rc;
 
+  if (s == se)
+    return UV_EINVAL;
+
   ds = d;
 
   si = s;
   while (si < se) {
     st = si;
diff --git a/test/test-idna.c b/test/test-idna.c
index 5f8d696a7..3c4820f76 100644
--- a/test/test-idna.c
+++ b/test/test-idna.c
@@ -113,10 +113,11 @@ TEST_IMPL(utf8_decode1_overrun) {
   b[0] = 0xC0;
   ASSERT_EQ((unsigned) -1, uv__utf8_decode1(&p, b + 1));
   ASSERT_PTR_EQ(p, b + 1);
 
   b[0] = 0x7F;
+  ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 0, c, c + 1));
   ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 1, c, c + 1));
 
   return 0;
 }
 

Fixed code:   if (s == se)
    return UV_EINVAL;

  ASSERT_EQ(UV_EINVAL, uv__idna_toascii(b, b + 0, c, c + 1));
CVE-2024-24806: Server-Side Request Forgery (SSRF) (CWE-918)
value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.3
Published: 2024-02-07T22:15Z
Repository: https://github.com/libuv/libuv
Language: Unknown
Commit date: 2024-02-07 20:53:55 +0100
Commit message: Merge pull request from GHSA-f74f-cvh7-c6q6

* fix: always zero-terminate idna output

* fix: reject zero-length idna inputs

* test: empty strings are not valid IDNA

---------

Co-authored-by: Santiago Gimeno <santiago.gimeno@gmail.com>
CVE-2024-24806: Server-Side Request Forgery (SSRF) (CWE-918)
value: libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username. This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.3
Published: 2024-02-07T22:15Z
Repository: https://github.com/libuv/libuv
Language: C
Files changed: test/test-idna.c
Commit date: 2024-02-07 20:50:13 +0100
Commit message: test: empty strings are not valid IDNA

Fixes: https://github.com/libuv/libuv/security/advisories/GHSA-f74f-cvh7-c6q6

Diff: diff --git a/test/test-idna.c b/test/test-idna.c
index 3c4820f76..28f9eaaae 100644
--- a/test/test-idna.c
+++ b/test/test-idna.c
@@ -149,12 +149,12 @@ TEST_IMPL(utf8_decode1_overrun) {
 
 TEST_IMPL(idna_toascii) {
   /* Illegal inputs. */
   F("\xC0\x80\xC1\x80", UV_EINVAL);  /* Overlong UTF-8 sequence. */
   F("\xC0\x80\xC1\x80.com", UV_EINVAL);  /* Overlong UTF-8 sequence. */
+  F("", UV_EINVAL);
   /* No conversion. */
-  T("", "");
   T(".", ".");
   T(".com", ".com");
   T("example", "example");
   T("example-", "example-");
   T("straße.de", "xn--strae-oqa.de");

Vulnerable code:   T("", "");
Fixed code:   F("", UV_EINVAL);
CVE-2014-1401: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-02-11T17:55Z
Repository: https://github.com/auracms/AuraCMS
Language: PHP
Files changed: mod/content/content.php
Commit date: 2014-01-14 11:02:30 +0700
Commit message: AuraCMS

Update Vulnerability SQL Injection in content.php

Diff: diff --git a/images/header/1378798712-ban1.png b/images/header/1378798712-ban1.png
deleted file mode 100644
index d1fb2c0..0000000
Binary files a/images/header/1378798712-ban1.png and /dev/null differ
diff --git a/images/header/1378799316-ban2.png b/images/header/1378799316-ban2.png
deleted file mode 100644
index 53a05e7..0000000
Binary files a/images/header/1378799316-ban2.png and /dev/null differ
diff --git a/images/header/1378799702-ban3.png b/images/header/1378799702-ban3.png
deleted file mode 100644
index 3f4e035..0000000
Binary files a/images/header/1378799702-ban3.png and /dev/null differ
diff --git a/images/header/1378799866-ban5.png b/images/header/1378799866-ban5.png
deleted file mode 100644
index 4d378e3..0000000
Binary files a/images/header/1378799866-ban5.png and /dev/null differ
diff --git a/images/header/1378801253-ban6.png b/images/header/1378801253-ban6.png
deleted file mode 100644
index b38ea66..0000000
Binary files a/images/header/1378801253-ban6.png and /dev/null differ
diff --git a/mod/content/content.php b/mod/content/content.php
index 50a62e1..28cfbf9 100644
--- a/mod/content/content.php
+++ b/mod/content/content.php
@@ -86,11 +86,11 @@ if (!defined('INDEX')) {
 		
 		$tengah .= '
 		<h2>Pencarian Berita</h2>
 		<div class="border" style="text-align:center;"><img src="mod/content/images/banner_searching_data.gif" alt="Searching Data" /></div>';
 		
-		$search	= !isset($_GET['search']) ? cleanText($_POST['search']) : cleanText($_GET['search']);
+		$search	= !isset($_GET['search']) ? mysqli_real_escape_string(cleanText($_POST['search'])) : mysqli_real_escape_string(cleanText($_GET['search']));
 		
 		if(!$search){
 			$tengah .= '<div class="error">Maaf Anda Belum Memasukkan Kata Pencarian</div>';
 		}else{
 		

Vulnerable code: 		$search	= !isset($_GET['search']) ? cleanText($_POST['search']) : cleanText($_GET['search']);
Fixed code: 		$search	= !isset($_GET['search']) ? mysqli_real_escape_string(cleanText($_POST['search'])) : mysqli_real_escape_string(cleanText($_GET['search']));
CVE-2023-42444: Improper Validation of Specified Quantity in Input (CWE-1284)
value: phonenumber is a library for parsing, formatting and validating international phone numbers. Prior to versions `0.3.3+8.13.9` and `0.2.5+8.11.3`, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`. Versions `0.3.3+8.13.9` and `0.2.5+8.11.3` contain a patch for this issue. There are no known workarounds.
CWE description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CVSS v3 base score: 7.5
Published: 2023-09-19T15:15Z
Repository: https://github.com/whisperfish/rust-phonenumber
Language: Unknown
Commit date: 2023-09-19 12:19:38 +0200
Commit message: Merge branch 'advisory-fix-1'

Fixes a panic vulnerability CVE-2023-42444

See advisory https://github.com/whisperfish/rust-phonenumber/security/advisories/GHSA-whhr-7f2w-qqj2
CVE-2024-39697: Insufficient Information (NVD-CWE-noinfo)
value: phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form `+dwPAA;phone-context=AA`, where the "number" part potentially parses as a number larger than 2^56. This vulnerability is fixed in 0.3.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-09T15:15Z
Repository: https://github.com/whisperfish/rust-phonenumber
Language: Unknown
Commit date: 2024-07-09 15:27:34 +0200
Commit message: Merge branch 'proptest' for CVE-2024-39697
CVE-2021-39196: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is important because the capture filters can effectively limit the scope of information that a user can see in the data captures. If no filter is present, then all data on the local network segment where the program is running can be captured and downloaded. v3.12 fixes this problem. There is no workaround, you must upgrade to v3.12 or greater.
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 6.5
Published: 2021-09-07T19:15Z
Repository: https://github.com/jdhwpgmbca/pcapture
Language: Java
Files changed: src/main/java/com/rtds/svc/CaptureTypeService.java
Commit date: 2021-08-29 21:54:01 -0500
Commit message: Fixed major security bug.

A user could effectively specify an undefined url and the program would return a null filter rather than throwing an exception and returning an error to the user. This was a really bad bug. I found it when I was adding code to validate the path parameters. That will be coming in the next commit.

Diff: diff --git a/src/main/java/com/rtds/svc/CaptureTypeService.java b/src/main/java/com/rtds/svc/CaptureTypeService.java
index 52bdea3..be6c346 100644
--- a/src/main/java/com/rtds/svc/CaptureTypeService.java
+++ b/src/main/java/com/rtds/svc/CaptureTypeService.java
@@ -50,16 +50,20 @@ public class CaptureTypeService
             throw new IllegalArgumentException( "The url_suffix must not be null." );
         }
         
         CaptureType type = em.find( CaptureType.class, url_suffix );
         
-        if( type != null )
+        if( type == null )
         {
-            return type.getCaptureFilter();
+            throw new IllegalArgumentException( "The url_suffix must exist in the database." );
         }
         
-        return null;
+        // It is okay for the capture filter itself to be null, but the CaptureType
+        // must be in the database, otherwise the user could effectively forge
+        // a capture filter for "all" just by requesting a non-existent filter.
+        
+        return type.getCaptureFilter();
     }
     
     public CaptureType find( String url_suffix )
     {
         return em.find( CaptureType.class, url_suffix );

Vulnerable code:         if( type != null )
            return type.getCaptureFilter();
        return null;
Fixed code:         if( type == null )
            throw new IllegalArgumentException( "The url_suffix must exist in the database." );
        // It is okay for the capture filter itself to be null, but the CaptureType
        // must be in the database, otherwise the user could effectively forge
        // a capture filter for "all" just by requesting a non-existent filter.
        
        return type.getCaptureFilter();
CVE-2014-125050: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in ScottTZhang voter-js and classified as critical. Affected by this issue is some unknown functionality of the file main.js. The manipulation leads to sql injection. The patch is identified as 6317c67a56061aeeaeed3cf9ec665fd9983d8044. It is recommended to apply a patch to fix this issue. VDB-217562 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-06T17:15Z
Repository: https://github.com/ScottTZhang/voter-js
Language: Unknown
Commit date: 2014-11-30 22:57:58 -0600
Commit message: Merge pull request #15 from ScottTZhang/injection

avoid sql injection
CVE-2013-1812: Resource Management Errors (CWE-399)
value: The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2013-12-12T18:55Z
Repository: https://github.com/openid/ruby-openid
Language: Unknown
Commit date: 2012-10-22 23:03:20 -0700
Commit message: Merge pull request #43 from nov/against_dos

limit fetching file size & disable XML entity expansion
CVE-2023-51390: Cleartext Transmission of Sensitive Information (CWE-319)
value: journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.
CWE description: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVSS v3 base score: 7.5
Published: 2023-12-21T00:15Z
Repository: https://github.com/Aiven-Open/journalpump
Language: Unknown
Commit date: 2023-12-15 15:04:31 +0100
Commit message: Merge pull request #162 from Aiven-Open/version-250

Updating version and NEWS with last updates since version 2.4.3
CVE-2024-23641: Insufficient Information (NVD-CWE-noinfo)
value: SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2024-01-24T17:15Z
Repository: https://github.com/sveltejs/kit
Language: JavaScript
Files changed: .changeset/smooth-kids-cover.md, packages/kit/src/exports/node/index.js
Commit date: 2024-01-22 15:49:37 -0500
Commit message: fix: ignore bodies sent with non-PUT/PATCH/POST requests  (#11708)

* fix: ignore bodies sent with non-PUT/PATCH/POST requests

* use ||

---------

Co-authored-by: Rich Harris <rich.harris@vercel.com>
Diff: diff --git a/.changeset/smooth-kids-cover.md b/.changeset/smooth-kids-cover.md
new file mode 100644
index 000000000..414b42612
--- /dev/null
+++ b/.changeset/smooth-kids-cover.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: ignore bodies sent with non-PUT/PATCH/POST requests
diff --git a/packages/kit/src/exports/node/index.js b/packages/kit/src/exports/node/index.js
index f38a09358..8a9add147 100644
--- a/packages/kit/src/exports/node/index.js
+++ b/packages/kit/src/exports/node/index.js
@@ -107,11 +107,14 @@ export async function getRequest({ request, base, bodySizeLimit }) {
 	return new Request(base + request.url, {
 		// @ts-expect-error
 		duplex: 'half',
 		method: request.method,
 		headers: /** @type {Record<string, string>} */ (request.headers),
-		body: get_raw_body(request, bodySizeLimit)
+		body:
+			request.method === 'POST' || request.method === 'PUT' || request.method === 'PATCH'
+				? get_raw_body(request, bodySizeLimit)
+				: undefined
 	});
 }
 
 /**
  * @param {import('http').ServerResponse} res

Vulnerable code: 		body: get_raw_body(request, bodySizeLimit)
Fixed code: ---
'@sveltejs/kit': patch
---

fix: ignore bodies sent with non-PUT/PATCH/POST requests
		body:
			request.method === 'POST' || request.method === 'PUT' || request.method === 'PATCH'
				? get_raw_body(request, bodySizeLimit)
				: undefined
CVE-2022-22109: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-05T15:15Z
Repository: https://github.com/Bottelet/DaybydayCRM
Language: PHP
Files changed: app/Http/Controllers/TasksController.php
Commit date: 2021-06-25 21:53:06 +0200
Commit message: fix xss for tasks index

Diff: diff --git a/app/Http/Controllers/TasksController.php b/app/Http/Controllers/TasksController.php
index 629437d2..831cd76d 100644
--- a/app/Http/Controllers/TasksController.php
+++ b/app/Http/Controllers/TasksController.php
@@ -80,11 +80,11 @@ class TasksController extends Controller
                 return '<span class="label label-success" style="background-color:' . $tasks->status->color . '"> ' .
                     $tasks->status->title . '</span>';
             })
             ->addColumn('view', function ($tasks) {
                 return '<a href="' . route("tasks.show", $tasks->external_id) . '" class="btn btn-link">' . __('View') .'</a>'
-                . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-title="'. $tasks->title . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'
+                . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'
                 ;
             })
             ->rawColumns(['titlelink','view', 'status_id'])
             ->make(true);
     }

Vulnerable code:                 . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-title="'. $tasks->title . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'
Fixed code:                 . '<a data-toggle="modal" data-id="'. route('tasks.destroy',$tasks->external_id) . '" data-target="#deletion" class="btn btn-link">' . __('Delete') .'</a>'